toolroll 0.9.57 → 0.9.59

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.9.59 — 2026-10-10
+
+- **Safer deploys.** A deploy that fails before the swap releases its own
+  lock. A stranded lock clears with one guided command.
+- **Planning restarts on a new scope.** Changing a task's scope restarts its
+  planning. Cancelling a task closes its open questions.
+
+## 0.9.58 — 2026-10-09
+
+- **One token kind.** Personal, lead and coordinator tokens now live in one
+  table with one check. Existing tokens keep working.
+- **Sessions join the CLI API.** The sessions API is now part of the CLI API.
+- **Passwords as tokens warn.** Sending your password as a token still works
+  this release but warns. Create a token with `toolroll tokens create`.
+
 ## 0.9.57 — 2026-10-09
 
 - **Truthful status.** Finished tasks read Complete everywhere. With checks

package/dist/action-ledger.js

@@ -36,6 +36,11 @@ export function installLedgerTriggers(db) {
     const task = (ref) => `(SELECT external_id FROM task_ref WHERE id = ${ref})`;
     const runRef = `(SELECT task_ref FROM run WHERE id = NEW.run)`;
     const event = (at, actor, project, taskId, runId, action, outcome) => `INSERT INTO action_ledger(at,actor,repo,task_id,run_id,action,outcome,source) VALUES (${at},${actor},${project},${taskId},${runId},'${action}',${outcome},'work');`;
+    // v119: closing a question without an answer is its own event. Replace only the old trigger's future behavior;
+    // every ledger entry already recorded, and its seal, stays unchanged.
+    const answeredTrigger = db.prepare("SELECT sql FROM sqlite_master WHERE type = 'trigger' AND name = 'ledger_decision_answered'").get();
+    if (answeredTrigger !== undefined && !String(answeredTrigger["sql"]).includes("superseded_reason"))
+        db.exec("DROP TRIGGER ledger_decision_answered");
     db.exec(`
 CREATE TRIGGER IF NOT EXISTS ledger_run_started AFTER INSERT ON run BEGIN
   ${event("NEW.started_at", "NEW.runner", repo("NEW.task_ref"), task("NEW.task_ref"), "NEW.id", "run started", "NEW.role")}
@@ -48,9 +53,13 @@ CREATE TRIGGER IF NOT EXISTS ledger_decision_opened AFTER INSERT ON decision BEG
   ${event("NEW.created_at", "'system'", repo(runRef), task(runRef), "NEW.run", "decision opened", "NEW.state")}
 END;
 CREATE TRIGGER IF NOT EXISTS ledger_decision_answered AFTER UPDATE OF answered_at ON decision
-WHEN NEW.answered_at IS NOT NULL AND OLD.answered_at IS NULL BEGIN
+WHEN NEW.answered_at IS NOT NULL AND OLD.answered_at IS NULL AND NEW.superseded_reason IS NULL BEGIN
   ${event("NEW.answered_at", "COALESCE(NEW.answered_by,'system')", repo(runRef), task(runRef), "NEW.run", "decision answered", "NEW.state")}
 END;
+CREATE TRIGGER IF NOT EXISTS ledger_decision_closed AFTER UPDATE OF answered_at ON decision
+WHEN NEW.answered_at IS NOT NULL AND OLD.answered_at IS NULL AND NEW.superseded_reason IS NOT NULL BEGIN
+  ${event("NEW.answered_at", "COALESCE(NEW.answered_by,'system')", repo(runRef), task(runRef), "NEW.run", "decision closed", "NEW.superseded_reason")}
+END;
 CREATE TRIGGER IF NOT EXISTS ledger_scope_approved AFTER UPDATE OF approved_at, approved_digest ON task_scope
 WHEN NEW.approved_at IS NOT NULL AND (OLD.approved_at IS NOT NEW.approved_at OR OLD.approved_digest IS NOT NEW.approved_digest) BEGIN
   ${event("NEW.approved_at", "COALESCE(NEW.approved_by,'system')", "(SELECT repo FROM task_ref WHERE backend = 'built-in' AND external_id = NEW.task_id)", "NEW.task_id", "NULL", "scope approved", "'approved'")}
@@ -63,10 +72,6 @@ CREATE TRIGGER IF NOT EXISTS ledger_task_placed AFTER UPDATE OF repo ON task_ref
 WHEN OLD.repo IS NOT NEW.repo BEGIN
   ${event("strftime('%Y-%m-%dT%H:%M:%fZ','now')", "'system'", "NEW.repo", "NEW.external_id", "NULL", "task placed", "'recorded'")}
 END;
-CREATE TRIGGER IF NOT EXISTS ledger_coordinator_minted AFTER INSERT ON coordinator_credential BEGIN
-  INSERT INTO action_ledger(at,actor,repo,task_id,run_id,action,outcome,source,detail) VALUES (NEW.created_at, NEW.created_by, NULL, NULL, NULL,
-    'coordinator minted: ' || NEW.name, 'minted', 'access', 'projects: ' || NEW.repos);
-END;
 CREATE TRIGGER IF NOT EXISTS ledger_task_registered AFTER INSERT ON task_ref BEGIN
   ${event("strftime('%Y-%m-%dT%H:%M:%fZ','now')", "'system'", "NEW.repo", "NEW.external_id", "NULL", "task registered", "'recorded'")}
 END;

package/dist/actor.d.ts

@@ -9,13 +9,3 @@ export declare function currentActor(): Actor | null;
 export declare function claimActor(account: string): void;
 /** How the ledger names an actor. */
 export declare function actorLabel(actor: Actor): string;
-export declare function mintLeadToken(): {
-    id: string;
-    token: string;
-    hash: string;
-};
-export declare function parseLeadToken(presented: string): {
-    id: string;
-    secret: string;
-} | null;
-export declare function leadSecretMatches(secret: string, keptHash: string): boolean;

package/dist/actor.js

@@ -2,7 +2,7 @@
  * Who is acting right now, for pings that follow responsibility.
  *
  * A lead is an agent acting for one person under a lead token (`toolroll lead
- * token`): it signs in as that person, and its acts are recorded as "lead for
+ * token`, a `credential` row of kind 'lead', api-tokens.ts): it signs in as that person, and its acts are recorded as "lead for
  * <owner>". A person acting for themselves is recorded by name. Work whose
  * actor is the lead pings nobody, and nobody is pinged about their own act.
  *
@@ -10,7 +10,6 @@
  * long-running service: a worker's facts are nobody's act.
  */
 import { AsyncLocalStorage } from "node:async_hooks";
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 /** The slot is mutable so a command can name its person after it has verified their password. */
 const slot = new AsyncLocalStorage();
 /** Run `fn` with this actor (or an empty slot a verified sign-in may fill). */
@@ -30,19 +29,3 @@ export function claimActor(account) {
 export function actorLabel(actor) {
     return actor.lead ? `lead for ${actor.account}` : actor.account;
 }
-// ---- the lead token ---------------------------------------------------------
-/** `lt_<id>_<secret>`: shown once, only its hash kept. */
-const SHAPE = /^lt_([a-f0-9]{12})_([A-Za-z0-9_-]{43})$/;
-export function mintLeadToken() {
-    const id = randomBytes(6).toString("hex"), secret = randomBytes(32).toString("base64url");
-    return { id, token: `lt_${id}_${secret}`, hash: hashLeadSecret(secret) };
-}
-const hashLeadSecret = (secret) => createHash("sha256").update(secret, "utf8").digest("hex");
-export function parseLeadToken(presented) {
-    const match = SHAPE.exec(presented.trim());
-    return match === null ? null : { id: match[1], secret: match[2] };
-}
-export function leadSecretMatches(secret, keptHash) {
-    const a = Buffer.from(hashLeadSecret(secret), "hex"), b = Buffer.from(keptHash, "hex");
-    return a.length === b.length && timingSafeEqual(a, b);
-}

package/dist/api-tokens.d.ts

@@ -1,5 +1,7 @@
 export type TokenAccess = "read" | "act";
 export type TokenPurpose = "api" | "mcp";
+/** Who a credential stands for: a person (their API token), a person's lead, or a coordinator. */
+export type CredentialKind = "person" | "lead" | "coordinator";
 export declare const MCP_ROTATION_REFUSAL = "Reconnect the MCP client to renew this token. You can still revoke it here.";
 /** Missing purpose is an old ordinary token; an unrecognised stored purpose is never treated as ordinary. */
 export declare const tokenPurpose: (value: unknown) => TokenPurpose;
@@ -7,18 +9,47 @@ export declare const tokenRotationProblem: (token: {
     purpose: TokenPurpose;
 }) => string | null;
 export declare const TOKEN_DAYS: readonly [30, 90, 365];
-export declare function mintApiToken(): {
+/** What a presented secret says it is, before any check. A coordinator's secret has no prefix and is hashed whole. */
+export type PresentedCredential = {
+    kind: "person" | "lead";
+    id: string;
+    secret: string;
+} | {
+    kind: "coordinator";
+    secret: string;
+};
+/** A new credential of `kind`: its id, the secret shown once, and the only thing kept, its hash. */
+export declare function mintCredential(kind: CredentialKind): {
     id: string;
     secret: string;
     token: string;
     hash: string;
 };
 export declare const hashSecret: (secret: string) => string;
-/** The id and secret of something shaped like a token, or null. */
+/** Read a presented credential's kind and parts; null for nothing at all. A lead token may carry surrounding space. */
+export declare function parseCredential(presented: string): PresentedCredential | null;
+export declare const mintApiToken: () => {
+    id: string;
+    secret: string;
+    token: string;
+    hash: string;
+};
+export declare const mintLeadToken: () => {
+    id: string;
+    secret: string;
+    token: string;
+    hash: string;
+};
+/** The id and secret of something shaped like an API token, or null. */
 export declare function parseApiToken(presented: string): {
     id: string;
     secret: string;
 } | null;
+/** The id and secret of something shaped like a lead token, or null. */
+export declare function parseLeadToken(presented: string): {
+    id: string;
+    secret: string;
+} | null;
 /** Whether the secret is the one whose hash was kept, in constant time. */
 export declare function secretMatches(secret: string, keptHash: string): boolean;
 /** v111: how long a rotated token keeps working beside its replacement, by default and at most. */

package/dist/api-tokens.js

@@ -1,8 +1,9 @@
 /**
- * API tokens (v101): what scripts and CI use instead of a password on each
- * request. A token belongs to one person, reads or acts (never more than the
- * person may), always expires (a year at most), is shown once, and only its
- * hash is kept. `Authorization: Bearer so_<id>_<secret>`.
+ * Machine credentials (D7, v118): one codec and one table (`credential`) for every kind. A person's API token is
+ * what scripts and CI use instead of a password on each request: it belongs to one person, reads or acts (never
+ * more than the person may), always expires (a year at most), is shown once, and only its hash is kept.
+ * `Authorization: Bearer so_<id>_<secret>`. A lead token (`lt_<id>_<secret>`) is an agent acting for its owner; a
+ * coordinator's secret (no prefix, hashed whole) files proposals over MCP. Each kind keeps its own policy.
  *
  * A token never passes a step-up: approvals and other password ceremonies
  * stay a person's act in the console.
@@ -13,16 +14,43 @@ export const MCP_ROTATION_REFUSAL = "Reconnect the MCP client to renew this toke
 export const tokenPurpose = (value) => value === undefined || value === "api" ? "api" : "mcp";
 export const tokenRotationProblem = (token) => token.purpose === "api" ? null : MCP_ROTATION_REFUSAL;
 export const TOKEN_DAYS = [30, 90, 365];
-const SHAPE = /^so_([a-f0-9]{12})_([A-Za-z0-9_-]{43})$/;
-export function mintApiToken() {
-    const id = randomBytes(6).toString("hex"), secret = randomBytes(32).toString("base64url");
-    return { id, secret, token: `so_${id}_${secret}`, hash: hashSecret(secret) };
+/** The prefixed shapes: so_ (a person's API token) and lt_ (a lead token), each `<prefix>_<12 hex>_<43 base64url>`. */
+const PRESENTED = /^(so|lt)_([a-f0-9]{12})_([A-Za-z0-9_-]{43})$/;
+const PREFIX = { person: "so", lead: "lt" };
+const CID_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
+/** A new credential of `kind`: its id, the secret shown once, and the only thing kept, its hash. */
+export function mintCredential(kind) {
+    const secret = randomBytes(32).toString("base64url");
+    if (kind === "coordinator") {
+        let id = "";
+        for (const byte of randomBytes(12))
+            id += CID_ALPHABET[byte % CID_ALPHABET.length];
+        return { id, secret, token: secret, hash: hashSecret(secret) };
+    }
+    const id = randomBytes(6).toString("hex");
+    return { id, secret, token: `${PREFIX[kind]}_${id}_${secret}`, hash: hashSecret(secret) };
 }
 export const hashSecret = (secret) => createHash("sha256").update(secret, "utf8").digest("hex");
-/** The id and secret of something shaped like a token, or null. */
+/** Read a presented credential's kind and parts; null for nothing at all. A lead token may carry surrounding space. */
+export function parseCredential(presented) {
+    if (presented === "")
+        return null;
+    const match = PRESENTED.exec(presented) ?? (/^lt_/.test(presented.trim()) ? PRESENTED.exec(presented.trim()) : null);
+    if (match !== null)
+        return { kind: match[1] === "so" ? "person" : "lead", id: match[2], secret: match[3] };
+    return { kind: "coordinator", secret: presented };
+}
+export const mintApiToken = () => mintCredential("person");
+export const mintLeadToken = () => mintCredential("lead");
+/** The id and secret of something shaped like an API token, or null. */
 export function parseApiToken(presented) {
-    const match = SHAPE.exec(presented);
-    return match === null ? null : { id: match[1], secret: match[2] };
+    const parsed = parseCredential(presented);
+    return parsed?.kind === "person" && PRESENTED.test(presented) ? { id: parsed.id, secret: parsed.secret } : null;
+}
+/** The id and secret of something shaped like a lead token, or null. */
+export function parseLeadToken(presented) {
+    const parsed = parseCredential(presented);
+    return parsed?.kind === "lead" ? { id: parsed.id, secret: parsed.secret } : null;
 }
 /** Whether the secret is the one whose hash was kept, in constant time. */
 export function secretMatches(secret, keptHash) {

package/dist/assignment-delivery.js

@@ -14,7 +14,7 @@ const ownerSql = `COALESCE((SELECT 'lead:'||o.lead FROM team_task_owner o WHERE
 function admittedRepos(store, owner) {
     if (owner.kind !== "coordinator" || typeof owner.id !== "string" || owner.id.length === 0)
         return null;
-    const row = store.handle.prepare("SELECT repos,revoked_at FROM coordinator_credential WHERE cid = ?").get(owner.id);
+    const row = store.handle.prepare("SELECT projects_json AS repos,revoked_at FROM credential WHERE id = ? AND kind = 'coordinator'").get(owner.id);
     if (!row || row["revoked_at"] !== null)
         return null;
     try {

package/dist/assignment-status.js

@@ -92,7 +92,7 @@ export function noteAssignmentStatus(store, snapshot, now) {
             const claimed = store.handle.prepare("SELECT actor FROM action_ledger WHERE task_id=? AND action='assignment claimed' AND source='work' ORDER BY id DESC LIMIT 1").get(snapshot.rootId);
             if ((claimed === undefined ? ref.coordinatorCid : String(claimed["actor"]).replace(/^coordinator:/, "")) !== owner.id)
                 return null;
-            const credential = store.handle.prepare("SELECT repos FROM coordinator_credential WHERE cid=? AND revoked_at IS NULL").get(owner.id);
+            const credential = store.handle.prepare("SELECT projects_json AS repos FROM credential WHERE id=? AND kind='coordinator' AND revoked_at IS NULL").get(owner.id);
             let repos;
             try {
                 repos = JSON.parse(String(credential?.["repos"] ?? "null"));

package/dist/assignment.js

@@ -73,7 +73,8 @@ function ownerOf(store, rootId, repo) {
     const id = claim === undefined ? origin : String(claim["actor"]).replace(/^coordinator:/, "");
     if (!id)
         return null;
-    const credential = store.handle.prepare("SELECT name,repos,revoked_at FROM coordinator_credential WHERE cid = ?").get(id);
+    // A ledger actor names a coordinator by the id it had when it acted (v118 keeps that as public_id).
+    const credential = store.handle.prepare("SELECT name,projects_json AS repos,revoked_at FROM credential WHERE kind = 'coordinator' AND (id = ? OR public_id = ?) ORDER BY id = ? DESC LIMIT 1").get(id, id, id);
     let repos = [];
     try {
         repos = JSON.parse(String(credential?.["repos"] ?? "[]"));
@@ -379,7 +380,7 @@ function readinessOf(store, receipt, repo, review) {
 function admittedOwner(store, taskId, owner, now, root) {
     if (owner.kind !== "coordinator")
         return null; // A stable lead is identity, not a bearer credential.
-    const row = store.handle.prepare("SELECT repos, revoked_at FROM coordinator_credential WHERE cid = ?").get(owner.id);
+    const row = store.handle.prepare("SELECT projects_json AS repos, revoked_at FROM credential WHERE id = ? AND kind = 'coordinator'").get(owner.id);
     if (row === undefined || row["revoked_at"] !== null)
         return null;
     let repos;