toolroll 0.9.62 → 0.9.65

package/dist/flows-cli.d.ts

@@ -269,6 +269,33 @@ export declare const FLOWS_DESCRIPTORS: readonly [{
         readonly takesValue: true;
         readonly meaning: "the script's name";
     }];
+}, {
+    readonly action: 'unattended';
+    readonly synopsis: "let a flow's own schedule run without approving each card (on: the owner signs, 1 to 7 days; off: any approver revokes)";
+    readonly mutation: 'identity-idempotent';
+    readonly audience: 'operator';
+    readonly positionals: readonly ['flow', 'on|off'];
+    readonly flags: readonly [...{
+        name: string;
+        takesValue: boolean;
+        meaning: string;
+    }[], {
+        readonly name: 'days';
+        readonly takesValue: true;
+        readonly meaning: "how long it lasts: 1 to 7 days (default 1)";
+    }, {
+        readonly name: 'budget';
+        readonly takesValue: true;
+        readonly meaning: 'optional dollar cap per attempt, like 5 or 2.50';
+    }, {
+        readonly name: 'runs';
+        readonly takesValue: true;
+        readonly meaning: "optional limit on runs a day (UTC), 1 to 50";
+    }, {
+        readonly name: 'include';
+        readonly takesValue: true;
+        readonly meaning: 'also cover these script or plane-review schedules (trigger ids, like 12,14); plain schedules are covered already';
+    }];
 }, {
     readonly action: 'archive';
     readonly synopsis: 'archive a flow: its cards stop moving and its triggers stop; previews until --yes';
@@ -284,7 +311,7 @@ export declare const FLOWS_DESCRIPTORS: readonly [{
         meaning: string;
     }];
 }];
-/** `--file` is a value here (a path in the project), where elsewhere it is a switch. */
+/** `--file` is a value here (a path in the project), where elsewhere it is a switch; so are unattended's `--budget`, `--runs` and `--include`. */
 export declare const FLOWS_VALUE_FLAGS: ReadonlySet<string>;
 export type FlowsCliContext = {
     store: Store;

package/dist/flows-cli.js

@@ -16,9 +16,12 @@ import { saveScript } from './flow-scripts.js';
 import { exportFlow, fetchFlowFile, FLOW_FILE_MAX_BYTES, FlowFileError, importFlow, parseFlowFile, planFlowImport } from './flow-share.js';
 import { describeStandingOrder } from './flow-schedule.js';
 import { STARTER_FLOWS, starterFlowOf, starterOf, startersFor, starterTerms, switchOnStarter } from './flow-starters.js';
-import { addFlowTriggerTo, checkFlowTriggerNow, describeTrigger, removeFlowTrigger, setFlowTriggerOn, triggerConfigOf, validateTriggerConfig } from './flow-triggers.js';
+import { addFlowTriggerTo, checkFlowTriggerNow, describeTrigger, removeFlowTrigger, setFlowTriggerOn, triggerConfigOf, validateTriggerConfig, rawTakesDeliveries } from './flow-triggers.js';
 import { deciderOf, FLOW_KIND_WORDS, FLOW_TEMPLATES, flowDigest, flowFromSteps, flowTerms, stepsFor } from './flows.js';
+import { prepareUnattendedCandidates, activeUnattendedGrant, parseUnattendedAsk, revokeUnattended, signUnattended, unattendedViewOf, unattendedWords, untilWords, UNATTENDED_MAX_RUNS } from './flow-unattended.js';
+import { MODE_MAX_DAYS } from './modes.js';
 import { verifyApproverByPassword } from './principal.js';
+import { proveCredential } from './scope.js';
 import { projectName } from './project.js';
 const EXIT = { ok: 0, failed: 1, usage: 2, refused: 3 };
 const json = { name: 'json', takesValue: false, meaning: 'answer with one machine envelope on stdout' };
@@ -62,10 +65,15 @@ export const FLOWS_DESCRIPTORS = [
     { action: 'import', synopsis: 'make a flow from a flow file or a gist/GitHub https address; previews in plain words until --yes; triggers arrive off and scripts wait for approval', mutation: 'unkeyed', positionals: ['file'], flags: [...write, yes, repo,
             { name: 'param', takesValue: true, meaning: 'a value the file asks for, as name=value (repeat for more)' }] },
     { action: 'script approve', synopsis: 'approve a script an imported flow brought, so it runs', mutation: 'identity-idempotent', flags: [...write, repo, { name: 'name', takesValue: true, meaning: "the script's name" }] },
+    { action: 'unattended', synopsis: `let a flow's own schedule run without approving each card (on: the owner signs, 1 to ${MODE_MAX_DAYS} days; off: any approver revokes)`, mutation: 'identity-idempotent', audience: 'operator', positionals: ['flow', 'on|off'], flags: [...write,
+            { name: 'days', takesValue: true, meaning: `how long it lasts: 1 to ${MODE_MAX_DAYS} days (default 1)` },
+            { name: 'budget', takesValue: true, meaning: 'optional dollar cap per attempt, like 5 or 2.50' },
+            { name: 'runs', takesValue: true, meaning: `optional limit on runs a day (UTC), 1 to ${UNATTENDED_MAX_RUNS}` },
+            { name: 'include', takesValue: true, meaning: 'also cover these script or plane-review schedules (trigger ids, like 12,14); plain schedules are covered already' }] },
     { action: 'archive', synopsis: 'archive a flow: its cards stop moving and its triggers stop; previews until --yes', mutation: 'identity-idempotent', positionals: ['flow'], flags: [...write, yes] },
 ];
-/** `--file` is a value here (a path in the project), where elsewhere it is a switch. */
-export const FLOWS_VALUE_FLAGS = new Set(['file', 'param']);
+/** `--file` is a value here (a path in the project), where elsewhere it is a switch; so are unattended's `--budget`, `--runs` and `--include`. */
+export const FLOWS_VALUE_FLAGS = new Set(['file', 'param', 'budget', 'runs', 'include']);
 export async function runFlowsCommand(positional, flags, context) {
     const [first, second] = positional;
     const action = first === 'trigger' || first === 'script' || first === 'card' ? `${first} ${second ?? ''}`.trim() : first ?? 'list';
@@ -104,7 +112,7 @@ export async function runFlowsCommand(positional, flags, context) {
         const flow = flowOf(args[0], context.projects);
         if (flow === null)
             return fail('unknown-flow', 'No such flow in your projects. toolroll flows list names them.');
-        const shown = describeFlow(store, flow);
+        const shown = describeFlow(store, flow, context.clock());
         return ok({ flow: shown }, showLines(shown));
     }
     if (action === 'export') {
@@ -197,7 +205,7 @@ export async function runFlowsCommand(positional, flags, context) {
             if (!switched.ok)
                 return refuse(project, 'refused', switched.said);
             record(project, 'accepted', `flow #${switched.flow}`);
-            return ok({ applied: true, flow: describeFlow(store, store.getFlow(switched.flow)) }, [`${switched.said} Flow #${switched.flow}.`]);
+            return ok({ applied: true, flow: describeFlow(store, store.getFlow(switched.flow), context.clock()) }, [`${switched.said} Flow #${switched.flow}.`]);
         }
         const template = templateId === null ? null : FLOW_TEMPLATES.find(one => one.id === templateId) ?? null;
         if (templateId !== null && template === null)
@@ -250,7 +258,7 @@ export async function runFlowsCommand(positional, flags, context) {
             return refuse(project, 'invalid-trigger', error instanceof Error ? error.message : 'Its trigger isn\'t valid.');
         }
         record(project, 'accepted', `flow #${id}`);
-        return ok({ applied: true, flow: describeFlow(store, store.getFlow(id)) }, [`Created ${flowName}, flow #${id}. Add cards with toolroll flows card add ${id} --title "…".`]);
+        return ok({ applied: true, flow: describeFlow(store, store.getFlow(id), context.clock()) }, [`Created ${flowName}, flow #${id}. Add cards with toolroll flows card add ${id} --title "…".`]);
     }
     if (action === 'script save') {
         const given = text('repo');
@@ -328,7 +336,7 @@ export async function runFlowsCommand(positional, flags, context) {
             return refuse(project, 'invalid-file', error instanceof Error ? error.message : 'That flow couldn\'t be imported.');
         }
         record(project, 'accepted', `flow #${made.id}`);
-        return ok({ applied: true, flow: describeFlow(store, store.getFlow(made.id)), said: made.said }, [`${made.said} Flow #${made.id}.`]);
+        return ok({ applied: true, flow: describeFlow(store, store.getFlow(made.id), context.clock()), said: made.said }, [`${made.said} Flow #${made.id}.`]);
     }
     if (action === 'script approve') {
         const given = text('repo'), name = text('name');
@@ -352,6 +360,33 @@ export async function runFlowsCommand(positional, flags, context) {
     if (flow === null)
         return refuse(null, 'unknown-flow', 'No such flow in your projects. toolroll flows list names them.');
     const definition = flowDefinitionOf(flow);
+    if (action === 'unattended') {
+        const flow = flowOf(args[0], reachable);
+        if (flow === null)
+            return refuse(null, 'unknown-flow', 'No such flow in your projects. toolroll flows list names them.');
+        const turn = args[1];
+        if (turn !== 'on' && turn !== 'off')
+            return fail('usage', `Use flows unattended ${flow.id} on --days N, or flows unattended ${flow.id} off.`, EXIT.usage);
+        if (turn === 'off') {
+            // Lowering authority is one step for any approver on the project.
+            if (!revokeUnattended(store, flow.id, who, now))
+                return refuse(flow.repo, 'not-on', `${flow.name} isn't running on its own. Nothing was changed.`);
+            record(flow.repo, 'accepted', `flow #${flow.id} off`);
+            return ok({ applied: true, unattended: null }, [`${flow.name} no longer runs on its own. Its next cards wait for you; running work is untouched.`]);
+        }
+        const asked = parseUnattendedAsk({ days: text('days') ?? '1', budget: text('budget') ?? '', runs: text('runs') ?? '', include: text('include') ?? '' });
+        if (!asked.ok)
+            return fail('usage', asked.message, EXIT.usage);
+        const signed = await signUnattended(store, { flow: flow.id, signer: who, ask: asked.ask }, now);
+        if (!signed.ok)
+            return refuse(flow.repo, 'refused', `${signed.message} Nothing was changed.`);
+        record(flow.repo, 'accepted', `flow #${flow.id} on until ${signed.grant.absoluteExpiry}`);
+        return ok({ applied: true, unattended: unattendedJson(store, flow, now) }, [
+            `${flow.name} runs on its own until ${untilWords(signed.grant.absoluteExpiry)}. Signed by ${who}:`,
+            ...unattendedWords(signed.grant.terms).map(line => `  ${line}`),
+            `Revoke: toolroll flows unattended ${flow.id} off`,
+        ]);
+    }
     if (action === 'archive') {
         const cards = store.flowCards(flow.id, false).length, triggers = store.flowTriggers(flow.id).filter(one => one.state === 'active').length;
         if (!flags.has('yes'))
@@ -395,7 +430,7 @@ export async function runFlowsCommand(positional, flags, context) {
             return refuse(flow.repo, 'stale', 'Someone else changed this flow. Look again, then make yours.');
         record(flow.repo, 'accepted', `flow #${flow.id}`);
         settle(flow.repo);
-        return ok({ applied: true, flow: describeFlow(store, store.getFlow(flow.id)) }, [`Saved ${name}.`]);
+        return ok({ applied: true, flow: describeFlow(store, store.getFlow(flow.id), context.clock()) }, [`Saved ${name}.`]);
     }
     if (action === 'card add') {
         const title = text('title');
@@ -468,9 +503,15 @@ export async function runFlowsCommand(positional, flags, context) {
             const zone = definition.stages.find(one => one.id === (config.zone ?? definition.start))?.title ?? 'the first zone';
             return preview(flow.repo, `Add a trigger to ${flow.name}`, [words, `Cards start in ${zone}.`, 'Work a card starts still waits for your usual approvals.'], { flowId: flow.id, trigger: config });
         }
-        const made = addFlowTriggerTo(store, flow, input.value, who, now, context.configDir);
+        // A trigger that takes deliveries mints an address: a credential act, a password typed for this command (never the
+        // remembered login under Passwordless) (docs/plans/passwordless.md).
+        const ingress = rawTakesDeliveries(input.value);
+        if (ingress && !proveCredential(store, acting.name, acting.token).ok)
+            return refuse(flow.repo, 'unauthenticated', 'Making a webhook address takes your password, typed: pass --token.');
+        const made = addFlowTriggerTo(store, flow, input.value, who, now, context.configDir, ingress ? { ingress: 'proved' } : {});
         if (!made.ok)
             return refuse(flow.repo, 'invalid-trigger', made.message);
+        await prepareUnattendedCandidates(store, flow.id);
         record(flow.repo, 'accepted', `flow #${flow.id} trigger #${made.id}`);
         settle(flow.repo);
         // A webhook's address (and GitHub's signing secret) is shown this once, never stored readable.
@@ -490,9 +531,9 @@ export async function runFlowsCommand(positional, flags, context) {
         return checked.ok ? ok({ applied: true, triggerId: trigger.id, said: checked.said }, [checked.said]) : fail('check-failed', checked.said);
     }
     if (action === 'trigger remove')
-        removeFlowTrigger(store, trigger, now, context.configDir);
+        removeFlowTrigger(store, trigger, now, context.configDir, who);
     else
-        setFlowTriggerOn(store, trigger, action !== 'trigger pause', now);
+        setFlowTriggerOn(store, trigger, action !== 'trigger pause', now, who);
     record(flow.repo, 'accepted', `flow #${flow.id} trigger #${trigger.id}`);
     settle(flow.repo);
     const said = action === 'trigger remove' ? 'Trigger removed.' : action === 'trigger pause' ? 'Trigger paused.' : 'Trigger on again.';
@@ -524,7 +565,7 @@ function zoneOf(stage, flow) {
 function cardOf(definition, card) {
     return { id: card.id, title: card.title, zone: card.stage, zoneTitle: definition?.stages.find(one => one.id === card.stage)?.title ?? card.stage, state: card.state, waiting: card.waiting, task: card.task ?? card.primaryTask, updatedAt: card.updatedAt };
 }
-function describeFlow(store, flow) {
+function describeFlow(store, flow, now) {
     const definition = flowDefinitionOf(flow);
     return {
         id: flow.id, name: flow.name, repo: flow.repo, project: projectName(flow.repo), owner: flow.owner, revision: flow.revision, readable: definition !== null,
@@ -537,14 +578,24 @@ function describeFlow(store, flow) {
                 ...(config?.kind === 'schedule' && config.order !== undefined ? { order: describeStandingOrder(config.order, flow.repo, config.schedule) } : {}) };
         }),
         cards: store.flowCards(flow.id, true).slice(0, 10).map(card => cardOf(definition, card)),
+        unattended: unattendedJson(store, flow, now),
     };
 }
+/** Whether a flow runs on its own, and until when: null when it doesn't. */
+function unattendedJson(store, flow, now) {
+    const live = activeUnattendedGrant(store, flow.id, now) === null ? null : unattendedViewOf(store, flow, { name: flow.owner, approver: true }, now).active;
+    return live === null ? null : { until: live.until, signedBy: live.signedBy, budgetMicrousd: live.budgetMicrousd, dailyRunCap: live.dailyRunCap, runsToday: live.runsToday, covers: live.covers };
+}
 function showLines(flow) {
     const title = (id) => id === null ? null : flow.zones.find(one => one.id === id)?.title ?? id;
     if (!flow.readable)
         return [`#${flow.id} ${flow.name} · ${flow.project}`, 'This flow\'s drawing can\'t be read. Save it again from the editor.'];
     return [
         `#${flow.id} ${flow.name} · ${flow.project} · owner ${flow.owner}`,
+        flow.unattended === null
+            ? `Runs on its own: no · turn on: toolroll flows unattended ${flow.id} on --days N`
+            : `Runs on its own until ${untilWords(flow.unattended.until)} · revoke: toolroll flows unattended ${flow.id} off`,
+        ...(flow.unattended === null ? [] : [`  Covers: ${flow.unattended.covers.join('; ')}`]),
         '', 'Zones',
         ...flow.zones.flatMap((zone, index) => [
             `  ${index + 1}. ${zone.title} (${zone.id}) — ${zone.does}${zone.id === flow.start ? ' · start' : ''}`,

package/dist/flows-ui.d.ts

@@ -1,5 +1,3 @@
-/** Flows in the console: the list of a person's flows, and one flow's canvas
- * (the React view's data, plus a plain fallback page the view replaces). */
 import type { BrowserFlowView } from "./browser-workspace.js";
 import type { FlowRow, Store } from "./store.js";
 import { type FlowFile, type FlowImportPlan } from "./flow-share.js";
@@ -29,7 +27,8 @@ export declare function flowView(store: Store, flow: FlowRow, viewer: {
     repos: readonly string[];
     startTrigger?: number | null;
     sortReady?: boolean;
-    toolHome?: string;
+    toolHome?: string | undefined;
+    now?: Date;
 }): BrowserFlowView;
 /** The page the canvas replaces when scripts can't run: each zone and its cards, in order. */
 export declare function flowFallbackHtml(view: BrowserFlowView): Html;

package/dist/flows-ui.js

@@ -1,6 +1,12 @@
+/** Flows in the console: the list of a person's flows, and one flow's canvas
+ * (the React view's data, plus a plain fallback page the view replaces). */
+import { liveAttemptOf, steerControlsFor } from "./steer-controls.js";
 import { draftFor, flowDefinitionOf } from "./flow-engine.js";
 import { describeStandingOrder } from "./flow-schedule.js";
-import { describeTrigger, triggerHeadline, FLOW_TRIGGER_KINDS, FLOW_TRIGGER_WORDS, githubRepoOf, HOOK_PATH, hookReady, planeStatusLink, readHooksBase, readLinearKey, takesDeliveries, triggerConfigOf } from "./flow-triggers.js";
+import { describeTrigger, triggerHeadline, FLOW_TRIGGER_KINDS, FLOW_TRIGGER_WORDS, githubRepoOf, HOOK_PATH, hookReady, planeStatusLink, readHooksBase, readLinearKey, senderOf, takesDeliveries, triggerConfigOf } from "./flow-triggers.js";
+import { SENDER_WORDS } from "./webhook-signing.js";
+import { READER_CAPTURED } from "./webhook-readers.js";
+import { hostOf, linkWords, provedWords, snapshotOf } from "./task-source.js";
 import { deciderOf, FLOW_COLORS, FLOW_KIND_WORDS, FLOW_STAGE_KINDS } from "./flows.js";
 import { flowInsights, troubleWords } from "./flow-insights.js";
 import { parseSortDecision, sortChip } from "./flow-sort.js";
@@ -16,9 +22,44 @@ import { labelOf, nameOf } from "./subagent-admin.js";
 import { callWords, receiptWords } from "./subagent-tools.js";
 import { undoFor } from "./subagent-week.js";
 import { flowCardTaskLine } from "./flow-card-task.js";
+import { unattendedViewOf } from "./flow-unattended.js";
 import { readFlowSecrets } from "./flow-secrets.js";
 import { html, joinHtml, postForm } from "./html.js";
 const projectName = (repo) => repo.split(/[\\/]/).filter(Boolean).pop() ?? repo;
+/** v126: what happens to deliveries turned away (refused with 503), as far as each sender is known to say: nothing
+ * here claims a loss that a sender's own retries may still make good. */
+function resendWords(config) {
+    if (config.kind === "github")
+        return "GitHub doesn't retry on its own: resend them from the repository's Settings → Webhooks → this webhook → Recent Deliveries → Redeliver.";
+    if (config.kind === "linear")
+        return "Linear may retry a refused delivery. Look in the webhook's settings in Linear for its recent deliveries; any it doesn't resend can't be recovered here.";
+    const sender = config.kind === "webhook" ? senderOf(config) : "none";
+    return sender === "vercel" ? "Vercel retries refused deliveries for up to a day, so some may still arrive. Its webhook's delivery attempts are listed in Vercel's webhook settings; any it gives up on are lost."
+        : sender === "sentry" ? "Sentry may retry a refused delivery. Your Internal Integration's Dashboard in Sentry (Developer Settings) shows its request log; any it doesn't resend are lost, though new alerts for the same issues still arrive."
+            : "The sender may retry. Look in its webhook delivery log and resend from there if it offers it; any it doesn't resend are lost.";
+}
+/** v126: what a webhook trigger's row says about how its deliveries are proved. */
+function hookView(trigger, config, dir) {
+    const ready = hookReady(trigger, dir);
+    const dropped = trigger.droppedCount > 0 && trigger.droppedSince !== null ? { count: trigger.droppedCount, since: trigger.droppedSince, resend: resendWords(config) } : null;
+    if (config.kind !== "webhook")
+        return { ready, needsSecret: config.kind === "linear", sender: null, makesSecret: false, warning: null, readerNote: null, dropped, scope: null };
+    const sender = senderOf(config);
+    // What it needs first, first: an unset secret refuses everything, so that is said before any narrowing.
+    const warning = trigger.hookHash === null && (sender === "none" || ready) ? "No address yet: choose New address to make one and give it to the sender."
+        : sender === "none" ? "Unsigned: anyone with its address can add cards. Choose who signs its deliveries to close that."
+            : !ready ? `Not set up: its deliveries are refused until ${sender === "sentry" || sender === "vercel" ? `${SENDER_WORDS[sender]}'s secret is pasted (with New address for the address to give it)` : "it is set up"}.`
+                : (sender === "sentry" || sender === "vercel") && config.project == null ? `Any ${SENDER_WORDS[sender]} project this secret covers can add cards. Name the project to narrow it.`
+                    : null;
+    // A sender that signs only the body: byte-identical requests are one delivery (§3).
+    const repeats = sender === "github-style" ? "Identical requests count once. If the sender must send the same request again and have it count, use Standard Webhooks." : null;
+    // A reader written from its sender's documentation, not yet from a captured delivery, says so on its own line,
+    // whatever else the row says (webhook-readers.ts).
+    const readerNote = (sender === "sentry" || sender === "vercel") && !READER_CAPTURED[sender]
+        ? `Reader unverified: Toolroll reads ${SENDER_WORDS[sender]} deliveries from ${SENDER_WORDS[sender]}'s documented examples; no real delivery has been checked yet.` : null;
+    return { ready, needsSecret: sender === "sentry" || sender === "vercel", sender, makesSecret: sender === "standard" || sender === "github-style", warning, readerNote: [readerNote, repeats].filter(one => one !== null).join(" ") || null, dropped,
+        scope: sender === "sentry" || sender === "vercel" ? { project: config.project ?? null, team: config.team ?? null } : null };
+}
 export const FLOWS_CSS = `.flows{max-width:880px;min-width:0}.flows .card{padding:16px 18px;margin:12px 0}.flows .flow-row{display:flex;justify-content:space-between;align-items:baseline;gap:12px;flex-wrap:wrap}.flows .flow-row h2{font-size:1.05rem;margin:0}.flows .flow-counts{font-size:.85rem;color:var(--so-muted)}.flows form{display:grid;gap:10px;margin:0}.flows label{display:grid;gap:6px}.flows input,.flows select{box-sizing:border-box;width:100%;max-width:100%}.flows button{justify-self:start;min-height:44px}.flows .flow-fallback ol{padding-left:20px}.flows summary{cursor:pointer;min-height:44px;display:flex;align-items:center;font-weight:600}.flows .flow-buttons{display:flex;flex-wrap:wrap;align-items:center;gap:8px;margin:10px 0 0}.flows .flow-import{margin-top:18px;padding-top:14px;border-top:1px solid var(--so-line)}.flows .flow-import h3{font-size:.95rem;margin:0}.flows .flow-terms{list-style:none;padding:0;margin:8px 0 16px;display:grid;gap:10px}.flows .flow-terms li{white-space:pre-line;overflow-wrap:anywhere}.flows .flow-terms pre{white-space:pre-wrap;overflow-wrap:anywhere;font-size:.8rem;margin:6px 0 0}.flows .flow-import-preview h2{font-size:1rem;margin:20px 0 4px}.flows .flow-untrusted{font-weight:600}.flows button.primary{background:var(--primary);color:var(--primary-foreground);border-color:var(--primary)}.flows fieldset{border:0;padding:0;margin:0;display:grid;gap:10px;min-width:0}.flows legend{font-weight:600;padding:0;margin-bottom:6px}.flows textarea[hidden]{display:none}.flows button.secondary{background:transparent;color:var(--foreground);border:1px solid var(--border)}@media(max-width:600px){.flows input,.flows select{font-size:16px}}@media(max-width:760px){.flows .card{padding:10px 12px;margin:8px 0;position:relative}.flows .flow-row{row-gap:2px}.flows .flow-row h2 a::after{content:"";position:absolute;inset:0;border-radius:inherit}.flows .flow-counts{line-height:1.35}}`;
 /** The flows a person can open, with how many cards wait in each, and the new-flow form. */
 export function flowsListHtml(store, flows, projects, canCreate, problem) {
@@ -141,14 +182,22 @@ export function flowView(store, flow, viewer, selectedCard, setup = { dir: null,
             id: card.id, title: card.title, description: card.description, stage: card.stage, state: card.state,
             waiting: card.state === "active" && card.task !== null && (stage?.kind === "task" || stage?.kind === "report")
                 ? canReadTask ? flowCardTaskLine(store, card.task, taskRepo, now, secretsFor(taskRepo)) : "Task unavailable" : card.waiting,
-            task: task === null ? null : { id: task, href: `/t/${encodeURIComponent(task)}` },
+            task: task === null ? null : { id: task, href: `/t/${encodeURIComponent(task)}`,
+                // Its running attempt's composer, for an approver who may read the task (steer-controls.ts).
+                ...(() => {
+                    const ref = card.state === "active" && canReadTask && viewer.approver ? store.lookupRef(task) : null;
+                    const run = ref === null ? null : liveAttemptOf(store, ref.id, now);
+                    const composer = run === null ? null : steerControlsFor(store, task, run, now, viewer.approver);
+                    return composer === null ? {} : { composer };
+                })() },
             createdBy: card.createdBy, updatedAt: card.updatedAt,
             canDecide,
             // What a "Send to me" sent shows once, in its own box (sent), not again here; a report zone's items and full report
             // (`<id>.items`, `<id>.report`) are for later zones, and its summary is shown.
             outputs: Object.entries(card.outputs).filter(([id]) => !id.includes(".") && stages.find(one => one.id === id)?.kind !== "send").map(([id, text]) => ({ stage: id, title: title(id), text })),
             history: [...moves, ...owned].sort((a, b) => b.at.localeCompare(a.at)).slice(0, 30),
-            source: card.source,
+            // v126: an outside event's card says how it was proved and where its link goes, from what was kept at receipt.
+            source: card.source === null ? null : (() => { const snapshot = snapshotOf(card.source); return snapshot === null ? card.source : { ...card.source, proved: provedWords(snapshot), host: hostOf(card.source.url), shown: card.source.url === null ? null : linkWords(card.source.url) }; })(),
             owner: card.owner, watchers, watching: watchers.includes(viewer.name),
             mine: card.owner === viewer.name || watchers.includes(viewer.name) || canDecide || choosing?.person === viewer.name,
             comments: discussion.filter(one => one.kind === "comment").map(one => ({ id: one.id, author: one.author, body: one.body, mentions: one.mentions, at: one.at })),
@@ -177,7 +226,7 @@ export function flowView(store, flow, viewer, selectedCard, setup = { dir: null,
             ...(config === null ? { name: "Trigger", detail: "Can't be read" } : triggerHeadline(config, store)),
             zone: title(config?.zone ?? definition?.start ?? ""), zoneId: config?.zone ?? definition?.start ?? "", state: trigger.state, status: trigger.lastOutcome, statusLink: planeStatusLink(config, trigger.lastOutcome), statusAt: trigger.lastAt, failing: trigger.failures > 0,
             button: config?.kind === "button" ? { label: config.label, questions: config.questions } : null,
-            hook: config !== null && takesDeliveries(config) ? { ready: hookReady(trigger, setup.dir), needsSecret: config.kind === "linear" } : null,
+            hook: config !== null && takesDeliveries(config) ? hookView(trigger, config, setup.dir) : null,
             checkable: ((config?.kind === "github" || config?.kind === "linear") && config.delivery === "poll") || config?.kind === "email" || (config?.kind === "schedule" && config.script !== undefined) || config?.kind === "plane-review",
             shared: config?.kind === "button" && trigger.hookHash !== null,
             ...(config?.kind === "schedule" && config.order !== undefined ? { order: describeStandingOrder(config.order, flow.repo, config.schedule) } : {}),
@@ -211,6 +260,7 @@ export function flowView(store, flow, viewer, selectedCard, setup = { dir: null,
         selectedCard,
         live: flowFingerprint(store, flow.id),
         canEdit: viewer.approver,
+        unattended: unattendedViewOf(store, flow, viewer, setup.now ?? now),
         approvers: store.listApprovers().map(one => one.name).filter(name => store.accountCanAccess(name, flow.repo)),
         projects: [flow.repo, ...setup.repos.filter(one => one !== flow.repo)].map(path => ({ path, name: projectName(path) })),
         kinds: FLOW_STAGE_KINDS.map(kind => ({ kind, label: FLOW_KIND_WORDS[kind].label, about: FLOW_KIND_WORDS[kind].about })),
@@ -219,7 +269,8 @@ export function flowView(store, flow, viewer, selectedCard, setup = { dir: null,
 }
 /** The page the canvas replaces when scripts can't run: each zone and its cards, in order. */
 export function flowFallbackHtml(view) {
-    return html `<section class="flows flow-fallback"><p class="meta">${view.flow.project}</p><ol>${view.stages.map(stage => {
+    const own = view.unattended.active;
+    return html `<section class="flows flow-fallback"><p class="meta">${view.flow.project}</p>${own !== null && html `<p data-flow-unattended>Runs on its own until ${own.untilWords}</p>`}<ol>${view.stages.map(stage => {
         const cards = view.cards.filter(card => card.stage === stage.id && card.state === "active");
         return html `<li><strong>${stage.title}</strong> · ${FLOW_KIND_WORDS[stage.kind].label}${cards.length > 0 && html `<ul>${cards.map(card => html `<li>${card.title}${card.waiting !== null && ` — ${card.waiting}`}</li>`)}</ul>`}</li>`;
     })}</ol></section>`;

package/dist/flows.d.ts

@@ -1,3 +1,4 @@
+import { type SourceLike } from "./task-source.js";
 import { type ContractIssue, type ContractResult } from "./contracts/contract.js";
 import { CHOICES_MAX, CHOICES_MIN, FLOW_COLORS, FLOW_END, FLOW_MERGE_METHODS, FLOW_STAGE_KINDS, LONGEST_WAIT_MINUTES, SCRIPT_LANGUAGES, SCRIPT_NAME, sortKeyOf, type FlowDefinition, type FlowStage, type FlowStageKind, type FlowStepFields, type FlowWait, type ScriptLanguage, type TriggerInput } from "./contracts/flow.js";
 export { CHOICES_MAX, CHOICES_MIN, FLOW_COLORS, FLOW_END, FLOW_MERGE_METHODS, FLOW_STAGE_KINDS, LONGEST_WAIT_MINUTES, SCRIPT_LANGUAGES, SCRIPT_NAME, sortKeyOf };
@@ -66,11 +67,13 @@ export declare function choiceTargets(stage: Pick<FlowStage, "options">): string
 export declare function replyTarget(stage: Pick<FlowStage, "options" | "onFail">): string | null;
 /** What a card's work is held to: the zones' steps and paths, never where they sit on the canvas. */
 export declare function flowDigest(definition: FlowDefinition): string;
+/** `source` (v126): where the card came from, when an outside event's delivery made it ({{card.source}}). */
 type FlowFillCard = {
     title: string;
     description: string | null;
     note: string | null;
     outputs: Record<string, string>;
+    source?: SourceLike | null;
 };
 /** Fill a zone's text from the card: title, description, the latest note and earlier zones' reports. */
 export declare function fillFlowText(template: string, card: FlowFillCard, encode?: (value: string) => string): string;
@@ -83,6 +86,7 @@ export declare const flowAttachedMark: (label: string) => string;
 export declare function flowWorkTemplate(instructions: string, card: {
     description: string | null;
     note: string | null;
+    source?: SourceLike | null;
 }): string;
 /** How a filled-in value is named where it is attached: the same words flowGoalCuts labels it with. */
 export declare function flowValueLabel(key: string, stageTitle?: (id: string) => string): string;

package/dist/flows.js

@@ -50,6 +50,7 @@
 import { TEXT_LIMITS } from "./text-limits.js";
 import { createHash } from "node:crypto";
 import { projectName } from "./project.js";
+import { cardReference } from "./task-source.js";
 import { parseContract, readVersioned } from "./contracts/contract.js";
 import { stageReferenceProblems } from "./contracts/stage-output.js";
 import { CHOICES_MAX, CHOICES_MIN, FLOW_ALIASES, FLOW_COLORS, FLOW_DEFINITION_VERSION, FLOW_END, FLOW_MERGE_METHODS, FLOW_STAGE_KINDS, flowDefinitionSchema, flowStepsSchema, HEADERS_MAX, legacySubagentStep, LONGEST_WAIT_MINUTES, savedFlowDefinitionSchema, SCRIPT_LANGUAGES, SCRIPT_NAME, sortKeyOf, SURE_AT_MAX, SURE_AT_MIN, ZONE_ID, } from "./contracts/flow.js";
@@ -477,7 +478,7 @@ export function flowDigest(definition) {
     return createHash("sha256").update(JSON.stringify({ start: definition.start, terms })).digest("hex").slice(0, 32);
 }
 /** {{stage.<id>}} is an earlier zone's output; a report zone also fills {{stage.<id>.items}} and {{stage.<id>.report}}. */
-const FILLED = /\{\{\s*(card\.title|card\.description|card\.email|note|stage\.([a-z0-9-]+(?:\.(?:items|report))?))\s*\}\}/g;
+const FILLED = /\{\{\s*(card\.title|card\.description|card\.email|card\.source|note|stage\.([a-z0-9-]+(?:\.(?:items|report))?))\s*\}\}/g;
 /** Fill a zone's text from the card: title, description, the latest note and earlier zones' reports. */
 export function fillFlowText(template, card, encode = value => value) {
     return template.replace(FILLED, (_match, key, stage) => encode(fillOne(key, stage, card))).trim();
@@ -494,6 +495,9 @@ export function flowWorkTemplate(instructions, card) {
         ...(names("card.title") || names("card.description") ? [] : [`The card: {{card.title}}${card.description ? "\n\n{{card.description}}" : ""}`]),
         ...(names("card.title") && !names("card.description") && card.description ? ["Details on the card:\n{{card.description}}"] : []),
         ...(names("note") || !card.note ? [] : ["Changes asked for: {{note}}"]),
+        // v126: an outside event's card says where it came from — a filled value like the others, so it is fitted into the
+        // goal with them (whole when it fits, attached when it doesn't), never at the cost of the zone's own words.
+        ...(names("card.source") || cardReference(card.source) === "" ? [] : ["{{card.source}}"]),
     ];
     return [instructions, ...extra].join("\n\n");
 }
@@ -507,6 +511,8 @@ export function flowValueLabel(key, stageTitle = id => id) {
         return "The card's description";
     if (key === "card.email")
         return "The card's email address";
+    if (key === "card.source")
+        return "Where the card came from";
     if (key === "note")
         return "The note it was sent back with";
     const match = /^stage\.([a-z0-9-]+)(?:\.(items|report))?$/.exec(key);
@@ -556,6 +562,8 @@ function fillOne(key, stage, card) {
     {
         if (key === "card.title")
             return card.title;
+        if (key === "card.source")
+            return cardReference(card.source);
         if (key === "card.description")
             return card.description ?? "";
         if (key === "card.email")

package/dist/google-mail.d.ts

@@ -9,6 +9,7 @@ export type GoogleMail = {
     refreshToken: string | null;
     address: string | null;
 };
+/** The saved client and connection; null when there's none. A keychain that refuses throws (SecretStoreError). */
 export declare function readGoogleMail(dir: string | null): GoogleMail | null;
 /** Connected: a refresh token and the address it belongs to. */
 export declare function googleConnected(dir: string | null): {

package/dist/google-mail.js

@@ -7,27 +7,31 @@
  * and pastes its ID and secret into Settings → Email. Connecting sends them
  * to Google's consent screen; Google sends them back here with a one-time
  * code (checked against a state and a PKCE verifier made for that visit),
- * which becomes a refresh token. The client secret and refresh token live
- * in a 0600 file beside the database, never in a column, a log or a page.
+ * which becomes a refresh token. The client secret and refresh token are
+ * kept by Toolroll (tool-secret-store.ts: the keychain, or an owner-only file
+ * beside the database where there's none), never in a column, a log or a page.
  * Mail itself goes over IMAP and SMTP with XOAUTH2, so reading and sending
  * are the same code as for any other mail server.
  */
 import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-const FILE = "google-mail.json";
+import { SecretStoreError, readHeldSecret, writeHeldSecret } from "./tool-secret-store.js";
+const HELD = { name: "google-mail", file: ["google-mail.json"] };
 export const GOOGLE_AUTH = "https://accounts.google.com/o/oauth2/v2/auth";
 export const GOOGLE_TOKEN = "https://oauth2.googleapis.com/token";
 const GOOGLE_REVOKE = "https://oauth2.googleapis.com/revoke";
 /** Full mail access is what IMAP and SMTP sign-in needs; "email" says which address it is. */
 export const GOOGLE_SCOPE = "https://mail.google.com/ openid email";
 export const GOOGLE_CALLBACK = "/settings/google/callback";
+/** The saved client and connection; null when there's none. A keychain that refuses throws (SecretStoreError). */
 export function readGoogleMail(dir) {
-    if (dir === null || !existsSync(join(dir, FILE)))
+    if (dir === null)
+        return null;
+    const text = readHeldSecret(dir, HELD.name, HELD.file);
+    if (text === null)
         return null;
     try {
-        const raw = JSON.parse(readFileSync(join(dir, FILE), "utf8"));
-        if (typeof raw["clientId"] !== "string" || typeof raw["clientSecret"] !== "string")
+        const raw = JSON.parse(text);
+        if (raw === null || typeof raw["clientId"] !== "string" || typeof raw["clientSecret"] !== "string")
             return null;
         return { clientId: raw["clientId"], clientSecret: raw["clientSecret"], refreshToken: typeof raw["refreshToken"] === "string" ? raw["refreshToken"] : null, address: typeof raw["address"] === "string" ? raw["address"] : null };
     }
@@ -37,23 +41,39 @@ export function readGoogleMail(dir) {
 }
 /** Connected: a refresh token and the address it belongs to. */
 export function googleConnected(dir) {
-    const saved = readGoogleMail(dir);
+    let saved;
+    try {
+        saved = readGoogleMail(dir);
+    }
+    catch {
+        saved = null;
+    }
     return saved?.refreshToken && saved.address ? { address: saved.address } : null;
 }
 function write(dir, value) {
-    writeFileSync(join(dir, FILE), JSON.stringify(value), { mode: 0o600 });
-    chmodSync(join(dir, FILE), 0o600);
+    writeHeldSecret(dir, HELD.name, HELD.file, JSON.stringify(value));
 }
 /** Save the OAuth client from Settings; an empty secret keeps the saved one. A new client forgets the old connection. */
 export function saveGoogleClient(dir, input) {
     const clientId = typeof input.clientId === "string" ? input.clientId.trim() : "";
     if (!/^[0-9]{6,20}-[a-z0-9]{8,64}\.apps\.googleusercontent\.com$/.test(clientId))
         return { ok: false, message: "That doesn't look like a Google OAuth client ID. It ends in .apps.googleusercontent.com." };
-    const before = readGoogleMail(dir);
+    let before;
+    try {
+        before = readGoogleMail(dir);
+    }
+    catch (error) {
+        return { ok: false, message: error instanceof SecretStoreError ? error.message : "The saved client couldn't be read." };
+    }
     const clientSecret = typeof input.clientSecret === "string" && input.clientSecret.trim() !== "" ? input.clientSecret.trim() : before?.clientId === clientId ? before.clientSecret : "";
     if (!/^[A-Za-z0-9_-]{16,80}$/.test(clientSecret))
         return { ok: false, message: "Paste the client secret from the same OAuth client." };
-    write(dir, { clientId, clientSecret, refreshToken: before?.clientId === clientId ? before.refreshToken : null, address: before?.clientId === clientId ? before.address : null });
+    try {
+        write(dir, { clientId, clientSecret, refreshToken: before?.clientId === clientId ? before.refreshToken : null, address: before?.clientId === clientId ? before.address : null });
+    }
+    catch (error) {
+        return { ok: false, message: error instanceof SecretStoreError ? error.message : "The client couldn't be saved." };
+    }
     return { ok: true };
 }
 /** Where to send the person to consent, and what to remember to check their return against. */
@@ -89,7 +109,13 @@ function addressOf(idToken) {
 }
 /** The one-time code from Google's redirect, exchanged for a refresh token and saved. */
 export async function finishGoogleConsent(dir, visit, code, fetcher) {
-    const client = readGoogleMail(dir);
+    let client;
+    try {
+        client = readGoogleMail(dir);
+    }
+    catch (error) {
+        return { ok: false, message: error instanceof SecretStoreError ? error.message : "The saved client couldn't be read." };
+    }
     if (client === null)
         return { ok: false, message: "Save the Google OAuth client first." };
     let answer;
@@ -107,14 +133,25 @@ export async function finishGoogleConsent(dir, visit, code, fetcher) {
     const address = addressOf(answer.body["id_token"]);
     if (address === null)
         return { ok: false, message: "Google didn't say which address this is. Connect again." };
-    write(dir, { ...client, refreshToken: refresh, address });
+    try {
+        write(dir, { ...client, refreshToken: refresh, address });
+    }
+    catch (error) {
+        return { ok: false, message: error instanceof SecretStoreError ? error.message : "The connection couldn't be saved." };
+    }
     cached.delete(client.clientId);
     return { ok: true, address };
 }
 const cached = new Map();
 /** A fresh access token for IMAP and SMTP (kept in memory until a minute before it ends). */
 export async function googleAccessToken(dir, fetcher, now = Date.now()) {
-    const saved = readGoogleMail(dir);
+    let saved;
+    try {
+        saved = readGoogleMail(dir);
+    }
+    catch (error) {
+        return { ok: false, said: error instanceof SecretStoreError ? error.message : "The Google connection couldn't be read.", permanent: false };
+    }
     if (saved?.refreshToken == null || saved.address === null)
         return { ok: false, said: "The Google account isn't connected. Connect it in Settings → Email.", permanent: true };
     const hit = cached.get(saved.clientId);
@@ -138,7 +175,13 @@ export async function googleAccessToken(dir, fetcher, now = Date.now()) {
 }
 /** Disconnect: Google forgets the grant (best effort), and the file goes. */
 export async function disconnectGoogle(dir, fetcher) {
-    const saved = readGoogleMail(dir);
+    let saved;
+    try {
+        saved = readGoogleMail(dir);
+    }
+    catch {
+        saved = null;
+    }
     if (saved?.refreshToken) {
         try {
             await fetcher(`${GOOGLE_REVOKE}?${new URLSearchParams({ token: saved.refreshToken })}`, { method: "POST", signal: AbortSignal.timeout(10_000) });
@@ -147,5 +190,5 @@ export async function disconnectGoogle(dir, fetcher) {
     }
     if (saved !== null)
         cached.delete(saved.clientId);
-    rmSync(join(dir, FILE), { force: true });
+    writeHeldSecret(dir, HELD.name, HELD.file, null);
 }

package/dist/html.d.ts

@@ -55,6 +55,15 @@ export type PostFormOptions = {
 };
 /** The server's request context supplies the request's CSRF token (server/request-context.ts). */
 export declare function provideFormToken(source: () => string | undefined): void;
+export declare function providePasswordless(source: () => boolean): void;
+/**
+ * A ceremony's re-authentication field: rendered as given, or — with Passwordless on for this signed-in browser —
+ * nothing at all (the form posts an empty password; the act proves the session). Never used for credential acts,
+ * the sign-in form, a new password, or a secret or API key field.
+ */
+export declare function reauth(field: Html): Html;
+/** The same question for a page's own script that builds a re-authentication field itself. */
+export declare const passwordlessRendering: () => boolean;
 /**
  * A POST form: the action, the request's one CSRF field, the optional
  * project revision and return fields, other hidden fields, then the body.

package/dist/html.js

@@ -111,6 +111,17 @@ export function attributes(values) {
 let formToken = () => undefined;
 /** The server's request context supplies the request's CSRF token (server/request-context.ts). */
 export function provideFormToken(source) { formToken = source; }
+/** Passwordless (docs/plans/passwordless.md), as the request sees it: the request context provides it. */
+let passwordlessNow = () => false;
+export function providePasswordless(source) { passwordlessNow = source; }
+/**
+ * A ceremony's re-authentication field: rendered as given, or — with Passwordless on for this signed-in browser —
+ * nothing at all (the form posts an empty password; the act proves the session). Never used for credential acts,
+ * the sign-in form, a new password, or a secret or API key field.
+ */
+export function reauth(field) { return passwordlessNow() ? html `` : field; }
+/** The same question for a page's own script that builds a re-authentication field itself. */
+export const passwordlessRendering = () => passwordlessNow();
 /**
  * A POST form: the action, the request's one CSRF field, the optional
  * project revision and return fields, other hidden fields, then the body.