toolroll 0.9.61 → 0.9.63

package/dist/store.js

@@ -74,9 +74,10 @@ import { isProviderId } from "./provider.js";
 import { authenticate as runnerAuthenticate } from "./runner.js";
 import { stampNewProjectLevel } from "./check-levels.js";
 import { parseCheckProgressSnapshot } from "./check-progress.js";
-import { normalizeProjectAccess, projectAccessAllows, readProjectAccess } from "./project-access.js";
+import { accountReachesSql, normalizeProjectAccess, projectAccessAllows, readProjectAccess } from "./project-access.js";
 import { LEDGER_COLUMNS, LEDGER_SCHEMA, LEDGER_TABLE, LEDGER_V99_TABLE, installLedgerTriggers } from "./action-ledger.js";
 import { PLAN_AUTO_SCHEMA } from "./plan-auto.js";
+import { endUnattendedGrants, FLOW_UNATTENDED_SCHEMA, grantStandsSql } from "./flow-unattended.js";
 import { RECIPE_SCHEMA } from "./recipes.js";
 import { POLICY_SCHEMA, agentRefusal, approvalRefusal, policyParts, readPolicy, underCeiling, sessionCeilingRefusal } from "./policy.js";
 import { PROVIDER_AUTH_SCHEMA } from "./provider-auth.js";
@@ -355,6 +356,22 @@ CREATE TABLE IF NOT EXISTS run_activity (
   at   TEXT NOT NULL
 );
 `;
+/** A task branch moved to current main before an attempt (fresh base; v122, a new table: additive only): the branch
+ * had no commits of its own and no changes, so it started over from `to_rev`. `after_run` is the newest run id when it
+ * moved: the branch's whole-task diff runs from the first builder base recorded after it (firstBuilderBase), never from
+ * the older main it left. */
+export const BRANCH_BASE_MOVE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS branch_base_move (
+  id        INTEGER PRIMARY KEY AUTOINCREMENT,
+  task_ref  INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,
+  branch    TEXT NOT NULL,
+  from_rev  TEXT NOT NULL,
+  to_rev    TEXT NOT NULL,
+  after_run INTEGER NOT NULL,
+  moved_at  TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS branch_base_move_branch ON branch_base_move (task_ref, branch, id);
+`;
 /** Pausing a running Claude build (live steering, v121: additive only). A person's Pause asks the build to
  * stop its current turn and keep its session: one row per request, bound to the exact run it was asked of, under the
  * request id the asker chose (a repeated request is the same request). `note` is the steering note a Pause and steer
@@ -459,6 +476,23 @@ CREATE TABLE IF NOT EXISTS integration_check (
   error_at    TEXT
 );
 `;
+/** Tool secrets (no version bump): which sealing key Toolroll made for the secrets it keeps in the keychain, as a
+ * digest of the key, never the key. A key found beside them that isn't this one was put there by something else and is
+ * refused (tool-secret-store.ts). */
+export const TOOL_SECRET_KEY_SCHEMA = `
+CREATE TABLE IF NOT EXISTS tool_secret_key (
+  id      INTEGER PRIMARY KEY CHECK (id = 1),
+  digest  TEXT NOT NULL CHECK (length(digest) = 64),
+  made_at TEXT NOT NULL
+);
+-- Where secrets were kept before Toolroll's folder, decided once at this database's first start (null: none) and never
+-- probed again, so a folder a build makes later under an old name is never migrated in.
+CREATE TABLE IF NOT EXISTS tool_secret_legacy (
+  id         INTEGER PRIMARY KEY CHECK (id = 1),
+  dir        TEXT,
+  decided_at TEXT NOT NULL
+);
+`;
 /** Sprint 8: database backups. One settings row (off, or every so many hours, keeping the newest N in a folder; no
  * folder means `backups` beside the database), every backup's outcome, and a lease the console's backup loop holds
  * and renews while it runs: one process backs up at a time, and a restore sees that the console is running. */
@@ -605,7 +639,13 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // v121 adds, and changes no saved row: the Agents board (run.attempt_key; agent_turn, agent_now, agent_question,
 // agent_seen, agent_view), live steering (a note's live identity and sends, a run's stdin session; run_pause and
 // run_resume) and landed work's teardown journal (landed_cleanup, landed_cleanup_item).
-export const SCHEMA_VERSION = 121;
+// v122 adds, and changes no saved row: the remote URL an owner's project add recorded (project.remote_url), the only
+// remote whose main automatic completion trusts (remote-main.ts; saved projects read none until it is recorded), and
+// fresh base's record of a task branch moved to current main before an attempt (branch_base_move).
+// v123 adds, and changes no saved row: flows that run on their own (flow_script_provenance, flow_unattended_grant,
+// flow_unattended_run, plan_authorization.basis, flow_trigger_event.on_time and ran_script) and the tool-secret
+// sealing key's record (tool_secret_key, tool_secret_legacy).
+export const SCHEMA_VERSION = 123;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -730,9 +770,12 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * (planning_generation on task_ref, run and plan_revision, defaulting to 0, and decision.superseded_reason, null);
  * the rehearsal checks every saved row reads the declared default (HISTORY_RULES' added columns). v120 only adds
  * three nullable task_steer columns (the running build's steering folder), checked the same way. v121 only adds
- * new tables and the columns in V121_ADDED_COLUMNS (null, or no sends), checked the same way.
+ * new tables and the columns in V121_ADDED_COLUMNS (null, or no sends), checked the same way. v122 only adds a new
+ * table (branch_base_move) and the nullable column in V122_ADDED_COLUMNS (a project's recorded remote), checked the
+ * same way. v123 only adds new tables (unattended flows, tool secrets) and the columns in V123_ADDED_COLUMNS ('mode',
+ * 0 or null), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -778,6 +821,21 @@ export const V121_ADDED_COLUMNS = Object.freeze({
     task_steer: LIVE_STEER_COLUMNS.task_steer,
     run: { ...LIVE_STEER_COLUMNS.run, attempt_key: { definition: "TEXT", saved: "NULL" } },
 });
+/** v122: the column it adds, with the value every row saved before it reads: the remote URL an owner's project add
+ * recorded (projects added before it read none, until `repos add <project> --remote <url>` records one). */
+export const V122_ADDED_COLUMNS = Object.freeze({
+    project: { remote_url: { definition: "TEXT", saved: "NULL" } },
+});
+/** v123: the columns it adds, with the value every row saved before it reads: which authority armed a plan's
+ * unchanged-plan approval (saved rows read the operating mode), whether a trigger's firing was the clock's own (saved
+ * firings read not), and what code an on-time script firing a grant signed for ran (saved firings read none). */
+export const V123_ADDED_COLUMNS = Object.freeze({
+    plan_authorization: { basis: { definition: "TEXT NOT NULL DEFAULT 'mode' CHECK (basis IN ('mode', 'grant'))", saved: "'mode'" } },
+    flow_trigger_event: {
+        on_time: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" },
+        ran_script: { definition: "TEXT", saved: "NULL" },
+    },
+});
 /** Whether a database settled at `version` reaches this build's schema through update-safe migrations alone. */
 export function updateSafeSchema(version) {
     if (version === null || !Number.isSafeInteger(version) || version <= 0 || version > SCHEMA_VERSION)
@@ -3501,6 +3559,8 @@ function initializeStore(db, file) {
     db.exec(LEDGER_CHAIN_SCHEMA);
     db.exec(MONITORING_SCHEMA);
     db.exec(INTEGRATIONS_SCHEMA);
+    // v123: the tool-secret sealing key's record and where secrets were kept before (tool-secret-store.ts): new tables.
+    db.exec(TOOL_SECRET_KEY_SCHEMA);
     db.exec(LEAD_ASK_SCHEMA);
     // Decisions in the chat app (no version bump: additive only): result, plan and merge buttons, and Request changes.
     db.exec(CHAT_DECIDE_SCHEMA);
@@ -3508,6 +3568,8 @@ function initializeStore(db, file) {
     db.exec(CHAT_APPROVAL_SCHEMA);
     // What a running agent did last (no version bump: additive only; absent means no word yet).
     db.exec(RUN_ACTIVITY_SCHEMA);
+    // v122: a task branch moved to current main before an attempt (fresh base): a new table, nothing carried over.
+    db.exec(BRANCH_BASE_MOVE_SCHEMA);
     // v121: the Agents board: each run's attempt key (V121_ADDED_COLUMNS, below), its turn history and current snapshot,
     // the agent's open questions, who has seen a finished run and who is watching one now. Older runs read null keys.
     db.exec(AGENT_BOARD_SCHEMA);
@@ -3540,6 +3602,12 @@ function initializeStore(db, file) {
     db.exec(STORAGE_SWEEP_SCHEMA);
     // v121: landed work's teardown journal (landed-cleanup.ts): new tables.
     db.exec(LANDED_CLEANUP_SCHEMA);
+    // v122: the remote URL an owner's project add recorded (V122_ADDED_COLUMNS; additive only, saved projects read none):
+    // automatic completion trusts only that remote's main (remote-main.ts), never the shared repository's config.
+    for (const [table, columns] of Object.entries(V122_ADDED_COLUMNS)) {
+        for (const [column, { definition }] of Object.entries(columns))
+            addColumn(db, table, column, definition);
+    }
     db.exec(BACKUP_SCHEMA);
     // Sprint 8: the organisation policy (one row, or none: nothing restricted).
     db.exec(POLICY_SCHEMA);
@@ -3579,6 +3647,16 @@ function initializeStore(db, file) {
     // v115: the task each standing-order firing filed, kept on the firing itself (a card's task changes as it moves).
     addColumn(db, "flow_trigger_event", "task", "TEXT");
     db.exec(PLAN_AUTO_SCHEMA);
+    // v123: a flow that runs on its own (flow-unattended.ts): its grants and daily runs (new tables), and which authority
+    // armed a plan's unchanged-plan approval (plan_authorization.basis, V123_ADDED_COLUMNS: saved rows read the mode).
+    db.exec(FLOW_UNATTENDED_SCHEMA);
+    // v123: whether a trigger's firing was the clock's own (flow_trigger_event.on_time, V123_ADDED_COLUMNS: a schedule
+    // due, not Run now; only those can run on their own), and what code an on-time script firing a grant signed for ran
+    // (flow_trigger_event.ran_script, V123_ADDED_COLUMNS: flow-unattended.ts scriptRanDigestOf; older firings read null).
+    for (const [table, columns] of Object.entries(V123_ADDED_COLUMNS)) {
+        for (const [column, { definition }] of Object.entries(columns))
+            addColumn(db, table, column, definition);
+    }
     // v119: planning generations, and why a question closed unanswered (additive only; saved rows read the defaults).
     for (const [table, columns] of Object.entries(V119_ADDED_COLUMNS)) {
         for (const [column, { definition }] of Object.entries(columns))
@@ -3712,6 +3790,8 @@ function createBaseline(db, file) {
         }
         db.exec(BASELINE_SCHEMA);
         db.prepare("INSERT INTO schema_version (version) VALUES (?)").run(BASELINE_SCHEMA_VERSION);
+        const installedAt = new Date().toISOString();
+        db.prepare("INSERT INTO installation_fact (key, value, created_at) VALUES ('installed-at', ?, ?)").run(installedAt, installedAt);
         db.exec("COMMIT");
     }
     catch (error) {
@@ -4782,6 +4862,36 @@ export class Store {
     close() {
         this.db.close();
     }
+    /** The digest of the sealing key Toolroll made for its tool secrets; null before it made one (or in an older database). */
+    toolSecretKeyDigest() {
+        if (!tableExists(this.db, "tool_secret_key"))
+            return null;
+        const row = this.db.prepare("SELECT digest FROM tool_secret_key WHERE id = 1").get();
+        return row === undefined ? null : String(row["digest"]);
+    }
+    /**
+     * The folder secrets were kept in before Toolroll's own, as decided at this database's first start of a command that
+     * can start builds (`record`): `probe` runs until then, and its answer (null: none) is kept for every later start.
+     * Other commands never write, so a preview stays read-only and a busy database doesn't stop them.
+     */
+    toolSecretLegacyDir(probe, now, options) {
+        const read = () => tableExists(this.db, "tool_secret_legacy") ? this.db.prepare("SELECT dir FROM tool_secret_legacy WHERE id = 1").get() : undefined;
+        let row = read();
+        if (row === undefined) {
+            if (!options.record)
+                return probe();
+            this.db.prepare("INSERT OR IGNORE INTO tool_secret_legacy (id, dir, decided_at) VALUES (1, ?, ?)").run(probe(), now.toISOString());
+            row = read();
+        }
+        return row?.["dir"] === null || row?.["dir"] === undefined ? null : String(row["dir"]);
+    }
+    /** Record a new sealing key's digest only if the one recorded is still `expected` (null: none yet). */
+    swapToolSecretKeyDigest(expected, next, now) {
+        const changed = expected === null
+            ? this.db.prepare("INSERT OR IGNORE INTO tool_secret_key (id, digest, made_at) VALUES (1, ?, ?)").run(next, now.toISOString()).changes
+            : this.db.prepare("UPDATE tool_secret_key SET digest = ?, made_at = ? WHERE id = 1 AND digest = ?").run(next, now.toISOString(), expected).changes;
+        return Number(changed) === 1;
+    }
     // ---- the built-in task store -------------------------------------------
     /**
      * Creating a task also creates its overlay reference, because a task with no
@@ -6308,7 +6418,9 @@ export class Store {
                                 ? `Approved by ${currentActor()?.lead === true ? "the lead" : lifecycleWords(by, 40)}. A connected worker can take it next.`
                                 : basis.kind === "chat"
                                     ? `Approved by ${lifecycleWords(by, 40)} in chat. A connected worker can take it next.`
-                                    : "Approved automatically under the operating mode. A connected worker can take it next.",
+                                    : basis.kind === "grant"
+                                        ? "Approved automatically: its flow runs on its own. A connected worker can take it next."
+                                        : "Approved automatically under the operating mode. A connected worker can take it next.",
                             link: chatControlHref("task", taskId),
                         }, now);
                     }
@@ -6339,16 +6451,19 @@ export class Store {
      * scopes answer true: this belt only ever REMOVES mode authority.
      */
     modeApprovalLive(taskRef, now) {
+        // A flow's "runs on its own" grant (flow-unattended.ts) is held to the same belt.
         const dead = this.db
             .prepare(`SELECT 1 AS dead FROM task_scope
           JOIN task_ref ON task_ref.id = ? AND task_ref.backend = 'built-in' AND task_scope.task_id = task_ref.external_id
-         WHERE task_scope.approval_basis = 'mode' AND task_scope.approved_at IS NOT NULL
+         WHERE task_scope.approved_at IS NOT NULL
+           AND ((task_scope.approval_basis = 'mode'
            AND NOT EXISTS (SELECT 1 FROM operating_mode om
                             JOIN approver signer ON signer.name = om.signed_by
                            WHERE om.repo = task_ref.repo AND om.revoked_at IS NULL
                              AND om.absolute_expiry > ? AND om.digest = task_scope.mode_digest
-                             AND signer.revoked_at IS NULL AND signer.role = 'approver')`)
-            .get(taskRef, now.toISOString());
+                             AND signer.revoked_at IS NULL AND signer.role = 'approver' AND ${accountReachesSql("signer", "task_ref.repo")}))
+             OR (task_scope.approval_basis = 'grant' AND NOT ${grantStandsSql("task_scope.mode_digest", "?", "task_ref.repo")}))`)
+            .get(taskRef, now.toISOString(), now.toISOString());
         return dead === undefined;
     }
     // ---- approvers ----------------------------------------------------------
@@ -6475,6 +6590,29 @@ export class Store {
             return true;
         });
     }
+    /** A flow's "runs on its own" grant ended (revoked, expired, renewed): the undispatched work it sealed falls back
+     * to a person, as a mode's does, and plans it armed lose their pre-authorization. Running and finished work keeps
+     * its history. */
+    withdrawGrantApprovals(digest, now) {
+        const demotable = `WHERE approval_basis = 'grant' AND approved_at IS NOT NULL AND mode_digest = ?
+            AND EXISTS (SELECT 1 FROM task_ref JOIN task ON task.id = task_ref.external_id
+                         WHERE task_ref.backend = 'built-in' AND task_ref.external_id = task_scope.task_id AND task.state = 'queued')
+            AND NOT EXISTS (SELECT 1 FROM claim JOIN task_ref tr ON tr.id = claim.task_ref
+                             WHERE tr.backend = 'built-in' AND tr.external_id = task_scope.task_id
+                               AND claim.released_at IS NULL AND claim.expires_at > ?)`;
+        const demoted = this.db.prepare(`SELECT task_id FROM task_scope ${demotable}`).all(digest, now.toISOString()).map(row => String(row["task_id"]));
+        this.db
+            .prepare(`UPDATE task_scope SET approved_at = NULL, approved_by = NULL, approved_digest = NULL,
+                approved_profile_json = NULL, approval_basis = 'password', mode_digest = NULL ${demotable}`)
+            .run(digest, now.toISOString());
+        this.db.prepare("DELETE FROM plan_authorization WHERE basis = 'grant' AND mode_digest = ?").run(digest);
+        for (const taskId of demoted) {
+            const ref = this.lookupRef(taskId);
+            if (ref === null)
+                continue;
+            this.noteLifecycle({ taskRef: ref.id, kind: "approval-withdrawn", identity: `t${ref.id}`, subject: "Approval needs renewing", body: "Its flow no longer runs on its own. Approve it before it runs.", link: chatControlHref("approval", taskId) }, now);
+        }
+    }
     /** F2/R-REVOKE: the ONE reconciliation road. newMode null = no live
      * automerge authority (revocation, expiry, or a notify posture):
      * mode-basis pending/claimed intents drop to waiting-human, leases
@@ -6699,6 +6837,7 @@ export class Store {
             for (const row of this.db.prepare("SELECT repo FROM operating_mode WHERE signed_by = ? AND revoked_at IS NULL").all(name)) {
                 this.revokeMode(String(row["repo"]), by, "operator", now);
             }
+            endUnattendedGrants(this, { signer: name }, by, "access changed", now);
             this.revokeDerivedAuthority(name, by, now);
             for (const repo of [...new Set([...(account.projects ?? []), ...(access ?? [])])]) {
                 this.recordAction({ at: now.toISOString(), actor: by, repo, taskId: null, runId: null,
@@ -6726,6 +6865,10 @@ export class Store {
         ON CONFLICT(repo) DO UPDATE SET not_requester = excluded.not_requester, protect_project = excluded.protect_project, protected_paths = excluded.protected_paths, updated_by = excluded.updated_by, updated_at = excluded.updated_at`)
                 .run(repo, next.notRequester ? 1 : 0, next.protectProject ? 1 : 0, JSON.stringify(next.protectedPaths), by, now.toISOString());
             this.recordPolicy(by, repo, "approval rules changed", rulesWords(before), rulesWords(next), now);
+            // Protected work is always a person's: a flow here (or building here) stops running on its own, and its queued
+            // approvals are withdrawn (flow-unattended.ts). The dispatch belts check the rules again for any race.
+            if (isProtectedWork(next, []))
+                endUnattendedGrants(this, { repo }, by, "project protected", now);
         });
     }
     /** Who filed a task, when anyone knows. */
@@ -12140,13 +12283,46 @@ export class Store {
      * legacy first-attempt behavior, unchanged byte-for-byte.
      */
     firstBuilderBase(taskRef, branch) {
+        // A branch moved to current main (fresh base) had no commits of its own:
+        // its origin is the first base recorded after the move, not the older main.
         const row = this.db
             .prepare(`SELECT base_revision FROM run
           WHERE task_ref = ? AND branch = ? AND role = 'builder' AND base_revision IS NOT NULL
+            AND id > COALESCE((SELECT after_run FROM branch_base_move WHERE task_ref = ? AND branch = ? ORDER BY id DESC LIMIT 1), 0)
           ORDER BY id ASC LIMIT 1`)
-            .get(taskRef, branch);
+            .get(taskRef, branch, taskRef, branch);
+        return row === undefined ? null : row.base_revision;
+    }
+    /** Where a task branch's attempts start now: a builder branch's pinned base, or the newest base any other attempt on
+     * it recorded (a planner never commits). Null before any attempt on the branch recorded one, or after a move to
+     * current main until the next attempt records its base. */
+    recordedBranchBase(taskRef, branch) {
+        const pinned = this.firstBuilderBase(taskRef, branch);
+        if (pinned !== null)
+            return pinned;
+        const row = this.db
+            .prepare(`SELECT base_revision FROM run
+          WHERE task_ref = ? AND branch = ? AND role <> 'builder' AND base_revision IS NOT NULL
+            AND id > COALESCE((SELECT after_run FROM branch_base_move WHERE task_ref = ? AND branch = ? ORDER BY id DESC LIMIT 1), 0)
+          ORDER BY id DESC LIMIT 1`)
+            .get(taskRef, branch, taskRef, branch);
         return row === undefined ? null : row.base_revision;
     }
+    /** Record a task branch's move to current main, before git moves it: a move that then fails leaves the next
+     * attempt's own base (still the old one) as the branch's origin, which is exactly right. */
+    recordBranchBaseMove(taskRef, branch, from, to, now) {
+        this.db
+            .prepare(`INSERT INTO branch_base_move (task_ref, branch, from_rev, to_rev, after_run, moved_at)
+         VALUES (?, ?, ?, ?, (SELECT COALESCE(MAX(id), 0) FROM run), ?)`)
+            .run(taskRef, branch, from, to, now.toISOString());
+    }
+    /** The newest move of a task branch to current main, or null. */
+    latestBranchBaseMove(taskRef, branch) {
+        const row = this.db
+            .prepare("SELECT from_rev, to_rev, after_run, moved_at FROM branch_base_move WHERE task_ref = ? AND branch = ? ORDER BY id DESC LIMIT 1")
+            .get(taskRef, branch);
+        return row === undefined ? null : { from: String(row["from_rev"]), to: String(row["to_rev"]), afterRun: Number(row["after_run"]), movedAt: String(row["moved_at"]) };
+    }
     finishRun(id, result) {
         this.transact(() => {
             // Read before the write (Telegram task updates): only the OPEN → closed
@@ -12256,6 +12432,12 @@ export class Store {
             .prepare("UPDATE run SET auth_mode = COALESCE(auth_mode, ?), terminal_class = ? WHERE id = ? AND terminal_class IS NULL")
             .run(authMode, terminalClass, id);
     }
+    /** A launch refused before any model turn (an installed CLI too old for a
+     * build's flags): the start stamp goes, its version and evidence stay. Only
+     * while the run is open, so a settled run's account never changes. */
+    withdrawProviderStart(id) {
+        this.db.prepare("UPDATE run SET provider_started_at = NULL WHERE id = ? AND outcome IS NULL").run(id);
+    }
     /** The race-refusal stamp (Phase 3 C5): the version that was REFUSED,
      * recorded without provider_started_at — no provider process started. */
     stampProviderVersion(id, providerVersion) {
@@ -14859,6 +15041,8 @@ export class Store {
             const version = (current?.version ?? Number(this.db.prepare("SELECT COALESCE(MAX(version), 0) AS v FROM flow_script WHERE repo = ? AND name = ?").get(script.repo, script.name)?.["v"] ?? 0)) + 1;
             if (current !== null)
                 this.db.prepare("UPDATE flow_script SET state = 'removed' WHERE id = ?").run(current.id);
+            // A "runs on its own" grant signed this script's code: a new version ends it (flow-unattended.ts).
+            endUnattendedGrants(this, { script: { repo: script.repo, name: script.name } }, script.by, "script changed", now);
             this.db.prepare(`INSERT INTO flow_script (repo, name, about, body, timeout_minutes, version, digest, saved_by, saved_at, state, language, file, held)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, ?)`).run(script.repo, script.name, script.about, script.body, script.timeoutMinutes, version, script.digest, script.by, now.toISOString(), script.language ?? "shell", script.file ?? null, script.held ?? null);
             return version;
@@ -14869,9 +15053,14 @@ export class Store {
         const { changes } = this.db.prepare("UPDATE flow_script SET held = NULL WHERE repo = ? AND name = ? AND state = 'active' AND held IS NOT NULL").run(repo, name);
         return Number(changes) === 1;
     }
-    removeFlowScript(repo, name) {
-        const { changes } = this.db.prepare("UPDATE flow_script SET state = 'removed' WHERE repo = ? AND name = ? AND state = 'active'").run(repo, name);
-        return Number(changes) === 1;
+    removeFlowScript(repo, name, by = "flow", now = new Date()) {
+        return this.transact(() => {
+            const { changes } = this.db.prepare("UPDATE flow_script SET state = 'removed' WHERE repo = ? AND name = ? AND state = 'active'").run(repo, name);
+            // A grant that signed this script's code covers nothing without it: it ends (flow-unattended.ts).
+            if (Number(changes) === 1)
+                endUnattendedGrants(this, { script: { repo, name } }, by, "script changed", now);
+            return Number(changes) === 1;
+        });
     }
     /** Claim a card's visit to a step zone. False when another pass holds it or it already finished. */
     claimFlowStep(step, now) {
@@ -14960,6 +15149,13 @@ export class Store {
     // ---- flow triggers (v82) -----------------------------------------------------
     addFlowTrigger(trigger, now) {
         const stamp = now.toISOString();
+        // A new schedule is one the flow's "runs on its own" grant never read: it ends (flow-unattended.ts).
+        if (trigger.kind === "schedule")
+            return this.transact(() => {
+                endUnattendedGrants(this, { flow: trigger.flow }, trigger.by, "schedule changed", now);
+                return Number(this.db.prepare("INSERT INTO flow_trigger (flow, kind, config_json, state, hook_hash, cursor, next_at, created_by, created_at, updated_at) VALUES (?, ?, ?, 'active', ?, ?, ?, ?, ?, ?)")
+                    .run(trigger.flow, trigger.kind, trigger.configJson, trigger.hookHash, trigger.cursor, trigger.nextAt, trigger.by, stamp, stamp).lastInsertRowid);
+            });
         return Number(this.db.prepare("INSERT INTO flow_trigger (flow, kind, config_json, state, hook_hash, cursor, next_at, created_by, created_at, updated_at) VALUES (?, ?, ?, 'active', ?, ?, ?, ?, ?, ?)")
             .run(trigger.flow, trigger.kind, trigger.configJson, trigger.hookHash, trigger.cursor, trigger.nextAt, trigger.by, stamp, stamp).lastInsertRowid);
     }
@@ -14980,11 +15176,17 @@ export class Store {
         const row = this.db.prepare("SELECT t.* FROM flow_trigger t JOIN flow f ON f.id = t.flow WHERE t.hook_hash = ? AND t.state = 'active' AND f.state = 'active'").get(hash);
         return row === undefined ? null : readFlowTriggerRow(row);
     }
-    updateFlowTrigger(id, change, now) {
+    updateFlowTrigger(id, change, now, by = "a person") {
         const trigger = this.getFlowTrigger(id);
         if (trigger === null)
             return;
-        this.db.prepare("UPDATE flow_trigger SET state = ?, cursor = ?, next_at = ?, last_at = ?, last_outcome = ?, failures = ?, hook_hash = ?, updated_at = ? WHERE id = ?").run(change.state ?? trigger.state, change.cursor === undefined ? trigger.cursor : change.cursor, change.nextAt === undefined ? trigger.nextAt : change.nextAt, change.lastAt ?? trigger.lastAt, change.lastOutcome ?? trigger.lastOutcome, change.failures ?? trigger.failures, change.hookHash === undefined ? trigger.hookHash : change.hookHash, now.toISOString(), id);
+        // Pausing, resuming or removing a schedule ends the flow's "runs on its own" grant (flow-unattended.ts).
+        const write = () => this.db.prepare("UPDATE flow_trigger SET state = ?, cursor = ?, next_at = ?, last_at = ?, last_outcome = ?, failures = ?, hook_hash = ?, updated_at = ? WHERE id = ?").run(change.state ?? trigger.state, change.cursor === undefined ? trigger.cursor : change.cursor, change.nextAt === undefined ? trigger.nextAt : change.nextAt, change.lastAt ?? trigger.lastAt, change.lastOutcome ?? trigger.lastOutcome, change.failures ?? trigger.failures, change.hookHash === undefined ? trigger.hookHash : change.hookHash, now.toISOString(), id);
+        if (trigger.kind !== "schedule" || change.state === undefined || change.state === trigger.state) {
+            write();
+            return;
+        }
+        this.transact(() => { endUnattendedGrants(this, { flow: trigger.flow }, by, "schedule changed", now); write(); });
     }
     /** Whether a trigger already handled this outside thing (an issue, a run, a schedule slot). */
     flowTriggerSaw(trigger, key) {
@@ -15005,8 +15207,8 @@ export class Store {
      * Record what a trigger did with one outside thing: the card it made, or why it made none, and (a standing order's
      * firing) the task it filed. False when it was already recorded.
      */
-    recordFlowTriggerEvent(trigger, key, card, note, now, task = null) {
-        const { changes } = this.db.prepare("INSERT OR IGNORE INTO flow_trigger_event (trigger, key, card, note, at, task) VALUES (?, ?, ?, ?, ?, ?)").run(trigger, key, card, note, now.toISOString(), task);
+    recordFlowTriggerEvent(trigger, key, card, note, now, task = null, onTime = false, ranScript = null) {
+        const { changes } = this.db.prepare("INSERT OR IGNORE INTO flow_trigger_event (trigger, key, card, note, at, task, on_time, ran_script) VALUES (?, ?, ?, ?, ?, ?, ?, ?)").run(trigger, key, card, note, now.toISOString(), task, onTime ? 1 : 0, ranScript);
         return Number(changes) === 1;
     }
     /** The last card a trigger made, if any. */
@@ -15594,17 +15796,38 @@ export class Store {
     // ---- projects ------------------------------------------------------------
     /** Remember a project was opened. Upsert keeps added_at; recency always moves.
      * A project added for the first time starts on Quick checks. */
-    upsertProject(path, name, now) {
+    upsertProject(path, name, now, admission) {
         this.transact(() => {
             const added = this.db.prepare("SELECT 1 FROM project WHERE path = ?").get(path) === undefined;
             this.db
                 .prepare(`INSERT INTO project (path, name, added_at, last_opened_at) VALUES (?, ?, ?, ?)
            ON CONFLICT (path) DO UPDATE SET name = excluded.name, last_opened_at = excluded.last_opened_at`)
                 .run(path, name, now.toISOString(), now.toISOString());
+            // Admission owns remote changes; ordinary openings preserve the saved value.
+            if (admission !== undefined)
+                this.db.prepare("UPDATE project SET remote_url = ? WHERE path = ?").run(admission.remoteUrl, path);
             if (added)
                 stampNewProjectLevel(this, path, now);
         });
     }
+    /** Includes removed/legacy projects, so deleting a row never makes build-writable config authoritative again. */
+    projectAdmissionKnown(path) {
+        return this.db.prepare(`SELECT 1 FROM project WHERE path = ?
+      UNION ALL SELECT 1 FROM action_ledger WHERE repo = ?
+      UNION ALL SELECT 1 FROM task_ref WHERE repo = ?
+      UNION ALL SELECT 1 FROM worktree WHERE repo = ? LIMIT 1`).get(path, path, path, path) !== undefined;
+    }
+    /** Full structured URL audit, without the generic ledger's display-text truncation. */
+    recordProjectRemote(actor, repo, previous, remoteUrl, now) {
+        this.db.prepare(`INSERT INTO action_ledger(at,actor,repo,task_id,run_id,action,outcome,source,detail)
+      VALUES (?,?,?,NULL,NULL,'project remote recorded','recorded','access',?)`)
+            .run(now.toISOString(), actor, repo, JSON.stringify({ previousRemote: previous, remoteUrl }));
+    }
+    /** The remote URL captured on admission or explicitly supplied by the owner; null when none was (or the project was removed). */
+    projectRemote(path) {
+        const url = this.db.prepare("SELECT remote_url FROM project WHERE path = ?").get(path)?.["remote_url"];
+        return typeof url === "string" && url !== "" ? url : null;
+    }
     /** A project removed from the lists (project-admission.ts): only its row goes; its tasks, results and settings stay. */
     forgetProject(path) {
         this.db.prepare("DELETE FROM project WHERE path = ?").run(path);
@@ -15619,6 +15842,7 @@ export class Store {
             name: String(row["name"]),
             addedAt: String(row["added_at"]),
             lastOpenedAt: String(row["last_opened_at"]),
+            remoteUrl: typeof row["remote_url"] === "string" ? row["remote_url"] : null,
         }));
     }
     /**

package/dist/subagent-tools.d.ts

@@ -12,7 +12,7 @@ export type ToolLister = (spec: ToolSpec, values: Record<string, string>) => Pro
 export type ToolIo = {
     callTool?: ToolCaller;
     listTools?: ToolLister;
-    toolHome?: string;
+    toolHome?: string | undefined;
 };
 /** Actions whose names say they only read start as "do it"; everything else asks first until its manager says otherwise. */
 export declare const READ_VERB: RegExp;

package/dist/surface.js

@@ -67,9 +67,11 @@ const GUIDE_ROWS = [
     // D5: the central team service (connect, the central lead verbs, conversation …) and native coding sessions are
     // deprecated: they still run this release, with a warning, but are no longer declared here.
     operator("chat", "talk to your lead: one conversation across every project; --say sends one message; --follow enables crew updates and --no-follow pauses them; proposals keep their approval requirements"),
-    { invocation: "repos add", synopsis: "add a project: a Git repository, in the console at once; the lead adds with its token", audience: "agent", agentMayInvoke: true, mutation: "identity-idempotent",
+    // Unkeyed: --remote with a different URL replaces the project's trusted remote (recorded in the action ledger).
+    { invocation: "repos add", synopsis: "add a project: a Git repository, in the console at once; the lead adds with its token; --remote records or replaces its trusted remote", audience: "agent", agentMayInvoke: true, mutation: "unkeyed",
         positionals: [{ name: "path", required: false, meaning: "the repository (default: the one you are in)" }],
-        flags: [jsonFlag, { name: "token", takesValue: true, meaning: "the lead token (or TOOLROLL_LEAD_TOKEN)" }],
+        flags: [jsonFlag, { name: "token", takesValue: true, meaning: "the lead token (or TOOLROLL_LEAD_TOKEN)" },
+            { name: "remote", takesValue: true, meaning: "an HTTPS or SSH URL without credentials whose main may complete landed work; replaces a different recorded one (owner or an instance operator's lead only)" }],
         notableReasons: ["not-git", "unavailable", "refused", "locked"] },
     { invocation: "repos remove", synopsis: "remove a project from the console and the builder; its tasks and results stay saved", audience: "agent", agentMayInvoke: true, mutation: "identity-idempotent",
         positionals: [{ name: "path", required: true, meaning: "the repository" }],
@@ -114,8 +116,9 @@ const GUIDE_ROWS = [
     ...KNOWLEDGE_DESCRIPTORS.map(spec => ({ invocation: `knowledge ${spec.action}`, synopsis: spec.synopsis, audience: "audience" in spec ? spec.audience : "agent", agentMayInvoke: !("audience" in spec), mutation: spec.mutation, flags: spec.flags, ...(spec.takesQuery ? { positionals: [{ name: "query", required: true, meaning: "search text or source file for impact" }] } : {}) })),
     ...MEMORY_DESCRIPTORS.map(spec => ({ invocation: `memory ${spec.action}`, synopsis: spec.synopsis, audience: "agent", agentMayInvoke: true, mutation: spec.mutation, flags: spec.flags, ...(spec.takesQuery ? { positionals: [{ name: "query", required: true, meaning: "search text, a decision id, or the decision sentence" }] } : {}) })),
     // Flow writes carry an approver's credential: an agent runs them only as the person asked, after showing the preview.
-    ...FLOWS_DESCRIPTORS.map(spec => ({ invocation: `flows ${spec.action}`, synopsis: spec.synopsis, audience: "agent", agentMayInvoke: true, mutation: spec.mutation, flags: spec.flags,
-        ...("positionals" in spec ? { positionals: spec.positionals.map(name => ({ name, required: true, meaning: name === "flow" ? "a flow id from flows list" : name === "card" ? "a card id from flows show" : "a trigger id from flows show, or for trigger add its settings as JSON, a JSON file, or -" })) } : {}) })),
+    // Letting a flow run on its own raises authority: the owner's own password ceremony, never an agent's act.
+    ...FLOWS_DESCRIPTORS.map(spec => ({ invocation: `flows ${spec.action}`, synopsis: spec.synopsis, audience: "audience" in spec ? spec.audience : "agent", agentMayInvoke: !("audience" in spec), mutation: spec.mutation, flags: spec.flags,
+        ...("positionals" in spec ? { positionals: spec.positionals.map(name => ({ name, required: true, meaning: name === "flow" ? "a flow id from flows list" : name === "card" ? "a card id from flows show" : name === "on|off" ? "on signs the grant, off revokes it" : "a trigger id from flows show, or for trigger add its settings as JSON, a JSON file, or -" })) } : {}) })),
     ...MODELS_DESCRIPTORS.map(spec => ({ invocation: `models ${spec.action}`, synopsis: spec.synopsis, audience: "agent", agentMayInvoke: true, mutation: spec.mutation, flags: spec.flags, ...(spec.takesQuery ? { positionals: [{ name: "target", required: true, meaning: "the CLI to update, or on/off" }] } : {}) })),
     // ---- the queue (agent surface) ----
     { invocation: "status", synopsis: "running work, queued reasons, results to review, the latest release check and plan windows", audience: "agent", agentMayInvoke: true, mutation: "none", flags: [jsonFlag, dbFlag] },
@@ -409,6 +412,7 @@ const GUIDE_ROWS = [
     operator("up", "console + worker + browser, one command"),
     operator("onboard", "add this repository, report signed-in agents, install or --remove the operator skill (--yes), offer the starter flows (--starter <ids>), and print the handoff"),
     operator("daemon", "install the loop under the OS service manager"),
+    { ...operatorRead("doctor", "check that Toolroll's service holds no key, token or password a build could read; names what it finds and the steps to fix it, never a value, and changes nothing"), flags: [jsonFlag] },
 ];
 /**
  * Whether each row may run on a central server for a person signed in with their own API token (`runOperateAs` in
@@ -427,7 +431,7 @@ const REMOTE_NO = [
     // Workers, the loop and the services that run here.
     "claim", "heartbeat", "worker release", "reap", "tick", "build", "reconcile",
     "runner register", "runner retire", "runner bind", "runner capacity", "coordinator mint", "coordinator revoke", "mcp", "outbox deliver", "peek",
-    "serve", "serve check-public", "watch", "up", "onboard", "daemon", "bridge", "setup show", "setup clear",
+    "serve", "serve check-public", "watch", "up", "onboard", "daemon", "doctor", "bridge", "setup show", "setup clear",
     // Provider keys and model tools on this machine.
     "providers", "keys status", "keys set", "keys clear", "keys verify", "keys auth", "models check", "models update", "models watch",
     // Publication and release.
@@ -441,7 +445,7 @@ const REMOTE_NO = [
 ];
 const REMOTE_STEP_UP = [
     "proposals", "decide", "task regate", "task approve", "task accept", "task merge", "run settle", "knowledge apply", "memory apply",
-    "flows card approve", "flows card send-back", "flows script approve",
+    "flows card approve", "flows card send-back", "flows script approve", "flows unattended",
     "approver list", "approver add", "people list", "people invite", "people projects", "people revoke",
     // A person's own API tokens: a password step-up on the server's machine, or the console. Never with a token.
     "tokens create", "tokens list", "tokens revoke", "tokens rotate",

package/dist/task-base.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Where a task's work starts, against current main (fresh base): one view for
+ * the task page and `task show`. The base is saved run lineage — a builder
+ * branch's pinned origin, or the newest plan's base — and the behind count is
+ * read from Git now. Reads only.
+ */
+import type { Store } from "./store.js";
+export type TaskBaseView = {
+    /** The base commit, in full. */
+    base: string;
+    branch: string;
+    /** The project's main: its checked-out branch, as a dispatch pass resolves it. Null when Git could not say. */
+    main: string | null;
+    /** Commits on main the base does not have; null when Git could not say. */
+    behind: number | null;
+    /** One short line: `Base 9d087efe · Behind main by 2 commits`. */
+    words: string;
+};
+/** A synchronous, read-only Git call in `cwd`: its trimmed output, or null on any failure. */
+export type GitRead = (cwd: string, args: readonly string[]) => string | null;
+export declare const readGit: GitRead;
+/** The base line on its own, for surfaces that label it already: `9d087efe · Behind main by 2 commits`. */
+export declare function baseStandingWords(view: Pick<TaskBaseView, "base" | "main" | "behind">): string;
+/**
+ * The lease's fresh-base request for one attempt on `branch`, or nothing when the task's start is pinned elsewhere: a
+ * revision keeps the head of the attempt it revises, and a prepared candidate or coding review keeps the base its
+ * candidate was proved against.
+ */
+export declare function freshBaseFor(store: Store, taskId: string, branch: string, main: string): {
+    freshBase: {
+        main: string;
+        recordedBase: string | null;
+    };
+} | Record<string, never>;
+export declare function taskBaseOf(store: Store, taskId: string, git?: GitRead): TaskBaseView | null;

package/dist/task-base.js

@@ -0,0 +1,51 @@
+/**
+ * Where a task's work starts, against current main (fresh base): one view for
+ * the task page and `task show`. The base is saved run lineage — a builder
+ * branch's pinned origin, or the newest plan's base — and the behind count is
+ * read from Git now. Reads only.
+ */
+import { execFileSync } from "node:child_process";
+export const readGit = (cwd, args) => {
+    try {
+        return execFileSync("git", ["--no-optional-locks", ...args], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000, maxBuffer: 65_536 }).trim();
+    }
+    catch {
+        return null;
+    }
+};
+const commits = (count) => `${count} commit${count === 1 ? "" : "s"}`;
+/** The base line on its own, for surfaces that label it already: `9d087efe · Behind main by 2 commits`. */
+export function baseStandingWords(view) {
+    const short = view.base.slice(0, 8);
+    if (view.main === null || view.behind === null)
+        return short;
+    return view.behind === 0 ? `${short} · Up to date with ${view.main}` : `${short} · Behind ${view.main} by ${commits(view.behind)}`;
+}
+/**
+ * The lease's fresh-base request for one attempt on `branch`, or nothing when the task's start is pinned elsewhere: a
+ * revision keeps the head of the attempt it revises, and a prepared candidate or coding review keeps the base its
+ * candidate was proved against.
+ */
+export function freshBaseFor(store, taskId, branch, main) {
+    const ref = store.lookupRef(taskId);
+    if (ref === null || ref.revisionOf !== null || store.getScope(taskId)?.candidate != null || store.filedViaOf(taskId)?.startsWith("coding:") === true)
+        return {};
+    return { freshBase: { main, recordedBase: store.recordedBranchBase(ref.id, branch) } };
+}
+export function taskBaseOf(store, taskId, git = readGit) {
+    const ref = store.lookupRef(taskId);
+    if (ref === null || ref.repo === null)
+        return null;
+    const latest = store.runsFor(ref.id).find(one => one.role !== "reviewer" && one.branch !== null && one.baseRevision !== null);
+    if (latest === undefined || latest.branch === null || latest.baseRevision === null)
+        return null;
+    const branch = latest.branch;
+    // A move to current main newer than the latest attempt is where the next one starts.
+    const move = store.latestBranchBaseMove(ref.id, branch);
+    const base = move !== null && move.afterRun >= latest.id ? move.to : store.recordedBranchBase(ref.id, branch) ?? latest.baseRevision;
+    const main = git(ref.repo, ["symbolic-ref", "--short", "-q", "HEAD"]) || null;
+    const counted = main === null ? null : git(ref.repo, ["rev-list", "--count", `${base}..refs/heads/${main}`]);
+    const behind = counted === null || !/^\d+$/.test(counted) ? null : Number(counted);
+    const view = { base, branch, main: behind === null ? null : main, behind };
+    return { ...view, words: `Base ${baseStandingWords(view)}` };
+}