toolroll 0.9.61 → 0.9.63

package/dist/server/flows.js

@@ -21,6 +21,7 @@ import { exportFlow, fetchFlowFile, FlowFileError, importFlow, parseFlowFile, pl
 import { addFlowTriggerTo, checkFlowTriggerNow, pressFlowButton, removeFlowTrigger, removeLinearKey, setFlowTriggerOn, renewFlowHook, saveHooksBase, saveLinearKey, saveLinearSigningSecret, shareFlowButton, stopSharingFlowButton } from "../flow-triggers.js";
 import { FLOW_IMPORT_SCRIPT, flowFallbackHtml, flowImportHtml, flowsListHtml, flowView } from "../flows-ui.js";
 import { FLOW_TEMPLATES, FlowContractError, validateFlowDefinition, withZoneNames } from "../flows.js";
+import { prepareUnattendedCandidates, parseUnattendedAsk, revokeUnattended, signUnattended, untilWords } from "../flow-unattended.js";
 import { keyStatus } from "../keys.js";
 import { kitPageHtml, kitsGalleryHtml } from "../kits-ui.js";
 import { addKitGithubTrigger, addKitSample, kitOf, setUpKit } from "../kits.js";
@@ -148,7 +149,7 @@ export function createFlowsHandlers(runtime) {
             return refuse(response, who, 404, "No such flow in your projects.", "/flows");
         const selected = Number(url.searchParams.get("card")), start = Number(url.searchParams.get("start"));
         const view = flowView(store, flow, { name: who.name, approver: who.via === "cookie" && who.role === "approver" }, Number.isSafeInteger(selected) && selected > 0 ? selected : null, { dir: options.configDir ?? null, repos: consoleProjects(), startTrigger: Number.isSafeInteger(start) && start > 0 ? start : null,
-            sortReady: keyStatus("openrouter", providerHome).set, toolHome });
+            sortReady: keyStatus("openrouter", providerHome).set, toolHome, now: clock() });
         if (url.searchParams.get("format") === "json")
             return respond(response, 200, "application/json; charset=utf-8", JSON.stringify(checkResponse("flowView", view)));
         return sendScreen(response, 200, screen(flow.name, html `<p><a href="/flows">Flows</a></p><h1>${flow.name}</h1>${flowFallbackHtml(view)}`, { chrome: chromeFor(flow.repo, "flows"), workspace: { view } }));
@@ -546,7 +547,7 @@ export function createFlowsHandlers(runtime) {
         }
         const definition = flowDefinitionOf(flow);
         const dir = options.configDir ?? null;
-        const viewNow = () => flowView(store, store.getFlow(flow.id) ?? flow, { name: who.name, approver: true }, null, { dir, repos: projects, sortReady: keyStatus("openrouter", providerHome).set, toolHome });
+        const viewNow = () => flowView(store, store.getFlow(flow.id) ?? flow, { name: who.name, approver: true }, null, { dir, repos: projects, sortReady: keyStatus("openrouter", providerHome).set, toolHome, now });
         const settle = (said, extra = {}) => {
             // Move what can move right away (a message, a decision's next zone); workers file and run the tasks.
             try {
@@ -572,6 +573,8 @@ export function createFlowsHandlers(runtime) {
                 return answer(400, { ok: false, said: "That trigger couldn't be read." });
             }
             const made = addFlowTriggerTo(store, flow, raw, who.name, now, dir);
+            if (made.ok)
+                await prepareUnattendedCandidates(store, flow.id);
             return made.ok ? settle(made.said, made.reveal === null ? {} : { reveal: made.reveal }) : answer(400, { ok: false, said: made.message });
         }
         if (action === "scripts") {
@@ -579,8 +582,10 @@ export function createFlowsHandlers(runtime) {
             if (body.get("approve") === "yes")
                 return store.approveFlowScript(flow.repo, body.get("name") ?? "") ? settle("Approved. Zones that run it go on.") : answer(404, { ok: false, said: "That script isn't waiting for approval." });
             if (body.get("remove") === "yes")
-                return store.removeFlowScript(flow.repo, body.get("name") ?? "") ? settle("Script removed. Zones that ran it wait until it's back.") : answer(404, { ok: false, said: "There's no script by that name." });
+                return store.removeFlowScript(flow.repo, body.get("name") ?? "", who.name, now) ? settle("Script removed. Zones that ran it wait until it's back.") : answer(404, { ok: false, said: "There's no script by that name." });
             const saved = saveScript(store, flow.repo, { name: body.get("name"), about: body.get("about"), body: body.get("body"), timeoutMinutes: body.get("timeoutMinutes"), language: body.get("language"), file: body.get("file") }, who.name, now);
+            if (saved.ok)
+                await prepareUnattendedCandidates(store, flow.id);
             return saved.ok ? settle(saved.said) : answer(400, { ok: false, said: saved.message });
         }
         if (action === "linear-key" || action === "hooks-address") {
@@ -604,6 +609,19 @@ export function createFlowsHandlers(runtime) {
             store.archiveFlow(flow.id, who.name, now);
             return redirect(response, "/flows");
         }
+        if (action === "unattended") {
+            // The owner's password signs exactly the terms the panel showed; a flow saved meanwhile is refused (sawRevision).
+            if (!authenticateApprover(who, body.get("password") ?? "").ok)
+                return answer(403, { ok: false, said: "That password isn't right. Nothing was signed." });
+            const asked = parseUnattendedAsk({ days: body.get("days"), budget: body.get("budget"), runs: body.get("runs"), include: body.get("include") });
+            if (!asked.ok)
+                return answer(400, { ok: false, said: asked.message });
+            const signed = await signUnattended(store, { flow: flow.id, signer: who.name, ask: asked.ask, sawRevision: Number(body.get("revision")), sawSchedules: body.get("schedules") ?? "" }, now);
+            return signed.ok ? settle(`Runs on its own until ${untilWords(signed.grant.absoluteExpiry)}.`) : answer(409, { ok: false, said: signed.message });
+        }
+        if (action === "unattended-off") {
+            return revokeUnattended(store, flow.id, who.name, now) ? settle("It no longer runs on its own. New cards wait for you.") : answer(409, { ok: false, said: "It wasn't running on its own." });
+        }
         if (action === "save") {
             let saved, drawn;
             try {
@@ -637,6 +655,8 @@ export function createFlowsHandlers(runtime) {
             if (dir === null)
                 return answer(409, { ok: false, said: "Secrets are kept on the console's computer." });
             const saved = setFlowSecret(dir, flow.repo, (body.get("name") ?? "").trim(), body.get("value") ?? "");
+            if (saved.ok)
+                await prepareUnattendedCandidates(store, flow.id);
             return saved.ok ? settle(saved.said) : answer(400, { ok: false, said: saved.message });
         }
         // Adding a card.
@@ -702,11 +722,11 @@ export function createFlowsHandlers(runtime) {
         if (trigger === null || trigger.flow !== flow.id || trigger.state === "removed")
             return answer(404, { ok: false, said: "That trigger isn't on this flow." });
         if (verb === "pause" || verb === "resume") {
-            setFlowTriggerOn(store, trigger, verb === "resume", now);
+            setFlowTriggerOn(store, trigger, verb === "resume", now, who.name);
             return settle(verb === "pause" ? "Trigger paused." : "Trigger on again.");
         }
         if (verb === "remove") {
-            removeFlowTrigger(store, trigger, now, dir);
+            removeFlowTrigger(store, trigger, now, dir, who.name);
             return settle("Trigger removed.");
         }
         if (verb === "share") {
@@ -887,6 +907,8 @@ export function createFlowsHandlers(runtime) {
         "flow.linear-key": flowAct("linear-key"),
         "flow.hooks-address": flowAct("hooks-address"),
         "flow.secrets": flowAct("secrets"),
+        "flow.unattended": flowAct("unattended"),
+        "flow.unattended-off": flowAct("unattended-off"),
         "flow.triggers": flowAct("triggers"),
         "flow.card.move": cardAct("move"),
         "flow.card.decide": cardAct("decide"),

package/dist/server/render-tasks.d.ts

@@ -3,6 +3,7 @@ import { type Html } from "../html.js";
 import { type RunActivity } from "../activity-line.js";
 import { type AgentChoice } from "../agentconfig.js";
 import { type AssignmentSnapshot } from "../assignment.js";
+import { type TaskBaseView } from "../task-base.js";
 import { type BrowserTaskView } from "../browser-workspace.js";
 import { type FormView } from "../contracts/console-api.js";
 import { type DispatchDiagnosis } from "../dispatch.js";
@@ -588,6 +589,8 @@ export declare function taskBodyParts(data: {
     /** The pull request opened through Complete (its state, link, CI and merge), or the offer to open one for a
      * result already marked complete; null when neither applies. */
     pullRequest?: TaskPullRequest | null;
+    /** Fresh base: the commit this task's work starts from, and how far current main has moved past it. */
+    base?: TaskBaseView | null;
     /** The task's whole family (the original and its revisions) and every attempt across it, for the thread. */
     family?: {
         root: {

package/dist/server/render-tasks.js

@@ -7,6 +7,7 @@ import { gateWords } from "../approval-policy.js";
 import { assignmentCardOf, assignmentStatusOf, assignmentSummaryHtml } from "../assignment-ui.js";
 import {} from "../assignment.js";
 import { holdOwnerWords } from "../board.js";
+import { baseStandingWords } from "../task-base.js";
 import {} from "../browser-workspace.js";
 import { permissionPlainWords } from "../chat-decide.js";
 import { CHAT_TASK_ACTIONS } from "../chat-task-actions.js";
@@ -2108,6 +2109,8 @@ export function taskBodyParts(data) {
     work.push({ label: "Status", parts: [data.assignment != null && assignmentOptions !== null ? assignmentCardOf(data.assignment, assignmentOptions).status.headline : status.label] });
     if (data.repo !== null)
         work.push({ label: "Project", parts: [projectName(data.repo)] });
+    if (data.base != null)
+        work.push({ label: "Base", parts: [baseStandingWords(data.base)] });
     work.push({ label: "Agent", parts: [lastRunForAgent !== undefined ? `${lastRunForAgent.provider}${lastRunForAgent.model === null ? "" : ` · ${lastRunForAgent.model}`} on ${lastRunForAgent.runner}`
                 : data.route?.legacy != null ? `${data.route.legacy.provider} · ${data.route.legacy.model}` : "The project's default"] });
     if (scope !== null)

package/dist/server/route-table.js

@@ -238,6 +238,9 @@ for (const one of ["save", "cards", "archive", "scripts"])
     post("flows", `flow.${one}`, `^\\/flows\\/${FLOW}\\/${one}$`, { project: "flow", limited: "resource", sample: `/flows/1/${one}`, ...EDIT_FLOWS });
 for (const one of ["linear-key", "hooks-address", "secrets"])
     post("flows", `flow.${one}`, `^\\/flows\\/${FLOW}\\/${one}$`, { scope: "step-up", project: "flow", sample: `/flows/1/${one}`, ...EDIT_FLOWS });
+// "Runs on its own": signing raises authority (the owner's password, a step-up); revoking is one click for any approver.
+post("flows", "flow.unattended", `^\\/flows\\/${FLOW}\\/unattended$`, { scope: "step-up", project: "flow", sample: "/flows/1/unattended", ...EDIT_FLOWS });
+post("flows", "flow.unattended-off", `^\\/flows\\/${FLOW}\\/unattended-off$`, { project: "flow", sample: "/flows/1/unattended-off", ...EDIT_FLOWS });
 post("flows", "flow.triggers", `^\\/flows\\/${FLOW}\\/triggers$`, { project: "flow", limited: "resource", sample: "/flows/1/triggers", ...EDIT_FLOWS });
 for (const one of ["move", "decide", "cancel", "comment", "assign", "watch"])
     post("flows", `flow.card.${one}`, `^\\/flows\\/${FLOW}\\/cards\\/${FLOW}\\/${one}$`, { project: "flow", limited: "resource", sample: `/flows/1/cards/2/${one}`, ...EDIT_FLOWS });

package/dist/server/runtime.d.ts

@@ -107,7 +107,7 @@ export interface ServerRuntime {
     consoleProjects: () => string[];
     flowRooms: FlowRooms;
     providerHome: string;
-    toolHome: string;
+    toolHome: string | undefined;
     leadPrincipal: (who: Who & {
         via: "cookie";
     }) => VerifiedApprover | null;

package/dist/server/settings.js

@@ -82,7 +82,8 @@ import { applySavedKnowledge, changeKnowledge, knowledgeVersion, knowledgeView }
 import { changeLearning } from "../project-learning.js";
 import { listDecisions, recordDecision, retireDecision, searchMemory } from "../project-memory.js";
 import { changeSkills, githubSkill, importSkill, reviseSkillTest, skillsView, testSkill } from "../project-skills.js";
-import { addToolTo, catalogTool, localAppOf, removeToolFrom, setToolSecret, splitCommandLine, testToolOf } from "../project-tools.js";
+import { signedIn } from "../oauth-run-token.js";
+import { addToolTo, catalogTool, localAppOf, removeToolFrom, setToolSecret, splitCommandLine, testToolOf, toolSecretStorage } from "../project-tools.js";
 import { liftAuthPause } from "../provider-auth.js";
 import { isProviderId, PROVIDER_IDS, validateSpec, validModelId } from "../provider.js";
 import { checkPublishing, MERGE_METHODS, saveMergeSettings, savePublishing } from '../pull-request-flow.js';
@@ -104,6 +105,7 @@ import { budgetStates, monthNamed, spendItems, usd as spendUsd, subagentNames as
 import { removeSsoSettings, saveSsoSettings, SSO_CALLBACK, ssoChangeWords } from "../sso-settings.js";
 import { ssoSettingsHtml } from "../sso-ui.js";
 import { lastSweep, saveSweep, storageSweepOff } from "../storage-sweep.js";
+import { sweepSchedule } from "../storage-sweep-schedule.js";
 import { storageHtml } from "../storage-ui.js";
 import { landedSummary } from "../landed-cleanup.js";
 import { bytesWords, parseCleanup } from "../storage.js";
@@ -302,7 +304,7 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
             return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
         const selector = projects.length > 1 ? html `<form class="approval-project" method="get" action="/settings/project"><label>Project<select name="repo">${projects.map(p => html `<option value="${p}"${p === chosen ? " selected" : ""}>${projectName(p)}</option>`)}</select></label><button>Show</button></form>` : "";
         const notice = { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") };
-        const content = chosen === "" ? html `${notice.said ? html `<p role="status">${notice.said}</p>` : ""}<p>No projects yet.</p>` : (projectSettingsHtml(projectViewOf(chosen, who), notice));
+        const content = chosen === "" ? html `${notice.said ? html `<p role="status">${notice.said}</p>` : ""}<p>No projects yet.</p>` : (projectSettingsHtml({ ...projectViewOf(chosen, who), remoteUrl: store.projectRemote(chosen) }, notice));
         return sendScreen(response, 200, screen("Project", html `<p><a href="/settings">Settings</a></p><h1>Project</h1>${selector}${content}`, { chrome: chromeFor(chosen || null, "settings") }));
     }
     // v102: Settings → Approval rules, a project's separation of duties. Anyone who sees the project reads them; an instance operator sets them.
@@ -349,7 +351,7 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         if (!options.configDir)
             return refuse(response, who, 403, "An installation approver sees integrations.", "/settings");
         const list = integrations.list();
-        return sendScreen(response, 200, screen("Integrations", html `<p><a href="/settings">Settings</a></p><h1>Integrations</h1>${(integrationsHtml(list, who.session.csrf, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem"), checking: integrations.checking }))}`, { chrome: chromeFor(project, "settings") }));
+        return sendScreen(response, 200, screen("Integrations", html `<p><a href="/settings">Settings</a></p><h1>Integrations</h1>${(integrationsHtml(list, who.session.csrf, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem"), checking: integrations.checking, secrets: toolSecretStorage() }))}`, { chrome: chromeFor(project, "settings") }));
     }
     // v104: Settings → Monitoring, where the audit stream and traces go. An instance operator's page.
     async function monitoringPage(ctx) {
@@ -398,7 +400,7 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         if (databaseFile === null)
             return refuse(response, who, 403, "An instance operator looks after storage.", "/settings");
         const plan = await checkoutPlan(store, storagePool(databaseFile), now, { manual: true });
-        const sweep = { last: lastSweep(store), off: storageSweepOff() };
+        const sweep = { last: lastSweep(store), off: storageSweepOff(), schedule: sweepSchedule(store, now) };
         return sendScreen(response, 200, screen("Storage", html `<p><a href="/settings">Settings</a></p><h1>Storage</h1>${(storageHtml({ plan, csrf: who.session.csrf, sweep, landed: landedSummary(store) }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }))}`, { chrome: chromeFor(project, "settings") }));
     }
     // Settings → Projects → Pull requests: one project's setup. Off, the checks run on open, so the page says
@@ -623,7 +625,12 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         }, who.role === "approver" && csrf !== "" ? (() => {
             // v87: the mail server flows send email through; the password is never shown back.
             // v89: where Inbox triggers read it, and a connected Google account (its client secret is never shown back either).
-            const email = readEmailSettings(options.configDir ?? null), google = readGoogleMail(options.configDir ?? null), origin = consoleOrigin(request.headers.host);
+            const email = readEmailSettings(options.configDir ?? null), google = (() => { try {
+                return readGoogleMail(options.configDir ?? null);
+            }
+            catch {
+                return null;
+            } })(), origin = consoleOrigin(request.headers.host);
             const googleView = { connected: googleConnected(options.configDir ?? null)?.address ?? null, clientId: google?.clientId ?? "", redirect: origin === null ? null : `${origin}${GOOGLE_CALLBACK}` };
             return email === null ? { set: false, host: "", port: 587, secure: false, user: "", from: "", imapHost: "", imapPort: 993, google: googleView }
                 : { set: true, host: email.host, port: email.port, secure: email.secure, user: email.user, from: email.from, imapHost: email.imap?.host ?? "", imapPort: email.imap?.port ?? 993, google: googleView };
@@ -1396,6 +1403,8 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
                 const secret = body.get("secret") ?? "";
                 if (!tool.spec.secrets.some(one => one.name === secret))
                     return back("problem", "Choose one of this tool's secrets.");
+                if (signedIn(tool.spec))
+                    return back("problem", `${name} is connected by signing in. Sign in again from Connect to renew it.`, `#tool-${name}`);
                 setToolSecret(repo, name, secret, body.get("value") ?? "", toolHome);
                 return back("said", `Saved ${secret} for ${name}. It is never shown again.`, `#tool-${name}`);
             }

package/dist/server/task-views.js

@@ -1,3 +1,4 @@
+import { taskBaseOf } from "../task-base.js";
 import { assignmentPresentationOf, historicalAssessmentReason } from '../assignment-presentation.js';
 import { html, joinHtml } from "../html.js";
 import { assignmentStatusOf, assignmentWithEvidence } from '../assignment-ui.js';
@@ -482,6 +483,7 @@ export function createTaskViews(runtime) {
                 return { rows, decisions: decisionsFor(runtime.store, rows), now };
             })(),
             steering: ref === null ? [] : runtime.store.listSteerNotes(ref.id),
+            base: taskBaseOf(runtime.store, taskId),
             steeringLive: ref !== null && runtime.store.steeringLiveBuild(ref.id, now) !== null,
             // "publishes as" reads ONLY publicationGrantFor(repo) — the grant
             // the publisher would act under — never listGrants(), which is

package/dist/storage-sweep-child.js

@@ -3,7 +3,7 @@ import { Worker } from "node:worker_threads";
 import { openStoreNoMigrate } from "./store.js";
 import { WorktreePool } from "./worktree.js";
 import { executeSweep } from "./storage-sweep.js";
-import { sweepRequest } from "./storage-sweep-process.js";
+import { enterSweepBackground, sweepRequest } from "./storage-sweep-process.js";
 const parent = process.ppid;
 let store;
 let finished = false;
@@ -57,6 +57,8 @@ process.once("message", async (request) => {
         finish(1);
         return;
     }
+    // Node and the sweep's code are loaded: from here on, on macOS, the work and everything it starts runs in the background.
+    enterSweepBackground();
     try {
         const opened = openStoreNoMigrate(request.databaseFile);
         if (!opened.ok)

package/dist/storage-sweep-process.d.ts

@@ -29,6 +29,20 @@ export type SweepSupervisor = {
 };
 export declare const SWEEP_TIMEOUT_MS: number;
 export declare const SWEEP_KILL_GRACE_MS = 5000;
+/** The sweep runs behind everything else: a positive nice and, on macOS, the background CPU and I/O policy. */
+export declare const SWEEP_NICE = 10;
+/**
+ * How the child enters the background policy on macOS, or null elsewhere (or without taskpolicy): the child runs it on
+ * its own pid once Node has started and loaded the sweep, before any sweep work. Everything it starts after that (rm,
+ * du, git) inherits the policy. Starting Node itself under it let a busy machine hold the child's start for as long
+ * as anything else wanted the CPU, before it had done any of the work the policy is for.
+ */
+export declare function sweepBackground(pid: number, platform?: NodeJS.Platform, exists?: (path: string) => boolean): {
+    file: string;
+    args: string[];
+} | null;
+/** In the child: the background policy from now on. Without it the sweep still runs, at the nice its parent set. */
+export declare function enterSweepBackground(run?: (file: string, args: string[]) => void): boolean;
 /** Owns one child without lending its lifetime to a reconcile pass or its database connection. */
 export declare function createSweepSupervisor(options?: {
     timeoutMs?: number;

package/dist/storage-sweep-process.js

@@ -1,5 +1,7 @@
 /** The storage child's bounded IPC protocol. No paths or process arguments are written to logs. */
-import { fork } from "node:child_process";
+import { execFileSync, fork } from "node:child_process";
+import { existsSync } from "node:fs";
+import { setPriority } from "node:os";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 const object = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -23,13 +25,45 @@ export function sweepResponse(value, request) {
 }
 export const SWEEP_TIMEOUT_MS = 20 * 60_000;
 export const SWEEP_KILL_GRACE_MS = 5_000;
+/** The sweep runs behind everything else: a positive nice and, on macOS, the background CPU and I/O policy. */
+export const SWEEP_NICE = 10;
+const TASKPOLICY = "/usr/sbin/taskpolicy";
+/**
+ * How the child enters the background policy on macOS, or null elsewhere (or without taskpolicy): the child runs it on
+ * its own pid once Node has started and loaded the sweep, before any sweep work. Everything it starts after that (rm,
+ * du, git) inherits the policy. Starting Node itself under it let a busy machine hold the child's start for as long
+ * as anything else wanted the CPU, before it had done any of the work the policy is for.
+ */
+export function sweepBackground(pid, platform = process.platform, exists = existsSync) {
+    return platform === "darwin" && exists(TASKPOLICY) ? { file: TASKPOLICY, args: ["-b", "-p", String(pid)] } : null;
+}
+/** In the child: the background policy from now on. Without it the sweep still runs, at the nice its parent set. */
+export function enterSweepBackground(run = (file, args) => { execFileSync(file, args, { stdio: "ignore", timeout: 5_000 }); }) {
+    const command = sweepBackground(process.pid);
+    if (command === null)
+        return false;
+    try {
+        run(command.file, command.args);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /** Only source checkouts need tsx; installed builds use the sibling child and the same Node. */
 function forkSweep() {
     const source = import.meta.url.endsWith(".ts");
     const child = fork(fileURLToPath(new URL(source ? "./storage-sweep-child.ts" : "./storage-sweep-child.js", import.meta.url)), [], {
         execArgv: source ? ["--import", "tsx"] : [], stdio: ["ignore", "ignore", "ignore", "ipc"], detached: true,
     });
-    // A one-shot CLI may exit after reconcile; the child's parent-loss guard then ends it.
+    // Before the request is sent, so every rm/du the child starts inherits it.
+    if (child.pid !== undefined) {
+        try {
+            setPriority(child.pid, SWEEP_NICE);
+        }
+        catch { /* the default priority still works */ }
+    }
+    // The service never waits on the child to exit; stop() and the child's parent-loss guard end it.
     child.unref();
     child.channel?.unref();
     return child;
@@ -165,7 +199,7 @@ export function createSweepSupervisor(options = {}) {
         },
     };
 }
-// All watch loops in this process share a flight. Other workers arbitrate the daily claim in SQLite.
+// All watch loops in this process share a flight. Other services arbitrate the claim in SQLite.
 const supervisors = new Map();
 export function storageSweepSupervisor(databaseFile) {
     const key = resolve(databaseFile);

package/dist/storage-sweep-schedule.d.ts

@@ -0,0 +1,30 @@
+import { type SweepDeps, type SweepRecord } from "./storage-sweep.js";
+import { type SweepSupervisor } from "./storage-sweep-process.js";
+import { type Store } from "./store.js";
+/** How often the service looks again at a due sweep. */
+export declare const SWEEP_CHECK_MS: number;
+/** After this long without an automatic sweep, it runs even while work is running or waiting. */
+export declare const SWEEP_FORCE_MS: number;
+export type SweepBusy = "run" | "claim" | "ready";
+/** What keeps a due sweep waiting now, or null when nothing is running or waiting. */
+export declare function sweepBusy(store: Store, now: Date): SweepBusy | null;
+/** Whether a long-lived Toolroll service holds a current lease. Rows from earlier services don't count. */
+export declare function sweepServiceRunning(store: Store, now: Date): boolean;
+export type SweepState = "off" | "sweeping" | "no-service" | "recent" | "retry" | "busy" | "forced" | "due";
+export type SweepSchedule = {
+    state: SweepState;
+    /** The latest automatic sweep's recorded time, or null when there has been none. */
+    lastAt: string | null;
+    /** When the next sweep is due, or null when it is off or due now. */
+    nextAt: string | null;
+    busy: SweepBusy | null;
+};
+/** The sweep's schedule from what is recorded now; reads only. */
+export declare function sweepSchedule(store: Store, now: Date, env?: NodeJS.ProcessEnv): SweepSchedule;
+/** Why the sweep is waiting or when it is next due, after "Automatic sweep: ". `when` formats a time for the reader. */
+export declare function sweepScheduleWords(schedule: SweepSchedule, when: (at: string) => string): string;
+/**
+ * The service's claim and launch. A one-shot caller has no `owner` and never claims. A hung child never holds
+ * reconciliation or the caller's store open; the result is saved by the flight's own connection.
+ */
+export declare function idleStorageSweep(store: Store, deps: SweepDeps, now: () => Date, supervisor?: SweepSupervisor): SweepRecord | null;

package/dist/storage-sweep-schedule.js

@@ -0,0 +1,164 @@
+/**
+ * When the automatic storage sweep (storage-sweep.ts) starts, and what `toolroll storage` and Settings → Storage say
+ * about it. A sweep is due a day after the last one (an hour after one that failed somewhere). Once due, the
+ * long-lived Toolroll service looks at most every 15 minutes and starts it only while nothing is running or waiting:
+ * no open run, no live claim and no task a worker could claim now. Work held by an approval, a hold or a provider limit
+ * is not waiting to start, so it never defers the sweep. 48 hours after the last automatic sweep it runs anyway: its
+ * scans run in a low-priority child, and every removal asks again whether live work uses the folder.
+ *
+ * Only the service claims a sweep (it passes its owner): a one-shot `toolroll reconcile` exits before a child would
+ * finish, and a claim it made would be lost until the next day. The idle gates are asked again inside the transaction
+ * that claims the sweep, so work that started since the first look still defers it.
+ */
+import { diagnoseTaskDispatch, diagnosisIsDispatchable } from "./dispatch.js";
+import { lastSweep, RETRY_MS, saveSweep, storageSweepOff, sweepFailure, SWEEP_CURSOR, SWEEP_EVERY_MS } from "./storage-sweep.js";
+import { storageSweepSupervisor, SWEEP_KILL_GRACE_MS, SWEEP_TIMEOUT_MS } from "./storage-sweep-process.js";
+import { openStoreNoMigrate } from "./store.js";
+/** How often the service looks again at a due sweep. */
+export const SWEEP_CHECK_MS = 15 * 60_000;
+/** After this long without an automatic sweep, it runs even while work is running or waiting. */
+export const SWEEP_FORCE_MS = 48 * 3_600_000;
+/** What keeps a due sweep waiting now, or null when nothing is running or waiting. */
+export function sweepBusy(store, now) {
+    const db = store.handle;
+    if (db.prepare("SELECT 1 FROM run WHERE finished_at IS NULL LIMIT 1").get() !== undefined)
+        return "run";
+    if (db.prepare("SELECT 1 FROM claim WHERE released_at IS NULL AND expires_at > ? LIMIT 1").get(now.toISOString()) !== undefined)
+        return "claim";
+    // Ready means a worker could claim it now: the same answer the task page gives, not merely queued.
+    if (store.listReady(now).some(ref => diagnosisIsDispatchable(diagnoseTaskDispatch(store, ref.externalId, now))))
+        return "ready";
+    return null;
+}
+/** Whether a long-lived Toolroll service holds a current lease. Rows from earlier services don't count. */
+export function sweepServiceRunning(store, now) {
+    return store.handle.prepare("SELECT 1 FROM watch_lease WHERE owner GLOB 'toolroll-service:*' AND expires_at > ? LIMIT 1").get(now.toISOString()) !== undefined;
+}
+const dueAt = (store) => store.serviceCursor(SWEEP_CURSOR) + SWEEP_EVERY_MS;
+/** Count from the last result, or the durable installation time before the first result. */
+function forcedFrom(store, last) {
+    if (last !== null)
+        return Date.parse(last.at);
+    const installed = store.installationFact("installed-at");
+    return installed === null ? null : Date.parse(installed);
+}
+/** The sweep's schedule from what is recorded now; reads only. */
+export function sweepSchedule(store, now, env = process.env) {
+    const last = lastSweep(store, "automatic");
+    const lastAt = last?.at ?? null;
+    if (storageSweepOff(env))
+        return { state: "off", lastAt, nextAt: null, busy: null };
+    const cursor = store.serviceCursor(SWEEP_CURSOR);
+    // Results record completion time, which may be later than the claim. An older result cannot finish a new claim.
+    if (cursor !== 0 && now.getTime() - cursor < SWEEP_TIMEOUT_MS + SWEEP_KILL_GRACE_MS && now.getTime() >= cursor && (lastAt === null || Date.parse(lastAt) < cursor)) {
+        return { state: "sweeping", lastAt, nextAt: null, busy: null };
+    }
+    const due = dueAt(store);
+    const nextAt = cursor === 0 || due <= now.getTime() ? null : new Date(due).toISOString();
+    if (!sweepServiceRunning(store, now))
+        return { state: "no-service", lastAt, nextAt, busy: null };
+    if (nextAt !== null) {
+        // Completion can follow the claim: elapsed sweep time alone does not mean a retry.
+        const retry = last !== null && Date.parse(last.at) >= cursor && last.parts.some(one => one.failed > 0 || one.more === true || one.problem !== undefined);
+        return { state: retry ? "retry" : "recent", lastAt, nextAt, busy: null };
+    }
+    const from = forcedFrom(store, last);
+    if (from !== null && now.getTime() - from >= SWEEP_FORCE_MS)
+        return { state: "forced", lastAt, nextAt: null, busy: null };
+    const busy = sweepBusy(store, now);
+    return { state: busy === null ? "due" : "busy", lastAt, nextAt: null, busy };
+}
+const BUSY_WORDS = { run: "work is running", claim: "a worker is starting a task", ready: "a task is ready to start" };
+/** Why the sweep is waiting or when it is next due, after "Automatic sweep: ". `when` formats a time for the reader. */
+export function sweepScheduleWords(schedule, when) {
+    switch (schedule.state) {
+        case "off": return "off.";
+        case "sweeping": return "sweeping now.";
+        case "no-service": return "waiting: no Toolroll service running.";
+        case "recent": return `swept recently, next due ${when(schedule.nextAt)}.`;
+        case "retry": return `retry due ${when(schedule.nextAt)}.`;
+        case "busy": return `due, waiting: ${BUSY_WORDS[schedule.busy]}.`;
+        case "forced": return "over 48 hours since the last sweep; it runs at the next check even if work is running.";
+        case "due": return "due; it starts within 15 minutes while nothing is running.";
+    }
+}
+// The last look per flight, so a due sweep is looked at no more than every 15 minutes.
+const looked = new WeakMap();
+/**
+ * The service's claim and launch. A one-shot caller has no `owner` and never claims. A hung child never holds
+ * reconciliation or the caller's store open; the result is saved by the flight's own connection.
+ */
+export function idleStorageSweep(store, deps, now, supervisor = storageSweepSupervisor(deps.databaseFile)) {
+    if (deps.owner === undefined || storageSweepOff() || supervisor.running)
+        return null;
+    const at = now();
+    // Older installations have no creation fact. Anchor once on their first service pass; never backdate a claim.
+    if (store.installationFact("installed-at") === null)
+        store.recordInstallationFact("installed-at", at.toISOString(), at);
+    if (at.getTime() < dueAt(store))
+        return null;
+    const seen = looked.get(supervisor);
+    if (seen !== undefined && at.getTime() - seen < SWEEP_CHECK_MS && at.getTime() >= seen)
+        return null;
+    looked.set(supervisor, at.getTime());
+    const ready = () => {
+        if (at.getTime() < dueAt(store))
+            return false;
+        const from = forcedFrom(store, lastSweep(store, "automatic"));
+        return (from !== null && at.getTime() - from >= SWEEP_FORCE_MS) || sweepBusy(store, at) === null;
+    };
+    if (!ready())
+        return null;
+    // This handle belongs to the flight, not to the pass that has already returned by the time it finishes.
+    const connection = openStoreNoMigrate(deps.databaseFile);
+    if (!connection.ok)
+        throw new Error("Sweep result store unavailable");
+    const results = connection.store;
+    let completed = null;
+    let owned = false;
+    try {
+        // Asked again where the cursor moves: work that started since the first look still defers the sweep.
+        const mine = store.transact(() => {
+            if (!ready())
+                return false;
+            store.setServiceCursor(SWEEP_CURSOR, at.getTime(), at);
+            return true;
+        });
+        if (!mine)
+            return null;
+        const request = { version: 1, databaseFile: deps.databaseFile, poolRoot: deps.pool?.root ?? null, tempRoots: [...deps.tempRoots], actor: deps.actor ?? "worker", at: at.toISOString() };
+        owned = supervisor.start(request, result => {
+            const record = result.ok ? result.record : sweepFailure(request.at, request.actor, deps.pool !== null, result.reason);
+            try {
+                results.transact(() => {
+                    if (!results.schemaCurrent())
+                        throw new Error("Sweep result store changed");
+                    saveSweep(results, record);
+                    // Only this claim can reschedule itself. A later claim must never be overwritten by a late callback.
+                    if (record.parts.some(one => one.failed > 0 || one.more === true || one.problem !== undefined) && results.serviceCursor(SWEEP_CURSOR) === at.getTime()) {
+                        results.setServiceCursor(SWEEP_CURSOR, Math.max(1, now().getTime() - SWEEP_EVERY_MS + RETRY_MS), now());
+                    }
+                });
+                completed = record;
+            }
+            catch {
+                // No exception/path from a process or database is safe to copy into a log.
+                console.error("Could not save the storage sweep result.");
+            }
+            finally {
+                results.close();
+            }
+        }, deps.owner);
+        if (!owned) {
+            store.transact(() => {
+                if (store.serviceCursor(SWEEP_CURSOR) === at.getTime())
+                    store.setServiceCursor(SWEEP_CURSOR, Math.max(1, at.getTime() - SWEEP_EVERY_MS + RETRY_MS), now());
+            });
+        }
+        return completed;
+    }
+    finally {
+        if (!owned)
+            results.close();
+    }
+}

package/dist/storage-sweep.d.ts

@@ -1,8 +1,9 @@
 import { type Located } from "./orphan-sweep.js";
 import { type ProcessRow } from "./run-closeout.js";
-import { type Store } from "./store.js";
+import type { Store } from "./store.js";
 import { type WorktreePool } from "./worktree.js";
-import { type SweepSupervisor, type SweepExecutor } from "./storage-sweep-process.js";
+import { type SweepCompletion, type SweepExecutor } from "./storage-sweep-process.js";
+export declare const SWEEP_CURSOR = "storage-sweep";
 export declare const SWEEP_EVERY_MS = 86400000;
 /** A sweep that failed somewhere, or left work for later, runs again this soon. */
 export declare const RETRY_MS: number;
@@ -36,9 +37,9 @@ export type SweepDeps = {
     graceMs?: number;
 };
 export declare function storageSweepOff(env?: NodeJS.ProcessEnv): boolean;
-export declare function storageSweepDue(store: Store, now: Date): boolean;
-/** Claim and launch only. A hung child never holds reconciliation or the caller's store open. */
-export declare function dailyStorageSweep(store: Store, deps: SweepDeps, now: () => Date, supervisor?: SweepSupervisor): SweepRecord | null;
+export declare function sweepFailure(at: string, actor: string, withPool: boolean, reason: Exclude<SweepCompletion, {
+    ok: true;
+}>["reason"]): SweepRecord;
 /**
  * What live work uses now. Live work: an open run, a current (unexpired, unreleased) lease, or a checkout leased, held
  * by a process or whose task has either. It uses its checkouts, the shared install each links, and every folder its