toolroll 0.9.71 → 0.9.73

package/dist/flow-schedule.js

@@ -14,6 +14,7 @@ import { legOf, routeDigestOf, routeFromJson, routeProblems } from "./phase-rout
 import { canonicalAcceptance, digestOf, parseAcceptanceCriteria, profileDigestOf, profileFromJson } from "./scope.js";
 import { hasDisguisedText, hasForbiddenControls } from "./decision.js";
 import { BUILT_IN, parseCapabilityKey } from "./store.js";
+import { fileNightlyCheck } from "./nightly-check.js";
 export const WEEKDAYS = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
 export function validTimezone(value) {
     if (value.trim() !== value)
@@ -195,10 +196,22 @@ export class StandingOrderRefused extends Error {
  */
 export function fileStandingOrder(store, input, now) {
     const { order, repo } = input;
+    // The nightly full check on main files a check-only task of its own (nightly-check.ts).
+    if (order.check !== undefined)
+        return fileNightlyCheck(store, input, now);
     const blocker = store.standingOrderBlocker(input.trigger, order.routine, now);
     if (blocker !== null)
         return { made: "skipped", note: `Skipped: the last one (${blocker.taskId}, ${blocker.state}) hasn't finished.` };
-    const approval = standingApproval(order, repo, input.schedule);
+    const standing = standingApproval(order, repo, input.schedule);
+    // The carried approval stands only while its approver still can approve here (approval policy §1.6): a demoted
+    // person, one off the project, or an approval that names nobody files an ordinary proposal instead.
+    const approverStands = standing.live && standing.by !== null && (() => {
+        const account = store.accountOf(standing.by);
+        return account !== null && account.revokedAt === null && account.role === "approver" && store.accountCanAccess(standing.by, repo);
+    })();
+    const approval = standing.live && !approverStands
+        ? { live: false, problem: standing.by === null ? "it names no approver" : "its approver can no longer approve in this project", acceptance: standing.acceptance }
+        : standing;
     if (approval.acceptance === null)
         return { made: "skipped", note: "Skipped: its success checks can't be read. Set the flow up again." };
     if (order.costCeilingUsd !== null) {
@@ -238,11 +251,17 @@ export function fileStandingOrder(store, input, now) {
         store.setRequirements(ref.id, order.requirements);
     const draft = { goal: order.goal, outOfScope: order.outOfScope, touches: [...order.touches], acceptance: approval.acceptance, ...(order.budgetPerRunMicrousd == null ? {} : { budgetMicrousd: order.budgetPerRunMicrousd }) };
     const digest = digestOf(draft, approval.profile, approval.route);
-    store.saveScope({ taskId, ...draft, proposedAt: now.toISOString(), digest, budgetMicrousd: order.budgetPerRunMicrousd ?? null, approvedAt: order.approval.at, approvedBy: approval.by, approvedDigest: digest }, {}, { profile: approval.profile, route: approval.route });
-    const sealed = store.sealScopeApproval(taskId, approval.by ?? "schedule", now, {}, undefined, "automation");
-    const sealedRoute = sealed ? store.sealedRouteOf(taskId) : null;
-    if (!sealed || sealedRoute === null || !sealedRoute.ok || routeDigestOf(sealedRoute.route) !== routeDigestOf(approval.route)) {
-        throw new StandingOrderRefused(!sealed ? "the approval couldn't be sealed" : sealedRoute !== null && !sealedRoute.ok ? sealedRoute.detail : "the sealed agents aren't the approved ones");
+    // Filed unapproved; only the seal below approves it (no approval fields are written beside it).
+    store.saveScope({ taskId, ...draft, proposedAt: now.toISOString(), digest, budgetMicrousd: order.budgetPerRunMicrousd ?? null, approvedAt: null, approvedBy: null, approvedDigest: null }, {}, { profile: approval.profile, route: approval.route });
+    // Its own authority (approval policy §1.6): the standing order's carried approval, never a person's ceremony. A seal
+    // the project's rules refuse to an automatic approval (checks beyond the sandbox, protected work, policy) leaves the
+    // task filed and waiting for a person, as any unapproved firing does — never a dropped firing.
+    const sealed = store.sealScopeApproval(taskId, approval.by, now, {}, { kind: "schedule", modeDigest: order.approval.digest }, "automation");
+    if (!sealed)
+        return { made: "filed", taskId, approved: false, note: "Its approval can't stand on its own here (its checks reach beyond the sandbox, or the project's rules need a person), so this one waits for approval." };
+    const sealedRoute = store.sealedRouteOf(taskId);
+    if (sealedRoute === null || !sealedRoute.ok || routeDigestOf(sealedRoute.route) !== routeDigestOf(approval.route)) {
+        throw new StandingOrderRefused(sealedRoute !== null && !sealedRoute.ok ? sealedRoute.detail : "the sealed agents aren't the approved ones");
     }
     return { made: "filed", taskId, approved: true, note: null };
 }

package/dist/flow-triggers.d.ts

@@ -57,6 +57,11 @@ export declare const senderOf: (config: Extract<TriggerConfig, {
 /** Whether this trigger takes deliveries at a secret address rather than being checked. */
 /** Whether a raw trigger the caller is about to add would take deliveries (an address): read leniently, before validation. */
 export declare function rawTakesDeliveries(raw: unknown): boolean;
+/** Whether a trigger brings in items from anyone (chat-management.md §0a.3): GitHub issues or pull requests from anyone,
+ * or mail from any sender. A widening: it takes a person's password, on every road that adds one. */
+export declare function admitsAnyone(config: TriggerConfig): boolean;
+/** The same, read leniently from a raw trigger before validation (so the form can ask for the password first). */
+export declare function rawAdmitsAnyone(raw: unknown): boolean;
 export declare function takesDeliveries(config: TriggerConfig): boolean;
 /** A webhook's signing secret (made here, or pasted from its sender). In the keychain (or an owner-only file where there's none), never a column. */
 export declare function saveHookSecret(dir: string, trigger: number, secret: string, credential?: string): void;
@@ -104,6 +109,9 @@ export type TriggerMade = {
 export declare function addFlowTriggerTo(store: Store, flow: FlowRow, raw: unknown, actor: string, now: Date, dir: string | null, options?: {
     shown?: boolean;
     ingress?: "proved";
+    /** The person proved themselves for this act (a password, or a session under Passwordless): a trigger that admits
+     * anyone is added only then. */
+    widening?: "proved";
 }): TriggerMade;
 /** A new secret address for a webhook trigger (the old one stops working at once). */
 export declare function renewFlowHook(store: Store, trigger: FlowTriggerRow, now: Date, dir: string): TriggerMade;

package/dist/flow-triggers.js

@@ -368,6 +368,18 @@ export function rawTakesDeliveries(raw) {
     const one = raw;
     return one["kind"] === "webhook" || ((one["kind"] === "github" || one["kind"] === "linear") && one["delivery"] === "webhook");
 }
+/** Whether a trigger brings in items from anyone (chat-management.md §0a.3): GitHub issues or pull requests from anyone,
+ * or mail from any sender. A widening: it takes a person's password, on every road that adds one. */
+export function admitsAnyone(config) {
+    return (config.kind === "github" && config.from === "anyone") || (config.kind === "email" && config.sender === null);
+}
+/** The same, read leniently from a raw trigger before validation (so the form can ask for the password first). */
+export function rawAdmitsAnyone(raw) {
+    if (raw === null || typeof raw !== "object")
+        return false;
+    const one = raw;
+    return (one["kind"] === "github" && one["from"] === "anyone") || (one["kind"] === "email" && (typeof one["sender"] !== "string" || one["sender"].trim() === ""));
+}
 export function takesDeliveries(config) {
     return config.kind === "webhook" || ((config.kind === "github" || config.kind === "linear") && config.delivery === "webhook");
 }
@@ -495,6 +507,9 @@ export function addFlowTriggerTo(store, flow, raw, actor, now, dir, options = {}
         return { ok: false, message: "Webhook addresses are set up on the console." };
     if (takesDeliveries(config) && config.kind !== "webhook" && options.ingress !== "proved")
         return { ok: false, message: "Webhook delivery is set up on the flow's trigger panel, with your password." };
+    // Items from anyone come in only on a person's proof (chat-management.md §0a.3): never from a card, an import or a template alone.
+    if (admitsAnyone(config) && options.ingress !== "proved" && options.widening !== "proved")
+        return { ok: false, message: "A trigger that brings in items from anyone takes your password. Add it on the flow's Triggers panel." };
     // v126: a webhook made where no one is shown its address (the gallery, an import) is made with none: its first
     // set-up or New address makes one and shows it. A webhook made on its panel is shown its address now.
     const token = takesDeliveries(config) && options.ingress === "proved" && (options.shown !== false || config.kind !== "webhook") ? randomBytes(24).toString("base64url") : null;

package/dist/flows-cli.js

@@ -21,7 +21,8 @@ import { deciderOf, FLOW_KIND_WORDS, FLOW_TEMPLATES, flowDigest, flowFromSteps,
 import { prepareUnattendedCandidates, activeUnattendedGrant, parseUnattendedAsk, revokeUnattended, signUnattended, unattendedViewOf, unattendedWords, untilWords, UNATTENDED_MAX_RUNS } from './flow-unattended.js';
 import { MODE_MAX_DAYS } from './modes.js';
 import { verifyApproverByPassword } from './principal.js';
-import { proveCredential } from './scope.js';
+import { authenticateApprover, proveCredential } from './scope.js';
+import { personProof } from './person-proof.js';
 import { projectName } from './project.js';
 const EXIT = { ok: 0, failed: 1, usage: 2, refused: 3 };
 const json = { name: 'json', takesValue: false, meaning: 'answer with one machine envelope on stdout' };
@@ -157,6 +158,12 @@ export async function runFlowsCommand(positional, flags, context) {
         store.recordAction({ at: context.clock().toISOString(), actor: who, repo: project, taskId: null, runId: null, action: command, outcome, source: 'request', detail: `command line${detail === null ? '' : ` · ${detail}`}` });
     };
     const refuse = (project, reason, message, code = EXIT.refused) => { record(project, 'refused', reason); return fail(reason, message, code); };
+    // A trigger from anyone widens what comes in (chat-management.md §0a.3): only the person's own proof counts, never a
+    // machine credential standing in for them (a remote run's API token, a lead's token), though both pass the check above.
+    const widening = (project) => {
+        const proved = authenticateApprover(store, acting.name, acting.token, project);
+        return proved.ok && personProof(proved.method) ? { widening: 'proved' } : {};
+    };
     const settle = (project) => { try {
         advanceFlows(store, project, context.clock(), { evidenceRoot: context.evidenceRoot });
     }
@@ -243,11 +250,13 @@ export async function runFlowsCommand(positional, flags, context) {
         if (!flags.has('yes'))
             return preview(project, `Create the ${flowName} flow in ${projectName(project)}`, terms, { definition });
         let id;
+        const proof = template?.trigger === undefined ? {} : widening(project);
         try {
             id = store.transact(() => {
                 const made = store.createFlow({ repo: project, name: flowName, definitionJson: JSON.stringify(definition), by: who }, now);
                 if (template?.trigger !== undefined) {
-                    const trigger = addFlowTriggerTo(store, store.getFlow(made), template.trigger, who, now, context.configDir);
+                    // A trigger from anyone only on the person's own proof (widening above); a machine credential's is refused.
+                    const trigger = addFlowTriggerTo(store, store.getFlow(made), template.trigger, who, now, context.configDir, proof);
                     if (!trigger.ok)
                         throw new Error(trigger.message);
                 }
@@ -508,7 +517,8 @@ export async function runFlowsCommand(positional, flags, context) {
         const ingress = rawTakesDeliveries(input.value);
         if (ingress && !proveCredential(store, acting.name, acting.token).ok)
             return refuse(flow.repo, 'unauthenticated', 'Making a webhook address takes your password, typed: pass --token.');
-        const made = addFlowTriggerTo(store, flow, input.value, who, now, context.configDir, ingress ? { ingress: 'proved' } : {});
+        // A trigger from anyone only on the person's own proof (widening above): a machine credential's is refused.
+        const made = addFlowTriggerTo(store, flow, input.value, who, now, context.configDir, ingress ? { ingress: 'proved' } : widening(flow.repo));
         if (!made.ok)
             return refuse(flow.repo, 'invalid-trigger', made.message);
         await prepareUnattendedCandidates(store, flow.id);

package/dist/flows-ui.js

@@ -8,6 +8,7 @@ import { SENDER_WORDS } from "./webhook-signing.js";
 import { READER_CAPTURED } from "./webhook-readers.js";
 import { hostOf, linkWords, provedWords, snapshotOf } from "./task-source.js";
 import { deciderOf, FLOW_COLORS, FLOW_KIND_WORDS, FLOW_STAGE_KINDS } from "./flows.js";
+import { nightlyHealthWords } from "./nightly-check.js";
 import { flowInsights, troubleWords } from "./flow-insights.js";
 import { parseSortDecision, sortChip } from "./flow-sort.js";
 import { flowSecretNames, readEmailSettings, sendingReady } from "./flow-actions.js";
@@ -68,7 +69,7 @@ export function flowsListHtml(store, flows, projects, canCreate, problem) {
         const definition = flowDefinitionOf(flow);
         const waiting = cards.filter(card => ["approval", "choose"].includes(definition?.stages.find(one => one.id === card.stage)?.kind ?? "")).length;
         const buttons = store.flowTriggers(flow.id).filter(one => one.state === "active").flatMap(one => { const config = triggerConfigOf(one); return config?.kind === "button" ? [{ id: one.id, label: config.label }] : []; });
-        const trouble = troubleWords(flowInsights(store, flow, new Date(), 7));
+        const trouble = troubleWords(flowInsights(store, flow, new Date(), 7)) ?? nightlyHealthOf(store, flow);
         return html `<article class="card"><div class="flow-row"><h2><a href="/flows/${flow.id}">${flow.name}</a></h2><span class="flow-counts">${projectName(flow.repo)} · ${cards.length} card${cards.length === 1 ? "" : "s"} in progress${waiting > 0 ? ` · ${waiting} waiting for a decision` : ""}${trouble === null ? "" : ` · ${trouble}`}</span></div>${buttons.length > 0 && html `<p class="flow-buttons">${joinHtml(buttons.map(one => html `<a class="button-link" href="/flows/${flow.id}?start=${one.id}">${one.label}</a>`), " ")}</p>`}</article>`;
     });
     const projectField = projects.length === 1 ? html `<input type="hidden" name="repo" value="${projects[0]}">` : html `<label>Project<select name="repo">${projects.map(repo => html `<option value="${repo}">${projectName(repo)}</option>`)}</select></label>`;
@@ -275,3 +276,8 @@ export function flowFallbackHtml(view) {
         return html `<li><strong>${stage.title}</strong> · ${FLOW_KIND_WORDS[stage.kind].label}${cards.length > 0 && html `<ul>${cards.map(card => html `<li>${card.title}${card.waiting !== null && ` — ${card.waiting}`}</li>`)}</ul>`}</li>`;
     })}</ol></section>`;
 }
+/** The nightly check's own health on its flow (release-once.md, part 3): nothing since the last firing for 26 hours. */
+function nightlyHealthOf(store, flow) {
+    const nightly = store.flowTriggers(flow.id).find(one => one.state === "active" && triggerConfigOf(one)?.kind === "schedule" && triggerConfigOf(one).order?.check !== undefined);
+    return nightly === undefined ? null : nightlyHealthWords(store, flow.repo, nightly.updatedAt, new Date());
+}

package/dist/guides.js

@@ -445,7 +445,13 @@ with a time limit.
 
 ## What it does, in order
 
-1. **gate**: files task \`release-<version>-<sha7>\` pinned to the
+1. **gate**: before filing, looks at the pull request's checks on the
+   branch's exact commit: a required check that failed stops here, before
+   anything is filed or sent for approval. Checks not started or still
+   running are named and waited for (GitHub not answering is waited out
+   too); if they don't finish within the gate's limit (60 min, \`--limit
+   gate=<min>\`), it stops here as well. A task already filed for the commit is kept and
+   not looked at again. Then it files task \`release-<version>-<sha7>\` pinned to the
    branch's exact commit with \`--checks full\`, regardless of the project's default.
 2. **approval**: waits for the owner to approve that exact scope
    (\`toolroll task approve <id> --digest <d>\`, or the console). A
@@ -499,6 +505,9 @@ instead of making them twice.
   checks and obtain a passing result; Quick and Off cannot authorize a release.
 - \`check-failed\`: fix the branch and release the new commit with \`--new\`.
 - \`ci-failed\`: fix the failed GitHub check, then rerun. Nothing was merged.
+  A stop at the gate comes before the task is filed, so nothing was filed
+  either: a fix pushed as a new commit is released with \`--new\`; after
+  rerunning the failed job on GitHub, run the same command again.
 - \`publish-failed\` / \`homebrew-failed\`: fix the failed workflow before
   resuming. A failed tag check cannot finish publication or update Homebrew.
 - \`base-moved\`: main gained a commit the branch doesn't have, so the

package/dist/invoke.d.ts

@@ -136,13 +136,24 @@ export declare function fencedCheckoutCommands(store: Store, repo: string, check
  * started unless all of it is.
  */
 /**
- * Whether a check with sign-ins also reaches the keychain (macOS securityd: any item every program may read, not only
- * the sign-ins). Only while the project's sign-ins level stands as a person set it: widening to sign-ins takes an
- * instance operator's password typed now (operate.ts project check-access, Settings → Project → Check access), and the
- * one who set it must still be an approver for the project and an instance operator now. Anything else: no keychain.
+ * macOS: the sign-ins a check with sign-ins needs that live in the keychain, not in files: Claude Code's
+ * ("Claude Code-credentials", its current access token as CLAUDE_CODE_OAUTH_TOKEN) and gh's ("gh:github.com", as
+ * GH_TOKEN). Read here, by Toolroll, outside the sandbox, and handed to the check in its environment, so the check never
+ * reaches securityd (sandbox-runtime.ts SEATBELT_NO_KEYCHAIN) and nothing else in the keychain. The check can't renew
+ * Claude's token: one that has expired fails its sign-in. A value that isn't a plain token is left out.
  */
-export declare function signInsKeychain(store: Store, repo: string | null): boolean;
-export declare function signInsLaunch(store: Store, own: string, temp: string, checkout: string, policy: NetworkProfile, gitPaths: readonly string[], platform?: NodeJS.Platform): Promise<{
+export declare const KEYCHAIN_SIGN_INS: readonly {
+    service: string;
+    env: string;
+    token(secret: string): string | null;
+}[];
+/** One keychain item's secret by its service, read with the system's `security` (null: none, or it can't be read). A
+ * keychain file may be named (tests: a throwaway one); never the item's value in an argument. */
+export declare function readKeychainSecret(service: string, keychain?: string): string | null;
+/** The keychain's sign-ins as a check's environment (macOS only; elsewhere, for anything missing, and where Toolroll
+ * keeps nothing in the keychain (TOOLROLL_SECRET_STORE=files: the test suite), nothing). */
+export declare function keychainSignIns(platform?: NodeJS.Platform, read?: (service: string) => string | null): Record<string, string>;
+export declare function signInsLaunch(store: Store, own: string, temp: string, checkout: string, policy: NetworkProfile, gitPaths: readonly string[], platform?: NodeJS.Platform, keychain?: () => Record<string, string>): Promise<{
     grants: SignInGrants;
     network: NetworkFence;
     env: Record<string, string>;

package/dist/invoke.js

@@ -24,6 +24,7 @@ import { classifyTerminal } from "./exhaustion.js";
 import { liftAuthPause } from "./provider-auth.js";
 import { attestProvider } from "./attest.js";
 import { run as runCommand, runOwnerTag, streamsInput } from "./exec.js";
+import { spawnSync } from "node:child_process";
 import { currentContainment } from "./containment.js";
 import { witnessedRunner } from "./process-custody.js";
 import { underStopWatch } from "./task-control.js";
@@ -1017,9 +1018,8 @@ export function fencedCommands(store, runId, writes, inner, available = () => ma
                     ...options,
                     fence: fenced.fence,
                     // Each sign-in file looked at again right before the launch: one no longer itself isn't granted.
-                    // With sign-ins, the keychain too (Claude Code keeps its macOS sign-in there), only while a person still set it.
-                    fenceGrants: signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network,
-                        ...(signInsKeychain(store, checkout === null ? null : store.getWorktree(checkout)?.repo ?? null) ? { keychain: true } : {}) },
+                    // Never the keychain: the sign-ins kept there come in the environment, read outside (keychainSignIns).
+                    fenceGrants: signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network },
                     confinement: "required",
                     env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(fenced.cache === undefined || fenced.grants.writes === undefined ? {} : buildCacheEnv(fenced.cache)), ...(signIns?.env ?? {}) },
                     ...(signIns === null ? {} : { omitEnv: [...(options?.omitEnv ?? []), ...SIGN_INS_OMITTED_ENV] }),
@@ -1088,9 +1088,8 @@ export function fencedCheckoutCommands(store, repo, checkout, inner, available =
                     ...options,
                     fence: launch.fence,
                     // Each sign-in file looked at again right before the launch: one no longer itself isn't granted.
-                    // With sign-ins, the keychain too (Claude Code keeps its macOS sign-in there), only while a person still set it.
-                    fenceGrants: signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network,
-                        ...(signInsKeychain(store, repo) ? { keychain: true } : {}) },
+                    // Never the keychain: the sign-ins kept there come in the environment, read outside (keychainSignIns).
+                    fenceGrants: signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network },
                     confinement: launch.confinement,
                     env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(allowed === null ? {} : buildCacheEnv(cache)), ...(signIns?.env ?? {}) },
                     ...(signIns === null ? {} : { omitEnv: [...(options?.omitEnv ?? []), ...SIGN_INS_OMITTED_ENV] }),
@@ -1178,19 +1177,50 @@ const SIGN_INS_OMITTED_ENV = ["CLAUDE_CONFIG_DIR"];
  * started unless all of it is.
  */
 /**
- * Whether a check with sign-ins also reaches the keychain (macOS securityd: any item every program may read, not only
- * the sign-ins). Only while the project's sign-ins level stands as a person set it: widening to sign-ins takes an
- * instance operator's password typed now (operate.ts project check-access, Settings → Project → Check access), and the
- * one who set it must still be an approver for the project and an instance operator now. Anything else: no keychain.
+ * macOS: the sign-ins a check with sign-ins needs that live in the keychain, not in files: Claude Code's
+ * ("Claude Code-credentials", its current access token as CLAUDE_CODE_OAUTH_TOKEN) and gh's ("gh:github.com", as
+ * GH_TOKEN). Read here, by Toolroll, outside the sandbox, and handed to the check in its environment, so the check never
+ * reaches securityd (sandbox-runtime.ts SEATBELT_NO_KEYCHAIN) and nothing else in the keychain. The check can't renew
+ * Claude's token: one that has expired fails its sign-in. A value that isn't a plain token is left out.
  */
-export function signInsKeychain(store, repo) {
-    if (repo === null || store.projectCheckAccess(repo) !== "sign-ins")
-        return false;
-    const change = store.projectCheckAccessChange(repo);
-    const account = change === null ? null : store.accountOf(change.by);
-    return account !== null && account.revokedAt === null && account.role === "approver" && store.accountCanAccess(change.by, repo) && store.isInstanceOperator(change.by);
+export const KEYCHAIN_SIGN_INS = [
+    { service: "Claude Code-credentials", env: "CLAUDE_CODE_OAUTH_TOKEN", token: secret => {
+            try {
+                const token = JSON.parse(secret).claudeAiOauth?.accessToken;
+                return typeof token === "string" ? token : null;
+            }
+            catch {
+                return null;
+            }
+        } },
+    // go-keyring (gh's) may keep it base64-encoded behind a prefix.
+    { service: "gh:github.com", env: "GH_TOKEN", token: secret => secret.startsWith("go-keyring-base64:") ? Buffer.from(secret.slice("go-keyring-base64:".length), "base64").toString("utf8") : secret },
+];
+const PLAIN_TOKEN = /^[A-Za-z0-9._~+/=-]{8,4096}$/;
+/** One keychain item's secret by its service, read with the system's `security` (null: none, or it can't be read). A
+ * keychain file may be named (tests: a throwaway one); never the item's value in an argument. */
+export function readKeychainSecret(service, keychain) {
+    const read = spawnSync("/usr/bin/security", ["find-generic-password", "-s", service, "-w", ...keychain === undefined ? [] : [keychain]], { encoding: "utf8", timeout: 10_000, env: { PATH: "/usr/bin:/bin", HOME: homedir() }, stdio: ["ignore", "pipe", "ignore"] });
+    return read.status === 0 && typeof read.stdout === "string" ? read.stdout.replace(/\n$/, "") : null;
+}
+/** The keychain's sign-ins as a check's environment (macOS only; elsewhere, for anything missing, and where Toolroll
+ * keeps nothing in the keychain (TOOLROLL_SECRET_STORE=files: the test suite), nothing). */
+export function keychainSignIns(platform = process.platform, read) {
+    if (platform !== "darwin")
+        return {};
+    if (read === undefined && process.env["TOOLROLL_SECRET_STORE"] === "files")
+        return {};
+    read ??= service => readKeychainSecret(service);
+    const env = {};
+    for (const one of KEYCHAIN_SIGN_INS) {
+        const secret = read(one.service);
+        const token = secret === null ? null : one.token(secret);
+        if (token !== null && PLAIN_TOKEN.test(token))
+            env[one.env] = token;
+    }
+    return env;
 }
-export async function signInsLaunch(store, own, temp, checkout, policy, gitPaths, platform = process.platform) {
+export async function signInsLaunch(store, own, temp, checkout, policy, gitPaths, platform = process.platform, keychain = () => keychainSignIns(platform)) {
     if (!signInsAvailable(platform))
         return { problem: "Sign-ins can't be shared with checks here, so nothing ran." };
     const home = homedir();
@@ -1198,7 +1228,7 @@ export async function signInsLaunch(store, own, temp, checkout, policy, gitPaths
     let egress = null;
     const close = async () => { await egress?.close(); };
     try {
-        const env = { CODEX_HOME: join(home, ".codex"), GH_CONFIG_DIR: join(home, ".config", "gh"), XDG_CONFIG_HOME: join(home, ".config") };
+        const env = { CODEX_HOME: join(home, ".codex"), GH_CONFIG_DIR: join(home, ".config", "gh"), XDG_CONFIG_HOME: join(home, ".config"), ...keychain() };
         if (policy.mode === "open")
             return { grants, network: { mode: "open" }, env, close };
         // Exactly the project's network: the services the sign-ins are for are reached only if the operator allowed their

package/dist/kits-ui.js

@@ -1,6 +1,6 @@
 import { kitChecklist, kitInstalled, KITS } from "./kits.js";
 import { SUBAGENT_TEMPLATES } from "./subagents.js";
-import { html, postForm } from "./html.js";
+import { html, postForm, reauth } from "./html.js";
 const CHECK = html `<svg viewBox="0 0 24 24" aria-hidden="true"><path d="M20 6 9 17l-5-5"/></svg>`;
 const RING = html `<svg viewBox="0 0 24 24" aria-hidden="true"><circle cx="12" cy="12" r="8"/></svg>`;
 export const KITS_CSS = `.kits{max-width:960px;min-width:0}.kits-lede{color:var(--so-muted);margin:.25rem 0 1.5rem;max-width:40rem}.kit-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(280px,1fr));gap:16px}` +
@@ -35,7 +35,9 @@ export function kitPageHtml(store, kit, repo, dir, canSetUp, notice) {
     const rows = steps.map(step => {
         const go = step.done ? (step.href === null ? "" : html `<a class="kit-step-go" href="${step.href}">Open</a>`)
             : step.action === "sample" || step.action === "github"
-                ? (canSetUp ? postForm(`/kits/${kit.id}/${step.action}`, html `<button${step.action === "sample" ? "" : html ` class="secondary"`}>${step.action === "sample" ? "Try it" : "Bring them in"}</button>`, { hidden: { repo } }) : "")
+                ? (canSetUp ? postForm(`/kits/${kit.id}/${step.action}`, step.action === "sample" ? html `<button>Try it</button>`
+                    // Issues from anyone come in: it takes your password (an ordinary step-up; a session does under Passwordless).
+                    : html `${reauth(html `<input type="password" name="password" autocomplete="current-password" aria-label="Your password" placeholder="Your password">`)}<button class="secondary">Bring them in</button>`, { hidden: { repo } }) : "")
                 : step.href === null ? "" : html `<a class="kit-step-go" href="${step.href}">${step.action === "connect" ? "Connect" : "Set up"}</a>`;
         return html `<li data-step="${step.id}" data-done="${String(step.done)}">${step.done ? CHECK : RING}<span class="kit-step-said">${step.said}</span>${go}</li>`;
     });

package/dist/kits.d.ts

@@ -53,9 +53,11 @@ export declare function kitInstalled(store: Store, kit: Kit, repo: string): {
  * flow, and its button triggers; then its subagent may use whichever of the
  * kit's tools the project already has (reading free, writing asking first).
  */
-export declare function setUpKit(store: Store, kit: Kit, repo: string, by: string, now: Date, dir: string | null, io?: ToolIo): Promise<Done>;
-/** The same, all at once (a chat confirmation can't wait on a tool): its subagent is given the kit's connected tools by the names their last test found, and each is listed properly on its first turn. */
-export declare function setUpKitNow(store: Store, kit: Kit, repo: string, by: string, now: Date, dir: string | null, grantByName?: boolean): Done;
+export declare function setUpKit(store: Store, kit: Kit, repo: string, by: string, now: Date, dir: string | null, io?: ToolIo, options?: {
+    widening?: "proved";
+}): Promise<Done>;
+/** The same, all at once and without its tools (a chat confirmation is never a grant's proof): its subagent, its flow and its buttons. */
+export declare function setUpKitNow(store: Store, kit: Kit, repo: string, by: string, now: Date, dir: string | null): Done;
 /** One line of a kit's checklist: done, or the next step with where to take it. */
 export type KitStep = {
     id: string;
@@ -76,7 +78,7 @@ export declare function addKitSample(store: Store, kit: Kit, repo: string, by: s
     said: string;
 };
 /** Bring new issues from the project's GitHub repository into the kit's flow (issues from anyone, polled). */
-export declare function addKitGithubTrigger(store: Store, kit: Kit, repo: string, by: string, now: Date, dir: string | null): {
+export declare function addKitGithubTrigger(store: Store, kit: Kit, repo: string, by: string, now: Date, dir: string | null, proved?: "proved" | null): {
     ok: true;
     said: string;
 } | {

package/dist/kits.js

@@ -17,7 +17,7 @@ import { readEmailSettings } from "./email-settings.js";
 import { mailboxReady } from "./mailbox.js";
 import { projectToolsOf } from "./project-tools.js";
 import { createSubagentFrom, nameOf } from "./subagent-admin.js";
-import { grantListed, grantTool } from "./subagent-tools.js";
+import { grantTool } from "./subagent-tools.js";
 import { SUBAGENT_TEMPLATES } from "./subagents.js";
 export const KITS = [
     {
@@ -115,22 +115,23 @@ export function kitInstalled(store, kit, repo) {
  * flow, and its button triggers; then its subagent may use whichever of the
  * kit's tools the project already has (reading free, writing asking first).
  */
-export async function setUpKit(store, kit, repo, by, now, dir, io = {}) {
+export async function setUpKit(store, kit, repo, by, now, dir, io = {}, options = {}) {
     const made = setUpKitNow(store, kit, repo, by, now, dir);
-    if (!made.ok || made.said.endsWith("already set up here."))
+    // Its tools only with the person's proof (chat-management.md §0a.3); without it, the checklist says to let it use each.
+    if (!made.ok || made.said.endsWith("already set up here.") || options.widening !== "proved")
         return made;
     const mate = store.getSubagent(made.subagent);
     const present = new Set(projectToolsOf(store, repo).map(one => one.name));
     for (const tool of kit.tools.filter(one => present.has(one.tool))) {
         try {
-            await grantTool(store, mate, tool.tool, by, now, io);
+            await grantTool(store, mate, tool.tool, by, now, io, options);
         }
         catch { /* it can be given the tool on its page */ }
     }
     return made;
 }
-/** The same, all at once (a chat confirmation can't wait on a tool): its subagent is given the kit's connected tools by the names their last test found, and each is listed properly on its first turn. */
-export function setUpKitNow(store, kit, repo, by, now, dir, grantByName = false) {
+/** The same, all at once and without its tools (a chat confirmation is never a grant's proof): its subagent, its flow and its buttons. */
+export function setUpKitNow(store, kit, repo, by, now, dir) {
     const had = kitInstalled(store, kit, repo);
     if (had !== null)
         return { ok: true, said: `${kit.name} is already set up here.`, flow: had.flow.id, subagent: had.mate.id };
@@ -155,9 +156,6 @@ export function setUpKitNow(store, kit, repo, by, now, dir, grantByName = false)
     const flow = store.getFlow(flowId);
     for (const button of kit.buttons)
         addFlowTriggerTo(store, flow, { kind: "button", label: button.label, questions: button.questions, zone: definition.start }, by, now, dir);
-    if (grantByName)
-        for (const tool of projectToolsOf(store, repo).filter(one => kit.tools.some(each => each.tool === one.name)))
-            grantListed(store, mate, tool, null, by, now);
     return { ok: true, said: `${kit.name} is ready: ${nameOf(mate)} works its ${kit.flowName} flow.`, flow: flowId, subagent: mate.id };
 }
 /** What's set up and what's left, read fresh each time. */
@@ -205,11 +203,11 @@ export function addKitSample(store, kit, repo, by, now) {
     return added.ok ? { ok: true, href: flowCardHref(set.flow.id, added.card) } : { ok: false, said: added.message };
 }
 /** Bring new issues from the project's GitHub repository into the kit's flow (issues from anyone, polled). */
-export function addKitGithubTrigger(store, kit, repo, by, now, dir) {
+export function addKitGithubTrigger(store, kit, repo, by, now, dir, proved = null) {
     const set = kitInstalled(store, kit, repo);
     const github = githubRepoOf(repo);
     if (set === null || github === null)
         return { ok: false, said: "This project isn't on GitHub." };
-    const made = addFlowTriggerTo(store, set.flow, { kind: "github", repo: github, watch: "issues", from: "anyone", delivery: "poll", zone: flowDefinitionOf(set.flow)?.start }, by, now, dir);
+    const made = addFlowTriggerTo(store, set.flow, { kind: "github", repo: github, watch: "issues", from: "anyone", delivery: "poll", zone: flowDefinitionOf(set.flow)?.start }, by, now, dir, proved === null ? {} : { widening: proved });
     return made.ok ? { ok: true, said: `New issues on ${github} now come into ${kit.flowName}.` } : { ok: false, said: made.message };
 }

package/dist/lead-status.js

@@ -122,13 +122,16 @@ export function taskWaitSnapshot(store, taskId, now, watchedRun) {
     const scope = store.handle.prepare(`SELECT digest, approved_digest, profile_state,
     (approved_at IS NOT NULL AND approved_by IS NOT NULL AND approved_digest = digest) AS approved
     FROM task_scope WHERE task_id = ?`).get(taskId);
-    if (task["plan"] === "drafted" && Number(scope?.["approved"]) !== 1)
+    // Approved only as dispatch reads it (approval policy): a seal whose authority doesn't stand — an old seal a lead token
+    // made, an ended mode — waits for a person, never for a worker.
+    const approvedNow = Number(scope?.["approved"]) === 1 && store.modeApprovalLive(taskRef, now);
+    if (task["plan"] === "drafted" && !approvedNow)
         return answer("Needs a person", "Approve plan", true, 1, "needs-person");
     if (Number(task["strikes"] ?? 0) >= 3)
         return answer("Needs a person", "Review repeated failures", true, 1, "needs-person");
     if (scope === undefined)
         return answer("Needs a person", "Add scope", true, 1, "needs-person");
-    if (Number(scope["approved"]) !== 1 || scope["profile_state"] !== "resolved")
+    if (!approvedNow || scope["profile_state"] !== "resolved")
         return answer("Needs a person", "Approve task", true, 1, "needs-person");
     if (state === "running" && attempt === undefined) {
         const liveClaim = store.handle.prepare(`SELECT 1 AS hit FROM claim INDEXED BY claim_by_task

package/dist/live-terminal.d.ts

@@ -202,9 +202,11 @@ export declare class TerminalHost {
      * End the program and everything that is its own: SIGHUP to every member (an interactive shell gives each job its own
      * process group, so the leader's group is not enough), then SIGKILL, re-reading the process table each time so a
      * child started during the close is caught too. Membership is the leader's descendants, every process with this
-     * terminal as its controlling terminal (started before the program ended), and every one noted while it ran, by pid
-     * and start time. A process that detached itself from the terminal AND its parents before it was noted is not seen —
-     * the same as any terminal. Resolves when the sweep is done; never waits without bound.
+     * terminal as its controlling terminal while the program runs, and every one noted while it ran, by pid and start
+     * time (membersOf). Each signal goes only to a process still that pid and start time; a process on the terminal after
+     * the program ended that was never noted, or a pid now someone else's, is never signalled and leaves the close
+     * uncertain. A process that detached itself from the terminal AND its parents before it was noted is not seen — the
+     * same as any terminal. Resolves when the sweep is done; never waits without bound.
      */
     close(id: string, by?: "owner" | "console"): Promise<void>;
     private sweep;
@@ -231,15 +233,17 @@ export type ProcessTable = Map<number, {
 export declare function readProcessTable(): ProcessTable | null;
 /**
  * A terminal's processes in this table, by pid and start time: what was noted while it ran (still the same process),
- * the leader, everything whose controlling terminal is its terminal and that started before it ended (a later process
- * on a reused device is someone else's), and every descendant of those. Never this console itself.
+ * the leader while it runs, everything whose controlling terminal is its terminal while it runs, and every descendant
+ * of those. Never this console itself. Once the program has ended its terminal's name is no one's proof: the device
+ * may already be someone else's, so a process on it that wasn't noted is not a member; it goes in `ambiguous` (when
+ * given), and the close that meets one says it is uncertain rather than signal it.
  */
 export declare function membersOf(table: ProcessTable, session: {
     leader: number;
     tty: string | null;
     known: ReadonlyMap<number, string>;
     exitedAt: number | null;
-}): Map<number, string>;
+}, ambiguous?: Set<number>): Map<number, string>;
 /**
  * Each listed process's working directory (Linux: /proc; macOS: lsof), and which ones couldn't be read (a setgid
  * helper such as ssh-agent is unreadable even to its own user). Null when the lookup itself failed: a timeout, a signal