toolroll 0.9.65 → 0.9.68

package/dist/builder.d.ts

@@ -1,3 +1,4 @@
+import type { WritesMode } from "./writes-mode.js";
 import type { LaunchNetwork } from "./invoke.js";
 import type { ProviderId } from "./contracts/provider.js";
 import { type PreparedEvidence } from "./prepared-evidence.js";
@@ -186,6 +187,9 @@ export declare function redactSecretAssignments(text: string): string;
 /** A build's network (egress.ts): the one its approval sealed, or — sealed before network policies existed — the
  * narrowed legacy one (provider hosts and the repository's registries, nothing added since). */
 export declare function launchNetworkOf(store: Store, taskRef: number, profile: ExecutionProfile): LaunchNetwork;
+/** Where a build may write (writes-mode.ts): what its approval sealed, or — sealed before write allowlists — anywhere
+ * its fence allows, as it was approved. */
+export declare function launchWritesOf(profile: ExecutionProfile): WritesMode;
 export declare function proveApprovedProfile(scope: Scope | null, given: {
     provider: string;
     model: string | undefined;

package/dist/builder.js

@@ -1,4 +1,5 @@
 import { legacyNetwork, repositoryEcosystems } from "./egress.js";
+import { checkoutGit } from "./teardown-git.js";
 import { isAcpProvider } from "./acp-agents.js";
 import { OBSERVATION_MAILBOX, observationBrief, parseObservationCases, collectObservations } from "./observations.js";
 import { checkCommandFor, effectiveCheckLevel, recordRunCheckLevel } from "./check-levels.js";
@@ -41,9 +42,9 @@ import { PREPARED_EVIDENCE_FILE, PREPARED_EVIDENCE_GIT, preparedScreenshotMatche
  * watchdog and a high runaway-turn breaker still stop a pathological loop;
  * repair remains narrowly time-bounded because its job is narrowly scoped.
  */
-import { existsSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, realpathSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { run, runClaudeStreamJsonl, runOwnerTag, streamsInput } from "./exec.js";
 import { stopRequestedFor, stopWords, underStopWatch } from "./task-control.js";
 import { witnessedRunner } from "./process-custody.js";
@@ -58,7 +59,7 @@ import { heartbeat as runnerHeartbeat } from "./runner.js";
 import { MARKER as LEASE_MARKER } from "./worktree.js";
 import { parseDecision, parseHandoff, repairPrompt, HEADLESS_RULE, HANDOFF_CONCLUSION_CAP, HANDOFF_ITEM_CAP, HANDOFF_LIST_CAP, HANDOFF_PAYLOAD_CAP } from "./decision.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { invokeAgent } from "./invoke.js";
+import { fencedCommands, invokeAgent } from "./invoke.js";
 import { TELEGRAM_TOKEN_ENVS } from "./names.js";
 import { OPENROUTER_ENV_KEY, auditOf, ALL_CREDENTIAL_ENV } from "./provider.js";
 import { liveLogContext } from "./live-detail.js";
@@ -73,7 +74,7 @@ import { captureParkEvidence, captureTerminalDiff, captureBaseTree, evidenceRoot
 import { attemptKeyOf, closeRunQuestions, noteOpenTool, recordAgentTurn } from "./agent-board.js";
 import { openStatusFile, pulseAgentBoard, removeStatusFile, statusBrief } from "./agent-pulse.js";
 import { withAgentTurns } from "./agent-turns.js";
-import { PROOF_LIMITS, parseProof, serializeProof, adjudicate, artifactManifestOnly, sameDiffStatFacts } from "./proof.js";
+import { PROOF_LIMITS, parseProof, serializeProof, adjudicate, sameDiffStatFacts } from "./proof.js";
 import { parseHandoffArtifact } from "./contracts/handoff.js";
 import { captureReviewContext } from "./review-context.js";
 import { authoritySnapshotDigest, classifyRevisionAuthority, isMilestoneRegression, milestonesOf, parseExecutionPlanDocument, parsePlanRevisionProposal, parseProgressSnapshot, renderExecutionPlanDocument, PROGRESS_LIMITS, REVISION_LIMITS, } from "./plan.js";
@@ -237,6 +238,43 @@ export function launchNetworkOf(store, taskRef, profile) {
     const repo = store.refForId(taskRef)?.repo ?? null;
     return { policy: legacyNetwork(profile.provider, repo === null ? [] : repositoryEcosystems(repo)) };
 }
+/** Asking a checkout which branch it is on: reads no file a build wrote and runs nothing. */
+const BRANCH_QUERIES = [
+    ["--no-optional-locks", "rev-parse", "--abbrev-ref", "HEAD"], ["--no-optional-locks", "symbolic-ref", "--short", "-q", "HEAD"],
+];
+/**
+ * The plane's git as a build runs it: hardened (teardown-git.ts checkoutGit) for every call, failing closed, but one —
+ * asking the project's own main checkout which branch it is on (its config is the operator's, and the query runs
+ * nothing). An injected runner (`request.git`: tests only; production always runs git itself) is used as given.
+ */
+function buildCheckoutGit(given, worktree, mainCheckout = null) {
+    if (given !== run)
+        return given;
+    const hardened = checkoutGit(given);
+    const real = (path) => { try {
+        return realpathSync(resolve(path));
+    }
+    catch {
+        return null;
+    } };
+    const trusted = mainCheckout === null ? null : real(mainCheckout);
+    const own = real(worktree);
+    return (file, args, options) => {
+        const at = options?.cwd === undefined ? null : real(options.cwd);
+        const query = BRANCH_QUERIES.some(one => one.length === args.length && one.every((word, index) => args[index] === word));
+        return trusted !== null && at === trusted && at !== own && query ? given(file, args, options) : hardened(file, args, options);
+    };
+}
+/** A run's setup and check commands, in its build's fence, writing where the approval this build runs under sealed
+ * (never the scope as it may since have been rewritten; invoke.ts fencedCommands). */
+function commandRunner(store, runId, profile, inner) {
+    return fencedCommands(store, runId, launchWritesOf(profile), inner);
+}
+/** Where a build may write (writes-mode.ts): what its approval sealed, or — sealed before write allowlists — anywhere
+ * its fence allows, as it was approved. */
+export function launchWritesOf(profile) {
+    return profile.writes ?? "anywhere";
+}
 export function proveApprovedProfile(scope, given) {
     // The raw terms first (raw authority repair): a scope whose stored terms
     // do not read back exactly proves nothing — not the filtered reading.
@@ -331,7 +369,9 @@ export function proveApprovedProfile(scope, given) {
  * that forgot one is exactly the caller this is protecting against.
  */
 export async function build(store, request) {
-    const { taskId, taskRef, runner, worktree, branch, now, permissionMode = "auto", skipPermissions = false, provider = "claude", model, maxTurns = DEFAULT_MAX_TURNS, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS, agent, git = run, } = request;
+    const { taskId, taskRef, runner, worktree, branch, now, permissionMode = "auto", skipPermissions = false, provider = "claude", maxTurns = DEFAULT_MAX_TURNS, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS, agent, git: givenGit = run, } = request;
+    // The plane's own git on this build's checkout runs hardened, and never where the checkout's config names a command.
+    const git = buildCheckoutGit(givenGit, worktree, store.getWorktree(worktree)?.repo ?? null);
     const scope = store.getScope(taskId);
     const approval = approvalOf(scope);
     if (!approval.approved) {
@@ -625,7 +665,7 @@ export async function build(store, request) {
             // Setup runs under the stop watch (v52), owned by this run: an
             // operator's stop ends the setup's process group and the attempt
             // settles as interrupted below, never as a setup failure.
-            const made = await underStopWatch(store, request.runId, () => runWithIsolatedDatabase(witnessedRunner(store, request.runId, request.clock ?? (() => now), runSetup), shell.file, shell.args, {
+            const made = await underStopWatch(store, request.runId, () => runWithIsolatedDatabase(witnessedRunner(store, request.runId, request.clock ?? (() => now), commandRunner(store, request.runId, effective.profile, runSetup)), shell.file, shell.args, {
                 cwd: worktree,
                 timeoutMs: setupWanted.timeoutMs,
                 processGroup: true,
@@ -1310,6 +1350,7 @@ export async function build(store, request) {
             ...watchdogsOf(effective.profile, effective.timeoutMs),
             omitEnv: AGENT_ENV_DENYLIST,
             network: launchNetworkOf(store, request.taskRef, effective.profile),
+            writes: launchWritesOf(effective.profile),
             ...(agent === undefined ? {} : { runner: agent }),
             onSpawn: (pid) => { spawned = true; request.onProviderSpawn?.(pid); },
             onStreamEvent: (event) => liveLog.observe(event),
@@ -1486,7 +1527,7 @@ export async function settleProviderOutcome(captured, result) {
         }
         catch { /* The commit gate still excludes it. */ }
     }
-    const { store, request, agent, git, worktree, branch, baseRevision, taskId, taskRef, runner, provider, scope, effective, answers, timeoutMs, root, mailbox, done, proof, clock } = captured;
+    const { store, request, agent, git, worktree, branch, baseRevision, taskId, taskRef, runner, provider, scope, effective, answers, timeoutMs, root, mailbox, done, clock } = captured;
     // THE STOP FENCE after the provider (v52): a stop recorded while the
     // agent ran ends the attempt HERE, before any handoff is read, any park
     // sealed, or any commit made — whatever the process wrote is preserved
@@ -1774,7 +1815,7 @@ export async function settleProviderOutcome(captured, result) {
                 };
                 if (!eligible())
                     throw Error("The observation source or execution authority changed.");
-                const execute = (file, args, options) => underStopWatch(store, request.runId, () => runWithIsolatedDatabase(witnessedRunner(store, request.runId, clock, request.verify ?? run), file, args, {
+                const execute = (file, args, options) => underStopWatch(store, request.runId, () => runWithIsolatedDatabase(witnessedRunner(store, request.runId, clock, commandRunner(store, request.runId, captured.effective.profile, request.verify ?? run)), file, args, {
                     ...options, processGroup: true, owner: runOwnerTag(store, request.runId), beforeSpawn: eligible,
                     onSpawn: pid => request.onProviderSpawn?.(pid), envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST,
                 }));
@@ -2234,7 +2275,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
         const runVerification = async (label) => {
             const streamed = { stdout: false, stderr: false };
             // The check runs under the stop watch (v52), owned by this run.
-            const result = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, verifyRunner), verifyShell.file, verifyShell.args, {
+            const result = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, commandRunner(store, runId, captured.effective.profile, verifyRunner)), verifyShell.file, verifyShell.args, {
                 cwd: worktree,
                 timeoutMs: configured.timeoutMs,
                 processGroup: true,
@@ -2276,7 +2317,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
             detachShared(worktree, depsRoot);
             const label = "Own install · approved project setup (package.json or lockfile changed)";
             const setupShell = approvedCommandShell(live.command);
-            const installed = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, request.setup ?? run), setupShell.file, setupShell.args, {
+            const installed = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, commandRunner(store, runId, captured.effective.profile, request.setup ?? run)), setupShell.file, setupShell.args, {
                 cwd: worktree,
                 timeoutMs: live.timeoutMs,
                 processGroup: true,
@@ -2295,7 +2336,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
             checkLog.push(attemptLog(label, live.command, installed));
             if (installed.notFound || installed.timedOut || installed.code !== 0)
                 return "own-install-failed";
-            return await sealedTreeState(request.git ?? run) === "clean" ? null : "setup-changed-files";
+            return await sealedTreeState(buildCheckoutGit(request.git ?? run, worktree)) === "clean" ? null : "setup-changed-files";
         };
         const ownInstall = await ownInstallIfChanged();
         const first = ownInstall === null ? await runVerification("Project check · attempt 1") : null;
@@ -2339,7 +2380,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
                 verifyCommand = { configured: true, ran: false, attemptFailed: true, failure: "custody-lost" };
             }
             else {
-                const gitRunner = request.git ?? run;
+                const gitRunner = buildCheckoutGit(request.git ?? run, worktree);
                 const beforeSetup = await sealedTreeState(gitRunner);
                 if (beforeSetup === "head-moved") {
                     verifyCommand = { configured: true, ran: false, attemptFailed: true, failure: "checkout-moved" };
@@ -2366,7 +2407,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
                     else {
                         const setupRunner = request.setup ?? run;
                         const setupShell = approvedCommandShell(liveBeforeSetup.command);
-                        const restored = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, setupRunner), setupShell.file, setupShell.args, {
+                        const restored = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, commandRunner(store, runId, captured.effective.profile, setupRunner)), setupShell.file, setupShell.args, {
                             cwd: worktree,
                             timeoutMs: liveBeforeSetup.timeoutMs,
                             processGroup: true,
@@ -2653,6 +2694,7 @@ async function resumeUnhandedWork(captured, sessionId) {
             ...watchdogsOf(effective.profile, effective.timeoutMs),
             omitEnv: AGENT_ENV_DENYLIST,
             network: launchNetworkOf(store, request.taskRef, effective.profile),
+            writes: launchWritesOf(effective.profile),
             ...(agent === undefined ? {} : { runner: agent }),
             ...(request.onProviderSpawn === undefined ? {} : { onSpawn: request.onProviderSpawn }),
             clock,
@@ -2867,7 +2909,7 @@ async function ingestPark(args) {
                 ? watchdogsOf(args.profile, args.profile.repairTimeoutSeconds * 1000, true)
                 : { timeoutMs: args.profile !== undefined ? args.profile.repairTimeoutSeconds * 1000 : REPAIR_TIMEOUT_MS }),
             omitEnv: AGENT_ENV_DENYLIST,
-            ...(args.profile === undefined ? {} : { network: launchNetworkOf(store, request.taskRef, args.profile) }),
+            ...(args.profile === undefined ? {} : { network: launchNetworkOf(store, request.taskRef, args.profile), writes: launchWritesOf(args.profile) }),
             ...(agent === undefined ? {} : { runner: agent }),
             ...(request.onProviderSpawn === undefined ? {} : { onSpawn: request.onProviderSpawn }),
             clock,
@@ -3492,29 +3534,6 @@ async function stripEvidenceImages(git, worktree) {
     const rest = await git(GIT, ["--no-optional-locks", "diff", "--cached", "--quiet"], { cwd: worktree });
     return { ok: true, notice: evidenceImagesNotice(images), staged: rest.code !== 0 };
 }
-/**
- * `claude --output-format json` returns an envelope: the result is the
- * summary, and the session id is what lets a malformed park be repaired by
- * resuming the conversation that produced it instead of paying for a new one.
- */
-function envelope(stdout) {
-    try {
-        const parsed = JSON.parse(stdout);
-        return {
-            summary: typeof parsed.result === "string" && parsed.result.trim() !== ""
-                ? parsed.result.trim()
-                : "unattended build",
-            ...(typeof parsed.session_id === "string" && parsed.session_id !== ""
-                ? { sessionId: parsed.session_id }
-                : {}),
-        };
-    }
-    catch {
-        // An agent that printed something unparseable still did work — and a
-        // session nobody can name simply cannot be resumed.
-        return { summary: "unattended build" };
-    }
-}
 /**
  * What a non-zero agent exit means, in words a person can act on: the
  * harness's own result line names the ending (a turn ceiling, an error

package/dist/canonical-json.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Deterministic JSON for digests and equality. These bytes are sealed into approvals and stored digests, so neither
+ * function may change its output for any input. The two differ on purpose and must stay distinct:
+ *
+ * - `canonicalJson` drops object keys whose value is undefined and returns JSON.stringify's own answer for a bare
+ *   value (an undefined array element therefore renders as nothing: `[,1]`).
+ * - `canonicalJsonUndefinedAsNull` keeps every key and renders an undefined (or otherwise unserializable) value as
+ *   `null` — the planner contract's bytes.
+ *
+ * Both sort object keys by UTF-16 code units and keep arrays in order.
+ */
+export declare function canonicalJson(value: unknown): string;
+/** Stable JSON for hashing and equality only — no filling, no trimming; undefined reads as null. */
+export declare function canonicalJsonUndefinedAsNull(value: unknown): string;

package/dist/canonical-json.js

@@ -0,0 +1,36 @@
+/**
+ * Deterministic JSON for digests and equality. These bytes are sealed into approvals and stored digests, so neither
+ * function may change its output for any input. The two differ on purpose and must stay distinct:
+ *
+ * - `canonicalJson` drops object keys whose value is undefined and returns JSON.stringify's own answer for a bare
+ *   value (an undefined array element therefore renders as nothing: `[,1]`).
+ * - `canonicalJsonUndefinedAsNull` keeps every key and renders an undefined (or otherwise unserializable) value as
+ *   `null` — the planner contract's bytes.
+ *
+ * Both sort object keys by UTF-16 code units and keep arrays in order.
+ */
+export function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const entries = Object.entries(value)
+            .filter(([, v]) => v !== undefined)
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+            .map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`);
+        return `{${entries.join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+/** Stable JSON for hashing and equality only — no filling, no trimming; undefined reads as null. */
+export function canonicalJsonUndefinedAsNull(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJsonUndefinedAsNull).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const body = value;
+        return `{${Object.keys(body)
+            .sort()
+            .map(key => `${JSON.stringify(key)}:${canonicalJsonUndefinedAsNull(body[key])}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "null";
+}

package/dist/chat-actions.js

@@ -16,7 +16,6 @@ import { changeKnowledge, knowledgeVersion, knowledgeView, } from "./project-kno
 import { passwordlessSessionFor, approve, authenticateApprover, describeScope, scopeAuthorityOf, freshnessFor, spendingOnlyOnSuccess, ssoNowAvailable, withFreshness, } from "./scope.js";
 import { readVerifiedArtifact, scanForSecrets } from "./evidence.js";
 import { readAuthModeStrict } from "./keys.js";
-import { parseProof } from "./proof.js";
 import { acceptAndCompleteAsOperator, assignmentOf } from "./assignment.js";
 import { getDecision, recordDecision, retireDecision } from "./project-memory.js";
 import { resumeTaskStop, taskControlOf } from "./task-control.js";
@@ -26,7 +25,7 @@ import { saveScript, scriptDigest, validateScript } from "./flow-scripts.js";
 import { addCardToFlow, advanceFlows, cancelFlowCard, crossProjectProblem, decideFlowCard, flowCardHref, flowCardText, flowDefinitionOf, moveCardInFlow } from "./flow-engine.js";
 import { chooseFlowCard, flowPersonOf } from "./flow-send.js";
 import { assignFlowCard, commentOnFlowCard, flowPeople, mentionsIn, watchFlowCard } from "./flow-people.js";
-import { addFlowTriggerTo, describeTrigger, readLinearKey, removeFlowTrigger, scheduleFromWords, takesDeliveries, triggerConfigOf, validateTriggerConfig } from "./flow-triggers.js";
+import { addFlowTriggerTo, describeTrigger, readLinearKey, removeFlowTrigger, takesDeliveries, triggerConfigOf, validateTriggerConfig } from "./flow-triggers.js";
 import { describeSchedule, parseSchedule } from "./flow-schedule.js";
 import { dirname } from "node:path";
 import { handleOf, parseSoul, SOUL_CHARS, SUBAGENT_TEMPLATES, subagentLabel } from "./subagents.js";

package/dist/chat-admission.d.ts

@@ -0,0 +1,19 @@
+import type { ChatBinding, ChatState } from "./chat-delivery-state.js";
+import type { ChatEventBody } from "./contracts/chat-content.js";
+import type { ChatApp } from "./contracts/flow.js";
+/**
+ * Whether a received message or tap, already proved to come from this app, may be queued — and under which binding.
+ * A room (any conversation that isn't a direct message) is taken only while it follows a conversation, for the words
+ * that make it follow one, or when it feeds a flow (v89: anyone's message then, as a card with no say over anything).
+ * A pairing message comes only from someone unpaired, in a direct message; everything else only from a live paired
+ * member in their own conversation or a followed room. Null when it is not taken.
+ */
+export declare function admitChatEvent(state: ChatState, app: ChatApp, installation: string, event: {
+    kind: "message" | "pair" | "action";
+    member: string;
+    channel: string;
+    isRoom: boolean;
+    payload: ChatEventBody;
+}): {
+    binding: ChatBinding | null;
+} | null;

package/dist/chat-admission.js

@@ -0,0 +1,22 @@
+import { channelInbox } from "./chat-inbox.js";
+import { roomCommand } from "./chat-rooms.js";
+/**
+ * Whether a received message or tap, already proved to come from this app, may be queued — and under which binding.
+ * A room (any conversation that isn't a direct message) is taken only while it follows a conversation, for the words
+ * that make it follow one, or when it feeds a flow (v89: anyone's message then, as a card with no say over anything).
+ * A pairing message comes only from someone unpaired, in a direct message; everything else only from a live paired
+ * member in their own conversation or a followed room. Null when it is not taken.
+ */
+export function admitChatEvent(state, app, installation, event) {
+    const { kind, member, channel, isRoom, payload } = event;
+    const words = "text" in payload ? payload.text ?? "" : "";
+    const inbox = isRoom && kind === "message" ? channelInbox(state.store, app, installation, channel, words) : { watched: false, command: false };
+    const roomish = isRoom && (state.room(installation, channel) !== null || (kind === "message" && roomCommand(words) !== null) || inbox.watched || inbox.command);
+    if (isRoom && !roomish)
+        return null;
+    const binding = state.bindingFor(installation, member);
+    const open = inbox.watched && !inbox.command;
+    if (kind === "pair" ? !!binding || isRoom : !open && (!binding || !state.live(binding) || (binding.channel !== channel && !roomish)))
+        return null;
+    return { binding };
+}

package/dist/chat-channel.js

@@ -9,7 +9,7 @@ import { LEAD_TOOL_SCHEMAS } from "./lead-tools.js";
 import { verifyApproverStanding } from "./principal.js";
 import { canonicalProject } from "./project.js";
 import { phoneText, projectLabel } from "./telegram-status.js";
-import { CHAT_CONTROLS, chatControlHref, chatResultHref, isChatControl, } from "./chat-controls.js";
+import { CHAT_CONTROLS, chatControlHref, isChatControl, } from "./chat-controls.js";
 import { CHAT_TASK_ACTIONS, isChatTaskAction } from "./chat-task-actions.js";
 export function channelRepos(store, approver, registry) {
     const seen = new Set();

package/dist/chat-delivery.js

@@ -23,7 +23,6 @@ import { phoneText, PHONE_HELP, phoneCommand, phoneStatus, phoneTaskView, phoneT
 import { applyRoomInbound, conversationRow, roomCardApprover, roomCommand, roomGrantAllowed, roomMessagesAfter, roomMessageText, teamDomain } from "./chat-rooms.js";
 import { isTelegramProgressNotification, proposalTaskOf } from "./store.js";
 import { isShotsKind, resultShotsFor } from "./result-shots.js";
-import { CHAT_APP_NAMES } from "./flow-triggers.js";
 import { answersPrompt, applyDecideFeedback, applyDecideTap, decideFallbackLink, decideOffer, decideTargetOf, hasLiveDecideTokens, linksFor, mergedText, mintDecideButtons, offerFingerprint, openPromptFor, recordChatMerge } from "./chat-decide.js";
 import { mergePullRequest } from "./pull-request-flow.js";
 import { attentionSubjectOf, neverHeld, watchedPing } from "./agent-board.js";

package/dist/chat-follow.d.ts

@@ -0,0 +1,17 @@
+/** A pause that ends early, and quietly, when `signal` aborts. */
+export declare const abortablePause: (signal: AbortSignal) => (ms: number) => Promise<void>;
+/**
+ * Works the queue while this connection stays the current, leased one: each pass takes in saved events, plans room
+ * messages, delivers one part and plans notifications (when they are on), checking it is still current between steps.
+ * A pass waits while the connection isn't ready (offline, or the provider asked to retry later).
+ */
+export declare function workChatQueue(steps: {
+    same: () => boolean;
+    ready: () => boolean;
+    pause: (ms: number) => Promise<void>;
+    notifications: () => boolean;
+    process: () => Promise<unknown>;
+    rooms: () => Promise<unknown>;
+    deliver: () => Promise<unknown>;
+    notify: () => Promise<unknown>;
+}): Promise<void>;

package/dist/chat-follow.js

@@ -0,0 +1,32 @@
+/** The loop every hosted chat connection (Slack, Discord, Teams) runs over its saved queue. */
+import { setTimeout as sleep } from "node:timers/promises";
+/** A pause that ends early, and quietly, when `signal` aborts. */
+export const abortablePause = (signal) => async (ms) => {
+    try {
+        await sleep(ms, undefined, { signal });
+    }
+    catch {
+        /* shutdown */
+    }
+};
+/**
+ * Works the queue while this connection stays the current, leased one: each pass takes in saved events, plans room
+ * messages, delivers one part and plans notifications (when they are on), checking it is still current between steps.
+ * A pass waits while the connection isn't ready (offline, or the provider asked to retry later).
+ */
+export async function workChatQueue(steps) {
+    while (steps.same()) {
+        if (!steps.ready()) {
+            await steps.pause(1000);
+            continue;
+        }
+        await steps.process();
+        if (steps.same())
+            await steps.rooms();
+        if (steps.same())
+            await steps.deliver();
+        if (steps.same() && steps.notifications())
+            await steps.notify();
+        await steps.pause(1000);
+    }
+}

package/dist/chat-messages.js

@@ -8,7 +8,6 @@
  *
  * Imports the store's types only (no runtime cycle): the store builds its chats on it.
  */
-import { join } from "node:path";
 import { neverHeld, watchedPing } from "./agent-board.js";
 import { ChatCore } from "./chat-core.js";
 import { readChatMessageBody, readChatPart, savedChatEventBody, savedChatPart } from "./contracts/chat-content.js";

package/dist/chat-settings-page.d.ts

@@ -0,0 +1,23 @@
+import type { Store } from "./store.js";
+import { type Html } from "./html.js";
+import { type ChatIdentity } from "./chat-delivery-state.js";
+export type ChatSettingsOptions = {
+    code?: string;
+    problem?: string;
+    now?: Date;
+    who?: string;
+};
+/** What differs between the Slack and Discord settings pages; everything else is one page. */
+export type ChatSettingsPage = {
+    provider: "slack" | "discord";
+    label: string;
+    credentials: ChatIdentity | null;
+    /** How to create the app, shown before it is connected. */
+    setup: Html;
+    /** The connect form's fields around the password. */
+    connect: (password: Html) => Html;
+    /** The "Access and setup" paragraphs. */
+    access: Html;
+};
+/** Settings → Slack or Discord: connect the app once, then each teammate pairs their own account. */
+export declare function chatSettingsHtml(store: Store, dir: string, options: ChatSettingsOptions, page: ChatSettingsPage): Html;

package/dist/chat-settings-page.js

@@ -0,0 +1,41 @@
+import { loadPrimary } from "./webhooks.js";
+import { html, postForm } from "./html.js";
+import { ChatState } from "./chat-delivery-state.js";
+/** Settings → Slack or Discord: connect the app once, then each teammate pairs their own account. */
+export function chatSettingsHtml(store, dir, options, page) {
+    const { provider, label, credentials } = page, state = new ChatState(store, provider), bindings = credentials ? state.bindings(credentials.installation).filter(one => state.live(one)) : [], binding = options.who === undefined ? null : bindings.find(one => one.approver === options.who) ?? null, others = bindings.length - (binding === null ? 0 : 1);
+    const runtime = credentials ? state.runtime(credentials.installation) : null;
+    const now = options.now ?? new Date(), live = runtime &&
+        runtime.leaseUntil !== null &&
+        runtime.leaseUntil > now.toISOString() &&
+        runtime.connected;
+    const password = html `<label>Your Toolroll password<input style="min-height:44px" type="password" name="password" autocomplete="current-password" required></label>`;
+    const post = (action, content) => postForm(`/settings/${provider}/${action}`, content, { attrs: { class: "card" } });
+    const parts = [];
+    if (!credentials) {
+        parts.push(html `<p>Manage projects and review results in a private ${label} conversation.</p>`, page.setup, post("connect", page.connect(password)));
+    }
+    else {
+        parts.push(html `<p><strong>${credentials.workspace}</strong> · ${live ? "Connected" : "Waiting for connection"}</p>`);
+        if (runtime?.problem)
+            parts.push(html `<p role="status">${String(runtime.problem)}</p>`);
+        if (!live && !runtime?.problem)
+            parts.push(html `<p>Keep the Toolroll worker running to receive ${label} messages.</p>`);
+        if (options.code) {
+            parts.push(html `<h2>Pair your account</h2><p>Send this in a direct message to your Toolroll ${label} app. It expires in 10 minutes.</p>`, html `<label>Pairing message<input type="text" readonly value="pair ${options.code}" autocomplete="off" style="width:100%;max-width:100%;font-size:14px;min-height:44px"></label>`, html `<a class="button-link" style="min-height:44px;white-space:nowrap" href="/settings/${provider}">Check connection</a>`);
+        }
+        else if (binding && state.live(binding)) {
+            const { pending, dropped: failed } = state.partCounts(binding.id);
+            parts.push(html `<p>Your ${label} account is paired.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} paired too.` : ""}${pending ? ` ${pending} replies waiting to send.` : ""}${failed ? ` ${failed} replies could not be delivered. Open the saved chat to recover them.` : ""}</p>`, html `<p>Try “What needs my attention?” or “Show the evidence for the latest result.”</p>`, html `<p><a href="/chat">Open saved chat</a></p>`, loadPrimary(process.env, dir) === provider
+                ? html `<p>Task updates are sent here.</p>`
+                : post("alerts", html `<button type="submit">Send task updates here</button>`));
+        }
+        else {
+            parts.push(post("pair", html `<h2>Pair your account</h2><p>Your paired ${label} account can read your connected projects and confirm proposed changes. Password approvals still open in Toolroll.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} already paired.` : ""}</p>${password}<button type="submit">Create pairing code</button>`));
+        }
+        if (binding && state.live(binding) && !options.code)
+            parts.push(post("unpair", html `${password}<p class="meta">Unpairing ends every open button in your chat. Teammates are unaffected.</p><button type="submit">Unpair my account</button>`));
+        parts.push(html `<details><summary>Connection settings</summary>${post("disconnect", html `${password}<button type="submit">Disconnect ${label}</button>`)}</details>`);
+    }
+    return html `<section style="max-width:42rem;overflow-wrap:anywhere"><p><a href="/settings">Settings</a></p><h1>${label}</h1>${options.problem ? html `<p class="problem" role="alert">${options.problem}</p>` : ""}${parts}<details><summary>Access and setup</summary>${page.access}</details></section>`;
+}

package/dist/claim.js

@@ -749,7 +749,7 @@ export const MAX_STRIKES = 3;
 function sealInterrupted(store, leaseId, args) {
     const { runId, taskId, stopRun, now } = args;
     const db = store.handle;
-    const run = openAttempt(store, leaseId, runId, "an interruption");
+    openAttempt(store, leaseId, runId, "an interruption");
     // A lease the world moved past still ends its run as interrupted — that IS the honest ending — touching no task state.
     const fenced = !releaseAs(store, leaseId, "interrupted", now);
     if (args.message !== undefined && args.message.trim() !== "") {
@@ -797,7 +797,7 @@ function sealInterrupted(store, leaseId, args) {
 function sealHandBack(store, leaseId, args) {
     const { runId, taskId, now } = args;
     const db = store.handle;
-    const run = openAttempt(store, leaseId, runId, "a hand-back");
+    openAttempt(store, leaseId, runId, "a hand-back");
     // A lease the world moved past still ends its run as interrupted — that IS the honest ending — touching no task state.
     const fenced = !releaseAs(store, leaseId, "interrupted", now);
     if (args.message.trim() !== "")
@@ -974,7 +974,6 @@ const PLAN_BACKOFF_MS = [60_000, 2 * 60_000, 4 * 60_000];
  */
 function sealPlan(store, leaseId, args) {
     const { runId, taskId, plan, now } = args;
-    const db = store.handle;
     // The ingestion record (contract handoff, task 1) is composed here from
     // the filed terms and the drafted plan; its file and row land inside the
     // transaction below, only after the stale-source check admits the draft.
@@ -1199,7 +1198,7 @@ function describeSourceDrift(source, current) {
  */
 function sealRevision(store, leaseId, args) {
     const { runId, taskId, taskRef, revision, now } = args;
-    const run = openAttempt(store, leaseId, runId, "a plan revision", "builder");
+    openAttempt(store, leaseId, runId, "a plan revision", "builder");
     const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
     if (stopped !== null)
         return { ok: false, reason: "stopped" };
@@ -1249,7 +1248,6 @@ function sealRevision(store, leaseId, args) {
  */
 function sealPlanFailure(store, leaseId, args) {
     const { runId, taskId, failure: kind, message, now } = args;
-    const db = store.handle;
     const run = openAttempt(store, leaseId, runId, "a failure", "planner");
     const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
     if (stopped !== null)
@@ -1331,7 +1329,6 @@ function sealPlanFailure(store, leaseId, args) {
  */
 function sealScout(store, leaseId, args) {
     const { runId, taskId, report, now } = args;
-    const db = store.handle;
     const run = openAttempt(store, leaseId, runId, "a report", "scout");
     const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
     if (stopped !== null)

package/dist/claude-print.d.ts

@@ -0,0 +1,12 @@
+import type { ExecResult, run } from "./exec.js";
+export type CommandRunner = (file: string, args: readonly string[], options: Parameters<typeof run>[2]) => Promise<ExecResult>;
+/** No tools, no permission prompts, no MCP servers, nothing kept: a `claude -p` call that can only answer. */
+export declare const CLAUDE_NO_TOOLS_ARGS: readonly string[];
+/** `--model <model>`, or nothing for the CLI's own default. */
+export declare const claudeModelArgs: (model: string) => string[];
+/** What a failed call's output says when this computer's Claude isn't signed in. */
+export declare const CLAUDE_SIGNED_OUT: RegExp;
+/** `claude -p --output-format json` stdout as its one object, or null. */
+export declare function claudeJsonBody(stdout: string, cap: number): Record<string, unknown> | null;
+/** Runs `work` in a fresh temporary folder named `<prefix>…`, removed afterwards whatever happens. */
+export declare function inScratchDir<T>(prefix: string, work: (dir: string) => Promise<T>): Promise<T>;

package/dist/claude-print.js

@@ -0,0 +1,34 @@
+/**
+ * The parts every bare `claude -p` call shares: a throwaway working folder, the flags that leave it with no tools,
+ * no MCP servers and no saved session, and reading its one JSON reply. Each caller still builds its own argv around
+ * these, in its own order.
+ */
+import { Buffer } from "node:buffer";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { strictJsonParse } from "./converse.js";
+/** No tools, no permission prompts, no MCP servers, nothing kept: a `claude -p` call that can only answer. */
+export const CLAUDE_NO_TOOLS_ARGS = [
+    "--safe-mode", "--no-session-persistence", "--tools", "", "--permission-mode", "dontAsk",
+    "--permission-prompts", "none", "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}',
+];
+/** `--model <model>`, or nothing for the CLI's own default. */
+export const claudeModelArgs = (model) => (model === "default" ? [] : ["--model", model]);
+/** What a failed call's output says when this computer's Claude isn't signed in. */
+export const CLAUDE_SIGNED_OUT = /not logged in|login|authenticat/i;
+/** `claude -p --output-format json` stdout as its one object, or null. */
+export function claudeJsonBody(stdout, cap) {
+    const parsed = strictJsonParse(Buffer.from(stdout, "utf8"), cap, 12);
+    return parsed.ok && typeof parsed.value === "object" && parsed.value !== null && !Array.isArray(parsed.value) ? parsed.value : null;
+}
+/** Runs `work` in a fresh temporary folder named `<prefix>…`, removed afterwards whatever happens. */
+export async function inScratchDir(prefix, work) {
+    const dir = mkdtempSync(join(tmpdir(), prefix));
+    try {
+        return await work(dir);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}

package/dist/cli-http.d.ts

@@ -3,7 +3,6 @@ import type { Store } from './store.js';
 import type { Principal } from './operate.js';
 import { type RemoteCommandLookup } from './remote-command.js';
 import { type Admission, type BudgetLimit } from './request-budget.js';
-import type { SessionRunner } from './session-remote.js';
 /**
  * `POST /api/cli` (remote CLI, Phase 1): a teammate's laptop sends the argv it would have run locally, and the central
  * server runs that same command as that person. There is no per-resource API here and no second policy: the transport
@@ -12,10 +11,6 @@ import type { SessionRunner } from './session-remote.js';
  *
  * Only `Authorization: Bearer so_…` is accepted — never a password, cookie or the owner's saved login — and a request
  * carrying a browser Origin is refused, so a page can never drive it.
- *
- * `session …` (D7) is the one command the server answers through its own owner rather than runOperateAs: native
- * session operations need the server's live coding workspace (session-remote.ts). They are admitted, budgeted and
- * refused here exactly like every other command.
  */
 /** Who a remote command runs as, and the runner: operate.ts's own types, so a change there breaks this build instead of
  * drifting. Type-only: the value is loaded lazily through `run` (operate.ts imports the server that imports this). */
@@ -50,8 +45,6 @@ export type CliHttpOptions = {
     modeOf?: RemoteCommandLookup | undefined;
     /** The token's request budget (request-budget.ts), charged once per request before its body is read. */
     admit?: ((principal: Principal) => Admission) | undefined;
-    /** Native session operations (`session …`), run by the server's session owner; absent where none is ready. */
-    session?: SessionRunner | undefined;
     store: Store;
 };
 /** Decode the request's shape and byte limits. The endpoint checks file references against its command policy. */