toolroll 0.9.61 → 0.9.63

package/dist/storage-sweep.js

@@ -1,7 +1,7 @@
 /**
- * The daily storage sweep: the plane cleans up after itself without anyone running a command. Once a day (one worker
- * takes the day: the cursor moves in the same transaction) it removes test temp folders nothing touched for a day
- * (test-temp.ts), stops orphans Toolroll left running (orphan-sweep.ts), removes finished checkouts the cleanup
+ * The storage sweep: the plane cleans up after itself without anyone running a command. About once a day, when nothing
+ * is running or waiting (storage-sweep-schedule.ts: one service takes it, the cursor moves in the same transaction),
+ * it removes test temp folders nothing touched for a day (test-temp.ts), stops orphans Toolroll left running (orphan-sweep.ts), removes finished checkouts the cleanup
  * setting lets go (checkout-cleanup.ts), keeps the current, previous and newest staged runtimes (staged-runtimes.ts)
  * and removes shared dependency installs no checkout has used for a week (shared-deps.ts).
  *
@@ -17,8 +17,9 @@
  *
  * What each sweep did is saved (the latest few) and in the ledger: `toolroll storage` and Settings → Storage show it.
  * A clean-up by hand (`storage clean --yes`) is saved the same way. A part that failed, or had more than one pass
- * takes, brings the next sweep forward to an hour later. `TOOLROLL_STORAGE_SWEEP=off` turns the automatic sweep off
- * (the unit tests do, so a test never sweeps the machine it runs on).
+ * takes, brings the next sweep forward to an hour later; it still waits for nothing to be running.
+ * `TOOLROLL_STORAGE_SWEEP=off` turns the automatic sweep off (the unit tests do, so a test never sweeps the machine
+ * it runs on).
  */
 import { realpathSync } from "node:fs";
 import { hostname } from "node:os";
@@ -29,11 +30,10 @@ import { processCensus } from "./run-closeout.js";
 import { linkedKey, pruneUnusedShared, sharedDepsRoot, sharedUse, SHARED_UNUSED_MS } from "./shared-deps.js";
 import { pruneStagedRuntimes, runtimesInUse, runtimeScriptPaths, stagePlan } from "./staged-runtimes.js";
 import { bytesWords, diskBytes } from "./storage.js";
-import { openStoreNoMigrate } from "./store.js";
 import { removeStaleTestTemp } from "./test-temp.js";
 import { worktreeProcessOccupancy } from "./worktree.js";
-import { runSweepChild, storageSweepSupervisor } from "./storage-sweep-process.js";
-const CURSOR = "storage-sweep";
+import { runSweepChild } from "./storage-sweep-process.js";
+export const SWEEP_CURSOR = "storage-sweep";
 export const SWEEP_EVERY_MS = 86_400_000;
 /** A sweep that failed somewhere, or left work for later, runs again this soon. */
 export const RETRY_MS = 60 * 60_000;
@@ -46,67 +46,7 @@ const ITEMS_MAX = 20;
 export function storageSweepOff(env = process.env) {
     return (env["TOOLROLL_STORAGE_SWEEP"] ?? "").trim().toLowerCase() === "off";
 }
-export function storageSweepDue(store, now) {
-    return now.getTime() - store.serviceCursor(CURSOR) >= SWEEP_EVERY_MS;
-}
-/** Claim and launch only. A hung child never holds reconciliation or the caller's store open. */
-export function dailyStorageSweep(store, deps, now, supervisor = storageSweepSupervisor(deps.databaseFile)) {
-    if (storageSweepOff() || supervisor.running || !storageSweepDue(store, now()))
-        return null;
-    // This handle belongs to the flight, not to the command that has already returned by the time it finishes.
-    const connection = openStoreNoMigrate(deps.databaseFile);
-    if (!connection.ok)
-        throw new Error("Sweep result store unavailable");
-    const results = connection.store;
-    const at = now();
-    let completed = null;
-    let owned = false;
-    try {
-        const mine = store.transact(() => {
-            if (!storageSweepDue(store, at))
-                return false;
-            store.setServiceCursor(CURSOR, at.getTime(), at);
-            return true;
-        });
-        if (!mine)
-            return null;
-        const request = { version: 1, databaseFile: deps.databaseFile, poolRoot: deps.pool?.root ?? null, tempRoots: [...deps.tempRoots], actor: deps.actor ?? "worker", at: at.toISOString() };
-        owned = supervisor.start(request, result => {
-            const record = result.ok ? result.record : sweepFailure(request.at, request.actor, deps.pool !== null, result.reason);
-            try {
-                results.transact(() => {
-                    if (!results.schemaCurrent())
-                        throw new Error("Sweep result store changed");
-                    saveSweep(results, record);
-                    // Only this claim can reschedule itself. A later claim must never be overwritten by a late callback.
-                    if (record.parts.some(one => one.failed > 0 || one.more === true || one.problem !== undefined) && results.serviceCursor(CURSOR) === at.getTime()) {
-                        results.setServiceCursor(CURSOR, Math.max(0, now().getTime() - SWEEP_EVERY_MS + RETRY_MS), now());
-                    }
-                });
-                completed = record;
-            }
-            catch {
-                // No exception/path from a process or database is safe to copy into a log.
-                console.error("Could not save the storage sweep result.");
-            }
-            finally {
-                results.close();
-            }
-        }, deps.owner);
-        if (!owned) {
-            store.transact(() => {
-                if (store.serviceCursor(CURSOR) === at.getTime())
-                    store.setServiceCursor(CURSOR, Math.max(0, at.getTime() - SWEEP_EVERY_MS + RETRY_MS), now());
-            });
-        }
-        return completed;
-    }
-    finally {
-        if (!owned)
-            results.close();
-    }
-}
-function sweepFailure(at, actor, withPool, reason) {
+export function sweepFailure(at, actor, withPool, reason) {
     const problem = reason === "timeout" ? "The sweep process exceeded its time limit; some cleanup may have completed. Cleanup will retry later."
         : reason === "stopped" ? "The sweep process was stopped; some cleanup may have completed. Cleanup will retry later."
             : "The sweep process did not return a valid result; some cleanup may have completed.";
@@ -339,7 +279,7 @@ export function lastSweep(store, source) {
 export function nextSweepAt(store) {
     if (storageSweepOff())
         return null;
-    const last = store.serviceCursor(CURSOR);
+    const last = store.serviceCursor(SWEEP_CURSOR);
     return last === 0 ? null : new Date(last + SWEEP_EVERY_MS).toISOString();
 }
 const NOUNS = {

package/dist/storage-ui.d.ts

@@ -1,6 +1,7 @@
 import { type Html } from "./html.js";
 import { type CheckoutPlan } from "./checkout-cleanup.js";
 import { type SweepRecord } from "./storage-sweep.js";
+import { type SweepSchedule } from "./storage-sweep-schedule.js";
 import type { LandedSummary } from "./landed-cleanup.js";
 export declare const STORAGE_CSS: string;
 export type StorageView = {
@@ -9,6 +10,7 @@ export type StorageView = {
     sweep?: {
         last: SweepRecord | null;
         off: boolean;
+        schedule?: SweepSchedule;
     };
     landed?: LandedSummary;
 };

package/dist/storage-ui.js

@@ -1,7 +1,7 @@
 /**
  * Settings → Storage: how much space task checkouts use, what a clean-up would free now, a Clean up button whose
  * preview (what goes, what stays and why, with paths) sits behind the password, what the last storage sweep removed
- * and when (its paths in a disclosure), what landed work's teardown did and still waits on (in a disclosure, with the
+ * and when (its paths in a disclosure) and why the next one waits, what landed work's teardown did and still waits on (in a disclosure, with the
  * one-time command for older work), and when a finished task's clean checkout goes by itself. An instance operator's page.
  */
 import { homedir } from "node:os";
@@ -10,6 +10,7 @@ import { html, postForm } from "./html.js";
 import { previewDigest, whyWords } from "./checkout-cleanup.js";
 import { CLEANUP_CHOICES, bytesWords } from "./storage.js";
 import { sweepDetails, sweepWords } from "./storage-sweep.js";
+import { sweepScheduleWords } from "./storage-sweep-schedule.js";
 const plural = (count, one, many = `${one}s`) => `${count} ${count === 1 ? one : many}`;
 export const STORAGE_CSS = `.storage{max-width:720px;min-width:0;overflow-wrap:anywhere}.storage h2{font-size:1.0625rem;margin:24px 0 4px}` +
     `.storage .storage-state{display:grid;gap:12px}.storage .storage-state h2{margin:0}.storage .storage-state p{margin:0}` +
@@ -45,15 +46,17 @@ function whenWords(at) {
     const date = new Date(at);
     return Number.isNaN(date.getTime()) ? at : date.toLocaleString("en-US", { month: "short", day: "numeric", hour: "numeric", minute: "2-digit" });
 }
-/** One line: when the last sweep ran and what it did; its paths and problems behind Details. */
+/** When the last sweep ran and what it did, then why the next one waits or when it is due; paths and problems behind Details. */
 function sweepHtml(sweep) {
     const last = sweep.last;
+    const schedule = sweep.schedule === undefined ? (sweep.off ? html `<p class="meta" data-sweep-state="off">Automatic sweep: off.</p>` : "")
+        : html `<p class="meta" data-sweep-state="${sweep.schedule.state}">Automatic sweep: ${sweepScheduleWords(sweep.schedule, whenWords)}</p>`;
     if (last === null)
-        return html `<p class="meta" data-last-sweep="">${sweep.off ? "Automatic sweep is off." : html `Toolroll sweeps leftovers once a day. It hasn't run yet.`}</p>`;
+        return html `<div class="sweep" data-last-sweep=""><p>Not swept yet.</p>${schedule}</div>`;
     const who = last.source === "manual" ? `Cleaned up by ${last.actor}` : "Swept";
     const details = sweepDetails(last.parts);
     const problem = last.parts.some(one => one.failed > 0 || one.problem !== undefined);
-    return html `<div class="sweep" data-last-sweep="${last.at}"><p${problem ? html ` class="problem"` : ""}>${who} <time datetime="${last.at}">${whenWords(last.at)}</time>. ${sweepWords(last.parts)}</p>${details.length === 0 ? "" : html `<details class="sweep-details"><summary>Details</summary><ul>${details.map(line => html `<li>${homeAsTilde(line)}</li>`)}</ul></details>`}</div>`;
+    return html `<div class="sweep" data-last-sweep="${last.at}"><p${problem ? html ` class="problem"` : ""}>${who} <time datetime="${last.at}">${whenWords(last.at)}</time>. ${sweepWords(last.parts)}</p>${schedule}${details.length === 0 ? "" : html `<details class="sweep-details"><summary>Details</summary><ul>${details.map(line => html `<li>${homeAsTilde(line)}</li>`)}</ul></details>`}</div>`;
 }
 /** Landed work, on demand: what its teardown did, what it waits on and why, and the one-time command for older work. */
 function landedHtml(landed) {

package/dist/store.d.ts

@@ -78,6 +78,11 @@ export declare const FLOW_SEND_SCHEMA = "\nCREATE TABLE IF NOT EXISTS flow_send
  * vocabulary and when — never text, tool names or arguments. Display state, not evidence;
  * a finished run's row goes with the live log's own retention (sweepRunActivity). */
 export declare const RUN_ACTIVITY_SCHEMA = "\nCREATE TABLE IF NOT EXISTS run_activity (\n  run  INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,\n  kind TEXT NOT NULL CHECK (kind IN ('session','message','edit','command','read','search','lookup','plan','delegate','tool')),\n  at   TEXT NOT NULL\n);\n";
+/** A task branch moved to current main before an attempt (fresh base; v122, a new table: additive only): the branch
+ * had no commits of its own and no changes, so it started over from `to_rev`. `after_run` is the newest run id when it
+ * moved: the branch's whole-task diff runs from the first builder base recorded after it (firstBuilderBase), never from
+ * the older main it left. */
+export declare const BRANCH_BASE_MOVE_SCHEMA = "\nCREATE TABLE IF NOT EXISTS branch_base_move (\n  id        INTEGER PRIMARY KEY AUTOINCREMENT,\n  task_ref  INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  branch    TEXT NOT NULL,\n  from_rev  TEXT NOT NULL,\n  to_rev    TEXT NOT NULL,\n  after_run INTEGER NOT NULL,\n  moved_at  TEXT NOT NULL\n);\nCREATE INDEX IF NOT EXISTS branch_base_move_branch ON branch_base_move (task_ref, branch, id);\n";
 /** Pausing a running Claude build (live steering, v121: additive only). A person's Pause asks the build to
  * stop its current turn and keep its session: one row per request, bound to the exact run it was asked of, under the
  * request id the asker chose (a repeated request is the same request). `note` is the steering note a Pause and steer
@@ -105,6 +110,10 @@ export declare const LEAD_FOLLOW_MESSAGE = "Automatic crew update: inspect the s
  * nothing set up, such as no `gh` sign-in). `ok_at` and `error`/`error_at` keep the last success and the last
  * failure across checks, so a row can say both. `account` is a display name only, never a credential. */
 export declare const INTEGRATIONS_SCHEMA = "\nCREATE TABLE IF NOT EXISTS integration_check (\n  key         TEXT PRIMARY KEY,\n  outcome     TEXT NOT NULL CHECK (outcome IN ('ok', 'failed', 'absent')),\n  account     TEXT,\n  detail      TEXT,\n  problem     TEXT,\n  checked_at  TEXT NOT NULL,\n  ok_at       TEXT,\n  error       TEXT,\n  error_at    TEXT\n);\n";
+/** Tool secrets (no version bump): which sealing key Toolroll made for the secrets it keeps in the keychain, as a
+ * digest of the key, never the key. A key found beside them that isn't this one was put there by something else and is
+ * refused (tool-secret-store.ts). */
+export declare const TOOL_SECRET_KEY_SCHEMA = "\nCREATE TABLE IF NOT EXISTS tool_secret_key (\n  id      INTEGER PRIMARY KEY CHECK (id = 1),\n  digest  TEXT NOT NULL CHECK (length(digest) = 64),\n  made_at TEXT NOT NULL\n);\n-- Where secrets were kept before Toolroll's folder, decided once at this database's first start (null: none) and never\n-- probed again, so a folder a build makes later under an old name is never migrated in.\nCREATE TABLE IF NOT EXISTS tool_secret_legacy (\n  id         INTEGER PRIMARY KEY CHECK (id = 1),\n  dir        TEXT,\n  decided_at TEXT NOT NULL\n);\n";
 export type BackupSettings = {
     enabled: boolean;
     everyHours: number;
@@ -161,7 +170,7 @@ export type SealedLedgerEntry = LedgerEntry & {
         hash: string;
     } | null;
 };
-export declare const SCHEMA_VERSION = 121;
+export declare const SCHEMA_VERSION = 123;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export declare const V118_MERGED_TABLES: Readonly<Record<string, CredentialKind>>;
 /**
@@ -220,7 +229,10 @@ export declare const V115_DROPPED_TABLES: readonly string[];
  * (planning_generation on task_ref, run and plan_revision, defaulting to 0, and decision.superseded_reason, null);
  * the rehearsal checks every saved row reads the declared default (HISTORY_RULES' added columns). v120 only adds
  * three nullable task_steer columns (the running build's steering folder), checked the same way. v121 only adds
- * new tables and the columns in V121_ADDED_COLUMNS (null, or no sends), checked the same way.
+ * new tables and the columns in V121_ADDED_COLUMNS (null, or no sends), checked the same way. v122 only adds a new
+ * table (branch_base_move) and the nullable column in V122_ADDED_COLUMNS (a project's recorded remote), checked the
+ * same way. v123 only adds new tables (unattended flows, tool secrets) and the columns in V123_ADDED_COLUMNS ('mode',
+ * 0 or null), checked the same way.
  */
 export declare const UPDATE_SAFE_MIGRATIONS: readonly number[];
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
@@ -250,6 +262,19 @@ export declare const V121_ADDED_COLUMNS: Readonly<Record<string, Readonly<Record
     definition: string;
     saved: string;
 }>>>>;
+/** v122: the column it adds, with the value every row saved before it reads: the remote URL an owner's project add
+ * recorded (projects added before it read none, until `repos add <project> --remote <url>` records one). */
+export declare const V122_ADDED_COLUMNS: Readonly<Record<string, Readonly<Record<string, {
+    definition: string;
+    saved: string;
+}>>>>;
+/** v123: the columns it adds, with the value every row saved before it reads: which authority armed a plan's
+ * unchanged-plan approval (saved rows read the operating mode), whether a trigger's firing was the clock's own (saved
+ * firings read not), and what code an on-time script firing a grant signed for ran (saved firings read none). */
+export declare const V123_ADDED_COLUMNS: Readonly<Record<string, Readonly<Record<string, {
+    definition: string;
+    saved: string;
+}>>>>;
 /** Whether a database settled at `version` reaches this build's schema through update-safe migrations alone. */
 export declare function updateSafeSchema(version: number | null): boolean;
 export type OAuthClientRow = {
@@ -1757,6 +1782,18 @@ export declare class Store {
     /** The database's own file (null in memory): where the agent fence begins. */
     databaseFile(): string | null;
     close(): void;
+    /** The digest of the sealing key Toolroll made for its tool secrets; null before it made one (or in an older database). */
+    toolSecretKeyDigest(): string | null;
+    /**
+     * The folder secrets were kept in before Toolroll's own, as decided at this database's first start of a command that
+     * can start builds (`record`): `probe` runs until then, and its answer (null: none) is kept for every later start.
+     * Other commands never write, so a preview stays read-only and a busy database doesn't stop them.
+     */
+    toolSecretLegacyDir(probe: () => string | null, now: Date, options: {
+        record: boolean;
+    }): string | null;
+    /** Record a new sealing key's digest only if the one recorded is still `expected` (null: none yet). */
+    swapToolSecretKeyDigest(expected: string | null, next: string, now: Date): boolean;
     /**
      * Creating a task also creates its overlay reference, because a task with no
      * `TaskRef` cannot be claimed, held, or scheduled — it would be work the
@@ -2151,7 +2188,7 @@ export declare class Store {
      * exactly what the signed digest was bound to. Returns false when the
      * scope vanished mid-ceremony. */
     sealScopeApproval(taskId: string, by: string, now: Date, mutation?: Mutation, basis?: {
-        kind: "mode" | "chat";
+        kind: "mode" | "chat" | "grant";
         modeDigest: string;
     }, approverKind?: ApproverKind): boolean;
     /** Whether this task's scope carries a LIVE seal: approved, and the
@@ -2206,6 +2243,10 @@ export declare class Store {
      * ceremony. Reconciliation drops mode-basis intents to waiting-human;
      * `firing` rows are untouched — an issued call is one-shot (E1). */
     revokeMode(repo: string, by: string, reason: string, now: Date): boolean;
+    /** A flow's "runs on its own" grant ended (revoked, expired, renewed): the undispatched work it sealed falls back
+     * to a person, as a mode's does, and plans it armed lose their pre-authorization. Running and finished work keeps
+     * its history. */
+    withdrawGrantApprovals(digest: string, now: Date): void;
     /** F2/R-REVOKE: the ONE reconciliation road. newMode null = no live
      * automerge authority (revocation, expiry, or a notify posture):
      * mode-basis pending/claimed intents drop to waiting-human, leases
@@ -4350,6 +4391,20 @@ export declare class Store {
      * legacy first-attempt behavior, unchanged byte-for-byte.
      */
     firstBuilderBase(taskRef: number, branch: string): string | null;
+    /** Where a task branch's attempts start now: a builder branch's pinned base, or the newest base any other attempt on
+     * it recorded (a planner never commits). Null before any attempt on the branch recorded one, or after a move to
+     * current main until the next attempt records its base. */
+    recordedBranchBase(taskRef: number, branch: string): string | null;
+    /** Record a task branch's move to current main, before git moves it: a move that then fails leaves the next
+     * attempt's own base (still the old one) as the branch's origin, which is exactly right. */
+    recordBranchBaseMove(taskRef: number, branch: string, from: string, to: string, now: Date): void;
+    /** The newest move of a task branch to current main, or null. */
+    latestBranchBaseMove(taskRef: number, branch: string): {
+        from: string;
+        to: string;
+        afterRun: number;
+        movedAt: string;
+    } | null;
     finishRun(id: number, result: {
         outcome: "built" | "failed" | "refused" | "parked" | "no-change" | "interrupted";
         reason?: string;
@@ -4385,6 +4440,10 @@ export declare class Store {
      * other class is observational.
      */
     stampTerminalClass(id: number, authMode: "subscription" | "api-key", terminalClass: TerminalClass): void;
+    /** A launch refused before any model turn (an installed CLI too old for a
+     * build's flags): the start stamp goes, its version and evidence stay. Only
+     * while the run is open, so a settled run's account never changes. */
+    withdrawProviderStart(id: number): void;
     /** The race-refusal stamp (Phase 3 C5): the version that was REFUSED,
      * recorded without provider_started_at — no provider process started. */
     stampProviderVersion(id: number, providerVersion: string): void;
@@ -5657,7 +5716,7 @@ export declare class Store {
     }, now: Date): number;
     /** A person approves a held script (one an imported flow brought): from now on it runs. False when it wasn't held. */
     approveFlowScript(repo: string, name: string): boolean;
-    removeFlowScript(repo: string, name: string): boolean;
+    removeFlowScript(repo: string, name: string, by?: string, now?: Date): boolean;
     /** Claim a card's visit to a step zone. False when another pass holds it or it already finished. */
     claimFlowStep(step: {
         card: number;
@@ -5737,7 +5796,7 @@ export declare class Store {
         lastOutcome?: string;
         failures?: number;
         hookHash?: string | null;
-    }, now: Date): void;
+    }, now: Date, by?: string): void;
     /** Whether a trigger already handled this outside thing (an issue, a run, a schedule slot). */
     flowTriggerSaw(trigger: number, key: string): boolean;
     /** The card one outside thing made (v89: a chat message, so replies in its thread find it). */
@@ -5748,7 +5807,7 @@ export declare class Store {
      * Record what a trigger did with one outside thing: the card it made, or why it made none, and (a standing order's
      * firing) the task it filed. False when it was already recorded.
      */
-    recordFlowTriggerEvent(trigger: number, key: string, card: number | null, note: string | null, now: Date, task?: string | null): boolean;
+    recordFlowTriggerEvent(trigger: number, key: string, card: number | null, note: string | null, now: Date, task?: string | null, onTime?: boolean, ranScript?: string | null): boolean;
     /** The last card a trigger made, if any. */
     lastFlowTriggerCard(trigger: number): number | null;
     /**
@@ -6004,7 +6063,15 @@ export declare class Store {
     leadStepsOf(leadTurn: number): ChatTurn[];
     /** Remember a project was opened. Upsert keeps added_at; recency always moves.
      * A project added for the first time starts on Quick checks. */
-    upsertProject(path: string, name: string, now: Date): void;
+    upsertProject(path: string, name: string, now: Date, admission?: {
+        remoteUrl: string | null;
+    }): void;
+    /** Includes removed/legacy projects, so deleting a row never makes build-writable config authoritative again. */
+    projectAdmissionKnown(path: string): boolean;
+    /** Full structured URL audit, without the generic ledger's display-text truncation. */
+    recordProjectRemote(actor: string, repo: string, previous: string | null, remoteUrl: string, now: Date): void;
+    /** The remote URL captured on admission or explicitly supplied by the owner; null when none was (or the project was removed). */
+    projectRemote(path: string): string | null;
     /** A project removed from the lists (project-admission.ts): only its row goes; its tasks, results and settings stay. */
     forgetProject(path: string): void;
     /** Most recently opened first — the opener page's order. */
@@ -6013,6 +6080,7 @@ export declare class Store {
         name: string;
         addedAt: string;
         lastOpenedAt: string;
+        remoteUrl: string | null;
     }[];
     /**
      * Tasks whose scope waits on a person's yes: proposed, not approved (or