toolroll 0.9.62 → 0.9.63

package/dist/lead-tools.js

@@ -44,11 +44,12 @@ import { diagnoseTaskDispatch, withDispatchDiagnoses } from "./dispatch.js";
 import { agentChoicesFor, routeOfTask, INSTALLATION_SCOPE } from "./agentconfig.js";
 import { isNewModel, modelWords, priceWords, runtimeStates, seenModels } from "./model-catalog.js";
 import { agentsSummary, chosenWords, PHASES, postureWords, routeProblems, sameSpec, sizeSourceWords, sizeWords, specWords } from "./phase-routing.js";
-import { TOOL_CATALOG, discoverTools, projectToolsOf, secretsSetFor, toolCommandLine, toolStanding } from "./project-tools.js";
+import { TOOL_CATALOG, credentialModeOf, discoverTools, projectToolsOf, secretsSetFor, toolCommandLine, toolSecretStorage, toolStanding } from "./project-tools.js";
 import { deciderOf, durationWords, FLOW_KIND_WORDS, FLOW_TEMPLATES, flowFromSteps, stepsFor, withKeptSteps } from "./flows.js";
 import { parseContract, toModelSchema } from "./contracts/contract.js";
 import { LEAD_TOOL_INPUTS, LEAD_TOOL_READ_INPUTS, LEAD_TOOL_OPTIONS, LEAD_TOOL_OUTPUTS, reportToolOutput } from "./contracts/lead-tools.js";
 import { flowCardHref, flowDefinitionOf } from "./flow-engine.js";
+import { activeUnattendedGrant } from "./flow-unattended.js";
 import { planInChat } from "./chat-decide.js";
 import { flowDecisionAt } from "./telegram-flow.js";
 import { flowPersonOf } from "./flow-send.js";
@@ -756,13 +757,14 @@ const LEAD_TOOL_HANDLERS = {
                     rule: "Builds in this project get exactly these tools and nothing else configured on this computer. A tool reaches work approved after it was added; earlier approvals need approving again. Reviewers and this chat never get tools; Gemini builds get none.",
                     tools: tools.map(tool => {
                         const set = secretsSetFor(repo, tool.spec);
-                        return { name: tool.name, about: tool.spec.about, starts: toolCommandLine(tool.spec), standing: toolStanding(tool, set).words,
+                        return { name: tool.name, about: tool.spec.about, starts: toolCommandLine(tool.spec), standing: toolStanding(tool, set).words, credentials: credentialModeOf(tool.spec, set)?.words ?? null,
                             secrets: tool.spec.secrets.map(one => ({ name: one.name, optional: one.optional, set: set.includes(one.name) })),
                             lastTest: tool.lastTest === null ? null : { ok: tool.lastTest.ok, at: tool.lastTest.at, tools: tool.lastTest.tools.slice(0, 40), problem: tool.lastTest.problem } };
                     }),
                     connectBySigningIn: connectionsOf(ctx.store, repo).map(one => ({ service: one.id, label: one.label, about: one.about, state: one.state, connect: `/settings/tools?repo=${encodeURIComponent(repo)}&connect=${one.id}#connect` })),
                     commonTools: TOOL_CATALOG.filter(one => !names.has(one.name) && oneClickOf(one.name) === null).map(one => ({ catalog: one.name, label: one.label, about: one.about, needs: one.secrets.filter(secret => !secret.optional).map(secret => secret.name) })),
                     foundOnThisComputer: found.filter(one => !names.has(one.spec.name)).map(one => ({ name: one.spec.name, source: one.source })),
+                    secretsKept: toolSecretStorage().words,
                     notice: "Never ask for, accept or repeat a secret's value in chat. Name the secret and open the Tools page (show_control tools with this repo).",
                 } };
         },
@@ -837,7 +839,13 @@ const LEAD_TOOL_HANDLERS = {
                             return { trigger: trigger.id, kind: trigger.kind, what: config === null ? "can't be read" : describeTrigger(config, ctx.store),
                                 startsIn: titleOf(config?.zone ?? definition.start), state: trigger.state, lastCheck: trigger.lastOutcome };
                         }),
-                        rule: "Change it with propose_flow. Build and research steps file ordinary tasks under the usual approvals.",
+                        // "Runs on its own" is signed with the owner's password on the flow page, never in chat; revoking is one click there.
+                        runsOnItsOwn: (() => {
+                            const own = activeUnattendedGrant(ctx.store, flow.id, ctx.now);
+                            return own === null || own.terms.flowRevision !== flow.revision ? { on: false, change: `Turn it on (the owner's password) on the flow page: /flows/${flow.id}` }
+                                : { on: true, until: own.absoluteExpiry, change: `Revoke it on the flow page: /flows/${flow.id}` };
+                        })(),
+                        rule: "Change it with propose_flow. Build and research steps file ordinary tasks under the usual approvals, unless runsOnItsOwn is on: then its schedule's cards are approved by the owner's signed grant. Signing or revoking that is on the flow page; send the person there.",
                     } };
             }
             const repo = args["repo"] === undefined ? null : repoPathOf(ctx.who, args["repo"]);

package/dist/mcp-connect.d.ts

@@ -1,5 +1,7 @@
 import { type ProjectTool, type ToolSpec } from "./project-tools.js";
 import type { Store } from "./store.js";
+import { readScope, scopeList } from "./oauth-run-token.js";
+export { readScope, scopeList };
 /**
  * A one-click service. `reads` names what a research step may read there:
  * an action is read-only only when it is named by a reading verb (READING)
@@ -63,10 +65,7 @@ export declare function connectionsOf(store: Store, repo: string, home?: string)
  * research read. An allow-list: a word nobody listed withholds the action.
  */
 export declare function readsOnly(action: string, subjects: readonly string[]): boolean;
-export declare const readScope: (scope: string) => boolean;
 export declare const readOnlyGrant: (grant: readonly string[] | null) => boolean;
-/** An OAuth `scope` value as scope tokens (RFC 6749), sorted and deduplicated; null when absent, empty or malformed. */
-export declare function scopeList(value: unknown): string[] | null;
 /** The scope a connected service's sign-in was granted, as saved beside its token; null when it was never proved. */
 export declare function grantOf(repo: string, tool: string, home?: string): string[] | null;
 /**
@@ -98,6 +97,7 @@ type Server = {
     register: string;
     scopes: string[];
     resource: string | null;
+    revoke: string | null;
 };
 /** A sign-in on its way: what the callback needs to finish it (kept in the console's memory, 15 minutes). `kit` or `template` is the page it returns to. */
 export type ConnectVisit = {
@@ -115,6 +115,8 @@ export type ConnectVisit = {
     expires: number;
     /** The scope asked for, when one was: the grant when the token answer leaves `scope` out (RFC 6749 §5.1). */
     scope?: string | null;
+    /** Where the service revokes a token, when its metadata said: a run's own token is revoked there when the run ends. */
+    revoke?: string | null;
 };
 /** A server's sign-in: the resource metadata its 401 names (or the well-known one), then its authorization server's metadata. */
 export declare function discoverSignIn(mcpUrl: string, fetcher?: Fetch): Promise<Server | null>;
@@ -145,11 +147,11 @@ export declare function connectedSpec(serviceId: string): ToolSpec | null;
 /**
  * Finish connecting: trade the code for tokens, add the tool to the project
  * (or refresh its sign-in, when it's there already), keep the tokens in its
- * secrets file, and test it.
+ * secrets, and test it.
  */
 export declare function finishConnect(store: Store, visit: ConnectVisit, code: string, now: Date, options?: {
     fetcher?: Fetch;
-    home?: string;
+    home?: string | undefined;
     test?: boolean;
     omitEnv?: readonly string[];
 }): Promise<{
@@ -162,9 +164,8 @@ export declare function finishConnect(store: Store, visit: ConnectVisit, code: s
 /** Keep connected services signed in: any token expiring within ten minutes is refreshed (the worker's pass, and before a subagent's call). */
 export declare function refreshConnections(store: Store, repos: readonly string[], now: Date, options?: {
     fetcher?: Fetch;
-    home?: string;
+    home?: string | undefined;
 }): Promise<{
     refreshed: number;
     problems: string[];
 }>;
-export {};

package/dist/mcp-connect.js

@@ -7,16 +7,19 @@
  * authorization server at its origin), registers Toolroll as a client
  * with this console's callback, and sends the person to the service to sign
  * in. The callback trades the code for tokens, which live in the tool's own
- * secrets file (never the database, never a log), and the tool joins the
- * project like any other: tested, listed, and given to subagents under rules.
- * The worker refreshes tokens before they expire.
+ * secrets (the OS keychain, or its file where there is none; never the
+ * database, never a log), and the tool joins the project like any other:
+ * tested, listed, and given to subagents under rules. The worker refreshes
+ * tokens before they expire, and each run gets an access token of its own
+ * (oauth-run-token.ts).
  */
 import { createHash, randomBytes } from "node:crypto";
-import { homedir } from "node:os";
 import { basename } from "node:path";
-import { LOCAL_APPS, addToolTo, catalogTool, localAppOf, projectToolsOf, readToolSecrets, setToolSecrets, testToolOf } from "./project-tools.js";
+import { LOCAL_APPS, addToolTo, catalogTool, localAppOf, projectToolsOf, readToolSecrets, renewingSignIn, setToolSecrets, testToolOf } from "./project-tools.js";
 import { envValue } from "./names.js";
-import { SCOPE_TOKEN, readAuthorizationServer, readProtectedResource, readRegistration, readTokenResponse } from "./contracts/integration-metadata.js";
+import { readAuthorizationServer, readProtectedResource, readRegistration, readTokenResponse } from "./contracts/integration-metadata.js";
+import { ACCESS, CLIENT, CLIENT_SECRET, EXPIRES, GRANTED, REFRESH, RESOURCE, REVOKE_URL, TOKEN_URL, readScope, scopeList } from "./oauth-run-token.js";
+export { readScope, scopeList };
 /**
  * Services that connect this way: their servers speak streamable HTTP and
  * advertise registering clients on the spot. Advertising isn't accepting:
@@ -92,7 +95,7 @@ export const localConnectOf = (id) => {
  * `local` connects with no sign-in. `research` says, for a connected service research can't use because of the access
  * it was granted, why (shown on its Tools entry beside Reconnect read-only).
  */
-export function connectionsOf(store, repo, home = homedir()) {
+export function connectionsOf(store, repo, home) {
     const tools = projectToolsOf(store, repo);
     const signIn = oneClickServices().map(service => {
         const had = tools.find(one => one.name === service.id);
@@ -126,29 +129,13 @@ export function readsOnly(action, subjects) {
     const subject = (word) => subjects.includes(word) || subjects.includes(word.replace(/s$/, ""));
     return words.some(word => READING.has(word)) && words.every(word => READING.has(word) || QUALIFIERS.has(word) || subject(word));
 }
-/**
- * Identity scopes a read-only grant may carry beside `<resource>:read` ones. An allow-list: any other scope (a
- * write, a wildcard, `introspection`, one nobody listed) makes the grant unsafe for research.
- */
-const IDENTITY_SCOPES = new Set(["openid", "profile", "email"]);
-const READ_SCOPE = /^[a-z][a-z0-9_]{0,63}:read$/;
-export const readScope = (scope) => IDENTITY_SCOPES.has(scope) || READ_SCOPE.test(scope);
 /** Whether a saved grant only reads: it names at least one scope and every one is a read or identity scope. Unknown (null) never is. */
 // A scope a server adds to every token without being asked, that grants no access to data. PostHog adds
 // `introspection` (its ALWAYS_ALLOWED_SCOPES): it lets the token be checked, and has no write form. Never requested.
 const GRANTED_ANYWAY = new Set(["introspection"]);
 export const readOnlyGrant = (grant) => grant !== null && grant.some(readScope) && grant.every(scope => readScope(scope) || GRANTED_ANYWAY.has(scope));
-/** An OAuth `scope` value as scope tokens (RFC 6749), sorted and deduplicated; null when absent, empty or malformed. */
-export function scopeList(value) {
-    if (typeof value !== "string")
-        return null;
-    const tokens = value.split(" ").filter(one => one !== "");
-    if (tokens.length === 0 || tokens.length > 512 || !tokens.every(one => SCOPE_TOKEN.test(one)))
-        return null;
-    return [...new Set(tokens)].sort();
-}
 /** The scope a connected service's sign-in was granted, as saved beside its token; null when it was never proved. */
-export function grantOf(repo, tool, home = homedir()) {
+export function grantOf(repo, tool, home) {
     try {
         return scopeList(readToolSecrets(repo, tool, home)[GRANTED]);
     }
@@ -195,10 +182,6 @@ export function researchToolsOf(tools, launched = null, granted = () => null) {
     }
     return research;
 }
-/** The secrets a connected tool keeps: the bearer the MCP server takes, and what refreshing it needs. */
-const ACCESS = "OAUTH_ACCESS_TOKEN", REFRESH = "OAUTH_REFRESH_TOKEN", CLIENT = "OAUTH_CLIENT_ID", CLIENT_SECRET = "OAUTH_CLIENT_SECRET", TOKEN_URL = "OAUTH_TOKEN_URL", EXPIRES = "OAUTH_EXPIRES_AT", RESOURCE = "OAUTH_RESOURCE";
-/** The scope the sign-in granted, kept beside its token. Not one of the spec's secrets, so it never reaches a launch. */
-const GRANTED = "OAUTH_GRANTED_SCOPE";
 /** Where a service sends the person back after they sign in. */
 export const CONNECT_CALLBACK = "/settings/tools/connected";
 const VISIT_MS = 15 * 60_000, RENEW_RETRY_MS = 5 * 60_000;
@@ -269,7 +252,7 @@ export async function discoverSignIn(mcpUrl, fetcher = fetch) {
     }
     // A token is for the resource the server names (Stripe's has no trailing slash), when it names one.
     const named = resource.resource;
-    return { authorize, token, register, scopes, resource: https(named) ? named : null };
+    return { authorize, token, register, scopes, resource: https(named) ? named : null, revoke: https(meta.revocation_endpoint) ? meta.revocation_endpoint : null };
 }
 /**
  * Start connecting a service: find its sign-in, register this console as a
@@ -323,7 +306,7 @@ export async function startConnect(input, fetcher = fetch, now = Date.now()) {
     const scope = scopes.length > 0 ? scopes.join(" ") : null;
     if (scope !== null)
         go.searchParams.set("scope", scope);
-    return { ok: true, go: go.toString(), state, visit: { service: service.id, repo: input.repo, by: input.by, kit: input.kit ?? null, template: input.template ?? null, verifier, clientId, clientSecret, token: server.token, resource, redirect, expires: now + VISIT_MS, scope } };
+    return { ok: true, go: go.toString(), state, visit: { service: service.id, repo: input.repo, by: input.by, kit: input.kit ?? null, template: input.template ?? null, verifier, clientId, clientSecret, token: server.token, resource, redirect, expires: now + VISIT_MS, scope, revoke: server.revoke } };
 }
 /** The spec a connected service joins the project with: its MCP address, signed in with the token its sign-in gave. */
 export function connectedSpec(serviceId) {
@@ -341,11 +324,11 @@ const tokensFrom = (body, now) => ({
 /**
  * Finish connecting: trade the code for tokens, add the tool to the project
  * (or refresh its sign-in, when it's there already), keep the tokens in its
- * secrets file, and test it.
+ * secrets, and test it.
  */
 export async function finishConnect(store, visit, code, now, options = {}) {
     const service = oneClickOf(visit.service);
-    const fetcher = options.fetcher ?? fetch, home = options.home ?? homedir();
+    const fetcher = options.fetcher ?? fetch, home = options.home;
     const spec = connectedSpec(service.id);
     const had = projectToolsOf(store, visit.repo).find(one => one.name === spec.name);
     if (had !== undefined && (had.spec.url !== spec.url || had.spec.bearer !== ACCESS))
@@ -375,7 +358,7 @@ export async function finishConnect(store, visit, code, now, options = {}) {
     }
     // The grant: what the answer says, or what was asked for when it says nothing; never one from an earlier sign-in.
     const granted = body.scopeSaid ? scopeList(body.scope) : scopeList(visit.scope ?? null);
-    setToolSecrets(visit.repo, spec.name, { [ACCESS]: tokens.access, [CLIENT]: visit.clientId, [TOKEN_URL]: visit.token, [RESOURCE]: visit.resource, [GRANTED]: granted?.join(" ") ?? "",
+    setToolSecrets(visit.repo, spec.name, { [ACCESS]: tokens.access, [CLIENT]: visit.clientId, [TOKEN_URL]: visit.token, [RESOURCE]: visit.resource, [GRANTED]: granted?.join(" ") ?? "", [REVOKE_URL]: visit.revoke ?? "", [REFRESH]: "",
         ...(tokens.refresh === null ? {} : { [REFRESH]: tokens.refresh }), ...(tokens.expires === null ? {} : { [EXPIRES]: tokens.expires }), ...(visit.clientSecret === null ? {} : { [CLIENT_SECRET]: visit.clientSecret }) }, home);
     // The success line names the project it went to: the page and chat may be looking at another.
     const to = basename(visit.repo);
@@ -387,7 +370,7 @@ export async function finishConnect(store, visit, code, now, options = {}) {
 }
 /** Keep connected services signed in: any token expiring within ten minutes is refreshed (the worker's pass, and before a subagent's call). */
 export async function refreshConnections(store, repos, now, options = {}) {
-    const fetcher = options.fetcher ?? fetch, home = options.home ?? homedir();
+    const fetcher = options.fetcher ?? fetch, home = options.home;
     const report = { refreshed: 0, problems: [] };
     for (const repo of repos)
         for (const tool of projectToolsOf(store, repo)) {
@@ -402,28 +385,43 @@ export async function refreshConnections(store, repos, now, options = {}) {
             if (now.getTime() - (renewTried.get(key) ?? 0) < RENEW_RETRY_MS)
                 continue;
             renewTried.set(key, now.getTime());
-            try {
-                const answer = await fetcher(values[TOKEN_URL], { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" }, signal: AbortSignal.timeout(15_000),
-                    body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: values[REFRESH], client_id: values[CLIENT], ...(values[CLIENT_SECRET] === undefined ? {} : { client_secret: values[CLIENT_SECRET] }), ...(values[RESOURCE] === undefined ? {} : { resource: values[RESOURCE] }) }) });
-                const body = readTokenResponse(await answer.json());
-                if (body === null) {
-                    report.problems.push(`${tool.name}: couldn't reach it to renew its sign-in`);
-                    continue;
+            // Renewed one at a time with a run's own sign-in, across Toolroll's processes: a rotated refresh token is never used twice.
+            const problem = await renewingSignIn(repo, tool.name, home, async () => {
+                const latest = readToolSecrets(repo, tool.name, home);
+                if (!latest[REFRESH] || !latest[TOKEN_URL] || !latest[CLIENT])
+                    return null;
+                try {
+                    const answer = await fetcher(latest[TOKEN_URL], { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" }, signal: AbortSignal.timeout(15_000),
+                        body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: latest[REFRESH], client_id: latest[CLIENT], ...(latest[CLIENT_SECRET] === undefined ? {} : { client_secret: latest[CLIENT_SECRET] }), ...(latest[RESOURCE] === undefined ? {} : { resource: latest[RESOURCE] }) }) });
+                    const body = readTokenResponse(await answer.json());
+                    if (body === null)
+                        return `${tool.name}: couldn't reach it to renew its sign-in`;
+                    const tokens = tokensFrom(body, now.getTime());
+                    if (!answer.ok || tokens.access === null)
+                        return `${tool.name}: its sign-in ran out; connect it again on the Tools page`;
+                    // A refresh carries the same grant or a narrower one, and says so when it changes; said badly, it is unknown.
+                    // Not saved (a locked keychain): the saved sign-in stays as it was, and this says so.
+                    try {
+                        setToolSecrets(repo, tool.name, { [ACCESS]: tokens.access, ...(tokens.refresh === null ? {} : { [REFRESH]: tokens.refresh }), ...(tokens.expires === null ? {} : { [EXPIRES]: tokens.expires }),
+                            ...(body.scopeSaid ? { [GRANTED]: scopeList(body.scope)?.join(" ") ?? "" } : {}) }, home);
+                    }
+                    catch {
+                        return `${tool.name}: its renewed sign-in couldn't be saved; check that the keychain is unlocked`;
+                    }
+                    return false;
                 }
-                const tokens = tokensFrom(body, now.getTime());
-                if (!answer.ok || tokens.access === null) {
-                    report.problems.push(`${tool.name}: its sign-in ran out; connect it again on the Tools page`);
-                    continue;
+                catch {
+                    return `${tool.name}: couldn't reach it to renew its sign-in`;
                 }
-                // A refresh carries the same grant or a narrower one, and says so when it changes; said badly, it is unknown.
-                setToolSecrets(repo, tool.name, { [ACCESS]: tokens.access, ...(tokens.refresh === null ? {} : { [REFRESH]: tokens.refresh }), ...(tokens.expires === null ? {} : { [EXPIRES]: tokens.expires }),
-                    ...(body.scopeSaid ? { [GRANTED]: scopeList(body.scope)?.join(" ") ?? "" } : {}) }, home);
+            });
+            if (typeof problem === "string") {
+                report.problems.push(problem);
+                continue;
+            }
+            if (problem === false) {
                 renewTried.delete(key);
                 report.refreshed++;
             }
-            catch {
-                report.problems.push(`${tool.name}: couldn't reach it to renew its sign-in`);
-            }
         }
     return report;
 }

package/dist/oauth-run-token.d.ts

@@ -0,0 +1,51 @@
+import type { ToolSpec } from "./contracts/integration-metadata.js";
+/** The secrets a connected tool keeps: the bearer the MCP server takes, and what renewing it needs. */
+export declare const ACCESS = "OAUTH_ACCESS_TOKEN", REFRESH = "OAUTH_REFRESH_TOKEN", CLIENT = "OAUTH_CLIENT_ID", CLIENT_SECRET = "OAUTH_CLIENT_SECRET", TOKEN_URL = "OAUTH_TOKEN_URL", EXPIRES = "OAUTH_EXPIRES_AT", RESOURCE = "OAUTH_RESOURCE";
+/** The scope the sign-in granted, kept beside its token. Not one of the spec's secrets, so it never reaches a launch. */
+export declare const GRANTED = "OAUTH_GRANTED_SCOPE";
+/** Where the service revokes a token (RFC 7009), when its sign-in said. Not one of the spec's secrets either. */
+export declare const REVOKE_URL = "OAUTH_REVOKE_URL";
+/** A tool connected by signing in: a web tool whose sign-in is the access token. */
+export declare const signedIn: (spec: Pick<ToolSpec, "transport" | "bearer">) => boolean;
+/** Whether runs of a signed-in tool get their own token: only when there is a refresh token to make one with. */
+export declare const mintsRunTokens: (values: Readonly<Record<string, string>> | readonly string[]) => boolean;
+/** A sign-in address Toolroll will send a token to: https, or a stand-in on this computer. */
+export declare const signInAddress: (value: unknown) => value is string;
+export declare const readScope: (scope: string) => boolean;
+/** An OAuth `scope` value as scope tokens (RFC 6749), sorted and deduplicated; null when absent, empty or malformed. */
+export declare function scopeList(value: unknown): string[] | null;
+/**
+ * The scope a run asks for: none (the saved grant, never more) for a build; for a research step, only the grant's
+ * read scopes when it has some and others besides. A grant never said is left as it is.
+ */
+export declare function runScope(granted: readonly string[] | null, readOnly: boolean): string[] | null;
+/**
+ * One renewal of a sign-in at a time (per project and tool, in this process): a service that rotates its refresh
+ * token on every use would otherwise see the same one twice, and whichever answer was saved last would be the
+ * newest only by luck.
+ */
+export declare function oneAtATime<T>(key: string, work: () => Promise<T>): Promise<T>;
+type Fetch = typeof fetch;
+/** A run's token: the access token alone, its expiry, a rotated refresh token to keep, and how to revoke it. */
+export type RunToken = {
+    access: string;
+    expires: string | null;
+    rotated: string | null;
+    revoke: (() => Promise<void>) | null;
+};
+/**
+ * Trade the saved refresh token for an access token of this run's own. Plain reasons only: a service's answer is
+ * never repeated, so no token can ride an error into a log or the run's record.
+ */
+export declare function mintRunToken(values: Readonly<Record<string, string>>, options: {
+    scope: readonly string[] | null;
+    now: Date;
+    fetcher?: Fetch;
+}): Promise<{
+    ok: true;
+    token: RunToken;
+} | {
+    ok: false;
+    reason: string;
+}>;
+export {};

package/dist/oauth-run-token.js

@@ -0,0 +1,127 @@
+/**
+ * A run's own sign-in for a service connected by signing in (mcp-connect.ts).
+ *
+ * The service's secrets are an access token and the refresh token that renews
+ * it. A run never gets the refresh token. When it launches, Toolroll — outside
+ * the fence — trades the refresh token for a fresh access token of the run's
+ * own, no broader than the saved grant (a research step asks for only its read
+ * scopes, where the service takes a narrower one), and only that access token
+ * enters the run's broker. When the run ends the token is revoked, where the
+ * service said how at sign-in, and otherwise runs out at its own expiry. A
+ * service that gave no refresh token has only its one access token: the broker
+ * holds it, as it holds an API key.
+ */
+import { SCOPE_TOKEN, readTokenResponse } from "./contracts/integration-metadata.js";
+/** The secrets a connected tool keeps: the bearer the MCP server takes, and what renewing it needs. */
+export const ACCESS = "OAUTH_ACCESS_TOKEN", REFRESH = "OAUTH_REFRESH_TOKEN", CLIENT = "OAUTH_CLIENT_ID", CLIENT_SECRET = "OAUTH_CLIENT_SECRET", TOKEN_URL = "OAUTH_TOKEN_URL", EXPIRES = "OAUTH_EXPIRES_AT", RESOURCE = "OAUTH_RESOURCE";
+/** The scope the sign-in granted, kept beside its token. Not one of the spec's secrets, so it never reaches a launch. */
+export const GRANTED = "OAUTH_GRANTED_SCOPE";
+/** Where the service revokes a token (RFC 7009), when its sign-in said. Not one of the spec's secrets either. */
+export const REVOKE_URL = "OAUTH_REVOKE_URL";
+/** A tool connected by signing in: a web tool whose sign-in is the access token. */
+export const signedIn = (spec) => spec.transport === "http" && spec.bearer === ACCESS;
+/** Whether runs of a signed-in tool get their own token: only when there is a refresh token to make one with. */
+export const mintsRunTokens = (values) => {
+    const has = (name) => Array.isArray(values) ? values.includes(name) : (values[name] ?? "") !== "";
+    return has(REFRESH) && has(TOKEN_URL) && has(CLIENT);
+};
+const loopback = (url) => url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+/** A sign-in address Toolroll will send a token to: https, or a stand-in on this computer. */
+export const signInAddress = (value) => {
+    if (typeof value !== "string")
+        return false;
+    try {
+        const url = new URL(value);
+        return url.protocol === "https:" || loopback(url);
+    }
+    catch {
+        return false;
+    }
+};
+/** Identity scopes a read-only grant may carry beside `<resource>:read` ones. */
+const IDENTITY_SCOPES = new Set(["openid", "profile", "email"]);
+const READ_SCOPE = /^[a-z][a-z0-9_]{0,63}:read$/;
+export const readScope = (scope) => IDENTITY_SCOPES.has(scope) || READ_SCOPE.test(scope);
+/** An OAuth `scope` value as scope tokens (RFC 6749), sorted and deduplicated; null when absent, empty or malformed. */
+export function scopeList(value) {
+    if (typeof value !== "string")
+        return null;
+    const tokens = value.split(" ").filter(one => one !== "");
+    if (tokens.length === 0 || tokens.length > 512 || !tokens.every(one => SCOPE_TOKEN.test(one)))
+        return null;
+    return [...new Set(tokens)].sort();
+}
+/**
+ * The scope a run asks for: none (the saved grant, never more) for a build; for a research step, only the grant's
+ * read scopes when it has some and others besides. A grant never said is left as it is.
+ */
+export function runScope(granted, readOnly) {
+    if (!readOnly || granted === null)
+        return null;
+    const reads = granted.filter(readScope);
+    return reads.length > 0 && reads.length < granted.length ? reads : null;
+}
+const busy = new Map();
+/**
+ * One renewal of a sign-in at a time (per project and tool, in this process): a service that rotates its refresh
+ * token on every use would otherwise see the same one twice, and whichever answer was saved last would be the
+ * newest only by luck.
+ */
+export function oneAtATime(key, work) {
+    const ran = (busy.get(key) ?? Promise.resolve()).then(work, work);
+    const settled = ran.then(() => undefined, () => undefined);
+    busy.set(key, settled);
+    void settled.then(() => { if (busy.get(key) === settled)
+        busy.delete(key); });
+    return ran;
+}
+/**
+ * Trade the saved refresh token for an access token of this run's own. Plain reasons only: a service's answer is
+ * never repeated, so no token can ride an error into a log or the run's record.
+ */
+export async function mintRunToken(values, options) {
+    const fetcher = options.fetcher ?? fetch;
+    const refresh = values[REFRESH], tokenUrl = values[TOKEN_URL], client = values[CLIENT];
+    if (!refresh || !client || !signInAddress(tokenUrl))
+        return { ok: false, reason: "its sign-in can't be renewed for this run; connect it again on the Tools page" };
+    const ask = async (scope) => {
+        const answer = await fetcher(tokenUrl, { method: "POST", redirect: "error", headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" }, signal: AbortSignal.timeout(15_000),
+            body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: refresh, client_id: client,
+                ...(values[CLIENT_SECRET] ? { client_secret: values[CLIENT_SECRET] } : {}), ...(values[RESOURCE] ? { resource: values[RESOURCE] } : {}),
+                ...(scope === null ? {} : { scope: scope.join(" ") }) }) });
+        let body = null;
+        try {
+            body = readTokenResponse(await answer.json());
+        }
+        catch {
+            body = null;
+        }
+        return { ok: answer.ok, body };
+    };
+    try {
+        let answered = await ask(options.scope);
+        // A service that won't narrow a grant on renewal gets asked for the grant as saved; the broker still offers the
+        // step only its read-only actions.
+        if (!answered.ok && options.scope !== null && answered.body?.error === "invalid_scope")
+            answered = await ask(null);
+        const access = answered.body?.access_token;
+        if (!answered.ok || typeof access !== "string" || access === "")
+            return { ok: false, reason: "its sign-in ran out; connect it again on the Tools page" };
+        const body = answered.body;
+        const expires = body.expires_in === undefined ? null : new Date(options.now.getTime() + body.expires_in * 1000).toISOString();
+        const rotated = typeof body.refresh_token === "string" && body.refresh_token !== "" && body.refresh_token !== refresh ? body.refresh_token : null;
+        const revokeUrl = values[REVOKE_URL];
+        const revoke = signInAddress(revokeUrl) ? async () => {
+            try {
+                const answer = await fetcher(revokeUrl, { method: "POST", redirect: "error", headers: { "content-type": "application/x-www-form-urlencoded" }, signal: AbortSignal.timeout(10_000),
+                    body: new URLSearchParams({ token: access, token_type_hint: "access_token", client_id: client, ...(values[CLIENT_SECRET] ? { client_secret: values[CLIENT_SECRET] } : {}) }) });
+                await answer.body?.cancel();
+            }
+            catch { /* it runs out at its own expiry */ }
+        } : null;
+        return { ok: true, token: { access, expires, rotated, revoke } };
+    }
+    catch {
+        return { ok: false, reason: "its service couldn't be reached to sign this run in" };
+    }
+}

package/dist/operate.js

@@ -52,6 +52,7 @@ import { readHooksBase, scheduleFromWords } from "./flow-triggers.js";
 import { sendSubagentSummaries } from "./subagent-admin.js";
 import { runRequestedUndos, sendSubagentWeeklies } from "./subagent-week.js";
 import { refreshConnections } from "./mcp-connect.js";
+import { SECRETS_FIRST, startToolSecrets, toolSecretStorage } from "./project-tools.js";
 import { followDiscord } from "./discord.js";
 import { followTeams } from "./teams.js";
 import { followSlack } from "./slack.js";
@@ -815,6 +816,9 @@ async function runOperateLocal(command, argv, write, options = {}) {
     catch (error) {
         return databaseFailure(write, json, command, file, error);
     }
+    // Toolroll's folder for the secrets it holds, beside this database: made before any build can run.
+    if (file !== ":memory:")
+        startToolSecrets(store, file, () => new Date(), { eager: SECRETS_FIRST.has(command) });
     // The lead (a lead token, as --token or TOOLROLL_LEAD_TOKEN) acts for its owner in single commands; its work
     // pings nobody. Anyone else who signs in inside one of these commands is who acted. Services name nobody.
     const presentedFlag = text(flags, "token");
@@ -1940,6 +1944,7 @@ async function mcpCommand(file, flags, write, json) {
     if (!door.ok)
         return said(door.message);
     const store = door.store;
+    startToolSecrets(store, file, () => new Date(), { eager: false });
     for (const suffix of ["", "-wal", "-shm"]) {
         try {
             chmodSync(`${file}${suffix}`, 0o600);
@@ -8480,7 +8485,8 @@ async function integrationsCommand(positional, flags, context) {
     const counts = { connected: 0, "not-set-up": 0, broken: 0 };
     for (const one of list)
         counts[one.state] += 1;
-    return succeed(context.write, context.json, command, { integrations: list, counts }, () => renderIntegrations(list));
+    const secrets = toolSecretStorage();
+    return succeed(context.write, context.json, command, { integrations: list, counts, secrets: { kind: secrets.kind, words: secrets.words, ...(secrets.problem === undefined ? {} : { problem: secrets.problem }) } }, () => renderIntegrations(list, secrets));
 }
 async function waitTask(positional, flags, context) {
     const command = "task wait";

package/dist/plan-auto.d.ts

@@ -1,4 +1,5 @@
 import type { Store } from "./store.js";
+import { type UnattendedGrant } from "./flow-unattended.js";
 export declare const PLAN_AUTO_SCHEMA = "CREATE TABLE IF NOT EXISTS plan_authorization (\n  task_id TEXT PRIMARY KEY REFERENCES task(id),\n  source_digest TEXT NOT NULL,\n  scope_digest TEXT NOT NULL,\n  mode_digest TEXT NOT NULL,\n  signed_by TEXT NOT NULL,\n  created_at TEXT NOT NULL\n);";
 /** Join the console's authority-free proposal to the authenticated filing
  * road in one transaction. Planning defers the seal until verified ingestion. */
@@ -7,6 +8,16 @@ export declare function applyModeToNewFiling(store: Store, taskId: string, actor
  * code. This authorizes the exact filed contract, not arbitrary future
  * planner text. Rewrites, mode renewal, expiry and revocation fail closed. */
 export declare function authorizePlanUnderMode(store: Store, taskId: string, actor: string, now: Date): boolean;
+/**
+ * A flow card's new filing under its flow's "runs on its own" grant (flow-unattended.ts), inside the engine's filing
+ * transaction, which has just proved the grant covers this card. A plain build that plans is pre-authorized for an
+ * unchanged plan only; anything else is sealed now, under a distinct `grant` basis. False (the filing then waits for a
+ * person, as it always did) when the filed terms aren't the safe, fixed ones the grant was signed for.
+ */
+export declare function sealFlowFilingUnderGrant(store: Store, taskId: string, grant: UnattendedGrant, card: {
+    flow: number;
+    id: number;
+}, now: Date): boolean;
 /** Read-side status only; finalization still proves the authority anew. */
 export declare function planAutoPending(store: Store, taskId: string, now: Date): boolean;
 /** Inside the verified planner finalization transaction, after the source,