toolroll 0.9.62 → 0.9.63

package/dist/flows-cli.d.ts

@@ -269,6 +269,33 @@ export declare const FLOWS_DESCRIPTORS: readonly [{
         readonly takesValue: true;
         readonly meaning: "the script's name";
     }];
+}, {
+    readonly action: 'unattended';
+    readonly synopsis: "let a flow's own schedule run without approving each card (on: the owner signs, 1 to 7 days; off: any approver revokes)";
+    readonly mutation: 'identity-idempotent';
+    readonly audience: 'operator';
+    readonly positionals: readonly ['flow', 'on|off'];
+    readonly flags: readonly [...{
+        name: string;
+        takesValue: boolean;
+        meaning: string;
+    }[], {
+        readonly name: 'days';
+        readonly takesValue: true;
+        readonly meaning: "how long it lasts: 1 to 7 days (default 1)";
+    }, {
+        readonly name: 'budget';
+        readonly takesValue: true;
+        readonly meaning: 'optional dollar cap per attempt, like 5 or 2.50';
+    }, {
+        readonly name: 'runs';
+        readonly takesValue: true;
+        readonly meaning: "optional limit on runs a day (UTC), 1 to 50";
+    }, {
+        readonly name: 'include';
+        readonly takesValue: true;
+        readonly meaning: 'also cover these script or plane-review schedules (trigger ids, like 12,14); plain schedules are covered already';
+    }];
 }, {
     readonly action: 'archive';
     readonly synopsis: 'archive a flow: its cards stop moving and its triggers stop; previews until --yes';
@@ -284,7 +311,7 @@ export declare const FLOWS_DESCRIPTORS: readonly [{
         meaning: string;
     }];
 }];
-/** `--file` is a value here (a path in the project), where elsewhere it is a switch. */
+/** `--file` is a value here (a path in the project), where elsewhere it is a switch; so are unattended's `--budget`, `--runs` and `--include`. */
 export declare const FLOWS_VALUE_FLAGS: ReadonlySet<string>;
 export type FlowsCliContext = {
     store: Store;

package/dist/flows-cli.js

@@ -18,6 +18,8 @@ import { describeStandingOrder } from './flow-schedule.js';
 import { STARTER_FLOWS, starterFlowOf, starterOf, startersFor, starterTerms, switchOnStarter } from './flow-starters.js';
 import { addFlowTriggerTo, checkFlowTriggerNow, describeTrigger, removeFlowTrigger, setFlowTriggerOn, triggerConfigOf, validateTriggerConfig } from './flow-triggers.js';
 import { deciderOf, FLOW_KIND_WORDS, FLOW_TEMPLATES, flowDigest, flowFromSteps, flowTerms, stepsFor } from './flows.js';
+import { prepareUnattendedCandidates, activeUnattendedGrant, parseUnattendedAsk, revokeUnattended, signUnattended, unattendedViewOf, unattendedWords, untilWords, UNATTENDED_MAX_RUNS } from './flow-unattended.js';
+import { MODE_MAX_DAYS } from './modes.js';
 import { verifyApproverByPassword } from './principal.js';
 import { projectName } from './project.js';
 const EXIT = { ok: 0, failed: 1, usage: 2, refused: 3 };
@@ -62,10 +64,15 @@ export const FLOWS_DESCRIPTORS = [
     { action: 'import', synopsis: 'make a flow from a flow file or a gist/GitHub https address; previews in plain words until --yes; triggers arrive off and scripts wait for approval', mutation: 'unkeyed', positionals: ['file'], flags: [...write, yes, repo,
             { name: 'param', takesValue: true, meaning: 'a value the file asks for, as name=value (repeat for more)' }] },
     { action: 'script approve', synopsis: 'approve a script an imported flow brought, so it runs', mutation: 'identity-idempotent', flags: [...write, repo, { name: 'name', takesValue: true, meaning: "the script's name" }] },
+    { action: 'unattended', synopsis: `let a flow's own schedule run without approving each card (on: the owner signs, 1 to ${MODE_MAX_DAYS} days; off: any approver revokes)`, mutation: 'identity-idempotent', audience: 'operator', positionals: ['flow', 'on|off'], flags: [...write,
+            { name: 'days', takesValue: true, meaning: `how long it lasts: 1 to ${MODE_MAX_DAYS} days (default 1)` },
+            { name: 'budget', takesValue: true, meaning: 'optional dollar cap per attempt, like 5 or 2.50' },
+            { name: 'runs', takesValue: true, meaning: `optional limit on runs a day (UTC), 1 to ${UNATTENDED_MAX_RUNS}` },
+            { name: 'include', takesValue: true, meaning: 'also cover these script or plane-review schedules (trigger ids, like 12,14); plain schedules are covered already' }] },
     { action: 'archive', synopsis: 'archive a flow: its cards stop moving and its triggers stop; previews until --yes', mutation: 'identity-idempotent', positionals: ['flow'], flags: [...write, yes] },
 ];
-/** `--file` is a value here (a path in the project), where elsewhere it is a switch. */
-export const FLOWS_VALUE_FLAGS = new Set(['file', 'param']);
+/** `--file` is a value here (a path in the project), where elsewhere it is a switch; so are unattended's `--budget`, `--runs` and `--include`. */
+export const FLOWS_VALUE_FLAGS = new Set(['file', 'param', 'budget', 'runs', 'include']);
 export async function runFlowsCommand(positional, flags, context) {
     const [first, second] = positional;
     const action = first === 'trigger' || first === 'script' || first === 'card' ? `${first} ${second ?? ''}`.trim() : first ?? 'list';
@@ -104,7 +111,7 @@ export async function runFlowsCommand(positional, flags, context) {
         const flow = flowOf(args[0], context.projects);
         if (flow === null)
             return fail('unknown-flow', 'No such flow in your projects. toolroll flows list names them.');
-        const shown = describeFlow(store, flow);
+        const shown = describeFlow(store, flow, context.clock());
         return ok({ flow: shown }, showLines(shown));
     }
     if (action === 'export') {
@@ -197,7 +204,7 @@ export async function runFlowsCommand(positional, flags, context) {
             if (!switched.ok)
                 return refuse(project, 'refused', switched.said);
             record(project, 'accepted', `flow #${switched.flow}`);
-            return ok({ applied: true, flow: describeFlow(store, store.getFlow(switched.flow)) }, [`${switched.said} Flow #${switched.flow}.`]);
+            return ok({ applied: true, flow: describeFlow(store, store.getFlow(switched.flow), context.clock()) }, [`${switched.said} Flow #${switched.flow}.`]);
         }
         const template = templateId === null ? null : FLOW_TEMPLATES.find(one => one.id === templateId) ?? null;
         if (templateId !== null && template === null)
@@ -250,7 +257,7 @@ export async function runFlowsCommand(positional, flags, context) {
             return refuse(project, 'invalid-trigger', error instanceof Error ? error.message : 'Its trigger isn\'t valid.');
         }
         record(project, 'accepted', `flow #${id}`);
-        return ok({ applied: true, flow: describeFlow(store, store.getFlow(id)) }, [`Created ${flowName}, flow #${id}. Add cards with toolroll flows card add ${id} --title "…".`]);
+        return ok({ applied: true, flow: describeFlow(store, store.getFlow(id), context.clock()) }, [`Created ${flowName}, flow #${id}. Add cards with toolroll flows card add ${id} --title "…".`]);
     }
     if (action === 'script save') {
         const given = text('repo');
@@ -328,7 +335,7 @@ export async function runFlowsCommand(positional, flags, context) {
             return refuse(project, 'invalid-file', error instanceof Error ? error.message : 'That flow couldn\'t be imported.');
         }
         record(project, 'accepted', `flow #${made.id}`);
-        return ok({ applied: true, flow: describeFlow(store, store.getFlow(made.id)), said: made.said }, [`${made.said} Flow #${made.id}.`]);
+        return ok({ applied: true, flow: describeFlow(store, store.getFlow(made.id), context.clock()), said: made.said }, [`${made.said} Flow #${made.id}.`]);
     }
     if (action === 'script approve') {
         const given = text('repo'), name = text('name');
@@ -352,6 +359,33 @@ export async function runFlowsCommand(positional, flags, context) {
     if (flow === null)
         return refuse(null, 'unknown-flow', 'No such flow in your projects. toolroll flows list names them.');
     const definition = flowDefinitionOf(flow);
+    if (action === 'unattended') {
+        const flow = flowOf(args[0], reachable);
+        if (flow === null)
+            return refuse(null, 'unknown-flow', 'No such flow in your projects. toolroll flows list names them.');
+        const turn = args[1];
+        if (turn !== 'on' && turn !== 'off')
+            return fail('usage', `Use flows unattended ${flow.id} on --days N, or flows unattended ${flow.id} off.`, EXIT.usage);
+        if (turn === 'off') {
+            // Lowering authority is one step for any approver on the project.
+            if (!revokeUnattended(store, flow.id, who, now))
+                return refuse(flow.repo, 'not-on', `${flow.name} isn't running on its own. Nothing was changed.`);
+            record(flow.repo, 'accepted', `flow #${flow.id} off`);
+            return ok({ applied: true, unattended: null }, [`${flow.name} no longer runs on its own. Its next cards wait for you; running work is untouched.`]);
+        }
+        const asked = parseUnattendedAsk({ days: text('days') ?? '1', budget: text('budget') ?? '', runs: text('runs') ?? '', include: text('include') ?? '' });
+        if (!asked.ok)
+            return fail('usage', asked.message, EXIT.usage);
+        const signed = await signUnattended(store, { flow: flow.id, signer: who, ask: asked.ask }, now);
+        if (!signed.ok)
+            return refuse(flow.repo, 'refused', `${signed.message} Nothing was changed.`);
+        record(flow.repo, 'accepted', `flow #${flow.id} on until ${signed.grant.absoluteExpiry}`);
+        return ok({ applied: true, unattended: unattendedJson(store, flow, now) }, [
+            `${flow.name} runs on its own until ${untilWords(signed.grant.absoluteExpiry)}. Signed by ${who}:`,
+            ...unattendedWords(signed.grant.terms).map(line => `  ${line}`),
+            `Revoke: toolroll flows unattended ${flow.id} off`,
+        ]);
+    }
     if (action === 'archive') {
         const cards = store.flowCards(flow.id, false).length, triggers = store.flowTriggers(flow.id).filter(one => one.state === 'active').length;
         if (!flags.has('yes'))
@@ -395,7 +429,7 @@ export async function runFlowsCommand(positional, flags, context) {
             return refuse(flow.repo, 'stale', 'Someone else changed this flow. Look again, then make yours.');
         record(flow.repo, 'accepted', `flow #${flow.id}`);
         settle(flow.repo);
-        return ok({ applied: true, flow: describeFlow(store, store.getFlow(flow.id)) }, [`Saved ${name}.`]);
+        return ok({ applied: true, flow: describeFlow(store, store.getFlow(flow.id), context.clock()) }, [`Saved ${name}.`]);
     }
     if (action === 'card add') {
         const title = text('title');
@@ -471,6 +505,7 @@ export async function runFlowsCommand(positional, flags, context) {
         const made = addFlowTriggerTo(store, flow, input.value, who, now, context.configDir);
         if (!made.ok)
             return refuse(flow.repo, 'invalid-trigger', made.message);
+        await prepareUnattendedCandidates(store, flow.id);
         record(flow.repo, 'accepted', `flow #${flow.id} trigger #${made.id}`);
         settle(flow.repo);
         // A webhook's address (and GitHub's signing secret) is shown this once, never stored readable.
@@ -490,9 +525,9 @@ export async function runFlowsCommand(positional, flags, context) {
         return checked.ok ? ok({ applied: true, triggerId: trigger.id, said: checked.said }, [checked.said]) : fail('check-failed', checked.said);
     }
     if (action === 'trigger remove')
-        removeFlowTrigger(store, trigger, now, context.configDir);
+        removeFlowTrigger(store, trigger, now, context.configDir, who);
     else
-        setFlowTriggerOn(store, trigger, action !== 'trigger pause', now);
+        setFlowTriggerOn(store, trigger, action !== 'trigger pause', now, who);
     record(flow.repo, 'accepted', `flow #${flow.id} trigger #${trigger.id}`);
     settle(flow.repo);
     const said = action === 'trigger remove' ? 'Trigger removed.' : action === 'trigger pause' ? 'Trigger paused.' : 'Trigger on again.';
@@ -524,7 +559,7 @@ function zoneOf(stage, flow) {
 function cardOf(definition, card) {
     return { id: card.id, title: card.title, zone: card.stage, zoneTitle: definition?.stages.find(one => one.id === card.stage)?.title ?? card.stage, state: card.state, waiting: card.waiting, task: card.task ?? card.primaryTask, updatedAt: card.updatedAt };
 }
-function describeFlow(store, flow) {
+function describeFlow(store, flow, now) {
     const definition = flowDefinitionOf(flow);
     return {
         id: flow.id, name: flow.name, repo: flow.repo, project: projectName(flow.repo), owner: flow.owner, revision: flow.revision, readable: definition !== null,
@@ -537,14 +572,24 @@ function describeFlow(store, flow) {
                 ...(config?.kind === 'schedule' && config.order !== undefined ? { order: describeStandingOrder(config.order, flow.repo, config.schedule) } : {}) };
         }),
         cards: store.flowCards(flow.id, true).slice(0, 10).map(card => cardOf(definition, card)),
+        unattended: unattendedJson(store, flow, now),
     };
 }
+/** Whether a flow runs on its own, and until when: null when it doesn't. */
+function unattendedJson(store, flow, now) {
+    const live = activeUnattendedGrant(store, flow.id, now) === null ? null : unattendedViewOf(store, flow, { name: flow.owner, approver: true }, now).active;
+    return live === null ? null : { until: live.until, signedBy: live.signedBy, budgetMicrousd: live.budgetMicrousd, dailyRunCap: live.dailyRunCap, runsToday: live.runsToday, covers: live.covers };
+}
 function showLines(flow) {
     const title = (id) => id === null ? null : flow.zones.find(one => one.id === id)?.title ?? id;
     if (!flow.readable)
         return [`#${flow.id} ${flow.name} · ${flow.project}`, 'This flow\'s drawing can\'t be read. Save it again from the editor.'];
     return [
         `#${flow.id} ${flow.name} · ${flow.project} · owner ${flow.owner}`,
+        flow.unattended === null
+            ? `Runs on its own: no · turn on: toolroll flows unattended ${flow.id} on --days N`
+            : `Runs on its own until ${untilWords(flow.unattended.until)} · revoke: toolroll flows unattended ${flow.id} off`,
+        ...(flow.unattended === null ? [] : [`  Covers: ${flow.unattended.covers.join('; ')}`]),
         '', 'Zones',
         ...flow.zones.flatMap((zone, index) => [
             `  ${index + 1}. ${zone.title} (${zone.id}) — ${zone.does}${zone.id === flow.start ? ' · start' : ''}`,

package/dist/flows-ui.d.ts

@@ -29,7 +29,8 @@ export declare function flowView(store: Store, flow: FlowRow, viewer: {
     repos: readonly string[];
     startTrigger?: number | null;
     sortReady?: boolean;
-    toolHome?: string;
+    toolHome?: string | undefined;
+    now?: Date;
 }): BrowserFlowView;
 /** The page the canvas replaces when scripts can't run: each zone and its cards, in order. */
 export declare function flowFallbackHtml(view: BrowserFlowView): Html;

package/dist/flows-ui.js

@@ -16,6 +16,7 @@ import { labelOf, nameOf } from "./subagent-admin.js";
 import { callWords, receiptWords } from "./subagent-tools.js";
 import { undoFor } from "./subagent-week.js";
 import { flowCardTaskLine } from "./flow-card-task.js";
+import { unattendedViewOf } from "./flow-unattended.js";
 import { readFlowSecrets } from "./flow-secrets.js";
 import { html, joinHtml, postForm } from "./html.js";
 const projectName = (repo) => repo.split(/[\\/]/).filter(Boolean).pop() ?? repo;
@@ -211,6 +212,7 @@ export function flowView(store, flow, viewer, selectedCard, setup = { dir: null,
         selectedCard,
         live: flowFingerprint(store, flow.id),
         canEdit: viewer.approver,
+        unattended: unattendedViewOf(store, flow, viewer, setup.now ?? now),
         approvers: store.listApprovers().map(one => one.name).filter(name => store.accountCanAccess(name, flow.repo)),
         projects: [flow.repo, ...setup.repos.filter(one => one !== flow.repo)].map(path => ({ path, name: projectName(path) })),
         kinds: FLOW_STAGE_KINDS.map(kind => ({ kind, label: FLOW_KIND_WORDS[kind].label, about: FLOW_KIND_WORDS[kind].about })),
@@ -219,7 +221,8 @@ export function flowView(store, flow, viewer, selectedCard, setup = { dir: null,
 }
 /** The page the canvas replaces when scripts can't run: each zone and its cards, in order. */
 export function flowFallbackHtml(view) {
-    return html `<section class="flows flow-fallback"><p class="meta">${view.flow.project}</p><ol>${view.stages.map(stage => {
+    const own = view.unattended.active;
+    return html `<section class="flows flow-fallback"><p class="meta">${view.flow.project}</p>${own !== null && html `<p data-flow-unattended>Runs on its own until ${own.untilWords}</p>`}<ol>${view.stages.map(stage => {
         const cards = view.cards.filter(card => card.stage === stage.id && card.state === "active");
         return html `<li><strong>${stage.title}</strong> · ${FLOW_KIND_WORDS[stage.kind].label}${cards.length > 0 && html `<ul>${cards.map(card => html `<li>${card.title}${card.waiting !== null && ` — ${card.waiting}`}</li>`)}</ul>`}</li>`;
     })}</ol></section>`;

package/dist/google-mail.d.ts

@@ -9,6 +9,7 @@ export type GoogleMail = {
     refreshToken: string | null;
     address: string | null;
 };
+/** The saved client and connection; null when there's none. A keychain that refuses throws (SecretStoreError). */
 export declare function readGoogleMail(dir: string | null): GoogleMail | null;
 /** Connected: a refresh token and the address it belongs to. */
 export declare function googleConnected(dir: string | null): {

package/dist/google-mail.js

@@ -7,27 +7,31 @@
  * and pastes its ID and secret into Settings → Email. Connecting sends them
  * to Google's consent screen; Google sends them back here with a one-time
  * code (checked against a state and a PKCE verifier made for that visit),
- * which becomes a refresh token. The client secret and refresh token live
- * in a 0600 file beside the database, never in a column, a log or a page.
+ * which becomes a refresh token. The client secret and refresh token are
+ * kept by Toolroll (tool-secret-store.ts: the keychain, or an owner-only file
+ * beside the database where there's none), never in a column, a log or a page.
  * Mail itself goes over IMAP and SMTP with XOAUTH2, so reading and sending
  * are the same code as for any other mail server.
  */
 import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-const FILE = "google-mail.json";
+import { SecretStoreError, readHeldSecret, writeHeldSecret } from "./tool-secret-store.js";
+const HELD = { name: "google-mail", file: ["google-mail.json"] };
 export const GOOGLE_AUTH = "https://accounts.google.com/o/oauth2/v2/auth";
 export const GOOGLE_TOKEN = "https://oauth2.googleapis.com/token";
 const GOOGLE_REVOKE = "https://oauth2.googleapis.com/revoke";
 /** Full mail access is what IMAP and SMTP sign-in needs; "email" says which address it is. */
 export const GOOGLE_SCOPE = "https://mail.google.com/ openid email";
 export const GOOGLE_CALLBACK = "/settings/google/callback";
+/** The saved client and connection; null when there's none. A keychain that refuses throws (SecretStoreError). */
 export function readGoogleMail(dir) {
-    if (dir === null || !existsSync(join(dir, FILE)))
+    if (dir === null)
+        return null;
+    const text = readHeldSecret(dir, HELD.name, HELD.file);
+    if (text === null)
         return null;
     try {
-        const raw = JSON.parse(readFileSync(join(dir, FILE), "utf8"));
-        if (typeof raw["clientId"] !== "string" || typeof raw["clientSecret"] !== "string")
+        const raw = JSON.parse(text);
+        if (raw === null || typeof raw["clientId"] !== "string" || typeof raw["clientSecret"] !== "string")
             return null;
         return { clientId: raw["clientId"], clientSecret: raw["clientSecret"], refreshToken: typeof raw["refreshToken"] === "string" ? raw["refreshToken"] : null, address: typeof raw["address"] === "string" ? raw["address"] : null };
     }
@@ -37,23 +41,39 @@ export function readGoogleMail(dir) {
 }
 /** Connected: a refresh token and the address it belongs to. */
 export function googleConnected(dir) {
-    const saved = readGoogleMail(dir);
+    let saved;
+    try {
+        saved = readGoogleMail(dir);
+    }
+    catch {
+        saved = null;
+    }
     return saved?.refreshToken && saved.address ? { address: saved.address } : null;
 }
 function write(dir, value) {
-    writeFileSync(join(dir, FILE), JSON.stringify(value), { mode: 0o600 });
-    chmodSync(join(dir, FILE), 0o600);
+    writeHeldSecret(dir, HELD.name, HELD.file, JSON.stringify(value));
 }
 /** Save the OAuth client from Settings; an empty secret keeps the saved one. A new client forgets the old connection. */
 export function saveGoogleClient(dir, input) {
     const clientId = typeof input.clientId === "string" ? input.clientId.trim() : "";
     if (!/^[0-9]{6,20}-[a-z0-9]{8,64}\.apps\.googleusercontent\.com$/.test(clientId))
         return { ok: false, message: "That doesn't look like a Google OAuth client ID. It ends in .apps.googleusercontent.com." };
-    const before = readGoogleMail(dir);
+    let before;
+    try {
+        before = readGoogleMail(dir);
+    }
+    catch (error) {
+        return { ok: false, message: error instanceof SecretStoreError ? error.message : "The saved client couldn't be read." };
+    }
     const clientSecret = typeof input.clientSecret === "string" && input.clientSecret.trim() !== "" ? input.clientSecret.trim() : before?.clientId === clientId ? before.clientSecret : "";
     if (!/^[A-Za-z0-9_-]{16,80}$/.test(clientSecret))
         return { ok: false, message: "Paste the client secret from the same OAuth client." };
-    write(dir, { clientId, clientSecret, refreshToken: before?.clientId === clientId ? before.refreshToken : null, address: before?.clientId === clientId ? before.address : null });
+    try {
+        write(dir, { clientId, clientSecret, refreshToken: before?.clientId === clientId ? before.refreshToken : null, address: before?.clientId === clientId ? before.address : null });
+    }
+    catch (error) {
+        return { ok: false, message: error instanceof SecretStoreError ? error.message : "The client couldn't be saved." };
+    }
     return { ok: true };
 }
 /** Where to send the person to consent, and what to remember to check their return against. */
@@ -89,7 +109,13 @@ function addressOf(idToken) {
 }
 /** The one-time code from Google's redirect, exchanged for a refresh token and saved. */
 export async function finishGoogleConsent(dir, visit, code, fetcher) {
-    const client = readGoogleMail(dir);
+    let client;
+    try {
+        client = readGoogleMail(dir);
+    }
+    catch (error) {
+        return { ok: false, message: error instanceof SecretStoreError ? error.message : "The saved client couldn't be read." };
+    }
     if (client === null)
         return { ok: false, message: "Save the Google OAuth client first." };
     let answer;
@@ -107,14 +133,25 @@ export async function finishGoogleConsent(dir, visit, code, fetcher) {
     const address = addressOf(answer.body["id_token"]);
     if (address === null)
         return { ok: false, message: "Google didn't say which address this is. Connect again." };
-    write(dir, { ...client, refreshToken: refresh, address });
+    try {
+        write(dir, { ...client, refreshToken: refresh, address });
+    }
+    catch (error) {
+        return { ok: false, message: error instanceof SecretStoreError ? error.message : "The connection couldn't be saved." };
+    }
     cached.delete(client.clientId);
     return { ok: true, address };
 }
 const cached = new Map();
 /** A fresh access token for IMAP and SMTP (kept in memory until a minute before it ends). */
 export async function googleAccessToken(dir, fetcher, now = Date.now()) {
-    const saved = readGoogleMail(dir);
+    let saved;
+    try {
+        saved = readGoogleMail(dir);
+    }
+    catch (error) {
+        return { ok: false, said: error instanceof SecretStoreError ? error.message : "The Google connection couldn't be read.", permanent: false };
+    }
     if (saved?.refreshToken == null || saved.address === null)
         return { ok: false, said: "The Google account isn't connected. Connect it in Settings → Email.", permanent: true };
     const hit = cached.get(saved.clientId);
@@ -138,7 +175,13 @@ export async function googleAccessToken(dir, fetcher, now = Date.now()) {
 }
 /** Disconnect: Google forgets the grant (best effort), and the file goes. */
 export async function disconnectGoogle(dir, fetcher) {
-    const saved = readGoogleMail(dir);
+    let saved;
+    try {
+        saved = readGoogleMail(dir);
+    }
+    catch {
+        saved = null;
+    }
     if (saved?.refreshToken) {
         try {
             await fetcher(`${GOOGLE_REVOKE}?${new URLSearchParams({ token: saved.refreshToken })}`, { method: "POST", signal: AbortSignal.timeout(10_000) });
@@ -147,5 +190,5 @@ export async function disconnectGoogle(dir, fetcher) {
     }
     if (saved !== null)
         cached.delete(saved.clientId);
-    rmSync(join(dir, FILE), { force: true });
+    writeHeldSecret(dir, HELD.name, HELD.file, null);
 }

package/dist/integrations-ui.d.ts

@@ -5,10 +5,11 @@
  * render never waits on one (see integrations.ts).
  */
 import { type Html } from "./html.js";
-import { type Integration } from "./integrations.js";
+import { type Integration, type SecretsKept } from "./integrations.js";
 export declare const INTEGRATIONS_CSS: string;
 export declare function integrationsHtml(list: readonly Integration[], csrf: string, notice: {
     said?: string | null;
     problem?: string | null;
     checking?: boolean;
+    secrets?: SecretsKept;
 }): Html;

package/dist/integrations-ui.js

@@ -5,7 +5,7 @@
  * render never waits on one (see integrations.ts).
  */
 import { html, joinHtml, postForm } from "./html.js";
-import { STATE_WORDS } from "./integrations.js";
+import { STATE_WORDS, secretsNote } from "./integrations.js";
 import { whenUtc } from "./when-html.js";
 import { brandMarkHtml } from "./brand-mark.js";
 const when = (at) => whenUtc(at);
@@ -49,7 +49,7 @@ function row(one, csrf) {
     const badge = !one.checked && one.state === "connected"
         ? html `<span class="integration-state integration-state--checking"><i aria-hidden="true"></i>Checking</span>`
         : html `<span class="integration-state integration-state--${one.state}"><i aria-hidden="true"></i>${STATE_WORDS[one.state]}</span>`;
-    const facts = [one.account, one.detail].filter(Boolean).join(" · ");
+    const facts = [one.account, one.detail, one.credentials].filter(Boolean).join(" · ");
     const command = one.action.kind !== "test" ? one.action.command : null;
     const fix = one.action.kind === "fix" ? html `<p class="integration-fix" role="status">${one.action.words}</p>` : "";
     const run = command === null || (one.action.kind === "fix" && one.action.words.includes(command)) ? "" : html `<p class="meta">Run <code>${command}</code> on the computer running Toolroll.</p>`;
@@ -69,5 +69,8 @@ export function integrationsHtml(list, csrf, notice) {
         const rows = list.filter(one => one.group === group);
         return rows.length === 0 ? "" : html `<h2>${title}</h2>${rows.map(one => row(one, csrf))}`;
     });
-    return html `<section class="integrations">${note}${summary}${sections}</section>`;
+    // No keychain here, or Toolroll's folder for secrets can't be used: said once, plainly.
+    const said = secretsNote(list, notice.secrets);
+    const kept = said === null ? "" : said.problem ? html `<p class="problem integration-secrets" role="alert">${said.words}</p>` : html `<p class="meta integration-secrets" role="note">${said.words}</p>`;
+    return html `<section class="integrations">${note}${summary}${kept}${sections}</section>`;
 }

package/dist/integrations.d.ts

@@ -38,6 +38,8 @@ export type Integration = {
     action: IntegrationAction;
     /** A project's own MCP tool: it shows a letter, never a logo matched by name. */
     custom?: true;
+    /** A project's MCP tool: how its runs get credentials ("Short-lived token per run", "Key held by Toolroll"). */
+    credentials?: string;
 };
 export declare const STATE_WORDS: Record<IntegrationState, string>;
 export type ProbeResult = {
@@ -69,7 +71,7 @@ export type IntegrationIo = {
     /** The same sign-in check Settings → AI providers makes. */
     checkConnection?: ConnectionChecker;
     /** Where project tool secrets live. */
-    toolHome?: string;
+    toolHome?: string | undefined;
     /** Whether a mail server answers at host:port (tests replace it). */
     reach?: (host: string, port: number, secure: boolean) => Promise<void>;
     clock?: () => Date;
@@ -97,8 +99,20 @@ export declare function integrationsNow(io: IntegrationIo): Integration[];
 export declare function checkIntegrations(io: IntegrationIo, keys?: readonly string[]): Promise<Integration[]>;
 /** The one line `status` and `onboard` add when something is Broken; null when nothing is. */
 export declare function integrationsBrokenLine(list: readonly Integration[]): string | null;
-/** The CLI's lines: one per integration, then the fix under anything Broken. */
-export declare function renderIntegrations(list: readonly Integration[]): string[];
+/** Where secrets rest (project-tools.ts toolSecretStorage), as Settings and the CLI take it. */
+export type SecretsKept = {
+    words: string;
+    filesOnly: boolean;
+    problem?: string;
+};
+/** The one line about where secrets rest, or null: a folder that can't be used always; files only once something set up holds secrets. */
+export declare function secretsNote(list: readonly Integration[], secrets: SecretsKept | null | undefined): {
+    words: string;
+    problem: boolean;
+} | null;
+/** The CLI's lines: one per integration, then the fix under anything Broken; last, where secrets are kept when that is
+ * files only, or why they can't be used (secretsNote). */
+export declare function renderIntegrations(list: readonly Integration[], secrets?: SecretsKept | null): string[];
 export type IntegrationMonitor = {
     /** The list now, without waiting; starts a background check when the last one is older than the cache. */
     list(): Integration[];

package/dist/integrations.js

@@ -17,7 +17,6 @@
  */
 import { connect as tcpConnect } from "node:net";
 import { connect as tlsConnect } from "node:tls";
-import { homedir } from "node:os";
 import { basename } from "node:path";
 import { ALL_CREDENTIAL_ENV } from "./provider.js";
 import { providerName, signInCommand } from "./provider-auth.js";
@@ -29,7 +28,7 @@ import { effectivePrimary } from "./webhooks.js";
 import { readEmailSettings } from "./email-settings.js";
 import { googleConnected } from "./google-mail.js";
 import { LINEAR_URL, readHooksBase, readLinearKey } from "./flow-triggers.js";
-import { projectToolsOf, readToolSecrets, missingSecrets, testToolOf } from "./project-tools.js";
+import { credentialModeOf, projectToolsOf, readToolSecrets, missingSecrets, secretsSetFor, testToolOf } from "./project-tools.js";
 import { origin, readMonitoring } from "./monitoring-settings.js";
 import { targetOf } from "./monitoring.js";
 export const STATE_WORDS = { connected: "Connected", "not-set-up": "Not set up", broken: "Broken" };
@@ -375,15 +374,23 @@ function targets(io) {
         probe: email === null ? null : check => probeEmail(check, { host: email.host, port: email.port, secure: email.secure }, email.imap),
     });
     // Each project's MCP tools: the server starts and lists its tools.
-    const toolHome = io.toolHome ?? homedir();
+    const toolHome = io.toolHome;
     let anyTool = false;
     for (const repo of io.repos) {
         for (const tool of projectToolsOf(store, repo)) {
             anyTool = true;
             const href = `/settings/tools?repo=${encodeURIComponent(repo)}#tool-${encodeURIComponent(tool.name)}`;
             const test = tool.lastTest;
+            // Which secrets are set, by name only: no value is read to say how runs get them.
+            let credentials;
+            try {
+                credentials = credentialModeOf(tool.spec, secretsSetFor(repo, tool.spec, toolHome))?.words;
+            }
+            catch {
+                credentials = undefined;
+            }
             list.push({
-                key: `mcp:${repo}:${tool.name}`, group: "tools", name: tool.name, configured: true, account: basename(repo), ...(tool.source === "custom" ? { custom: true } : {}),
+                key: `mcp:${repo}:${tool.name}`, group: "tools", name: tool.name, configured: true, account: basename(repo), ...(tool.source === "custom" ? { custom: true } : {}), ...(credentials === undefined ? {} : { credentials }),
                 setup: place(href), fix: place(href), usedBy: [`Tasks in ${basename(repo)}`],
                 activity: test === null ? NO_ACTIVITY : test.ok ? { okAt: test.at, error: null, errorAt: null, failing: false } : { okAt: null, error: test.problem, errorAt: test.at, failing: false },
                 probe: async (check) => {
@@ -432,7 +439,7 @@ function targets(io) {
 }
 // ---------------------------------------------------------------- the list
 function combine(target, row) {
-    const base = { key: target.key, group: target.group, name: target.name, usedBy: target.usedBy, ...(target.custom ? { custom: true } : {}) };
+    const base = { key: target.key, group: target.group, name: target.name, usedBy: target.usedBy, ...(target.custom ? { custom: true } : {}), ...(target.credentials === undefined ? {} : { credentials: target.credentials }) };
     const checked = target.probe === null || row !== undefined;
     const lastSuccessAt = later(row?.okAt ?? null, target.activity.okAt);
     const checkError = row?.error ?? null, checkErrorAt = row?.errorAt ?? null;
@@ -482,20 +489,33 @@ export function integrationsBrokenLine(list) {
     return `Broken integration${broken.length === 1 ? "" : "s"}: ${names}. See \`toolroll integrations\` or Settings → Integrations.`;
 }
 const whenText = (at) => (at === null ? "never" : `${at.slice(0, 16).replace("T", " ")} UTC`);
-/** The CLI's lines: one per integration, then the fix under anything Broken. */
-export function renderIntegrations(list) {
+/** Integrations whose secrets Toolroll holds: project tools, the Linear key, a Google mail connection. */
+const holdsSecrets = (one) => one.group === "tools" || one.key === "linear" || one.key === "email";
+/** The one line about where secrets rest, or null: a folder that can't be used always; files only once something set up holds secrets. */
+export function secretsNote(list, secrets) {
+    if (secrets === null || secrets === undefined)
+        return null;
+    if (secrets.problem !== undefined)
+        return { words: secrets.problem, problem: true };
+    return secrets.filesOnly && list.some(one => holdsSecrets(one) && one.state !== "not-set-up") ? { words: secrets.words, problem: false } : null;
+}
+/** The CLI's lines: one per integration, then the fix under anything Broken; last, where secrets are kept when that is
+ * files only, or why they can't be used (secretsNote). */
+export function renderIntegrations(list, secrets = null) {
     const width = Math.min(24, Math.max(...list.map(one => one.name.length)));
-    return list.flatMap(one => {
-        const facts = [one.account, one.detail].filter(Boolean).join(" · ");
-        const lines = [`${one.name.padEnd(width)}  ${STATE_WORDS[one.state].padEnd(10)}${facts === "" ? "" : `  ${facts}`}`];
-        if (one.state !== "not-set-up")
-            lines.push(`${"".padEnd(width)}  last success ${whenText(one.lastSuccessAt)}${one.lastError === null ? "" : ` · last error ${whenText(one.lastErrorAt)}: ${one.lastError}`}`);
-        if (one.action.kind === "fix")
-            lines.push(`${"".padEnd(width)}  Fix: ${one.action.words}${one.action.command === null || one.action.words.includes(one.action.command) ? "" : ` (run ${one.action.command})`}`);
-        if (one.action.kind === "setup")
-            lines.push(`${"".padEnd(width)}  Set up: ${one.action.command !== null ? `run ${one.action.command}` : `Settings (${one.action.href ?? "/settings"})`}`);
-        return lines;
-    });
+    const said = secretsNote(list, secrets);
+    const note = said === null ? [] : [said.words];
+    return [...list.flatMap(one => {
+            const facts = [one.account, one.detail, one.credentials].filter(Boolean).join(" · ");
+            const lines = [`${one.name.padEnd(width)}  ${STATE_WORDS[one.state].padEnd(10)}${facts === "" ? "" : `  ${facts}`}`];
+            if (one.state !== "not-set-up")
+                lines.push(`${"".padEnd(width)}  last success ${whenText(one.lastSuccessAt)}${one.lastError === null ? "" : ` · last error ${whenText(one.lastErrorAt)}: ${one.lastError}`}`);
+            if (one.action.kind === "fix")
+                lines.push(`${"".padEnd(width)}  Fix: ${one.action.words}${one.action.command === null || one.action.words.includes(one.action.command) ? "" : ` (run ${one.action.command})`}`);
+            if (one.action.kind === "setup")
+                lines.push(`${"".padEnd(width)}  Set up: ${one.action.command !== null ? `run ${one.action.command}` : `Settings (${one.action.href ?? "/settings"})`}`);
+            return lines;
+        }), ...note];
 }
 /** Checks in the background with a short cache, as the first-run suggestions are: a render never waits on a check. */
 export function createIntegrationMonitor(io, options = {}) {