toolroll 0.9.82 → 0.9.83

package/dist/server/render-pages.d.ts

@@ -422,22 +422,6 @@ export type ProjectPeek = {
  * GitHub identity. Everything else is null.
  */
 export declare function githubIdentityOf(remoteUrl: string): string | null;
-/**
- * The `origin` remote's url from a repository's OWN .git/config. BOUNDED
- * I/O by construction (ghlist review, finding 1): the final component may
- * not be a symlink (O_NOFOLLOW + lstat), must be a REGULAR file under a
- * size cap, and at most 64 KiB are ever read — a sparse monster or a fifo
- * planted as a "config" reads as null, never as a hang. Parsed LINE BY
- * LINE with real section tracking (finding 2): a `[remote "origin"]`
- * embedded inside some other value never opens the section. null when
- * unreadable or origin-less; a worktree-style `.git` FILE (gitdir pointer)
- * reads null too, which is honest — its identity lives elsewhere. The
- * answer is ADVISORY metadata for offering a button: the /projects/open
- * road re-proves path, ceiling, and git-ness before anything mutates, and
- * a config that lies about its origin can only mislabel a repository the
- * operator was already allowed to open.
- */
-export declare function originUrlOf(repoPath: string): string | null;
 /** The GitHub listing page: the account's repositories with ONE honest
  * action each. Names, descriptions, and paths are gh/filesystem DATA —
  * escaped at the sink like everything else. */
@@ -450,6 +434,8 @@ export declare function githubReposPage(chrome: Chrome, data: {
     csrf: string;
     cloneReady: boolean;
     openProject: string | null;
+    /** A projects folder didn't answer in time: local copies weren't matched this time. */
+    localUnanswered?: boolean;
 }): Screen;
 export declare function projectsPage(chrome: Chrome, recent: {
     path: string;

package/dist/server/render-pages.js

@@ -22,7 +22,6 @@ import { runCostWords, spendLine, tally } from "../summary.js";
 import {} from "../work-index.js";
 import { WORK_VIEWS } from "../workspace-ui.js";
 import { createHash } from "node:crypto";
-import { closeSync, constants as fsConstants, lstatSync, openSync, readSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { buildsViews, CHEVRON_ICON, consoleSpend, FOLDER_PATHS, GRIP_HANDLE, isOverdue, projectChip, relativeAge, safePrUrl, screen, sentenceCase, strokeIcon, TO_FRONT_ICON, when, whenTime } from "./chrome.js";
@@ -865,60 +864,6 @@ export function githubIdentityOf(remoteUrl) {
         return `${ssh[1]}/${ssh[2]}`;
     return null;
 }
-/**
- * The `origin` remote's url from a repository's OWN .git/config. BOUNDED
- * I/O by construction (ghlist review, finding 1): the final component may
- * not be a symlink (O_NOFOLLOW + lstat), must be a REGULAR file under a
- * size cap, and at most 64 KiB are ever read — a sparse monster or a fifo
- * planted as a "config" reads as null, never as a hang. Parsed LINE BY
- * LINE with real section tracking (finding 2): a `[remote "origin"]`
- * embedded inside some other value never opens the section. null when
- * unreadable or origin-less; a worktree-style `.git` FILE (gitdir pointer)
- * reads null too, which is honest — its identity lives elsewhere. The
- * answer is ADVISORY metadata for offering a button: the /projects/open
- * road re-proves path, ceiling, and git-ness before anything mutates, and
- * a config that lies about its origin can only mislabel a repository the
- * operator was already allowed to open.
- */
-export function originUrlOf(repoPath) {
-    const file = join(repoPath, ".git", "config");
-    let fd = null;
-    try {
-        const stat = lstatSync(file);
-        if (!stat.isFile() || stat.size > 1024 * 1024)
-            return null;
-        fd = openSync(file, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
-        const buffer = Buffer.alloc(64 * 1024);
-        const read = readSync(fd, buffer, 0, buffer.length, 0);
-        const config = buffer.toString("utf8", 0, read);
-        let inOrigin = false;
-        for (const line of config.split("\n")) {
-            if (/^\s*\[/.test(line)) {
-                inOrigin = /^\s*\[remote "origin"\]\s*$/.test(line);
-                continue;
-            }
-            if (!inOrigin)
-                continue;
-            const url = /^\s*url\s*=\s*(.+)$/.exec(line)?.[1];
-            if (url !== undefined)
-                return url.trim();
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-    finally {
-        if (fd !== null) {
-            try {
-                closeSync(fd);
-            }
-            catch {
-                // already closed
-            }
-        }
-    }
-}
 /** The GitHub listing page: the account's repositories with ONE honest
  * action each. Names, descriptions, and paths are gh/filesystem DATA —
  * escaped at the sink like everything else. */
@@ -955,6 +900,7 @@ export function githubReposPage(chrome, data) {
     return screen("projects", joinHtml([
         html `<h1>Your GitHub repositories</h1>`,
         html `<p class="meta">Repositories available to the GitHub account signed in on this machine — open one you already have, or clone a new one after a quick preview.</p>`,
+        data.localUnanswered === true ? html `<p class="meta">Your projects folder didn't answer, so copies already on this machine aren't matched yet. Try again in a moment.</p>` : null,
         rows,
         data.listed === null ? null : list("Refresh list"),
         html `<p class="row" style="margin-top:.6rem"><a class="badge" href="/projects">← back to projects</a></p>`,

package/dist/server/runtime.d.ts

@@ -1,3 +1,4 @@
+import { type ProjectIdentities } from "../project-identity.js";
 import type { FreshFacts } from '../scope.js';
 import type { createPersonalQueueRuntime } from '../lead-queue-runtime.js';
 import type { FlowRooms } from '../flow-live.js';
@@ -95,7 +96,10 @@ export interface ServerRuntime {
     liveCeiling: () => {
         repos: string[];
         roots: readonly string[];
+        canon?: (path: string) => string | null;
     };
+    /** Project identities without reading folders on the console's thread (project-identity.ts). */
+    identities: ProjectIdentities;
     taskScreen: (response: ServerResponse, who: Who, taskId: string, problem: string | null, status: number, scopeDraft?: URLSearchParams, cancelDraft?: string, editPlan?: boolean, page?: TaskPageExtras) => void;
     runVisible: (run: Run) => boolean;
     runIsLive: (run: Pick<Run, "outcome" | "leaseId" | "taskRef">) => boolean;

package/dist/server/runtime.js

@@ -1,3 +1,4 @@
+import {} from "../project-identity.js";
 /** Captured server state and shared guards. Getters preserve live state across requests. */
 import {} from "node:http";
 import {} from '../assignment.js';

package/dist/server/settings.js

@@ -9,6 +9,7 @@ import { CONNECT_CALLBACK, connectionsOf, finishConnect, localConnectOf, oneClic
 import { learningView } from "../project-learning.js";
 import { skillTestResult } from "../project-skills.js";
 import { discoverTools, projectToolsOf } from "../project-tools.js";
+import { lookProjectMcp } from "../folder-look.js";
 import { publishingOf } from '../pull-request-flow.js';
 import { skillTestFeedbackHtml } from "../skills-ui.js";
 import { labelOf, nameOf } from "../subagent-admin.js";
@@ -132,7 +133,7 @@ import { personChip, ROLE_TITLES } from "./chrome.js";
 import { chatReturnWithSaid, goOutside } from "./http.js";
 import { leadSettingsHtml, notificationProjects, SETTINGS_AUTOSAVE_SCRIPT, settingsPage, settingsWorkers, telegramDeliveryWords, telegramTrouble } from "./render-settings.js";
 export function createSettingsHandlers(runtime) {
-    const { store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, connectionKnown, lastChecks, checkRelease, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, chatCatalogKnown, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, authenticateCredential, deletedRepos, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, defaultProject, googleVisits } = runtime;
+    const { identities, store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, connectionKnown, lastChecks, checkRelease, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, chatCatalogKnown, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, authenticateCredential, deletedRepos, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, defaultProject, googleVisits } = runtime;
     // v105: what agent work cost, by month, and the monthly budgets. An instance operator's page.
     async function spendPage(ctx) {
         const { url, who, response, now } = ctx;
@@ -1547,7 +1548,15 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
                 const wanted = body.getAll("import");
                 if (wanted.length === 0)
                     return back("problem", "Choose at least one tool to add.");
-                const found = discoverTools(repo, await codexServers(repo), toolHome);
+                // The project's own .mcp.json read now, off the console's thread (folder-look.ts).
+                let projectConfig;
+                if (options.identities !== undefined) {
+                    const looked = await lookProjectMcp(repo);
+                    if (!looked.ok)
+                        return back("problem", "This project's folder didn't answer. It may be on a drive that's disconnected, or waiting on macOS. Try again in a moment.");
+                    projectConfig = looked.value;
+                }
+                const found = discoverTools(repo, await codexServers(repo), toolHome, process.env, projectConfig);
                 const added = [], problems = [];
                 for (const one of wanted) {
                     const match = found.find(tool => tool.spec.name === one);
@@ -1887,7 +1896,9 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         if (["scope", "full-access", "cap-usd", "nonce", "digest", "token"].some(key => body.getAll(key).length > 1))
             return refuse(response, who, 400, "Submit one value for each field.", "/settings");
         const given = (body.get("scope") ?? "all").trim();
-        const scope = given === "all" || given === "" ? CHAT_APPROVAL_ALL : canonicalProject(given) ?? given;
+        const scope = given === "all" || given === "" ? CHAT_APPROVAL_ALL : identities.vouched(given, consoleProjects) ?? null;
+        if (scope === null)
+            return refuse(response, who, 403, "That isn't one of your projects.", "/settings");
         if (scope !== CHAT_APPROVAL_ALL && !(visible(scope) && store.accountCanAccess(who.name, scope)))
             return refuse(response, who, 403, "That isn't one of your projects.", "/settings");
         const where = scope === CHAT_APPROVAL_ALL ? "all your projects" : projectName(scope);

package/dist/server/tasks.js

@@ -72,7 +72,7 @@ import { ACCEPT_ANYWAY_NEEDS_REASON, editorFileHref, proofBundleView, rankReview
 import { approvalFormDigest, approveRefusalWords, checkProgressHtml, consentDoorOf, decisionPage, nonceHashOf, PermissionsWouldChange, requirementsFromEditor, resumeDigestOf, taskOf } from "./render-tasks.js";
 import {} from "./session.js";
 export function createTasksHandlers(runtime) {
-    const { store, peekSay, peekCache, PEEK_CACHE_TTL_MS, peekInFlight, PEEK_GLOBAL_INFLIGHT, peekBySession, PEEK_SESSION_INFLIGHT, clock, peekName, PEEK_FRAGMENT_BYTES, peekEvict, evidenceRoot, sendScreen, chromeFor, visible, consumeApprovalNonce, authenticateApprover, options, mintApprovalNonce, taskScreen, unscopedMode, admissionList, planViewOf, revisionViewOf, runIsTaskResult, leadPrincipal, familyOf, armTaskResume, runIsLive, revisionLedgerOf, resultDetailOf, reviewFactsFor, taskRepoOf, runVisible, restricted, codingActorAllowed, codingProjectAllowed, managedRepos, routeViewOf, workAccess, firstRunStepsNow, revisionDocOf, failureOf, dockedConversation, planContractViewOf, familiesInView, explainAttempt, taskChatFocus, familyTasksInView, liveCeiling, projectOf, ceiling, bustBadge, revisionDestination } = runtime;
+    const { identities, store, peekSay, peekCache, PEEK_CACHE_TTL_MS, peekInFlight, PEEK_GLOBAL_INFLIGHT, peekBySession, PEEK_SESSION_INFLIGHT, clock, peekName, PEEK_FRAGMENT_BYTES, peekEvict, evidenceRoot, sendScreen, chromeFor, visible, consumeApprovalNonce, authenticateApprover, options, mintApprovalNonce, taskScreen, unscopedMode, admissionList, planViewOf, revisionViewOf, runIsTaskResult, leadPrincipal, familyOf, armTaskResume, runIsLive, revisionLedgerOf, resultDetailOf, reviewFactsFor, taskRepoOf, runVisible, restricted, codingActorAllowed, codingProjectAllowed, managedRepos, routeViewOf, workAccess, firstRunStepsNow, revisionDocOf, failureOf, dockedConversation, planContractViewOf, familiesInView, explainAttempt, taskChatFocus, familyTasksInView, liveCeiling, projectOf, ceiling, bustBadge, revisionDestination } = runtime;
     /** A row admitted the address but its path parameter does not parse: the console's unknown page. */
     function noPage(who, response) {
         return refuse(response, who, 404, "There's no page at this address.", "/chat");
@@ -1022,8 +1022,12 @@ export function createTasksHandlers(runtime) {
         let admitted = unscopedMode ? null : admissionList() ?? [];
         const rootMode = !unscopedMode && ceiling.roots.length > 0;
         if (rootMode && effective !== "") {
-            const canonical = (await authorizedProject(liveCeiling(), effective)) ? canonicalProject(effective) : null;
-            if (canonical === null || canonical === undefined) {
+            // Resolved off the console's thread (project-identity.ts), then proved against the ceiling as that identity.
+            const resolved = await identities.resolveNow(effective);
+            if (resolved === "no-answer")
+                return newTaskScreen(ctx, 503, `${effective} didn't answer — its folder may be on a drive that's disconnected, or waiting on macOS; try again in a moment`, draft);
+            const canonical = resolved !== null && (await authorizedProject(liveCeiling(), resolved)) ? resolved : null;
+            if (canonical === null) {
                 return newTaskScreen(ctx, 403, `${effective} is outside what this server was configured to show`, draft);
             }
             repo = canonical;

package/dist/up-processes.d.ts

@@ -26,6 +26,14 @@ export type UpWorkerConfig = {
     terminal: boolean;
     /** How long a start waits for a predecessor's watch lease to expire (a crashed worker's, after a restart). */
     leaseWaitMs: number;
+    /** Saved projects this start couldn't reach (a folder that didn't answer, a drive not connected): looked at again
+     * while it runs, and connected once they answer, on the same saved-list authority the start had. */
+    deferredRepos?: string[];
+    /** Each of those lines' removal count when this start read the saved list: a different count at binding means it was
+     * removed since (even if saved again), and the start's authority for it is gone. */
+    deferredGenerations?: Record<string, number>;
+    /** The saved line each of `repos` was proved from: a project stays while its line is saved, whatever else answers. */
+    repoLines?: Record<string, string[]>;
 };
 export type UpRoleStart = {
     type: "start";
@@ -67,6 +75,11 @@ export type RoleToParent = {
 } | {
     type: "repos";
     repos: string[];
+}
+/** The saved projects the worker still holds start authority for (it only ever shrinks: connected or removed). */
+ | {
+    type: "deferred";
+    repos: string[];
 } | {
     type: "failed";
     reason: "port-busy" | "start";

package/dist/up-processes.js

@@ -53,6 +53,7 @@ export function roleMessage(value, role) {
             return { type: "ready", role, build: value["build"], pid: value["pid"], url: value["url"], port: value["port"] };
         case "log": return text(value["line"]) ? { type: "log", line: value["line"] } : null;
         case "repos": return role === "worker" && texts(value["repos"]) ? { type: "repos", repos: [...value["repos"]] } : null;
+        case "deferred": return role === "worker" && texts(value["repos"]) ? { type: "deferred", repos: [...value["repos"]] } : null;
         case "failed": return (value["reason"] === "port-busy" || value["reason"] === "start") && text(value["detail"]) ? { type: "failed", reason: value["reason"], detail: value["detail"] } : null;
         case "fatal": return text(value["detail"]) ? { type: "fatal", detail: value["detail"] } : null;
         case "sign-in-link": return role === "console" && whole(value["id"]) && orNull(value["link"], (one) => nonEmpty(one, 2_048)) ? { type: "sign-in-link", id: value["id"], link: value["link"] } : null;
@@ -78,12 +79,15 @@ export function startMessage(value) {
         return { ...base, role: "console", config: config };
     }
     if (value["role"] === "worker") {
-        const keys = ["runner", "token", "repos", "pinnedRepos", "projectRoots", "registryPath", "pool", "forMs", "publicUrl", "stopGraceMs", "verbose", "terminal", "leaseWaitMs"];
+        const keys = ["runner", "token", "repos", "pinnedRepos", "projectRoots", "registryPath", "pool", "forMs", "publicUrl", "stopGraceMs", "verbose", "terminal", "leaseWaitMs", "deferredRepos", "deferredGenerations", "repoLines"];
         if (Object.keys(config).some(key => !keys.includes(key)))
             return null;
         if (!nonEmpty(config["runner"], 256) || !nonEmpty(config["token"], 1_024) || !texts(config["repos"]) || !texts(config["pinnedRepos"]) || !texts(config["projectRoots"]) ||
             !nonEmpty(config["registryPath"], 4_096) || !nonEmpty(config["pool"], 4_096) || !orNull(config["forMs"], (one) => whole(one, 1)) ||
-            !orNull(config["publicUrl"], (one) => nonEmpty(one, 2_048)) || !whole(config["stopGraceMs"], 0) || typeof config["verbose"] !== "boolean" || typeof config["terminal"] !== "boolean" || !whole(config["leaseWaitMs"], 0))
+            !orNull(config["publicUrl"], (one) => nonEmpty(one, 2_048)) || !whole(config["stopGraceMs"], 0) || typeof config["verbose"] !== "boolean" || typeof config["terminal"] !== "boolean" || !whole(config["leaseWaitMs"], 0) ||
+            (config["deferredRepos"] !== undefined && !texts(config["deferredRepos"])) ||
+            (config["deferredGenerations"] !== undefined && !(isObject(config["deferredGenerations"]) && Object.values(config["deferredGenerations"]).every(one => whole(one, -1, Number.MAX_SAFE_INTEGER)))) ||
+            (config["repoLines"] !== undefined && !(isObject(config["repoLines"]) && Object.values(config["repoLines"]).every(one => texts(one)))))
             return null;
         return { ...base, role: "worker", config: config };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.82",
+  "version": "0.9.83",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"