toolroll 0.9.62 → 0.9.65

package/dist/mcp-connect.js

@@ -7,16 +7,19 @@
  * authorization server at its origin), registers Toolroll as a client
  * with this console's callback, and sends the person to the service to sign
  * in. The callback trades the code for tokens, which live in the tool's own
- * secrets file (never the database, never a log), and the tool joins the
- * project like any other: tested, listed, and given to subagents under rules.
- * The worker refreshes tokens before they expire.
+ * secrets (the OS keychain, or its file where there is none; never the
+ * database, never a log), and the tool joins the project like any other:
+ * tested, listed, and given to subagents under rules. The worker refreshes
+ * tokens before they expire, and each run gets an access token of its own
+ * (oauth-run-token.ts).
  */
 import { createHash, randomBytes } from "node:crypto";
-import { homedir } from "node:os";
 import { basename } from "node:path";
-import { LOCAL_APPS, addToolTo, catalogTool, localAppOf, projectToolsOf, readToolSecrets, setToolSecrets, testToolOf } from "./project-tools.js";
+import { LOCAL_APPS, addToolTo, catalogTool, localAppOf, projectToolsOf, readToolSecrets, renewingSignIn, setToolSecrets, testToolOf } from "./project-tools.js";
 import { envValue } from "./names.js";
-import { SCOPE_TOKEN, readAuthorizationServer, readProtectedResource, readRegistration, readTokenResponse } from "./contracts/integration-metadata.js";
+import { readAuthorizationServer, readProtectedResource, readRegistration, readTokenResponse } from "./contracts/integration-metadata.js";
+import { ACCESS, CLIENT, CLIENT_SECRET, EXPIRES, GRANTED, REFRESH, RESOURCE, REVOKE_URL, TOKEN_URL, readScope, scopeList } from "./oauth-run-token.js";
+export { readScope, scopeList };
 /**
  * Services that connect this way: their servers speak streamable HTTP and
  * advertise registering clients on the spot. Advertising isn't accepting:
@@ -92,7 +95,7 @@ export const localConnectOf = (id) => {
  * `local` connects with no sign-in. `research` says, for a connected service research can't use because of the access
  * it was granted, why (shown on its Tools entry beside Reconnect read-only).
  */
-export function connectionsOf(store, repo, home = homedir()) {
+export function connectionsOf(store, repo, home) {
     const tools = projectToolsOf(store, repo);
     const signIn = oneClickServices().map(service => {
         const had = tools.find(one => one.name === service.id);
@@ -126,29 +129,13 @@ export function readsOnly(action, subjects) {
     const subject = (word) => subjects.includes(word) || subjects.includes(word.replace(/s$/, ""));
     return words.some(word => READING.has(word)) && words.every(word => READING.has(word) || QUALIFIERS.has(word) || subject(word));
 }
-/**
- * Identity scopes a read-only grant may carry beside `<resource>:read` ones. An allow-list: any other scope (a
- * write, a wildcard, `introspection`, one nobody listed) makes the grant unsafe for research.
- */
-const IDENTITY_SCOPES = new Set(["openid", "profile", "email"]);
-const READ_SCOPE = /^[a-z][a-z0-9_]{0,63}:read$/;
-export const readScope = (scope) => IDENTITY_SCOPES.has(scope) || READ_SCOPE.test(scope);
 /** Whether a saved grant only reads: it names at least one scope and every one is a read or identity scope. Unknown (null) never is. */
 // A scope a server adds to every token without being asked, that grants no access to data. PostHog adds
 // `introspection` (its ALWAYS_ALLOWED_SCOPES): it lets the token be checked, and has no write form. Never requested.
 const GRANTED_ANYWAY = new Set(["introspection"]);
 export const readOnlyGrant = (grant) => grant !== null && grant.some(readScope) && grant.every(scope => readScope(scope) || GRANTED_ANYWAY.has(scope));
-/** An OAuth `scope` value as scope tokens (RFC 6749), sorted and deduplicated; null when absent, empty or malformed. */
-export function scopeList(value) {
-    if (typeof value !== "string")
-        return null;
-    const tokens = value.split(" ").filter(one => one !== "");
-    if (tokens.length === 0 || tokens.length > 512 || !tokens.every(one => SCOPE_TOKEN.test(one)))
-        return null;
-    return [...new Set(tokens)].sort();
-}
 /** The scope a connected service's sign-in was granted, as saved beside its token; null when it was never proved. */
-export function grantOf(repo, tool, home = homedir()) {
+export function grantOf(repo, tool, home) {
     try {
         return scopeList(readToolSecrets(repo, tool, home)[GRANTED]);
     }
@@ -195,10 +182,6 @@ export function researchToolsOf(tools, launched = null, granted = () => null) {
     }
     return research;
 }
-/** The secrets a connected tool keeps: the bearer the MCP server takes, and what refreshing it needs. */
-const ACCESS = "OAUTH_ACCESS_TOKEN", REFRESH = "OAUTH_REFRESH_TOKEN", CLIENT = "OAUTH_CLIENT_ID", CLIENT_SECRET = "OAUTH_CLIENT_SECRET", TOKEN_URL = "OAUTH_TOKEN_URL", EXPIRES = "OAUTH_EXPIRES_AT", RESOURCE = "OAUTH_RESOURCE";
-/** The scope the sign-in granted, kept beside its token. Not one of the spec's secrets, so it never reaches a launch. */
-const GRANTED = "OAUTH_GRANTED_SCOPE";
 /** Where a service sends the person back after they sign in. */
 export const CONNECT_CALLBACK = "/settings/tools/connected";
 const VISIT_MS = 15 * 60_000, RENEW_RETRY_MS = 5 * 60_000;
@@ -269,7 +252,7 @@ export async function discoverSignIn(mcpUrl, fetcher = fetch) {
     }
     // A token is for the resource the server names (Stripe's has no trailing slash), when it names one.
     const named = resource.resource;
-    return { authorize, token, register, scopes, resource: https(named) ? named : null };
+    return { authorize, token, register, scopes, resource: https(named) ? named : null, revoke: https(meta.revocation_endpoint) ? meta.revocation_endpoint : null };
 }
 /**
  * Start connecting a service: find its sign-in, register this console as a
@@ -323,7 +306,7 @@ export async function startConnect(input, fetcher = fetch, now = Date.now()) {
     const scope = scopes.length > 0 ? scopes.join(" ") : null;
     if (scope !== null)
         go.searchParams.set("scope", scope);
-    return { ok: true, go: go.toString(), state, visit: { service: service.id, repo: input.repo, by: input.by, kit: input.kit ?? null, template: input.template ?? null, verifier, clientId, clientSecret, token: server.token, resource, redirect, expires: now + VISIT_MS, scope } };
+    return { ok: true, go: go.toString(), state, visit: { service: service.id, repo: input.repo, by: input.by, kit: input.kit ?? null, template: input.template ?? null, verifier, clientId, clientSecret, token: server.token, resource, redirect, expires: now + VISIT_MS, scope, revoke: server.revoke } };
 }
 /** The spec a connected service joins the project with: its MCP address, signed in with the token its sign-in gave. */
 export function connectedSpec(serviceId) {
@@ -341,11 +324,11 @@ const tokensFrom = (body, now) => ({
 /**
  * Finish connecting: trade the code for tokens, add the tool to the project
  * (or refresh its sign-in, when it's there already), keep the tokens in its
- * secrets file, and test it.
+ * secrets, and test it.
  */
 export async function finishConnect(store, visit, code, now, options = {}) {
     const service = oneClickOf(visit.service);
-    const fetcher = options.fetcher ?? fetch, home = options.home ?? homedir();
+    const fetcher = options.fetcher ?? fetch, home = options.home;
     const spec = connectedSpec(service.id);
     const had = projectToolsOf(store, visit.repo).find(one => one.name === spec.name);
     if (had !== undefined && (had.spec.url !== spec.url || had.spec.bearer !== ACCESS))
@@ -375,7 +358,7 @@ export async function finishConnect(store, visit, code, now, options = {}) {
     }
     // The grant: what the answer says, or what was asked for when it says nothing; never one from an earlier sign-in.
     const granted = body.scopeSaid ? scopeList(body.scope) : scopeList(visit.scope ?? null);
-    setToolSecrets(visit.repo, spec.name, { [ACCESS]: tokens.access, [CLIENT]: visit.clientId, [TOKEN_URL]: visit.token, [RESOURCE]: visit.resource, [GRANTED]: granted?.join(" ") ?? "",
+    setToolSecrets(visit.repo, spec.name, { [ACCESS]: tokens.access, [CLIENT]: visit.clientId, [TOKEN_URL]: visit.token, [RESOURCE]: visit.resource, [GRANTED]: granted?.join(" ") ?? "", [REVOKE_URL]: visit.revoke ?? "", [REFRESH]: "",
         ...(tokens.refresh === null ? {} : { [REFRESH]: tokens.refresh }), ...(tokens.expires === null ? {} : { [EXPIRES]: tokens.expires }), ...(visit.clientSecret === null ? {} : { [CLIENT_SECRET]: visit.clientSecret }) }, home);
     // The success line names the project it went to: the page and chat may be looking at another.
     const to = basename(visit.repo);
@@ -387,7 +370,7 @@ export async function finishConnect(store, visit, code, now, options = {}) {
 }
 /** Keep connected services signed in: any token expiring within ten minutes is refreshed (the worker's pass, and before a subagent's call). */
 export async function refreshConnections(store, repos, now, options = {}) {
-    const fetcher = options.fetcher ?? fetch, home = options.home ?? homedir();
+    const fetcher = options.fetcher ?? fetch, home = options.home;
     const report = { refreshed: 0, problems: [] };
     for (const repo of repos)
         for (const tool of projectToolsOf(store, repo)) {
@@ -402,28 +385,43 @@ export async function refreshConnections(store, repos, now, options = {}) {
             if (now.getTime() - (renewTried.get(key) ?? 0) < RENEW_RETRY_MS)
                 continue;
             renewTried.set(key, now.getTime());
-            try {
-                const answer = await fetcher(values[TOKEN_URL], { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" }, signal: AbortSignal.timeout(15_000),
-                    body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: values[REFRESH], client_id: values[CLIENT], ...(values[CLIENT_SECRET] === undefined ? {} : { client_secret: values[CLIENT_SECRET] }), ...(values[RESOURCE] === undefined ? {} : { resource: values[RESOURCE] }) }) });
-                const body = readTokenResponse(await answer.json());
-                if (body === null) {
-                    report.problems.push(`${tool.name}: couldn't reach it to renew its sign-in`);
-                    continue;
+            // Renewed one at a time with a run's own sign-in, across Toolroll's processes: a rotated refresh token is never used twice.
+            const problem = await renewingSignIn(repo, tool.name, home, async () => {
+                const latest = readToolSecrets(repo, tool.name, home);
+                if (!latest[REFRESH] || !latest[TOKEN_URL] || !latest[CLIENT])
+                    return null;
+                try {
+                    const answer = await fetcher(latest[TOKEN_URL], { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" }, signal: AbortSignal.timeout(15_000),
+                        body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: latest[REFRESH], client_id: latest[CLIENT], ...(latest[CLIENT_SECRET] === undefined ? {} : { client_secret: latest[CLIENT_SECRET] }), ...(latest[RESOURCE] === undefined ? {} : { resource: latest[RESOURCE] }) }) });
+                    const body = readTokenResponse(await answer.json());
+                    if (body === null)
+                        return `${tool.name}: couldn't reach it to renew its sign-in`;
+                    const tokens = tokensFrom(body, now.getTime());
+                    if (!answer.ok || tokens.access === null)
+                        return `${tool.name}: its sign-in ran out; connect it again on the Tools page`;
+                    // A refresh carries the same grant or a narrower one, and says so when it changes; said badly, it is unknown.
+                    // Not saved (a locked keychain): the saved sign-in stays as it was, and this says so.
+                    try {
+                        setToolSecrets(repo, tool.name, { [ACCESS]: tokens.access, ...(tokens.refresh === null ? {} : { [REFRESH]: tokens.refresh }), ...(tokens.expires === null ? {} : { [EXPIRES]: tokens.expires }),
+                            ...(body.scopeSaid ? { [GRANTED]: scopeList(body.scope)?.join(" ") ?? "" } : {}) }, home);
+                    }
+                    catch {
+                        return `${tool.name}: its renewed sign-in couldn't be saved; check that the keychain is unlocked`;
+                    }
+                    return false;
                 }
-                const tokens = tokensFrom(body, now.getTime());
-                if (!answer.ok || tokens.access === null) {
-                    report.problems.push(`${tool.name}: its sign-in ran out; connect it again on the Tools page`);
-                    continue;
+                catch {
+                    return `${tool.name}: couldn't reach it to renew its sign-in`;
                 }
-                // A refresh carries the same grant or a narrower one, and says so when it changes; said badly, it is unknown.
-                setToolSecrets(repo, tool.name, { [ACCESS]: tokens.access, ...(tokens.refresh === null ? {} : { [REFRESH]: tokens.refresh }), ...(tokens.expires === null ? {} : { [EXPIRES]: tokens.expires }),
-                    ...(body.scopeSaid ? { [GRANTED]: scopeList(body.scope)?.join(" ") ?? "" } : {}) }, home);
+            });
+            if (typeof problem === "string") {
+                report.problems.push(problem);
+                continue;
+            }
+            if (problem === false) {
                 renewTried.delete(key);
                 report.refreshed++;
             }
-            catch {
-                report.problems.push(`${tool.name}: couldn't reach it to renew its sign-in`);
-            }
         }
     return report;
 }

package/dist/mcp-oauth.d.ts

@@ -51,7 +51,9 @@ export type OAuthSession = {
     name: string;
     role: "approver" | "viewer";
     csrf: string;
-    /** Signed in with an identity provider: its name, and whether it checked the person in the last ten minutes. */
+    /** The account's credential generation this session signed in under: a code is never issued under another. */
+    generation: number;
+    /** Signed in with an identity provider: its name, and whether an explicit re-check made on request awaits one step-up. */
     sso: {
         label: string;
         fresh: boolean;
@@ -68,8 +70,9 @@ export type OAuthHttpOptions = {
     session: (request: IncomingMessage) => OAuthSession | null;
     /** A posted form came from a page of this console (its Origin, or Referer, names an allowed host). */
     sameSite: (request: IncomingMessage) => boolean;
-    /** The step-up: the person's password, or (empty) a fresh identity-provider check. */
-    confirm: (session: OAuthSession, typed: string) => boolean;
+    /** The step-up, proved at the moment of consent on this request's live session: the person's password, or (empty)
+     * an explicit identity-provider re-check, spent by this consent. */
+    confirm: (request: IncomingMessage, session: OAuthSession, typed: string) => boolean;
     /** The projects this person may choose: each a project the server knows that they can use now. */
     projectsFor: (account: string) => string[];
     /** The token exchange's budget by source (request-budget.ts): charged once per request, before its body is read or any code or refresh secret is spent. */

package/dist/mcp-oauth.js

@@ -308,8 +308,8 @@ export function createOAuthHttp(options) {
             return backToClient(response, origin, one.redirectUri, one.state, { error: "access_denied", error_description: "the person declined" }, "Cancelled. Returning to your MCP client…");
         }
         const account = store.accountOf(session.name);
-        if (account === null || account.revokedAt !== null)
-            return problemPage(response, 403, "Sign in first", "Your account can't sign in. Nothing was allowed.");
+        if (account === null || account.revokedAt !== null || account.generation !== session.generation)
+            return problemPage(response, 403, "Sign in first", "Your access changed. Sign in again; nothing was allowed.");
         const access = form.get("access") === "act" ? "act" : "read";
         const chosen = [...new Set(form.getAll("project"))];
         const again = (status, problem) => page(response, status, consentHtml(session, id, one, problem, { access, projects: chosen }));
@@ -323,11 +323,15 @@ export function createOAuthHttp(options) {
             return again(403, "Choose from your own projects.");
         if (!adapterPolicy({ caller: "cookie", capability: account.role === "approver" ? "act" : "read", viewer: account.role === "viewer" }, "step-up", source => source === "none" && chosen.every(path => mine.includes(path))).ok)
             return again(403, "Choose from your own projects.");
-        if (!options.confirm(session, form.get("password") ?? ""))
+        if (!options.confirm(request, session, form.get("password") ?? ""))
             return again(403, "Enter your Toolroll password to allow access.");
+        // Re-proved after the step-up: the code carries the generation the person consented under, never a newer one.
+        const current = store.accountOf(session.name);
+        if (current === null || current.revokedAt !== null || current.generation !== session.generation)
+            return problemPage(response, 403, "Sign in first", "Your access changed. Sign in again; nothing was allowed.");
         waiting.delete(id);
         const code = randomBytes(32).toString("base64url");
-        store.saveOAuthCode(sha256(code), { client: client.id, account: session.name, generation: account.generation, access, projects: chosen, redirectUri: one.redirectUri, resource: one.resource,
+        store.saveOAuthCode(sha256(code), { client: client.id, account: session.name, generation: session.generation, access, projects: chosen, redirectUri: one.redirectUri, resource: one.resource,
             challenge: one.challenge, expiresAt: new Date(now.getTime() + OAUTH_TIMES.codeMs).toISOString() });
         return backToClient(response, origin, one.redirectUri, one.state, { code }, "Allowed. Returning to your MCP client…");
     }

package/dist/memory-pass.js

@@ -138,11 +138,11 @@ function fileSources(repo, kind, home) {
 /** The plane's own sessions: lead threads that touched the project, and finished crew runs with their handoff and check output. */
 function planeSources(store, repo, evidenceRoot) {
     const out = [];
-    const threads = store.handle.prepare(`SELECT c.thread AS thread, c.id AS conversation, MAX(m.id) AS last, MAX(m.created_at) AS at FROM team_conversation c JOIN lead_message m ON m.thread=c.thread
+    const threads = store.handle.prepare(`SELECT c.thread AS thread, c.id AS conversation, MAX(m.id) AS last, MAX(m.created_at) AS at FROM team_conversation c JOIN lead_message m ON m.thread=c.thread AND m.pending=0
     WHERE EXISTS (SELECT 1 FROM json_each(c.projects_json) WHERE value=?) GROUP BY c.thread`).all(repo);
     for (const row of threads) {
         const thread = Number(row['thread']);
-        out.push({ id: `lead:${thread}:${Number(row['last'])}`, repo, kind: 'lead', source: `conversation:${String(row['conversation'])}`, at: String(row['at']), trace: () => redact(store.handle.prepare('SELECT role,text FROM lead_message WHERE thread=? ORDER BY id LIMIT 400').all(thread).map(m => `${m['role']}: ${clip(String(m['text']), 4000)}`).join('\n')) });
+        out.push({ id: `lead:${thread}:${Number(row['last'])}`, repo, kind: 'lead', source: `conversation:${String(row['conversation'])}`, at: String(row['at']), trace: () => redact(store.handle.prepare('SELECT role,text FROM lead_message WHERE thread=? AND pending=0 ORDER BY id LIMIT 400').all(thread).map(m => `${m['role']}: ${clip(String(m['text']), 4000)}`).join('\n')) });
     }
     const runs = store.handle.prepare(`SELECT r.id, r.role, r.finished_at, r.handoff, t.external_id FROM run r JOIN task_ref t ON t.id=r.task_ref WHERE t.repo=? AND r.role IN ('builder','repair') AND r.outcome IS NOT NULL ORDER BY r.id DESC LIMIT 100`).all(repo);
     for (const row of runs) {

package/dist/mobile-viewport.d.ts

@@ -1,3 +1,7 @@
 /** Presentation only: no fields are read, no requests are sent, and no
- * keyboard events are captured. A focused input alone is NOT a keyboard. */
+ * keyboard events are captured. A focused input alone is NOT a keyboard.
+ *
+ * It publishes the visible area (--viewport-height, --viewport-top): a phone's
+ * keyboard shrinks only the visual viewport on iOS (100dvh never moves), so a
+ * full-height app shell sized to it is what keeps the composer above the keys. */
 export declare const MOBILE_VIEWPORT_SCRIPT: string;

package/dist/mobile-viewport.js

@@ -1,10 +1,14 @@
 /** Presentation only: no fields are read, no requests are sent, and no
- * keyboard events are captured. A focused input alone is NOT a keyboard. */
+ * keyboard events are captured. A focused input alone is NOT a keyboard.
+ *
+ * It publishes the visible area (--viewport-height, --viewport-top): a phone's
+ * keyboard shrinks only the visual viewport on iOS (100dvh never moves), so a
+ * full-height app shell sized to it is what keeps the composer above the keys. */
 export const MOBILE_VIEWPORT_SCRIPT = String.raw `
 (function(){
   var root=document.documentElement,viewport=window.visualViewport;
   if(!viewport)return;
-  var phone=window.matchMedia('(max-width: 760px)'),baseline=window.innerHeight,frame=0;
+  var phone=window.matchMedia('(max-width: 900px)'),baseline=window.innerHeight,frame=0;
   function update(){
     frame=0;
     var active=document.activeElement;
@@ -18,8 +22,20 @@ export const MOBILE_VIEWPORT_SCRIPT = String.raw `
     var opening=open&&!root.hasAttribute('data-mobile-keyboard');
     var atEnd=opening&&window.innerHeight+window.scrollY>=root.scrollHeight-120;
     root.toggleAttribute('data-mobile-keyboard',Boolean(open));
+    // A pinch zoom shrinks the visual viewport too, and then a keyboard can't be told from the zoom: zoomed, the shell
+    // is the whole screen (the reader pans to the field), so a keyboard closed while zoomed never leaves it short.
+    if(Math.abs(viewport.scale-1)<0.01){
+      root.style.setProperty('--viewport-height',Math.round(viewport.height)+'px');
+      root.style.setProperty('--viewport-top',Math.max(0,Math.round(viewport.offsetTop))+'px');
+    }else{
+      root.style.removeProperty('--viewport-height');
+      root.style.removeProperty('--viewport-top');
+    }
     root.style.setProperty('--keyboard-inset',open?Math.round(gap)+'px':'0px');
     if(atEnd)window.scrollTo({top:root.scrollHeight,behavior:'instant'});
+    // In the app shell the field sits in its own scrolling panel, which the shell's new size just cut short:
+    // bring it back into that panel's view once the smaller layout is in.
+    if(opening&&active.closest('.so-workspace'))requestAnimationFrame(function(){active.scrollIntoView({block:'nearest',behavior:'instant'});});
   }
   function schedule(){if(!frame)frame=requestAnimationFrame(update);}
   viewport.addEventListener('resize',schedule);

package/dist/model-catalog.js

@@ -6,6 +6,7 @@
  * installed CLIs are current. Everything lands in orders.db so pickers,
  * spend pins and "new model" notices read one saved snapshot.
  */
+import { isAcpProvider } from "./acp-agents.js";
 import { execFile } from "node:child_process";
 import { accessSync, constants, lstatSync, readFileSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
@@ -197,6 +198,9 @@ export function modelOptions(store, provider, now, home = homedir()) {
     }
     if (provider === "gemini")
         return seenModels(store, "gemini").slice(0, 20).map(option);
+    // An ACP agent offers only the models its check recorded, on the runner that checked it — read there, never guessed.
+    if (isAcpProvider(provider))
+        return [];
     return seenModels(store, "openrouter").filter(model => model.tools).sort((a, b) => a.name.localeCompare(b.name)).map(option);
 }
 /** Chat reserves worst-case spend: price per token in whole micro-dollars,

package/dist/monitoring-ui.js

@@ -3,7 +3,7 @@
  * the company's tools. One form, the status of each destination beside it,
  * and how Prometheus reads `/metrics`. The signing secret is shown once.
  */
-import { html, postForm } from "./html.js";
+import { html, postForm, reauth } from "./html.js";
 import { targetOf } from "./monitoring.js";
 import { whenUtc } from "./when-html.js";
 const when = (at) => whenUtc(at);
@@ -31,7 +31,7 @@ export function monitoringHtml(view, notice) {
     const s = view.settings;
     const note = notice.problem ? html `<p class="problem" role="alert">${notice.problem}</p>` : notice.said ? html `<p role="status">${notice.said}</p>` : "";
     const metrics = view.origin === null ? "/metrics" : `${view.origin}/metrics`;
-    return html `<section class="monitoring">${note}${postForm("/settings/monitoring", html `<fieldset><legend>Audit stream</legend><p class="meta">Every ledger entry with its seal, as it happens, to your log system.</p><label>Webhook<input type="url" name="webhook" value="${s.webhook?.url ?? ""}" placeholder="https://logs.example.com/standing-orders" spellcheck="false"></label>${statusLine(view, "webhook", s.webhook?.url ?? null)}${s.webhook === null ? "" : html `<label class="choice"><input type="checkbox" name="rotate" value="1"> Make a new signing secret</label>`}<label>Folder (JSON Lines, a file per day)<input type="text" name="folder" value="${s.folder?.path ?? ""}" placeholder="/var/log/standing-orders" spellcheck="false"></label>${statusLine(view, "folder", s.folder?.path ?? null)}</fieldset><fieldset><legend>Traces</legend><p class="meta">Each run as an OpenTelemetry span: timings, model, tokens and cost. Never a prompt or code.</p><label>Collector (OTLP over HTTP)<input type="url" name="traces" value="${s.traces?.endpoint ?? ""}" placeholder="https://otel.example.com:4318" spellcheck="false"></label>${statusLine(view, "traces", s.traces?.endpoint ?? null)}<label>Header name (optional)<input type="text" name="header-name" value="${s.traces?.header?.name ?? ""}" placeholder="x-honeycomb-team" spellcheck="false"></label><label>Header value<input type="password" name="header-value" autocomplete="off" placeholder="${s.traces?.header ? "Saved; leave blank to keep" : "API key"}"></label></fieldset><div class="step-up"><label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label></div><button type="submit">Save</button>`)}<fieldset><legend>Metrics</legend><p class="meta">Prometheus reads <code>${metrics}</code> with an instance operator's API token (<a href="/settings/sessions">Sessions &amp; tokens</a>).</p><details><summary>Example</summary><pre>curl -H "Authorization: Bearer so_…" ${metrics}</pre></details></fieldset></section>`;
+    return html `<section class="monitoring">${note}${postForm("/settings/monitoring", html `<fieldset><legend>Audit stream</legend><p class="meta">Every ledger entry with its seal, as it happens, to your log system.</p><label>Webhook<input type="url" name="webhook" value="${s.webhook?.url ?? ""}" placeholder="https://logs.example.com/standing-orders" spellcheck="false"></label>${statusLine(view, "webhook", s.webhook?.url ?? null)}${s.webhook === null ? "" : html `<label class="choice"><input type="checkbox" name="rotate" value="1"> Make a new signing secret</label>`}<label>Folder (JSON Lines, a file per day)<input type="text" name="folder" value="${s.folder?.path ?? ""}" placeholder="/var/log/standing-orders" spellcheck="false"></label>${statusLine(view, "folder", s.folder?.path ?? null)}</fieldset><fieldset><legend>Traces</legend><p class="meta">Each run as an OpenTelemetry span: timings, model, tokens and cost. Never a prompt or code.</p><label>Collector (OTLP over HTTP)<input type="url" name="traces" value="${s.traces?.endpoint ?? ""}" placeholder="https://otel.example.com:4318" spellcheck="false"></label>${statusLine(view, "traces", s.traces?.endpoint ?? null)}<label>Header name (optional)<input type="text" name="header-name" value="${s.traces?.header?.name ?? ""}" placeholder="x-honeycomb-team" spellcheck="false"></label><label>Header value<input type="password" name="header-value" autocomplete="off" placeholder="${s.traces?.header ? "Saved; leave blank to keep" : "API key"}"></label></fieldset><div class="step-up">${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label>`)}</div><button type="submit">Save</button>`)}<fieldset><legend>Metrics</legend><p class="meta">Prometheus reads <code>${metrics}</code> with an instance operator's API token (<a href="/settings/sessions">Sessions &amp; tokens</a>).</p><details><summary>Example</summary><pre>curl -H "Authorization: Bearer so_…" ${metrics}</pre></details></fieldset></section>`;
 }
 /** The webhook's signing secret, once: a focused page with no script. */
 export function signingSecretHtml(url, secret) {

package/dist/needs-you.d.ts

@@ -6,7 +6,7 @@
  * The words never name the machine's internals; `plainSentence` keeps a
  * recorded reason only when it is free of them. */
 /** What a person is asked for. */
-export type NeedKey = "approval" | "card" | "answer" | "questions" | "sign-in" | "confirm-stopped" | "check-stopped" | "hold" | "choose-project" | "define-task" | "fix-request" | "choose-agent" | "fix-dependency" | "add-requirement" | "connect-builder" | "start-builder" | "vanished" | "review-result" | "rebuild" | "earlier-version" | "other";
+export type NeedKey = "approval" | "card" | "answer" | "questions" | "sign-in" | "confirm-stopped" | "check-stopped" | "hold" | "choose-project" | "define-task" | "fix-request" | "choose-agent" | "fix-dependency" | "add-requirement" | "connect-builder" | "start-builder" | "vanished" | "review-result" | "rebuild" | "replan" | "earlier-version" | "other";
 /** What the work waits for when no person can act. */
 export type WaitKey = "build-stopping" | "build-finishing" | "other-computer" | "card-reply" | "card-time" | "card-ci";
 /** The action's code: the WorkAction that owns the act, or one of the acts a surface renders itself. */

package/dist/needs-you.js

@@ -25,7 +25,11 @@ export const NEEDS = {
         useReason: reason => /the planner can carry at most/.test(reason) },
     "choose-agent": { sentence: () => "Choose an agent to build this.", action: { code: "select-agent", label: "Choose an agent" } },
     "fix-dependency": { sentence: () => "A task this one waits on didn't finish. Fix or remove it so this one can start.", action: { code: "repair-dependency", label: "Fix the required task" },
-        useReason: reason => /didn't finish|did not finish|before it finished/i.test(reason), withReason: reason => `${reason.replace(/[.\s]*$/, ".")} Fix or remove it so this one can start.` },
+        useReason: reason => /didn't finish|did not finish|before it finished/i.test(reason), withReason: reason => {
+            // A reason that already says what to do is said once.
+            const said = reason.replace(/[.\s]*$/, ".");
+            return /Fix or remove it so this one can start\.$/.test(said) ? said : `${said} Fix or remove it so this one can start.`;
+        } },
     "add-requirement": { sentence: () => "This project is missing something the task needs. Add it so a builder can start.", action: { code: "repair-capability", label: "Add the requirement" } },
     "connect-builder": { sentence: () => "No builder works on this project yet. Connect one so the task can start.", action: { code: "start-worker", label: "Connect a builder" } },
     "start-builder": { sentence: () => "The builder for this project is offline. Start it and the task begins on its own.", action: { code: "start-worker", label: "Start the builder" } },
@@ -33,6 +37,8 @@ export const NEEDS = {
     "review-result": { sentence: () => "Check the result, then accept it or ask for changes.", action: { code: "open-result", label: "Open result" } },
     // Accepting it would not help: it was built to terms that are no longer the plan.
     rebuild: { sentence: context => `${Build(context)} was made to an earlier plan. Build it again to the current plan.`, action: { code: "retry-task", label: "Build again" } },
+    // The plan was rewritten after the build and not yet approved: the yes comes first, then Build again.
+    replan: { sentence: context => `The plan changed after ${build(context)}. Approve the new plan, then build it again.`, action: { code: "approve-scope", label: "Approve plan" } },
     "earlier-version": { sentence: () => "An earlier version of this task still needs you. Finish it first.", action: { code: "inspect-task", label: "Open earlier version" } },
     other: { sentence: () => "Open the task to see what it needs from you.", action: { code: "inspect-task", label: "Open the task" }, useReason: always },
 };
@@ -42,7 +48,7 @@ export const ASK_LABEL = { decide: "Decide", review: "Review", unblock: "Unblock
 export function askChipOf(read) {
     if (read.headline === "Failed")
         return "Failed";
-    if (read.planChanged === true || read.need === "rebuild")
+    if (read.planChanged === true || read.need === "rebuild" || read.need === "replan")
         return "Plan changed";
     if (read.mismatch === true)
         return "Mismatch";
@@ -60,7 +66,8 @@ export function resultHoldUpSentence(facts) {
     if (facts.hold != null)
         return "A hold is on this result. Release it to accept the result.";
     if (facts.planChanged)
-        return "The plan changed after this was built. Build it again to the current plan.";
+        return facts.unapproved ? "The plan changed after this was built. Approve the new plan, then build it again."
+            : "The plan changed after this was built. Build it again to the current plan.";
     if (facts.unapproved)
         return "The current plan isn't approved. Approve it, then review the result.";
     if (facts.question)
@@ -76,7 +83,7 @@ export function resultHoldUpSentence(facts) {
 export const NEED_ASK = {
     approval: "decide", card: "decide", answer: "decide", questions: "decide", "choose-project": "decide", "define-task": "decide",
     "fix-request": "decide", "choose-agent": "decide",
-    "review-result": "review", rebuild: "review",
+    "review-result": "review", rebuild: "review", replan: "decide",
     "sign-in": "unblock", "confirm-stopped": "unblock", "check-stopped": "unblock", hold: "unblock", "fix-dependency": "unblock",
     "add-requirement": "unblock", "connect-builder": "unblock", "start-builder": "unblock", vanished: "unblock", "earlier-version": "unblock", other: "unblock",
 };

package/dist/oauth-run-token.d.ts

@@ -0,0 +1,51 @@
+import type { ToolSpec } from "./contracts/integration-metadata.js";
+/** The secrets a connected tool keeps: the bearer the MCP server takes, and what renewing it needs. */
+export declare const ACCESS = "OAUTH_ACCESS_TOKEN", REFRESH = "OAUTH_REFRESH_TOKEN", CLIENT = "OAUTH_CLIENT_ID", CLIENT_SECRET = "OAUTH_CLIENT_SECRET", TOKEN_URL = "OAUTH_TOKEN_URL", EXPIRES = "OAUTH_EXPIRES_AT", RESOURCE = "OAUTH_RESOURCE";
+/** The scope the sign-in granted, kept beside its token. Not one of the spec's secrets, so it never reaches a launch. */
+export declare const GRANTED = "OAUTH_GRANTED_SCOPE";
+/** Where the service revokes a token (RFC 7009), when its sign-in said. Not one of the spec's secrets either. */
+export declare const REVOKE_URL = "OAUTH_REVOKE_URL";
+/** A tool connected by signing in: a web tool whose sign-in is the access token. */
+export declare const signedIn: (spec: Pick<ToolSpec, "transport" | "bearer">) => boolean;
+/** Whether runs of a signed-in tool get their own token: only when there is a refresh token to make one with. */
+export declare const mintsRunTokens: (values: Readonly<Record<string, string>> | readonly string[]) => boolean;
+/** A sign-in address Toolroll will send a token to: https, or a stand-in on this computer. */
+export declare const signInAddress: (value: unknown) => value is string;
+export declare const readScope: (scope: string) => boolean;
+/** An OAuth `scope` value as scope tokens (RFC 6749), sorted and deduplicated; null when absent, empty or malformed. */
+export declare function scopeList(value: unknown): string[] | null;
+/**
+ * The scope a run asks for: none (the saved grant, never more) for a build; for a research step, only the grant's
+ * read scopes when it has some and others besides. A grant never said is left as it is.
+ */
+export declare function runScope(granted: readonly string[] | null, readOnly: boolean): string[] | null;
+/**
+ * One renewal of a sign-in at a time (per project and tool, in this process): a service that rotates its refresh
+ * token on every use would otherwise see the same one twice, and whichever answer was saved last would be the
+ * newest only by luck.
+ */
+export declare function oneAtATime<T>(key: string, work: () => Promise<T>): Promise<T>;
+type Fetch = typeof fetch;
+/** A run's token: the access token alone, its expiry, a rotated refresh token to keep, and how to revoke it. */
+export type RunToken = {
+    access: string;
+    expires: string | null;
+    rotated: string | null;
+    revoke: (() => Promise<void>) | null;
+};
+/**
+ * Trade the saved refresh token for an access token of this run's own. Plain reasons only: a service's answer is
+ * never repeated, so no token can ride an error into a log or the run's record.
+ */
+export declare function mintRunToken(values: Readonly<Record<string, string>>, options: {
+    scope: readonly string[] | null;
+    now: Date;
+    fetcher?: Fetch;
+}): Promise<{
+    ok: true;
+    token: RunToken;
+} | {
+    ok: false;
+    reason: string;
+}>;
+export {};

package/dist/oauth-run-token.js

@@ -0,0 +1,127 @@
+/**
+ * A run's own sign-in for a service connected by signing in (mcp-connect.ts).
+ *
+ * The service's secrets are an access token and the refresh token that renews
+ * it. A run never gets the refresh token. When it launches, Toolroll — outside
+ * the fence — trades the refresh token for a fresh access token of the run's
+ * own, no broader than the saved grant (a research step asks for only its read
+ * scopes, where the service takes a narrower one), and only that access token
+ * enters the run's broker. When the run ends the token is revoked, where the
+ * service said how at sign-in, and otherwise runs out at its own expiry. A
+ * service that gave no refresh token has only its one access token: the broker
+ * holds it, as it holds an API key.
+ */
+import { SCOPE_TOKEN, readTokenResponse } from "./contracts/integration-metadata.js";
+/** The secrets a connected tool keeps: the bearer the MCP server takes, and what renewing it needs. */
+export const ACCESS = "OAUTH_ACCESS_TOKEN", REFRESH = "OAUTH_REFRESH_TOKEN", CLIENT = "OAUTH_CLIENT_ID", CLIENT_SECRET = "OAUTH_CLIENT_SECRET", TOKEN_URL = "OAUTH_TOKEN_URL", EXPIRES = "OAUTH_EXPIRES_AT", RESOURCE = "OAUTH_RESOURCE";
+/** The scope the sign-in granted, kept beside its token. Not one of the spec's secrets, so it never reaches a launch. */
+export const GRANTED = "OAUTH_GRANTED_SCOPE";
+/** Where the service revokes a token (RFC 7009), when its sign-in said. Not one of the spec's secrets either. */
+export const REVOKE_URL = "OAUTH_REVOKE_URL";
+/** A tool connected by signing in: a web tool whose sign-in is the access token. */
+export const signedIn = (spec) => spec.transport === "http" && spec.bearer === ACCESS;
+/** Whether runs of a signed-in tool get their own token: only when there is a refresh token to make one with. */
+export const mintsRunTokens = (values) => {
+    const has = (name) => Array.isArray(values) ? values.includes(name) : (values[name] ?? "") !== "";
+    return has(REFRESH) && has(TOKEN_URL) && has(CLIENT);
+};
+const loopback = (url) => url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+/** A sign-in address Toolroll will send a token to: https, or a stand-in on this computer. */
+export const signInAddress = (value) => {
+    if (typeof value !== "string")
+        return false;
+    try {
+        const url = new URL(value);
+        return url.protocol === "https:" || loopback(url);
+    }
+    catch {
+        return false;
+    }
+};
+/** Identity scopes a read-only grant may carry beside `<resource>:read` ones. */
+const IDENTITY_SCOPES = new Set(["openid", "profile", "email"]);
+const READ_SCOPE = /^[a-z][a-z0-9_]{0,63}:read$/;
+export const readScope = (scope) => IDENTITY_SCOPES.has(scope) || READ_SCOPE.test(scope);
+/** An OAuth `scope` value as scope tokens (RFC 6749), sorted and deduplicated; null when absent, empty or malformed. */
+export function scopeList(value) {
+    if (typeof value !== "string")
+        return null;
+    const tokens = value.split(" ").filter(one => one !== "");
+    if (tokens.length === 0 || tokens.length > 512 || !tokens.every(one => SCOPE_TOKEN.test(one)))
+        return null;
+    return [...new Set(tokens)].sort();
+}
+/**
+ * The scope a run asks for: none (the saved grant, never more) for a build; for a research step, only the grant's
+ * read scopes when it has some and others besides. A grant never said is left as it is.
+ */
+export function runScope(granted, readOnly) {
+    if (!readOnly || granted === null)
+        return null;
+    const reads = granted.filter(readScope);
+    return reads.length > 0 && reads.length < granted.length ? reads : null;
+}
+const busy = new Map();
+/**
+ * One renewal of a sign-in at a time (per project and tool, in this process): a service that rotates its refresh
+ * token on every use would otherwise see the same one twice, and whichever answer was saved last would be the
+ * newest only by luck.
+ */
+export function oneAtATime(key, work) {
+    const ran = (busy.get(key) ?? Promise.resolve()).then(work, work);
+    const settled = ran.then(() => undefined, () => undefined);
+    busy.set(key, settled);
+    void settled.then(() => { if (busy.get(key) === settled)
+        busy.delete(key); });
+    return ran;
+}
+/**
+ * Trade the saved refresh token for an access token of this run's own. Plain reasons only: a service's answer is
+ * never repeated, so no token can ride an error into a log or the run's record.
+ */
+export async function mintRunToken(values, options) {
+    const fetcher = options.fetcher ?? fetch;
+    const refresh = values[REFRESH], tokenUrl = values[TOKEN_URL], client = values[CLIENT];
+    if (!refresh || !client || !signInAddress(tokenUrl))
+        return { ok: false, reason: "its sign-in can't be renewed for this run; connect it again on the Tools page" };
+    const ask = async (scope) => {
+        const answer = await fetcher(tokenUrl, { method: "POST", redirect: "error", headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" }, signal: AbortSignal.timeout(15_000),
+            body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: refresh, client_id: client,
+                ...(values[CLIENT_SECRET] ? { client_secret: values[CLIENT_SECRET] } : {}), ...(values[RESOURCE] ? { resource: values[RESOURCE] } : {}),
+                ...(scope === null ? {} : { scope: scope.join(" ") }) }) });
+        let body = null;
+        try {
+            body = readTokenResponse(await answer.json());
+        }
+        catch {
+            body = null;
+        }
+        return { ok: answer.ok, body };
+    };
+    try {
+        let answered = await ask(options.scope);
+        // A service that won't narrow a grant on renewal gets asked for the grant as saved; the broker still offers the
+        // step only its read-only actions.
+        if (!answered.ok && options.scope !== null && answered.body?.error === "invalid_scope")
+            answered = await ask(null);
+        const access = answered.body?.access_token;
+        if (!answered.ok || typeof access !== "string" || access === "")
+            return { ok: false, reason: "its sign-in ran out; connect it again on the Tools page" };
+        const body = answered.body;
+        const expires = body.expires_in === undefined ? null : new Date(options.now.getTime() + body.expires_in * 1000).toISOString();
+        const rotated = typeof body.refresh_token === "string" && body.refresh_token !== "" && body.refresh_token !== refresh ? body.refresh_token : null;
+        const revokeUrl = values[REVOKE_URL];
+        const revoke = signInAddress(revokeUrl) ? async () => {
+            try {
+                const answer = await fetcher(revokeUrl, { method: "POST", redirect: "error", headers: { "content-type": "application/x-www-form-urlencoded" }, signal: AbortSignal.timeout(10_000),
+                    body: new URLSearchParams({ token: access, token_type_hint: "access_token", client_id: client, ...(values[CLIENT_SECRET] ? { client_secret: values[CLIENT_SECRET] } : {}) }) });
+                await answer.body?.cancel();
+            }
+            catch { /* it runs out at its own expiry */ }
+        } : null;
+        return { ok: true, token: { access, expires, rotated, revoke } };
+    }
+    catch {
+        return { ok: false, reason: "its service couldn't be reached to sign this run in" };
+    }
+}

package/dist/operate.d.ts

@@ -145,6 +145,8 @@ export declare function runOperateAs(argv: string[], opts: {
  * finding 27): exclusive, 0600, fsynced — file and directory both — so the
  * row only ever follows a durable secret. Throws on any failure. */
 export declare function writeLoginFileDurably(path: string, name: string, password: string): void;
+/** The platform browser opener — detached, silent, never load-bearing. */
+export declare function openBrowser(url: string): void;
 export declare function readUpConsoleUrl(dir: string): string | null;
 /**
  * The people allowed to agree to a scope.