toolroll 0.9.72 → 0.9.73

package/dist/release-git.js

@@ -0,0 +1,106 @@
+/**
+ * The release coordinator's Git, as one hardened runner's pieces (docs/plans/chat-management.md §0a.2): the recorded
+ * repository's shape, the programs by absolute path, the allowlisted environment, the fixed settings and the checkout
+ * config allowlist. Kept apart from release-adapters.ts so the release card (release-card.ts) reads Git the same way
+ * without loading the coordinator.
+ */
+import { accessSync, constants as fsConstants, statSync } from "node:fs";
+import { delimiter, isAbsolute, join } from "node:path";
+import { HARDENED_GIT_ARGS } from "./agent-fence.js";
+import { TEARDOWN_FLAGS } from "./teardown-git.js";
+/** owner/name and transport of a recorded GitHub remote, read strictly (https or ssh to github.com, nothing else). */
+export function releaseRemote(url) {
+    const part = "([A-Za-z0-9_.-]+)";
+    const https = new RegExp(`^https://github\\.com/${part}/${part}?(?:\\.git)?/?$`).exec(url);
+    const ssh = new RegExp(`^(?:ssh://)?git@github\\.com[:/]${part}/${part}?(?:\\.git)?/?$`).exec(url);
+    const match = https ?? ssh;
+    if (match === null || match[2] === undefined || match[1].startsWith(".") || match[2].startsWith("."))
+        return null;
+    return { slug: `${match[1]}/${match[2].replace(/\.git$/, "")}`, ssh: https === null };
+}
+const executable = (path) => { try {
+    accessSync(path, fsConstants.X_OK);
+    return statSync(path).isFile();
+}
+catch {
+    return false;
+} };
+/** Fixed system folders: the only PATH the coordinator's Git and gh run with. */
+export const RELEASE_PATH = "/usr/bin:/bin:/usr/sbin:/sbin";
+/** Git, gh and ssh by absolute path: the system's Git (or the first in the fixed system folders), the installed gh as
+ * this process's PATH finds it now, and the system ssh. Resolved once; never looked up again. */
+export function releaseTools(path = process.env["PATH"] ?? "") {
+    const find = (name, dirs) => {
+        for (const dir of dirs) {
+            if (!isAbsolute(dir))
+                continue;
+            const candidate = join(dir, name);
+            if (executable(candidate))
+                return candidate;
+        }
+        return null;
+    };
+    const system = ["/usr/bin", "/bin", "/usr/local/bin", "/opt/homebrew/bin"];
+    return {
+        git: find("git", system) ?? "/usr/bin/git",
+        gh: find("gh", [...path.split(delimiter), ...system]) ?? "/usr/bin/gh",
+        ssh: find("ssh", ["/usr/bin", "/bin"]) ?? "/usr/bin/ssh",
+    };
+}
+/** The coordinator's Git and gh environment: an allowlist, a fixed PATH, no system or global Git config, no prompts. */
+export function releaseGitEnv(base = process.env) {
+    const kept = ["HOME", "LANG", "LC_ALL", "LC_CTYPE", "TMPDIR", "USER", "LOGNAME", "SSH_AUTH_SOCK", "GH_CONFIG_DIR", "XDG_CONFIG_HOME", "GH_TOKEN", "GITHUB_TOKEN", "GH_HOST"];
+    return {
+        ...Object.fromEntries(kept.flatMap(name => base[name] === undefined ? [] : [[name, base[name]]])),
+        PATH: RELEASE_PATH, GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_TERMINAL_PROMPT: "0", GH_PROMPT_DISABLED: "1", GIT_ASKPASS: "", SSH_ASKPASS: "",
+    };
+}
+/** Every coordinator Git command's fixed settings, ahead of its own arguments: the recorded Git directory and checkout,
+ * no hooks, fsmonitor, replacement objects, pager or submodule recursion, only https (and ssh for an ssh remote), the
+ * system ssh, and gh as the only credential helper. */
+export function releaseGitArgs(repo, tools) {
+    return [`--git-dir=${repo.gitDir}`, `--work-tree=${repo.checkout}`, "--no-replace-objects", "--no-pager", ...HARDENED_GIT_ARGS, ...TEARDOWN_FLAGS,
+        "-c", "protocol.allow=never", "-c", "protocol.https.allow=always", ...(repo.ssh ? ["-c", "protocol.ssh.allow=always"] : []),
+        "-c", `core.sshCommand=${tools.ssh}`, "-c", "core.askPass=", "-c", "fetch.recurseSubmodules=false", "-c", "core.pager=cat",
+        // Where it connects and what it sends: verified TLS, no proxy, no extra header or cookie file. (An empty CA file
+        // or path can't be given here, Git then trusts nothing; a checkout setting either stops the release instead.)
+        "-c", "http.sslVerify=true", "-c", "http.proxy=", "-c", "http.extraHeader=", "-c", "http.cookieFile=",
+        // The recorded URL, as a remote that exists only here.
+        "-c", `remote.${RELEASE_REMOTE}.url=${repo.remote}`, "-c", `remote.${RELEASE_REMOTE}.pushurl=${repo.remote}`, "-c", `remote.${RELEASE_REMOTE}.proxy=`,
+        ...(repo.ssh ? [] : ["-c", `credential.helper=!'${tools.gh.replace(/'/g, "'\\''")}' auth git-credential`])];
+}
+/** The named remote the coordinator fetches, looks and pushes through: defined only on its own command line (`-c`), so
+ * no checkout setting names or rewrites it. */
+export const RELEASE_REMOTE = "toolroll-release";
+/** The local and worktree settings a gate checkout may hold for a release (an allowlist): plain values Git writes
+ * itself and that never decide where it connects, what it sends or what it runs. Anything else stops the release. */
+const RELEASE_KEYS = [
+    /^core\.(repositoryformatversion|filemode|bare|logallrefupdates|ignorecase|precomposeunicode|symlinks|autocrlf|eol|safecrlf|quotepath|longpaths|checkstat|trustctime)$/,
+    /^extensions\.(worktreeconfig|objectformat|refstorage)$/,
+    /^remote\.[^/:\\]+\.(url|fetch|pushurl|tagopt|prune)$/,
+    /^branch\..+\.(remote|merge|rebase|pushremote|description|vscode-merge-base)$/,
+    /^(user\.(name|email)|pull\.(rebase|ff)|init\.defaultbranch|lfs\.repositoryformatversion)$/,
+];
+/** The first local or worktree setting a gate checkout's config holds that a release won't run with, or null: one
+ * outside the allowlist (an include, a command, a proxy, TLS or header setting, a credential helper, a URL rewrite, a
+ * hooks folder), a remote named like a URL or after the coordinator's own, or a remote over a transport helper. */
+export function releaseConfigProblem(listing) {
+    const fields = listing.split("\0");
+    for (let at = 0; at + 1 < fields.length; at += 2) {
+        if (fields[at] !== "local" && fields[at] !== "worktree")
+            continue;
+        const entry = fields[at + 1];
+        const newline = entry.indexOf("\n");
+        const key = (newline < 0 ? entry : entry.slice(0, newline)).toLowerCase();
+        const value = (newline < 0 ? "" : entry.slice(newline + 1)).trim();
+        if (key.includes(RELEASE_REMOTE))
+            return key;
+        if (key === "core.fsmonitor" && /^(false|no|off|0)$/i.test(value))
+            continue;
+        if (!RELEASE_KEYS.some(pattern => pattern.test(key)))
+            return key;
+        if (/^remote\./.test(key) && /^[A-Za-z][A-Za-z0-9+.-]*::/.test(value))
+            return key;
+    }
+    return null;
+}

package/dist/release.d.ts

@@ -5,7 +5,11 @@
  *
  *   gate → approval → check → complete → quiet → deploy → link → ci → merge → tree → tag → publish → homebrew → done
  *
- * gate files a prepared-candidate task pinned to the branch's exact commit, with the full release check. approval
+ * gate, before filing a task for that commit, looks at the pull request's required checks on it: one that failed stops
+ * the release before anything is filed or sent for approval; it waits, naming them, for checks not started or still
+ * running, and stops if they don't finish within its limit (a task already filed is not looked at again; ci checks
+ * once more before merging). It then files a prepared-candidate task pinned to the branch's exact commit, with the full
+ * release check. approval
  * waits for an active approver's yes to that exact scope (never a mode's, an AI's or the lead's). check requires a Full
  * result of that commit: a failed check stops the release and stays visible, nothing reruns it. complete marks that
  * exact result Complete through the task's own authorization. quiet waits until nothing builds. deploy runs the
@@ -35,7 +39,7 @@ export declare const REQUIRED_PR_CHECKS: readonly ["node 22 · ubuntu-latest", "
 export declare const RELEASE_TAG_CHECKS: readonly ["node 22 · macos-latest", "node 24 · macos-latest", "publish"];
 export declare const RELEASE_STEPS: readonly ["gate", "approval", "check", "complete", "quiet", "deploy", "link", "ci", "merge", "tree", "tag", "publish", "homebrew", "done"];
 export type ReleaseStep = typeof RELEASE_STEPS[number];
-type WaitingStep = "approval" | "check" | "quiet" | "deploy" | "ci" | "publish" | "homebrew";
+type WaitingStep = "gate" | "approval" | "check" | "quiet" | "deploy" | "ci" | "publish" | "homebrew";
 /** How long each waiting step may take, in minutes, before the release stops there (rerunning continues from it). */
 export declare const RELEASE_LIMITS: Readonly<Record<WaitingStep, number>>;
 /** One check attempt; `app` is the GitHub App that made it (github-actions for a workflow), when known. */
@@ -467,4 +471,6 @@ export declare function checksVerdict(runs: readonly CheckRun[], required: reado
 };
 /** Run the release from wherever its journal stopped. */
 export declare function runRelease(options: ReleaseOptions, adapters: ReleaseAdapters): Promise<ReleaseOutcome>;
+/** A probe's failure that is only the network to GitHub being slow, never a decision (a Stop) or another error. */
+export declare function transientNetworkError(error: unknown): boolean;
 export {};

package/dist/release.js

@@ -5,7 +5,11 @@
  *
  *   gate → approval → check → complete → quiet → deploy → link → ci → merge → tree → tag → publish → homebrew → done
  *
- * gate files a prepared-candidate task pinned to the branch's exact commit, with the full release check. approval
+ * gate, before filing a task for that commit, looks at the pull request's required checks on it: one that failed stops
+ * the release before anything is filed or sent for approval; it waits, naming them, for checks not started or still
+ * running, and stops if they don't finish within its limit (a task already filed is not looked at again; ci checks
+ * once more before merging). It then files a prepared-candidate task pinned to the branch's exact commit, with the full
+ * release check. approval
  * waits for an active approver's yes to that exact scope (never a mode's, an AI's or the lead's). check requires a Full
  * result of that commit: a failed check stops the release and stays visible, nothing reruns it. complete marks that
  * exact result Complete through the task's own authorization. quiet waits until nothing builds. deploy runs the
@@ -45,7 +49,7 @@ export const REQUIRED_PR_CHECKS = [
 export const RELEASE_TAG_CHECKS = ["node 22 · macos-latest", "node 24 · macos-latest", "publish"];
 export const RELEASE_STEPS = ["gate", "approval", "check", "complete", "quiet", "deploy", "link", "ci", "merge", "tree", "tag", "publish", "homebrew", "done"];
 /** How long each waiting step may take, in minutes, before the release stops there (rerunning continues from it). */
-export const RELEASE_LIMITS = { approval: 24 * 60, check: 120, quiet: 60, deploy: 30, ci: 60, publish: 45, homebrew: 45 };
+export const RELEASE_LIMITS = { gate: 60, approval: 24 * 60, check: 120, quiet: 60, deploy: 30, ci: 60, publish: 45, homebrew: 45 };
 const POLL_MS = 15_000;
 /** A stop the release reports: the step it stopped at and why, in words. */
 class Stop extends Error {
@@ -177,16 +181,29 @@ export async function runRelease(options, adapters) {
         delete j.intents.deploy;
         save();
     };
-    /** Ask `probe` until it answers, within this step's limit. */
+    /** Ask `probe` until it answers, within this step's limit. A short network failure on the way to GitHub (git or gh
+     * timing out) is no answer yet, never the release's end: the next poll asks again, until the step's own limit. */
     const waitFor = async (at, what, probe) => {
         const deadline = adapters.now().getTime() + limits[at] * 60_000;
-        let said = false;
+        let said = false, unreachable = null;
         for (;;) {
-            const answer = await probe();
+            let answer;
+            try {
+                answer = await probe();
+                unreachable = null;
+            }
+            catch (error) {
+                if (!transientNetworkError(error))
+                    throw error;
+                if (unreachable === null)
+                    say(`  GitHub didn't answer in time (${networkWords(error)}); asking again`);
+                unreachable = networkWords(error);
+                answer = null;
+            }
             if (answer !== null)
                 return answer;
             if (adapters.now().getTime() >= deadline)
-                throw new Stop("timeout", `Still waiting for ${what} after ${limits[at]} minutes.`);
+                throw new Stop("timeout", `Still waiting for ${what} after ${limits[at]} minutes${unreachable === null ? "" : ` (GitHub last didn't answer: ${unreachable})`}.`);
             if (!said) {
                 say(`  waiting for ${what} (up to ${limits[at]} min)`);
                 said = true;
@@ -464,11 +481,13 @@ export async function runRelease(options, adapters) {
                         if (existing.exists && j.freshTask === true && j.intents.gate === undefined)
                             throw new Stop("approval", `Task ${j.task.id} appeared before this release filed it; rerun with --new.`);
                         if (existing.exists) {
+                            // Filed already (a resume after a lost answer): the task stands, and the ci step judges its checks.
                             if (existing.candidate !== j.candidate.sha)
                                 throw new Stop("conflict", `Task ${j.task.id} exists for a different commit (${existing.candidate?.slice(0, 7) ?? "none"}).`);
                             j.task.scopeDigest = existing.scopeDigest;
                         }
                         else {
+                            await earlyChecks(adapters, j, (what, probe) => waitFor("gate", what, probe));
                             intend("gate");
                             await adapters.repo.sync(j.branch);
                             const filed = await adapters.toolroll.fileGate({
@@ -886,3 +905,57 @@ async function deployed(adapters, candidate) {
     const [runtime] = runtimes;
     return runtime !== undefined && runtime !== "" && await adapters.toolroll.runtimeCommit(runtime) === candidate ? runtime : null;
 }
+/**
+ * The gate's look at the pull request's required checks on the exact commit, before anything is filed or anyone is
+ * asked to approve (#237): a required check that failed or was cancelled stops here; checks not started or still
+ * running are named, and the gate waits for them; ones that never finish within the gate's limit stop here too. GitHub
+ * not answering is waited out the same way, never taken for a pass. The ci step still checks again before merging.
+ */
+async function earlyChecks(adapters, j, wait) {
+    const sha = j.candidate.sha.slice(0, 7);
+    const required = REQUIRED_PR_CHECKS;
+    let named = "", unread = false;
+    try {
+        await wait(`the pull request checks on ${sha}`, async () => {
+            let runs;
+            try {
+                runs = await adapters.github.checks(j.github, j.candidate.sha);
+            }
+            catch (error) {
+                if (!unread)
+                    adapters.say(`  Couldn't read the pull request checks on ${sha} (${error?.message ?? error}); trying again.`);
+                unread = true;
+                return null;
+            }
+            const verdict = checksVerdict(runs.filter(run => required.includes(run.name)), required);
+            if (verdict.state === "failed") {
+                throw new Stop("ci-failed", `Pull request checks already failed on ${sha}: ${verdict.failed.join(", ")}. Nothing was filed or sent for approval. Fix the branch, then release the new commit with \`toolroll release ${j.branch} --repo ${j.checkout} --new\` (or rerun the failed job on GitHub and run this command again).`);
+            }
+            if (verdict.state === "passed")
+                return true;
+            const now = verdict.waiting.join(", ");
+            if (now !== named) {
+                adapters.say(`  Pull request checks on ${sha} not finished yet: ${now}.`);
+                named = now;
+            }
+            return null;
+        });
+    }
+    catch (error) {
+        if (!(error instanceof Stop) || error.reason !== "timeout")
+            throw error;
+        throw new Stop("ci-missing", `Pull request checks on ${sha} didn't all finish in time${named === "" ? (unread ? " (GitHub didn't answer)" : "") : `: ${named}`}. Nothing was filed or sent for approval. Start or rerun them on GitHub, then run this command again.`);
+    }
+}
+/** The network failures a release's waits ride out: git or gh timing out (or cut off) on the way to GitHub. */
+const TRANSIENT_NETWORK = /Recv failure: (?:Operation timed out|Connection reset by peer)|TLS handshake timeout|Operation timed out|Connection timed out|i\/o timeout|Connection reset by peer|Failed to connect to [^\s]*github\.com port \d+/i;
+/** A probe's failure that is only the network to GitHub being slow, never a decision (a Stop) or another error. */
+export function transientNetworkError(error) {
+    if (error instanceof Stop || error instanceof Restart)
+        return false;
+    return TRANSIENT_NETWORK.test(String(error?.message ?? error));
+}
+/** The part of a network failure worth saying: its matching phrase. */
+function networkWords(error) {
+    return TRANSIENT_NETWORK.exec(String(error?.message ?? error))?.[0] ?? "a network failure";
+}

package/dist/scope.d.ts

@@ -945,3 +945,10 @@ export declare function liveReleaseOf(store: Store, taskId: string, action: Rele
  * check was composed from a targeted run: a full pass is needed first. Null when nothing blocks.
  */
 export declare function mainDebtProblem(store: Store, repo: string, taskId: string): string | null;
+/**
+ * A deploy gate (docs/plans/chat-management.md §0a.5): a scope whose signed terms name a prepared candidate or carry
+ * release terms. Both are in the scope digest and written at filing, before any release authority exists, so this is
+ * read from the scope alone: a first approval and a fallback gate filed without --release are deploy gates too. From
+ * chat it is approved only through the release card.
+ */
+export declare function deployGateScope(scope: Pick<Scope, "candidate" | "releaseTerms">): boolean;

package/dist/scope.js

@@ -1327,7 +1327,8 @@ export function describeScope(scope, readiness = NO_READINESS) {
 export function releaseTermsSentence(terms) {
     if (!terms.policy.carry)
         return `Release ${terms.packageVersion} from pull request #${terms.pr} at ${terms.approvedSha.slice(0, 7)}. Every later commit asks for your approval again.`;
-    return `Release ${terms.packageVersion} from pull request #${terms.pr} at ${terms.approvedSha.slice(0, 7)}. Later commits on this pull request that only change tests, docs or the changelog ship without asking you again, until it merges or for 3 days. You'll see each one in the release summary.`;
+    const outside = terms.access === "sandboxed" ? "" : " This project's checks don't run in the sandbox: those later test-only commits will run outside the sandbox without being shown to you first.";
+    return `Release ${terms.packageVersion} from pull request #${terms.pr} at ${terms.approvedSha.slice(0, 7)}. Later commits on this pull request that only change tests, docs or the changelog ship without asking you again, until it merges or for 3 days. You'll see each one in the release summary.${outside}`;
 }
 /** What asks again, in full: the terms behind the sentence. */
 export function releaseAsksAgainWords(terms) {
@@ -1338,7 +1339,7 @@ export function releaseAsksAgainWords(terms) {
         `when it deletes, renames or changes the mode of a file, adds a binary, a symlink or a submodule; when it changes the production build;`,
         `when more than ${p.limits.lines} lines or ${p.limits.files} files change after this approval, or ${p.limits.churn} lines of churn;`,
         ...(p.protectProject ? ["when it changes anything: this project is protected;"] : p.protectedPaths.length === 0 ? [] : [`when it changes a protected path: ${p.protectedPaths.join(", ")};`]),
-        `and always once the deploy starts. Repository ${terms.repo}, branch ${terms.branch} into ${terms.base}, check grant ${terms.grant.id}, checks in the sandbox, until ${terms.expiresAt}.`,
+        `and always once the deploy starts. Repository ${terms.repo}, branch ${terms.branch} into ${terms.base}, check grant ${terms.grant.id}, ${terms.access === "sandboxed" ? "checks in the sandbox" : `checks outside the sandbox (${terms.access}), carried because the project allows it`}, until ${terms.expiresAt}.`,
     ];
 }
 function releaseTermsWords(terms) {
@@ -1358,7 +1359,7 @@ function describeApproval(approval) {
 export { personProof } from "./person-proof.js";
 import { personProof } from "./person-proof.js";
 import { releaseTermsDigest } from "./contracts/release-terms.js";
-import { newestReleaseGeneration, releaseAuthorityOfTask, releaseSealProblem } from "./release-authority.js";
+import { CHECK_ACCESS_WIDTH, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseSealProblem } from "./release-authority.js";
 /** Whether the command running now is a machine's: the lead (its token) or a remote API run. Trusted context only. */
 export const machineActing = () => currentActor()?.lead === true || activeRemote() !== null;
 /** A proof row's detail, either form: the legacy text (`<at> · generation <n> · digest <d>`) or the versioned record
@@ -1494,8 +1495,15 @@ export function liveReleaseOf(store, taskId, action, now = new Date()) {
     const grant = store.liveVerifyCommand(a.repo);
     if (grant === null || grant.id !== a.verifyCommand || grant.digest !== a.verifyDigest)
         return refuse("the release check command changed since the approval");
-    if (a.accessDigest !== "sandboxed" || store.projectCheckAccess(a.repo) !== "sandboxed")
-        return refuse("the project's checks no longer run in the sandbox");
+    // The checks reach no further than at the approval. Wider than the sandbox, a carried commit stands only while both
+    // the sealed and the current "Carry release approvals when checks aren't sandboxed" allow it (the stricter of the two).
+    const access = store.projectCheckAccess(a.repo);
+    const sealedWidth = CHECK_ACCESS_WIDTH[a.accessDigest], nowWidth = CHECK_ACCESS_WIDTH[access];
+    if (sealedWidth === undefined || nowWidth === undefined || nowWidth > sealedWidth)
+        return refuse(a.accessDigest === "sandboxed" ? "the project's checks no longer run in the sandbox" : "the project's checks reach further than when the release was approved");
+    if (carry !== null && (a.accessDigest !== "sandboxed" || access !== "sandboxed") && (a.policy?.unsandboxedCarry !== true || !carriesUnsandboxed(store, a.repo))) {
+        return refuse("carrying release approvals when checks aren't sandboxed is off");
+    }
     if (a.policy === null)
         return refuse("this Toolroll doesn't know the release's carry rules; update Toolroll first");
     if (action === "deploy" || action === "merge") {
@@ -1522,3 +1530,12 @@ export function mainDebtProblem(store, repo, taskId) {
         return null;
     return `the nightly full check on main has ${open} open failure${open === 1 ? "" : "s"}, so a check made from a re-run of what failed can't deploy; a full check has to pass first`;
 }
+/**
+ * A deploy gate (docs/plans/chat-management.md §0a.5): a scope whose signed terms name a prepared candidate or carry
+ * release terms. Both are in the scope digest and written at filing, before any release authority exists, so this is
+ * read from the scope alone: a first approval and a fallback gate filed without --release are deploy gates too. From
+ * chat it is approved only through the release card.
+ */
+export function deployGateScope(scope) {
+    return (scope.candidate ?? null) !== null || (scope.releaseTerms ?? null) !== null;
+}

package/dist/server/flows.js

@@ -12,13 +12,13 @@ import { run as execRun } from "../exec.js";
 import { setFlowSecret } from "../flow-actions.js";
 import { addCardToFlow, advanceFlows, cancelFlowCard, crossProjectProblem, decideFlowCard, flowDefinitionOf, moveCardInFlow } from "../flow-engine.js";
 import { galleryHtml, galleryUseHtml } from "../flow-gallery-ui.js";
-import { galleryDefaults, galleryDiagram, galleryTemplateOf, galleryToolsOf, previewGallery, useGalleryTemplate } from "../flow-gallery.js";
+import { galleryAdmitsAnyone, galleryDefaults, galleryDiagram, galleryTemplateOf, galleryToolsOf, previewGallery, useGalleryTemplate } from "../flow-gallery.js";
 import { flowInsights } from "../flow-insights.js";
 import { assignFlowCard, commentOnFlowCard, watchFlowCard } from "../flow-people.js";
 import { saveScript } from "../flow-scripts.js";
 import { chooseFlowCard } from "../flow-send.js";
 import { exportFlow, fetchFlowFile, FlowFileError, importFlow, parseFlowFile, planFlowImport } from "../flow-share.js";
-import { addFlowTriggerTo, checkFlowTriggerNow, pressFlowButton, removeFlowTrigger, removeLinearKey, setFlowTriggerOn, renewFlowHook, saveHooksBase, saveLinearKey, saveSigningSecret, setUpFlowHook, changeFlowHookSender, setFlowHookScope, shareFlowButton, stopSharingFlowButton, rawTakesDeliveries } from "../flow-triggers.js";
+import { addFlowTriggerTo, checkFlowTriggerNow, pressFlowButton, removeFlowTrigger, removeLinearKey, setFlowTriggerOn, renewFlowHook, saveHooksBase, saveLinearKey, saveSigningSecret, setUpFlowHook, changeFlowHookSender, setFlowHookScope, shareFlowButton, stopSharingFlowButton, rawTakesDeliveries, rawAdmitsAnyone } from "../flow-triggers.js";
 import { FLOW_IMPORT_SCRIPT, flowFallbackHtml, flowImportHtml, flowsListHtml, flowView } from "../flows-ui.js";
 import { FLOW_TEMPLATES, FlowContractError, validateFlowDefinition, withZoneNames } from "../flows.js";
 import { prepareUnattendedCandidates, parseUnattendedAsk, revokeUnattended, signUnattended, untilWords } from "../flow-unattended.js";
@@ -32,7 +32,7 @@ import { createWorkflowPreview, exportRecipe, findRecipe, importRecipe, launchWo
 import { isAlive as runnerAlive } from "../runner.js";
 import { createSubagentFrom, labelOf, nameOf, saveSoul, sendSubagentSummaries, setSubagentState, subagentSettings } from "../subagent-admin.js";
 import { addRoutine, removeRoutine, runRoutine } from "../subagent-desk.js";
-import { editMemory, forgetMemory, tellSubagent } from "../subagent-memory.js";
+import { ACCEPT as ACCEPT_SUGGESTION, editMemory, forgetMemory, tellSubagent } from "../subagent-memory.js";
 import { grantTool, revokeTool, rulesFromForm, setToolRules } from "../subagent-tools.js";
 import { sendSubagentWeeklies, undoCall } from "../subagent-week.js";
 import { answerSubagentQuestion } from "../subagent-work.js";
@@ -301,11 +301,16 @@ export function createFlowsHandlers(runtime) {
             return redirect(response, `/kits?problem=${encodeURIComponent("Choose one of your projects.")}`);
         const page = (key, words) => redirect(response, `/kits/${kit.id}?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}`);
         if (step === "setup") {
-            const made = await setUpKit(store, kit, repo, who.name, now, options.configDir ?? null, { toolHome });
+            // Its tools come with it only on the person's proof (a password, or the session under Passwordless): a grant widens.
+            const proved = authenticateApprover(who, body.get("password") ?? "", repo).ok;
+            const made = await setUpKit(store, kit, repo, who.name, now, options.configDir ?? null, { toolHome }, proved ? { widening: "proved" } : {});
             return page(made.ok ? "said" : "problem", made.said);
         }
         if (step === "github") {
-            const made = addKitGithubTrigger(store, kit, repo, who.name, now, options.configDir ?? null);
+            // Issues from anyone on GitHub come into a flow: a widening, so it takes a password (chat-management.md §0a.3).
+            if (!authenticateApprover(who, body.get("password") ?? "", repo).ok)
+                return page("problem", "Enter your Toolroll password to bring in GitHub issues. Nothing changed.");
+            const made = addKitGithubTrigger(store, kit, repo, who.name, now, options.configDir ?? null, "proved");
             return page(made.ok ? "said" : "problem", made.said);
         }
         const tried = addKitSample(store, kit, repo, who.name, now);
@@ -330,7 +335,10 @@ export function createFlowsHandlers(runtime) {
         const card = question === null ? null : store.getFlowCard(question.card);
         const flow = card === null ? null : store.getFlow(card.flow);
         const done = question === null || flow === null || !visible(flow.repo) ? { ok: false, said: "No such question." }
-            : answerSubagentQuestion(store, question.id, { choice: body.get("choice"), text: body.get("text"), by: who.name, via: "web" }, now);
+            // Accepting a looser rule it suggested takes the password (chat-management.md §0a.3); every other answer doesn't.
+            : question.suggestion !== null && body.get("choice") === ACCEPT_SUGGESTION && !authenticateApprover(who, body.get("password") ?? "").ok
+                ? { ok: false, said: "Enter your Toolroll password to change the rule." }
+                : answerSubagentQuestion(store, question.id, { choice: body.get("choice"), text: body.get("text"), by: who.name, via: "web", ...(question.suggestion !== null ? { widening: "proved" } : {}) }, now);
         if (wantsJson)
             return respond(response, done.ok ? 200 : 409, "application/json; charset=utf-8", JSON.stringify(done));
         const back = question === null ? "/settings/lead/subagents" : `/settings/lead/subagents/${question.subagent}`;
@@ -403,9 +411,23 @@ export function createFlowsHandlers(runtime) {
             // v94: which project tools it may use, and its rule for each action.
             const tool = body.get("tool") ?? "", op = body.get("op");
             const grant = store.subagentGrant(mate.id, tool);
-            const changed = op === "grant" ? await grantTool(store, mate, tool, who.name, now, { toolHome })
+            // Giving a subagent a tool widens what it does unasked: a password (chat-management.md §0a.3). Revoking and
+            // tightening a rule don't need one.
+            if (op === "grant" && !authenticateApprover(who, body.get("password") ?? "", mate.repo).ok) {
+                return redirect(response, `${back}?problem=${encodeURIComponent(`Enter your Toolroll password to let ${nameOf(mate)} use ${tool}. Nothing changed.`)}#tools`);
+            }
+            const changed = op === "grant" ? await grantTool(store, mate, tool, who.name, now, { toolHome }, { widening: "proved" })
                 : op === "revoke" ? revokeTool(store, mate, tool, who.name, now)
-                    : grant === null ? { ok: false, said: `${nameOf(mate)} doesn't use ${tool}.` } : setToolRules(store, mate, tool, rulesFromForm(grant, key => body.sent.get(key)), who.name, now);
+                    : grant === null ? { ok: false, said: `${nameOf(mate)} doesn't use ${tool}.` } : (() => {
+                        // Loosening a rule widens what it does unasked: a password (chat-management.md §0a.3); tightening needs none.
+                        const changes = rulesFromForm(grant, key => body.sent.get(key));
+                        const tried = setToolRules(store, mate, tool, changes, who.name, now);
+                        if (tried.ok || !/takes your password/.test(tried.said))
+                            return tried;
+                        if (!authenticateApprover(who, body.get("password") ?? "", mate.repo).ok)
+                            return { ok: false, said: `Enter your Toolroll password to let ${nameOf(mate)} do more on its own. Nothing changed.` };
+                        return setToolRules(store, mate, tool, changes, who.name, now, { widening: "proved" });
+                    })();
             return redirect(response, `${back}?${changed.ok ? "said" : "problem"}=${encodeURIComponent(changed.said)}#tools`);
         }
         const done = part === "state" ? setSubagentState(store, mate, body.get("state") === "removed" ? "removed" : body.get("state") === "paused" ? "paused" : "active", who.name, now)
@@ -445,7 +467,11 @@ export function createFlowsHandlers(runtime) {
         }
         if (digest === null || digest !== body.get("previewed"))
             return sendGalleryUse(response, who, template, projects, repo, answers, name, digest === null ? null : "Your answers changed. Check the preview, then create the flow.");
-        const used = useGalleryTemplate(store, template, repo, answers, { name, by: who.name, now: clock(), dir: options.configDir ?? null });
+        // A template whose trigger brings in items from anyone takes the password (chat-management.md §0a.3).
+        const anyone = galleryAdmitsAnyone(template);
+        if (anyone && !authenticateApprover(who, body.get("password") ?? "", repo).ok)
+            return sendGalleryUse(response, who, template, projects, repo, answers, name, "Enter your Toolroll password: this flow brings in items from anyone.");
+        const used = useGalleryTemplate(store, template, repo, answers, { name, by: who.name, now: clock(), dir: options.configDir ?? null, ...(anyone ? { widening: "proved" } : {}) });
         if (!used.ok)
             return sendGalleryUse(response, who, template, projects, repo, answers, name, used.said);
         return redirect(response, `/flows/${used.flow}`);
@@ -576,7 +602,11 @@ export function createFlowsHandlers(runtime) {
             const ingress = rawTakesDeliveries(raw);
             if (ingress && !authenticateCredential(who, body.get("password") ?? "").ok)
                 return answer(403, { ok: false, said: "Enter your Toolroll password to make a webhook address." });
-            const made = addFlowTriggerTo(store, flow, raw, who.name, now, dir, ingress ? { ingress: "proved" } : {});
+            // Items from anyone: a widening, an ordinary step-up (chat-management.md §0a.3).
+            const anyone = !ingress && rawAdmitsAnyone(raw);
+            if (anyone && !authenticateApprover(who, body.get("password") ?? "", flow.repo).ok)
+                return answer(403, { ok: false, said: "Enter your Toolroll password to bring in items from anyone." });
+            const made = addFlowTriggerTo(store, flow, raw, who.name, now, dir, ingress ? { ingress: "proved" } : anyone ? { widening: "proved" } : {});
             if (made.ok)
                 await prepareUnattendedCandidates(store, flow.id);
             return made.ok ? settle(made.said, made.reveal === null ? {} : { reveal: made.reveal }) : answer(400, { ok: false, said: made.message });

package/dist/server/render-settings.js

@@ -170,7 +170,7 @@ export function settingsPage(chrome, existing, hasEnv, csrf, problem, messaging
         : joinHtml([
             html `<h2>Unattended permissions</h2>`,
             permissionDefault.canManage && csrf !== ""
-                ? postForm("/settings/permission-default", html `${permissionModeChoices("permission-mode", permissionDefault.mode)}<button type="submit">Save default</button>`, { attrs: { class: "card permission-policy", "data-autosave": true } })
+                ? postForm("/settings/permission-default", html `${permissionModeChoices("permission-mode", permissionDefault.mode)}${permissionDefault.mode === "bypassPermissions" ? "" : reauth(html `<label>Your password <span class="meta">(needed for Full access)</span><input type="password" name="password" autocomplete="current-password"></label>`)}<button type="submit">Save default</button>`, { attrs: { class: "card permission-policy" } })
                 : html `<div class="card"><p><strong>${permissionDefault.mode === "bypassPermissions" ? "Full access" : "Auto"}</strong></p><p class="meta">An approver can change this default</p></div>`,
             permissionDefault.updatedAt === null
                 ? ""

package/dist/server/settings.js

@@ -1422,7 +1422,12 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         for (const [key, visit] of connectVisits)
             if (visit.expires < Date.now())
                 connectVisits.delete(key);
-        connectVisits.set(started.state, started.visit);
+        // The password above proves one thing: this connection, by this account as it is now, and (from a kit whose subagent
+        // is set up) letting that subagent use this tool in this project. The callback holds the visit to exactly that.
+        const kitSet = kit === null || also !== null ? null : kitOf(kit);
+        const installed = kitSet === null || !kitSet.tools.some(one => one.tool === service.id) ? null : kitInstalled(store, kitSet, target);
+        connectVisits.set(started.state, { ...started.visit, generation: store.accountOf(who.name)?.generation ?? -1,
+            grant: installed === null ? null : { subagent: installed.mate.id, tool: service.id, repo: target } });
         return goOutside(response, started.go, `Going to ${service.label} to sign in…`, { state: started.state, path: CONNECT_CALLBACK, secure: origin.startsWith("https:") });
     }
     async function toolsChange(ctx) {
@@ -2015,6 +2020,11 @@ ${postForm("/settings/chat-approval/save", html `\
         if (wanted !== "auto" && wanted !== "bypassPermissions") {
             return refuse(response, who, 400, "permissions must be Auto or Full access", "/settings");
         }
+        // Widening every new task to Full access takes a password (chat-management.md §0a.3): an ordinary step-up, so a
+        // signed-in session does under Passwordless. Back to Auto narrows, and needs none.
+        if (wanted === "bypassPermissions" && store.permissionDefault().mode !== "bypassPermissions" && !authenticateApprover(who, body.get("password") ?? "").ok) {
+            return redirect(response, `/settings?said=${encodeURIComponent("Enter your Toolroll password to start new tasks with Full access. Nothing changed.")}`);
+        }
         store.setPermissionDefault(wanted, who.name, now);
         return redirect(response, `/settings?said=${encodeURIComponent(wanted === "bypassPermissions"
             ? "New tasks now start with Full access. Approved tasks keep their setting."
@@ -2413,7 +2423,14 @@ ${modeWords(terms)
             return done("/settings/tools", "problem", "That sign-in was started in another browser. Connect again from this one.");
         const visit = connectVisits.get(state);
         connectVisits.delete(state);
-        if (visit === undefined || visit.expires < Date.now() || store.accountOf(visit.by)?.role !== "approver")
+        // The signer as at Connect: still an approver, not revoked, the same generation, still in the project. Checked here,
+        // before the connection changes, and again at the grant, after every wait.
+        const standing = () => {
+            const account = visit === undefined ? null : store.accountOf(visit.by);
+            return visit !== undefined && account !== null && account.role === "approver" && account.revokedAt === null && visit.generation !== undefined
+                && account.generation === visit.generation && store.accountCanAccess(visit.by, visit.repo);
+        };
+        if (visit === undefined || visit.expires < Date.now() || !standing())
             return done("/settings/tools", "problem", "That sign-in expired. Connect again.");
         const service = oneClickOf(visit.service);
         const kit = visit.kit === null ? null : kitOf(visit.kit);
@@ -2430,13 +2447,17 @@ ${modeWords(terms)
         const now = clock();
         if (!adapterPolicy({ caller: "service", capability: "none" }).ok)
             return respond(response, 403, "text/plain", "Forbidden");
-        const finished = await finishConnect(store, visit, code, now, { fetcher: options.connectFetch ?? fetch, home: toolHome, omitEnv: ALL_CREDENTIAL_ENV });
+        const finished = await finishConnect(store, visit, code, now, { fetcher: options.connectFetch ?? fetch, home: toolHome, omitEnv: ALL_CREDENTIAL_ENV, stillStanding: standing });
         if (!finished.ok)
             return done(back, "problem", finished.said);
         // From a kit: its teammate may use the tool now (reading freely, the rest after a person approves each call).
         const set = kit === null || !kit.tools.some(one => one.tool === service.id) ? null : kitInstalled(store, kit, visit.repo);
-        if (set !== null && store.subagentGrant(set.mate.id, service.id) === null) {
-            const granted = await grantTool(store, set.mate, service.id, visit.by, now, { toolHome });
+        const bound = visit.grant ?? null;
+        if (set !== null && bound !== null && bound.subagent === set.mate.id && bound.tool === service.id && bound.repo === visit.repo && set.mate.repo === visit.repo
+            && store.subagentGrant(set.mate.id, service.id) === null && standing()) {
+            // The password at Connect (toolsConnect) is this grant's proof, for exactly the grant the visit names, while the
+            // signer still stands: re-checked after the tool's listing, in the step that saves the grant.
+            const granted = await grantTool(store, set.mate, service.id, visit.by, now, { toolHome }, { widening: "proved", stillProved: standing });
             if (granted.ok)
                 return done(back, "said", `${service.label} is connected to ${to}, and ${nameOf(set.mate)} can use it: reading freely, the rest after you approve each call.`);
         }

package/dist/setup-guide.d.ts

@@ -15,10 +15,10 @@ export declare function detectPreparation(repo: string): {
 } | null;
 /** Browser installation may write only this known file inside its project. */
 export declare function previewProjectInstructions(repo: string): {
+    content?: never;
     ok: false;
     message: string;
     plan?: never;
-    content?: never;
     fingerprint?: never;
     installed?: never;
 } | {
@@ -30,10 +30,10 @@ export declare function previewProjectInstructions(repo: string): {
     installed: boolean;
 };
 export declare function addProjectInstructions(repo: string, fingerprint: string): {
+    content?: never;
     ok: false;
     message: string;
     plan?: never;
-    content?: never;
     fingerprint?: never;
     installed?: never;
 } | import("./skills.js").InstallResult;

package/dist/store.d.ts

@@ -2354,6 +2354,9 @@ export declare class Store {
     sealScopeApproval(taskId: string, by: string, now: Date, mutation?: Mutation, basis?: {
         kind: "mode" | "chat" | "grant" | "schedule";
         modeDigest: string;
+        /** A chat seal of a deploy gate: the release card it came from (chat-management.md §0a.5). */
+        card?: "release";
+        cardDigest?: string;
     }, approverKind?: ApproverKind): boolean;
     /** Whether this task's scope carries a LIVE seal: approved, and the
      * approved digest is the current one (a rewritten scope unseals). The

package/dist/store.js

@@ -6989,6 +6989,12 @@ export class Store {
             const terms = storedReleaseTerms(working["release_terms_json"]);
             if (!terms.ok)
                 return false;
+            // A DEPLOY GATE FROM CHAT (chat-management.md §0a.5): a signed candidate or release terms seal from chat only
+            // with the release card's evidence (its act and card digest), never through the plain plan card or a generic
+            // one. Read from the raw row, so a terms column that doesn't parse is a deploy gate too.
+            const deployGate = (typeof working["candidate"] === "string" && working["candidate"] !== "") || working["release_terms_json"] != null;
+            if (deployGate && basis?.kind === "chat" && !(basis.card === "release" && typeof basis.cardDigest === "string" && /^[0-9a-f]{64}$/.test(basis.cardDigest)))
+                return false;
             if (terms.terms !== null && basis !== undefined && basis.kind !== "chat")
                 return false;
             if (terms.terms !== null && releaseSealProblem(this, terms.terms) !== null)

package/dist/subagent-memory.d.ts

@@ -60,5 +60,6 @@ export declare function answerSuggestion(store: Store, mate: SubagentRow, sugges
     choice: string | null;
     text: string | null;
     by: string;
+    widening?: "proved";
 }, now: Date): Done;
 export {};

package/dist/subagent-memory.js

@@ -183,7 +183,7 @@ export function answerSuggestion(store, mate, suggestion, answer, now) {
             store.decideSubagentSuggestion(offered.id, "stale", null, now);
             return { ok: false, said: "Its rules changed since it suggested this, so nothing was changed." };
         }
-        const changed = setToolRules(store, mate, offered.tool, { [offered.action]: { use: offered.rule.use, limit: offered.rule.limit ?? null, undo: current.undo ?? "" } }, answer.by, now);
+        const changed = setToolRules(store, mate, offered.tool, { [offered.action]: { use: offered.rule.use, limit: offered.rule.limit ?? null, undo: current.undo ?? "" } }, answer.by, now, answer.widening === undefined ? {} : { widening: answer.widening });
         if (!changed.ok)
             return changed;
         store.decideSubagentSuggestion(offered.id, "accepted", answer.by, now);