toolroll 0.9.62 → 0.9.63

package/dist/provider-home.d.ts

@@ -0,0 +1,22 @@
+/** The operator's own choices a no-model build keeps. */
+export type ProviderDefaults = {
+    model?: string;
+    alwaysThinking?: boolean;
+    effort?: string;
+};
+export declare function claudeConfigDir(env?: Readonly<Record<string, string | undefined>>, home?: string): string;
+export declare function codexHomeDir(env?: Readonly<Record<string, string | undefined>>, home?: string): string;
+/** Claude's user settings: its `model` and `alwaysThinkingEnabled`, when valid. */
+export declare function claudeDefaults(configDir: string): ProviderDefaults;
+/** Codex's config.toml: its top-level `model` and `model_reasoning_effort`, or the selected profile's. */
+export declare function codexDefaults(codexHome: string): ProviderDefaults;
+/**
+ * One Codex launch's CODEX_HOME: a private folder linking the operator's
+ * sign-in and sessions. A missing `auth.json` stays missing (an API-key
+ * build needs none); a missing `sessions/` is made where Codex would make
+ * it, so a resumed build finds the thread its first launch wrote.
+ */
+export declare function isolatedCodexHome(source: string, root?: string): {
+    dir: string;
+    cleanup: () => void;
+};

package/dist/provider-home.js

@@ -0,0 +1,99 @@
+/**
+ * What a build keeps of the provider's own home, and nothing more.
+ *
+ * A build loads none of the operator's Claude settings or Codex config
+ * (provider.ts), so two things from them are carried explicitly:
+ *
+ * - A build routed with no model runs as the operator's own CLI would: the
+ *   model they chose (Claude's settings.json `model`, Codex's config.toml
+ *   `model`), Claude's `alwaysThinkingEnabled` and Codex's reasoning effort.
+ *   Nothing else of either file (hooks, plugins, MCP servers) is read.
+ * - A Codex build gets its own CODEX_HOME for the launch: links to the
+ *   operator's `auth.json` and `sessions/` (so it signs in, and a repair
+ *   resumes the same thread), and no skills, AGENTS.md or anything else from
+ *   theirs. Links, never copies: a refreshed sign-in lands in the real file.
+ *   The folder is fenced from the agent's commands and removed after the run.
+ */
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
+import { validModelId } from "./provider.js";
+const EFFORT = /^[a-z]{1,16}$/;
+export function claudeConfigDir(env = process.env, home = homedir()) {
+    return env["CLAUDE_CONFIG_DIR"] || join(home, ".claude");
+}
+export function codexHomeDir(env = process.env, home = homedir()) {
+    return env["CODEX_HOME"] || join(home, ".codex");
+}
+/** Claude's user settings: its `model` and `alwaysThinkingEnabled`, when valid. */
+export function claudeDefaults(configDir) {
+    let settings;
+    try {
+        settings = JSON.parse(readFileSync(join(configDir, "settings.json"), "utf8"));
+    }
+    catch {
+        return {};
+    }
+    if (settings === null || typeof settings !== "object" || Array.isArray(settings))
+        return {};
+    const { model, alwaysThinkingEnabled } = settings;
+    return {
+        ...(typeof model === "string" && model !== "" && validModelId(model) ? { model } : {}),
+        ...(typeof alwaysThinkingEnabled === "boolean" ? { alwaysThinking: alwaysThinkingEnabled } : {}),
+    };
+}
+/** Codex's config.toml: its top-level `model` and `model_reasoning_effort`, or the selected profile's. */
+export function codexDefaults(codexHome) {
+    let text;
+    try {
+        text = readFileSync(join(codexHome, "config.toml"), "utf8");
+    }
+    catch {
+        return {};
+    }
+    const tables = new Map([["", {}]]);
+    let table = "";
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        const header = /^\[\s*([^\]]+?)\s*\]$/.exec(line);
+        if (header !== null) {
+            table = header[1].replace(/"/g, "");
+            if (!tables.has(table))
+                tables.set(table, {});
+            continue;
+        }
+        const pair = /^([A-Za-z0-9_]+)\s*=\s*"([^"\\]*)"\s*(?:#.*)?$/.exec(line);
+        if (pair !== null)
+            tables.get(table)[pair[1]] = pair[2];
+    }
+    const top = tables.get("");
+    const profile = top["profile"] === undefined ? {} : tables.get(`profiles.${top["profile"]}`) ?? {};
+    const model = profile["model"] ?? top["model"];
+    const effort = profile["model_reasoning_effort"] ?? top["model_reasoning_effort"];
+    return {
+        ...(model !== undefined && model !== "" && validModelId(model) ? { model } : {}),
+        ...(effort !== undefined && EFFORT.test(effort) ? { effort } : {}),
+    };
+}
+/**
+ * One Codex launch's CODEX_HOME: a private folder linking the operator's
+ * sign-in and sessions. A missing `auth.json` stays missing (an API-key
+ * build needs none); a missing `sessions/` is made where Codex would make
+ * it, so a resumed build finds the thread its first launch wrote.
+ */
+export function isolatedCodexHome(source, root = tmpdir()) {
+    const dir = mkdtempSync(join(root, "so-codex-"));
+    try {
+        chmodSync(dir, 0o700);
+        if (existsSync(join(source, "auth.json")))
+            symlinkSync(join(source, "auth.json"), join(dir, "auth.json"));
+        mkdirSync(join(source, "sessions"), { recursive: true, mode: 0o700 });
+        symlinkSync(join(source, "sessions"), join(dir, "sessions"), "dir");
+    }
+    catch (error) {
+        rmSync(dir, { recursive: true, force: true });
+        throw error;
+    }
+    // rm removes the links themselves, never what they point to.
+    return { dir, cleanup: () => rmSync(dir, { recursive: true, force: true }) };
+}

package/dist/provider.d.ts

@@ -18,6 +18,7 @@
  * TOML-quoted deterministically, and the API key excluded from every
  * shell the model itself launches (Codex provider review, Q5).
  */
+import { type FenceGrants } from "./agent-fence.js";
 import { type ExecResult, type RunOptions } from "./exec.js";
 import { MODEL_ID, type AgentSpec, type ProviderId } from "./contracts/provider.js";
 export type { AgentSpec, ProviderId } from "./contracts/provider.js";
@@ -64,6 +65,17 @@ export type Invocation = {
      * Codex renders it as its own sandbox profile; Claude as deny rules for
      * its file tools (its shell is fenced by the macOS sandbox around it). */
     fence?: readonly string[];
+    /** What the fence gives back (agent-fence.ts): Codex renders read-only
+     * paths as "read", Claude's file tools never edit them. */
+    fenceGrants?: FenceGrants;
+    /** The operator's own model choices, for a build routed with no model
+     * (provider-home.ts): the model, Claude's always-on thinking and Codex's
+     * reasoning effort. Never rendered for a review or an explicit model. */
+    inherited?: {
+        model?: string;
+        alwaysThinking?: boolean;
+        effort?: string;
+    };
     /** More paths Claude's own file tools refuse, beside the fence: home
      * configuration its CLI still reads itself (so the sandbox around the
      * whole process can't deny them). */
@@ -199,6 +211,7 @@ export declare const OPENROUTER_ENV_KEY = "OPENROUTER_API_KEY";
  * planted user, project and local hooks and MCP servers: none loaded.
  */
 export declare const CLAUDE_BUILD_ISOLATION_ARGV: readonly string[];
+export declare function claudePluginEnv(env: Readonly<Record<string, string | undefined>>): string[];
 /** Claude's own tools that only make sense with a person to wake them. */
 export declare const HEADLESS_DISALLOWED_TOOLS: readonly string[];
 /**
@@ -221,9 +234,10 @@ export declare function isolationUnsupported(provider: ProviderId, stderr: strin
  * A Codex build's own setup, the equivalent of Claude's: the operator's
  * config.toml (its MCP servers, model choices, profiles) and execpolicy
  * rules ignored, ChatGPT apps and plugins off (plugins carry their own MCP
- * servers), and hooks off. Sign-in still comes from CODEX_HOME, which
- * `--ignore-user-config` leaves alone. The project's named tools follow as
- * `-c mcp_servers.*` (project-tools.ts).
+ * servers), and hooks off. The gateway gives each launch its own CODEX_HOME
+ * linking only the operator's sign-in and sessions (provider-home.ts), so no
+ * skills or AGENTS.md of theirs load either. The project's named tools follow
+ * as `-c mcp_servers.*` (project-tools.ts).
  */
 export declare const CODEX_BUILD_ISOLATION_ARGV: readonly string[];
 /**

package/dist/provider.js

@@ -181,6 +181,16 @@ const CLAUDE_REVIEW_JSON_SCHEMA = {
  * planted user, project and local hooks and MCP servers: none loaded.
  */
 export const CLAUDE_BUILD_ISOLATION_ARGV = ["--setting-sources", "", "--strict-mcp-config"];
+/**
+ * Plugins also ride the environment: a plugin named in CLAUDE_CODE_PLUGIN_DIRS
+ * loads its hooks whatever `--setting-sources` says (Claude Code 2.1.290,
+ * the provider canary's plugin sentinel). A build's launch sheds every
+ * plugin variable of the environment it would inherit.
+ */
+const CLAUDE_PLUGIN_ENV = /^CLAUDE_(CODE_\w*PLUGIN|AI_PLUGINS)\w*$/;
+export function claudePluginEnv(env) {
+    return Object.keys(env).filter(name => CLAUDE_PLUGIN_ENV.test(name));
+}
 const EMPTY_MCP_CONFIG = '{"mcpServers":{}}';
 /** Claude's own tools that only make sense with a person to wake them. */
 export const HEADLESS_DISALLOWED_TOOLS = ["ScheduleWakeup", "CronCreate", "Monitor"];
@@ -203,7 +213,7 @@ const claudeArgv = (invocation) => [
         : invocation.skipPermissions
             ? ["--dangerously-skip-permissions"]
             : ["--permission-mode", invocation.permissionMode]),
-    ...(invocation.model === null ? [] : ["--model", invocation.model]),
+    ...modelArgv("--model", invocation),
     ...(invocation.maxBudgetUsd === undefined ? [] : ["--max-budget-usd", String(invocation.maxBudgetUsd)]),
     ...(invocation.phase === "review"
         ? [...CLAUDE_REVIEW_ISOLATION_ARGV, "--json-schema", JSON.stringify(CLAUDE_REVIEW_JSON_SCHEMA)]
@@ -222,12 +232,22 @@ const claudeArgv = (invocation) => [
             ...(invocation.jsonSchema === undefined ? [] : ["--json-schema", JSON.stringify(invocation.jsonSchema)])
         ]),
 ];
+/** The route's model, or for a build routed with none, the operator's own (never for a review). */
+function modelArgv(flag, invocation) {
+    const model = invocation.model ?? (invocation.phase === "review" ? undefined : invocation.inherited?.model);
+    return model === undefined ? [] : [flag, model];
+}
+/** What else a no-model build keeps of the operator's setup. */
+const inheritedFrom = (invocation) => invocation.model === null && invocation.phase !== "review" ? invocation.inherited ?? {} : {};
 /** The build's one --settings: no personal memory, plus the fence and steering doorbell. */
 function claudeSettingsArgv(invocation) {
     const denied = [...(invocation.fence ?? []), ...(invocation.fileToolFence ?? [])];
+    const readOnly = invocation.fenceGrants?.readOnly ?? [];
+    const thinking = inheritedFrom(invocation).alwaysThinking;
     return ["--settings", JSON.stringify({
             autoMemoryEnabled: false,
-            ...(denied.length > 0 ? JSON.parse(claudeFenceSettings(denied)) : {}),
+            ...(thinking === undefined ? {} : { alwaysThinkingEnabled: thinking }),
+            ...(denied.length > 0 || readOnly.length > 0 ? JSON.parse(claudeFenceSettings(denied, readOnly)) : {}),
             ...(invocation.steerFolder === undefined ? {} : { hooks: claudeSteerHooks(invocation.steerFolder.dir, invocation.steerFolder.name) }),
         })];
 }
@@ -421,9 +441,10 @@ const codexSandboxArgv = (mode, resuming) => resuming ? ["-c", `sandbox_mode="${
  * A Codex build's own setup, the equivalent of Claude's: the operator's
  * config.toml (its MCP servers, model choices, profiles) and execpolicy
  * rules ignored, ChatGPT apps and plugins off (plugins carry their own MCP
- * servers), and hooks off. Sign-in still comes from CODEX_HOME, which
- * `--ignore-user-config` leaves alone. The project's named tools follow as
- * `-c mcp_servers.*` (project-tools.ts).
+ * servers), and hooks off. The gateway gives each launch its own CODEX_HOME
+ * linking only the operator's sign-in and sessions (provider-home.ts), so no
+ * skills or AGENTS.md of theirs load either. The project's named tools follow
+ * as `-c mcp_servers.*` (project-tools.ts).
  */
 export const CODEX_BUILD_ISOLATION_ARGV = [
     "--ignore-user-config",
@@ -469,11 +490,12 @@ const codexArgv = (extra) => (invocation) => {
             // denied. Full access becomes that sandbox widened to write anywhere
             // with network, instead of no sandbox (which fenced nothing).
             : invocation.fence !== undefined && invocation.fence.length > 0
-                ? codexFenceArgv(invocation.fence, invocation.skipPermissions)
+                ? codexFenceArgv(invocation.fence, invocation.skipPermissions, invocation.fenceGrants)
                 : invocation.skipPermissions
                     ? ["--dangerously-bypass-approvals-and-sandbox"]
                     : codexSandboxArgv("workspace-write", resuming)),
-        ...(invocation.model === null ? [] : ["-m", invocation.model]),
+        ...modelArgv("-m", invocation),
+        ...(inheritedFrom(invocation).effort === undefined ? [] : ["-c", `model_reasoning_effort=${toml(inheritedFrom(invocation).effort)}`]),
         ...extra,
         // After `extra`: the tools' shell_environment_policy must be the last word (it keeps OpenRouter's key out too).
         ...(invocation.phase === "review" ? [] : invocation.toolArgv ?? []),
@@ -851,6 +873,7 @@ const AUDITS = {
         isolation: { flag: CLAUDE_BUILD_ISOLATION_ARGV.filter(one => one !== "").join(" "), resumeSafe: true, enforced: true },
         configSurface: [
             "Toolroll's own --settings (the fence and steering hook)",
+            "your model and alwaysThinkingEnabled, when the route names no model",
             "the project's named tools (Settings → Tools)",
             "repository CLAUDE.md",
             "organisation-managed settings",
@@ -863,10 +886,11 @@ const AUDITS = {
         sessionIdentity: "announced",
         terminalContract: "none",
         // Builds ignore config.toml and execpolicy rules, with apps, plugins and
-        // hooks off (CODEX_BUILD_ISOLATION_ARGV); sign-in stays in CODEX_HOME.
+        // hooks off (CODEX_BUILD_ISOLATION_ARGV), in a per-launch CODEX_HOME that
+        // links only the sign-in and sessions (provider-home.ts).
         // Never --ephemeral: repair resumes sessions.
         isolation: { flag: "--ignore-user-config --ignore-rules", resumeSafe: true, enforced: true },
-        configSurface: ["the project's named tools (Settings → Tools)", "~/.codex/AGENTS.md and repository AGENTS.md", "sign-in from CODEX_HOME"],
+        configSurface: ["the project's named tools (Settings → Tools)", "repository AGENTS.md", "sign-in and sessions linked from CODEX_HOME (no skills or AGENTS.md)", "your model and reasoning effort, when the route names no model"],
     },
     openrouter: {
         transport: "streaming-jsonl",
@@ -876,7 +900,7 @@ const AUDITS = {
         terminalContract: "none",
         // Codex's build setup, with the model provider pinned by constant -c overrides.
         isolation: { flag: "--ignore-user-config --ignore-rules", resumeSafe: true, enforced: true },
-        configSurface: ["the project's named tools (Settings → Tools)", "~/.codex/AGENTS.md and repository AGENTS.md", `${OPENROUTER_ENV_KEY}`],
+        configSurface: ["the project's named tools (Settings → Tools)", "repository AGENTS.md", `${OPENROUTER_ENV_KEY}`],
     },
     gemini: {
         transport: "streaming-jsonl",

package/dist/remote-main.d.ts

@@ -1,6 +1,10 @@
 import { type ExecResult } from "./exec.js";
 import type { Store } from "./store.js";
 import type { Runner } from "./worktree.js";
+/** What the private directory's git may see of this process's environment: nothing that names a repository, an
+ * object store or config. The fixed settings below go on top. Teardown git (teardown-git.ts) uses the same. */
+export declare const ENV_ALLOWLIST: string[];
+export declare const ENV: Record<string, string>;
 /** The only credential helper https may use: the system keychain on macOS; elsewhere none, so a private https remote
  * fails closed instead of asking. */
 export declare const CREDENTIAL_HELPER: string;

package/dist/remote-main.js

@@ -21,9 +21,9 @@ const REMOTE_MAIN = "refs/toolroll/remote-main";
 const SHA = /^[0-9a-f]{40}$/;
 const FETCH_TIMEOUT_MS = 120_000;
 /** What the private directory's git may see of this process's environment: nothing that names a repository, an
- * object store or config. The fixed settings below go on top. */
-const ENV_ALLOWLIST = ["PATH", "HOME", "TMPDIR", "LANG", "LC_ALL", "SSH_AUTH_SOCK", "HTTPS_PROXY", "https_proxy", "NO_PROXY", "no_proxy"];
-const ENV = {
+ * object store or config. The fixed settings below go on top. Teardown git (teardown-git.ts) uses the same. */
+export const ENV_ALLOWLIST = ["PATH", "HOME", "TMPDIR", "LANG", "LC_ALL", "SSH_AUTH_SOCK", "HTTPS_PROXY", "https_proxy", "NO_PROXY", "no_proxy"];
+export const ENV = {
     GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_NO_REPLACE_OBJECTS: "1", GIT_TERMINAL_PROMPT: "0",
     GIT_ASKPASS: "", SSH_ASKPASS: "", GIT_SSH_COMMAND: "ssh -o BatchMode=yes",
 };

package/dist/scope.d.ts

@@ -258,7 +258,7 @@ export type Scope = SavedScopeTerms & {
      * 'mode' = sealed by the signer's live mode (modeDigest names it);
      * 'chat' = the owner's own two taps in their paired chat, under their chat-approval setting or a signed term
      * (modeDigest names that authority; the yes is the person's and doesn't lapse with it). */
-    approvalBasis?: "password" | "mode" | "chat" | null;
+    approvalBasis?: "password" | "mode" | "chat" | "grant" | null;
     modeDigest?: string | null;
     /** v24 (optional so hand-built scopes in tests stay valid): the working
      * execution profile, its resolution state, and the immutable snapshot

package/dist/serve.js

@@ -14,7 +14,7 @@ import { startMaintenance } from './maintenance.js';
 import { connectionsOf, localConnectOf, oneClickOf } from "./mcp-connect.js";
 import { MOBILE_VIEWPORT_SCRIPT } from "./mobile-viewport.js";
 import { projectAuthority } from "./project-access.js";
-import { discoverTools, projectToolsOf, secretsSetFor, TOOL_CATALOG, toolStanding } from "./project-tools.js";
+import { discoverTools, projectToolsOf, secretsSetFor, TOOL_CATALOG, toolSecretStorage, toolStanding } from "./project-tools.js";
 import { toolRefusal } from "./policy.js";
 import { isEdgeAddress, refuseEdge } from "./server/edge-refusal.js";
 import { announcePasswordBearer, isPasswordBearer, PASSWORD_BEARER_REFUSED, passwordBearerAccepted } from "./password-bearer.js";
@@ -434,17 +434,25 @@ export function createDecisionServer(options) {
         }
     };
     /** One project's Tools page: its tools with which secrets are set (never values), the common tools not yet added, and what this computer already has. */
-    const toolHome = options.toolHome ?? homedir();
+    // A test's own folder for tool secrets and found tools; Toolroll's own (beside its database, and this home) otherwise.
+    const toolHome = options.toolHome;
     const toolsViewOf = (repo, codex, kit = null, wanted = null) => {
         const tools = projectToolsOf(store, repo);
         const names = new Set(tools.map(one => one.name));
         return {
             repo, project: repo.split(/[\\/]/).filter(Boolean).at(-1) ?? repo,
-            tools: tools.map(tool => ({ tool, secretsSet: secretsSetFor(repo, tool.spec, toolHome) })),
+            // Secrets that can't be read (a refused folder, a locked keychain) read as none set: the page says why once (storage).
+            tools: tools.map(tool => { let secretsSet = []; try {
+                secretsSet = secretsSetFor(repo, tool.spec, toolHome);
+            }
+            catch {
+                secretsSet = [];
+            } return { tool, secretsSet }; }),
             // A service that connects by signing in (or an app's own Connect) is offered only that way.
             catalog: TOOL_CATALOG.filter(one => !names.has(one.name) && oneClickOf(one.name) === null && localConnectOf(one.name) === null),
             connections: connectionsOf(store, repo, toolHome), kit, wanted,
             found: discoverTools(repo, codex, toolHome).filter(one => !names.has(one.spec.name)),
+            storage: toolSecretStorage(),
         };
     };
     const codingProjects = () => [...new Set([...managedRepos(), ...store.listProjects().map(project => project.path)])].filter(repo => rowVisible(liveCeiling(), repo));

package/dist/server/flows.js

@@ -21,6 +21,7 @@ import { exportFlow, fetchFlowFile, FlowFileError, importFlow, parseFlowFile, pl
 import { addFlowTriggerTo, checkFlowTriggerNow, pressFlowButton, removeFlowTrigger, removeLinearKey, setFlowTriggerOn, renewFlowHook, saveHooksBase, saveLinearKey, saveLinearSigningSecret, shareFlowButton, stopSharingFlowButton } from "../flow-triggers.js";
 import { FLOW_IMPORT_SCRIPT, flowFallbackHtml, flowImportHtml, flowsListHtml, flowView } from "../flows-ui.js";
 import { FLOW_TEMPLATES, FlowContractError, validateFlowDefinition, withZoneNames } from "../flows.js";
+import { prepareUnattendedCandidates, parseUnattendedAsk, revokeUnattended, signUnattended, untilWords } from "../flow-unattended.js";
 import { keyStatus } from "../keys.js";
 import { kitPageHtml, kitsGalleryHtml } from "../kits-ui.js";
 import { addKitGithubTrigger, addKitSample, kitOf, setUpKit } from "../kits.js";
@@ -148,7 +149,7 @@ export function createFlowsHandlers(runtime) {
             return refuse(response, who, 404, "No such flow in your projects.", "/flows");
         const selected = Number(url.searchParams.get("card")), start = Number(url.searchParams.get("start"));
         const view = flowView(store, flow, { name: who.name, approver: who.via === "cookie" && who.role === "approver" }, Number.isSafeInteger(selected) && selected > 0 ? selected : null, { dir: options.configDir ?? null, repos: consoleProjects(), startTrigger: Number.isSafeInteger(start) && start > 0 ? start : null,
-            sortReady: keyStatus("openrouter", providerHome).set, toolHome });
+            sortReady: keyStatus("openrouter", providerHome).set, toolHome, now: clock() });
         if (url.searchParams.get("format") === "json")
             return respond(response, 200, "application/json; charset=utf-8", JSON.stringify(checkResponse("flowView", view)));
         return sendScreen(response, 200, screen(flow.name, html `<p><a href="/flows">Flows</a></p><h1>${flow.name}</h1>${flowFallbackHtml(view)}`, { chrome: chromeFor(flow.repo, "flows"), workspace: { view } }));
@@ -546,7 +547,7 @@ export function createFlowsHandlers(runtime) {
         }
         const definition = flowDefinitionOf(flow);
         const dir = options.configDir ?? null;
-        const viewNow = () => flowView(store, store.getFlow(flow.id) ?? flow, { name: who.name, approver: true }, null, { dir, repos: projects, sortReady: keyStatus("openrouter", providerHome).set, toolHome });
+        const viewNow = () => flowView(store, store.getFlow(flow.id) ?? flow, { name: who.name, approver: true }, null, { dir, repos: projects, sortReady: keyStatus("openrouter", providerHome).set, toolHome, now });
         const settle = (said, extra = {}) => {
             // Move what can move right away (a message, a decision's next zone); workers file and run the tasks.
             try {
@@ -572,6 +573,8 @@ export function createFlowsHandlers(runtime) {
                 return answer(400, { ok: false, said: "That trigger couldn't be read." });
             }
             const made = addFlowTriggerTo(store, flow, raw, who.name, now, dir);
+            if (made.ok)
+                await prepareUnattendedCandidates(store, flow.id);
             return made.ok ? settle(made.said, made.reveal === null ? {} : { reveal: made.reveal }) : answer(400, { ok: false, said: made.message });
         }
         if (action === "scripts") {
@@ -579,8 +582,10 @@ export function createFlowsHandlers(runtime) {
             if (body.get("approve") === "yes")
                 return store.approveFlowScript(flow.repo, body.get("name") ?? "") ? settle("Approved. Zones that run it go on.") : answer(404, { ok: false, said: "That script isn't waiting for approval." });
             if (body.get("remove") === "yes")
-                return store.removeFlowScript(flow.repo, body.get("name") ?? "") ? settle("Script removed. Zones that ran it wait until it's back.") : answer(404, { ok: false, said: "There's no script by that name." });
+                return store.removeFlowScript(flow.repo, body.get("name") ?? "", who.name, now) ? settle("Script removed. Zones that ran it wait until it's back.") : answer(404, { ok: false, said: "There's no script by that name." });
             const saved = saveScript(store, flow.repo, { name: body.get("name"), about: body.get("about"), body: body.get("body"), timeoutMinutes: body.get("timeoutMinutes"), language: body.get("language"), file: body.get("file") }, who.name, now);
+            if (saved.ok)
+                await prepareUnattendedCandidates(store, flow.id);
             return saved.ok ? settle(saved.said) : answer(400, { ok: false, said: saved.message });
         }
         if (action === "linear-key" || action === "hooks-address") {
@@ -604,6 +609,19 @@ export function createFlowsHandlers(runtime) {
             store.archiveFlow(flow.id, who.name, now);
             return redirect(response, "/flows");
         }
+        if (action === "unattended") {
+            // The owner's password signs exactly the terms the panel showed; a flow saved meanwhile is refused (sawRevision).
+            if (!authenticateApprover(who, body.get("password") ?? "").ok)
+                return answer(403, { ok: false, said: "That password isn't right. Nothing was signed." });
+            const asked = parseUnattendedAsk({ days: body.get("days"), budget: body.get("budget"), runs: body.get("runs"), include: body.get("include") });
+            if (!asked.ok)
+                return answer(400, { ok: false, said: asked.message });
+            const signed = await signUnattended(store, { flow: flow.id, signer: who.name, ask: asked.ask, sawRevision: Number(body.get("revision")), sawSchedules: body.get("schedules") ?? "" }, now);
+            return signed.ok ? settle(`Runs on its own until ${untilWords(signed.grant.absoluteExpiry)}.`) : answer(409, { ok: false, said: signed.message });
+        }
+        if (action === "unattended-off") {
+            return revokeUnattended(store, flow.id, who.name, now) ? settle("It no longer runs on its own. New cards wait for you.") : answer(409, { ok: false, said: "It wasn't running on its own." });
+        }
         if (action === "save") {
             let saved, drawn;
             try {
@@ -637,6 +655,8 @@ export function createFlowsHandlers(runtime) {
             if (dir === null)
                 return answer(409, { ok: false, said: "Secrets are kept on the console's computer." });
             const saved = setFlowSecret(dir, flow.repo, (body.get("name") ?? "").trim(), body.get("value") ?? "");
+            if (saved.ok)
+                await prepareUnattendedCandidates(store, flow.id);
             return saved.ok ? settle(saved.said) : answer(400, { ok: false, said: saved.message });
         }
         // Adding a card.
@@ -702,11 +722,11 @@ export function createFlowsHandlers(runtime) {
         if (trigger === null || trigger.flow !== flow.id || trigger.state === "removed")
             return answer(404, { ok: false, said: "That trigger isn't on this flow." });
         if (verb === "pause" || verb === "resume") {
-            setFlowTriggerOn(store, trigger, verb === "resume", now);
+            setFlowTriggerOn(store, trigger, verb === "resume", now, who.name);
             return settle(verb === "pause" ? "Trigger paused." : "Trigger on again.");
         }
         if (verb === "remove") {
-            removeFlowTrigger(store, trigger, now, dir);
+            removeFlowTrigger(store, trigger, now, dir, who.name);
             return settle("Trigger removed.");
         }
         if (verb === "share") {
@@ -887,6 +907,8 @@ export function createFlowsHandlers(runtime) {
         "flow.linear-key": flowAct("linear-key"),
         "flow.hooks-address": flowAct("hooks-address"),
         "flow.secrets": flowAct("secrets"),
+        "flow.unattended": flowAct("unattended"),
+        "flow.unattended-off": flowAct("unattended-off"),
         "flow.triggers": flowAct("triggers"),
         "flow.card.move": cardAct("move"),
         "flow.card.decide": cardAct("decide"),

package/dist/server/route-table.js

@@ -238,6 +238,9 @@ for (const one of ["save", "cards", "archive", "scripts"])
     post("flows", `flow.${one}`, `^\\/flows\\/${FLOW}\\/${one}$`, { project: "flow", limited: "resource", sample: `/flows/1/${one}`, ...EDIT_FLOWS });
 for (const one of ["linear-key", "hooks-address", "secrets"])
     post("flows", `flow.${one}`, `^\\/flows\\/${FLOW}\\/${one}$`, { scope: "step-up", project: "flow", sample: `/flows/1/${one}`, ...EDIT_FLOWS });
+// "Runs on its own": signing raises authority (the owner's password, a step-up); revoking is one click for any approver.
+post("flows", "flow.unattended", `^\\/flows\\/${FLOW}\\/unattended$`, { scope: "step-up", project: "flow", sample: "/flows/1/unattended", ...EDIT_FLOWS });
+post("flows", "flow.unattended-off", `^\\/flows\\/${FLOW}\\/unattended-off$`, { project: "flow", sample: "/flows/1/unattended-off", ...EDIT_FLOWS });
 post("flows", "flow.triggers", `^\\/flows\\/${FLOW}\\/triggers$`, { project: "flow", limited: "resource", sample: "/flows/1/triggers", ...EDIT_FLOWS });
 for (const one of ["move", "decide", "cancel", "comment", "assign", "watch"])
     post("flows", `flow.card.${one}`, `^\\/flows\\/${FLOW}\\/cards\\/${FLOW}\\/${one}$`, { project: "flow", limited: "resource", sample: `/flows/1/cards/2/${one}`, ...EDIT_FLOWS });

package/dist/server/runtime.d.ts

@@ -107,7 +107,7 @@ export interface ServerRuntime {
     consoleProjects: () => string[];
     flowRooms: FlowRooms;
     providerHome: string;
-    toolHome: string;
+    toolHome: string | undefined;
     leadPrincipal: (who: Who & {
         via: "cookie";
     }) => VerifiedApprover | null;

package/dist/server/settings.js

@@ -82,7 +82,8 @@ import { applySavedKnowledge, changeKnowledge, knowledgeVersion, knowledgeView }
 import { changeLearning } from "../project-learning.js";
 import { listDecisions, recordDecision, retireDecision, searchMemory } from "../project-memory.js";
 import { changeSkills, githubSkill, importSkill, reviseSkillTest, skillsView, testSkill } from "../project-skills.js";
-import { addToolTo, catalogTool, localAppOf, removeToolFrom, setToolSecret, splitCommandLine, testToolOf } from "../project-tools.js";
+import { signedIn } from "../oauth-run-token.js";
+import { addToolTo, catalogTool, localAppOf, removeToolFrom, setToolSecret, splitCommandLine, testToolOf, toolSecretStorage } from "../project-tools.js";
 import { liftAuthPause } from "../provider-auth.js";
 import { isProviderId, PROVIDER_IDS, validateSpec, validModelId } from "../provider.js";
 import { checkPublishing, MERGE_METHODS, saveMergeSettings, savePublishing } from '../pull-request-flow.js';
@@ -350,7 +351,7 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         if (!options.configDir)
             return refuse(response, who, 403, "An installation approver sees integrations.", "/settings");
         const list = integrations.list();
-        return sendScreen(response, 200, screen("Integrations", html `<p><a href="/settings">Settings</a></p><h1>Integrations</h1>${(integrationsHtml(list, who.session.csrf, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem"), checking: integrations.checking }))}`, { chrome: chromeFor(project, "settings") }));
+        return sendScreen(response, 200, screen("Integrations", html `<p><a href="/settings">Settings</a></p><h1>Integrations</h1>${(integrationsHtml(list, who.session.csrf, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem"), checking: integrations.checking, secrets: toolSecretStorage() }))}`, { chrome: chromeFor(project, "settings") }));
     }
     // v104: Settings → Monitoring, where the audit stream and traces go. An instance operator's page.
     async function monitoringPage(ctx) {
@@ -624,7 +625,12 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         }, who.role === "approver" && csrf !== "" ? (() => {
             // v87: the mail server flows send email through; the password is never shown back.
             // v89: where Inbox triggers read it, and a connected Google account (its client secret is never shown back either).
-            const email = readEmailSettings(options.configDir ?? null), google = readGoogleMail(options.configDir ?? null), origin = consoleOrigin(request.headers.host);
+            const email = readEmailSettings(options.configDir ?? null), google = (() => { try {
+                return readGoogleMail(options.configDir ?? null);
+            }
+            catch {
+                return null;
+            } })(), origin = consoleOrigin(request.headers.host);
             const googleView = { connected: googleConnected(options.configDir ?? null)?.address ?? null, clientId: google?.clientId ?? "", redirect: origin === null ? null : `${origin}${GOOGLE_CALLBACK}` };
             return email === null ? { set: false, host: "", port: 587, secure: false, user: "", from: "", imapHost: "", imapPort: 993, google: googleView }
                 : { set: true, host: email.host, port: email.port, secure: email.secure, user: email.user, from: email.from, imapHost: email.imap?.host ?? "", imapPort: email.imap?.port ?? 993, google: googleView };
@@ -1397,6 +1403,8 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
                 const secret = body.get("secret") ?? "";
                 if (!tool.spec.secrets.some(one => one.name === secret))
                     return back("problem", "Choose one of this tool's secrets.");
+                if (signedIn(tool.spec))
+                    return back("problem", `${name} is connected by signing in. Sign in again from Connect to renew it.`, `#tool-${name}`);
                 setToolSecret(repo, name, secret, body.get("value") ?? "", toolHome);
                 return back("said", `Saved ${secret} for ${name}. It is never shown again.`, `#tool-${name}`);
             }

package/dist/storage-sweep-child.js

@@ -3,7 +3,7 @@ import { Worker } from "node:worker_threads";
 import { openStoreNoMigrate } from "./store.js";
 import { WorktreePool } from "./worktree.js";
 import { executeSweep } from "./storage-sweep.js";
-import { sweepRequest } from "./storage-sweep-process.js";
+import { enterSweepBackground, sweepRequest } from "./storage-sweep-process.js";
 const parent = process.ppid;
 let store;
 let finished = false;
@@ -57,6 +57,8 @@ process.once("message", async (request) => {
         finish(1);
         return;
     }
+    // Node and the sweep's code are loaded: from here on, on macOS, the work and everything it starts runs in the background.
+    enterSweepBackground();
     try {
         const opened = openStoreNoMigrate(request.databaseFile);
         if (!opened.ok)

package/dist/storage-sweep-process.d.ts

@@ -31,11 +31,18 @@ export declare const SWEEP_TIMEOUT_MS: number;
 export declare const SWEEP_KILL_GRACE_MS = 5000;
 /** The sweep runs behind everything else: a positive nice and, on macOS, the background CPU and I/O policy. */
 export declare const SWEEP_NICE = 10;
-/** How the child starts: taskpolicy execs Node in place, so the pid, its group and the IPC channel stay the same. */
-export declare function sweepLaunch(platform?: NodeJS.Platform, exists?: (path: string) => boolean): {
-    execPath: string;
-    prefix: string[];
-};
+/**
+ * How the child enters the background policy on macOS, or null elsewhere (or without taskpolicy): the child runs it on
+ * its own pid once Node has started and loaded the sweep, before any sweep work. Everything it starts after that (rm,
+ * du, git) inherits the policy. Starting Node itself under it let a busy machine hold the child's start for as long
+ * as anything else wanted the CPU, before it had done any of the work the policy is for.
+ */
+export declare function sweepBackground(pid: number, platform?: NodeJS.Platform, exists?: (path: string) => boolean): {
+    file: string;
+    args: string[];
+} | null;
+/** In the child: the background policy from now on. Without it the sweep still runs, at the nice its parent set. */
+export declare function enterSweepBackground(run?: (file: string, args: string[]) => void): boolean;
 /** Owns one child without lending its lifetime to a reconcile pass or its database connection. */
 export declare function createSweepSupervisor(options?: {
     timeoutMs?: number;

package/dist/storage-sweep-process.js

@@ -1,5 +1,5 @@
 /** The storage child's bounded IPC protocol. No paths or process arguments are written to logs. */
-import { fork } from "node:child_process";
+import { execFileSync, fork } from "node:child_process";
 import { existsSync } from "node:fs";
 import { setPriority } from "node:os";
 import { resolve } from "node:path";
@@ -28,16 +28,33 @@ export const SWEEP_KILL_GRACE_MS = 5_000;
 /** The sweep runs behind everything else: a positive nice and, on macOS, the background CPU and I/O policy. */
 export const SWEEP_NICE = 10;
 const TASKPOLICY = "/usr/sbin/taskpolicy";
-/** How the child starts: taskpolicy execs Node in place, so the pid, its group and the IPC channel stay the same. */
-export function sweepLaunch(platform = process.platform, exists = existsSync) {
-    return platform === "darwin" && exists(TASKPOLICY) ? { execPath: TASKPOLICY, prefix: ["-b", process.execPath] } : { execPath: process.execPath, prefix: [] };
+/**
+ * How the child enters the background policy on macOS, or null elsewhere (or without taskpolicy): the child runs it on
+ * its own pid once Node has started and loaded the sweep, before any sweep work. Everything it starts after that (rm,
+ * du, git) inherits the policy. Starting Node itself under it let a busy machine hold the child's start for as long
+ * as anything else wanted the CPU, before it had done any of the work the policy is for.
+ */
+export function sweepBackground(pid, platform = process.platform, exists = existsSync) {
+    return platform === "darwin" && exists(TASKPOLICY) ? { file: TASKPOLICY, args: ["-b", "-p", String(pid)] } : null;
+}
+/** In the child: the background policy from now on. Without it the sweep still runs, at the nice its parent set. */
+export function enterSweepBackground(run = (file, args) => { execFileSync(file, args, { stdio: "ignore", timeout: 5_000 }); }) {
+    const command = sweepBackground(process.pid);
+    if (command === null)
+        return false;
+    try {
+        run(command.file, command.args);
+        return true;
+    }
+    catch {
+        return false;
+    }
 }
 /** Only source checkouts need tsx; installed builds use the sibling child and the same Node. */
 function forkSweep() {
     const source = import.meta.url.endsWith(".ts");
-    const launch = sweepLaunch();
     const child = fork(fileURLToPath(new URL(source ? "./storage-sweep-child.ts" : "./storage-sweep-child.js", import.meta.url)), [], {
-        execPath: launch.execPath, execArgv: [...launch.prefix, ...(source ? ["--import", "tsx"] : [])], stdio: ["ignore", "ignore", "ignore", "ipc"], detached: true,
+        execArgv: source ? ["--import", "tsx"] : [], stdio: ["ignore", "ignore", "ignore", "ipc"], detached: true,
     });
     // Before the request is sent, so every rm/du the child starts inherits it.
     if (child.pid !== undefined) {