toolroll 0.9.83 → 0.9.84

package/dist/models-ui.d.ts

@@ -2,20 +2,31 @@
  * role picked from live lists, and the models that just arrived. */
 import { type Html } from "./html.js";
 import type { ModelOption, RuntimeState, SeenModel, WatchState } from "./model-catalog.js";
-export declare const MODELS_CSS = ".models{max-width:780px;min-width:0;overflow-wrap:anywhere}.models .card{padding:16px 20px;margin:12px 0;min-width:0}.models h2{margin:24px 0 8px}.models form{margin:0}.models label{display:grid;gap:6px}.models select,.models input[type=search]{box-sizing:border-box;width:100%;max-width:100%;min-width:0}.models button,.models summary,.models .button-link{min-height:44px}.models button{white-space:nowrap}.models summary{padding:12px 0;cursor:pointer}.models .tool{display:flex;gap:12px;align-items:center;justify-content:space-between;flex-wrap:wrap}.models .role{display:grid;grid-template-columns:minmax(0,1fr);gap:8px}.models .role-row{display:flex;gap:12px;align-items:end;flex-wrap:wrap}.models .role-row select{flex:1 1 240px;width:auto;min-width:0}.models .role-name{font-weight:600}.models .new{font-weight:600}.models ul{padding-left:20px}.models .meta{font-size:.86rem}@media(max-width:600px){.models .card{padding:14px}}";
+export declare const MODELS_CSS = ".models{max-width:780px;min-width:0;overflow-wrap:anywhere}.models .card{padding:16px 20px;margin:12px 0;min-width:0}.models h2{margin:24px 0 8px}.models form{margin:0}.models label{display:grid;gap:6px}.models select,.models input[type=search]{box-sizing:border-box;width:100%;max-width:100%;min-width:0}.models button,.models summary,.models .button-link{min-height:44px}.models button{white-space:nowrap}.models summary{padding:12px 0;cursor:pointer}.models .tool{display:flex;gap:12px;align-items:center;justify-content:space-between;flex-wrap:wrap}.models .role{display:grid;grid-template-columns:minmax(0,1fr);gap:8px}.models .role-row{display:flex;gap:12px;align-items:end;flex-wrap:wrap}.models .role-row select{flex:1 1 240px;width:auto;min-width:0}.models .role-name{font-weight:600}.models .new{font-weight:600}.models ul{padding-left:20px}.models .meta{font-size:.86rem}.models .role-read{display:grid;gap:2px;padding:8px 0}.models .editor{display:grid;gap:14px}.models .editor .role select{width:100%}.models .tiers{border-top:1px solid var(--so-line)}.models .tiers .role{margin:0 0 14px}.models .mono{font-family:var(--font-mono,ui-monospace,monospace);font-size:.84rem}.models .preset{display:flex;gap:12px;align-items:center;justify-content:space-between;flex-wrap:wrap}.models .preset p{margin:4px 0 0}.models .preset>div{flex:1 1 280px;min-width:0}.models .button-link{display:inline-flex;align-items:center;padding:0 14px;border:1px solid var(--so-input-line);border-radius:8px;text-decoration:none;color:var(--so-ink);font-weight:600}.models table{width:100%;border-collapse:collapse}.models th,.models td{text-align:left;vertical-align:top;padding:8px 6px;border-bottom:1px solid var(--so-line)}.models .diff th{width:38%;font-weight:600}.models .diff ul{margin:4px 0 0}.models .preview{border-color:var(--so-input-line)}.models .preview form{display:grid;gap:10px;margin-top:12px}.models .preview .cancel{justify-self:start;display:inline-flex;align-items:center;min-height:44px}.models .sizing dt{font-weight:600;margin-top:8px}.models .sizing dd{margin:2px 0 0}.models .editor label:has(input[type=password]){margin-top:4px}@media(max-width:600px){.models .card{padding:14px}.models .diff th,.models .diff td{display:block;width:auto;border:0;padding:4px 0}.models .diff tr{display:block;border-bottom:1px solid var(--so-line);padding:6px 0}.models .recent td{display:block;border:0;padding:2px 0}.models .recent tr{display:block;border-bottom:1px solid var(--so-line);padding:6px 0}.models .recent thead{display:none}}";
+/** One row of the editor: a role at the scope being edited. */
 export type RoleView = {
-    phase: "plan" | "build" | "review" | "repair";
+    /** The slot's form field (model-choices.ts slotKey). */
+    key: string;
     label: string;
-    /** "provider|model", or "inherit" for a repair that follows the builder. */
+    /** "provider|model", or "" when this scope has no row of its own. */
     current: string;
+    /** What runs now, in words, including what is inherited. */
     words: string;
+    /** What "no row here" means for this role: "Same as the builder", "Same as the installation (…)", "Not set". */
+    unset: string;
     groups: {
         label: string;
         provider: string;
         options: ModelOption[];
     }[];
-    /** Repair only: offer "Same as the builder". */
-    inherit?: boolean;
+    /** Behind the tiers disclosure. */
+    tier: boolean;
+};
+export type DiffView = {
+    role: string;
+    before: string;
+    after: string;
+    notes: string[];
 };
 export type ModelsView = {
     runtimes: RuntimeState[];
@@ -29,6 +40,59 @@ export type ModelsView = {
     canManage: boolean;
     said: string | null;
     problem: string | null;
+    /** The scope being edited, the scopes on offer, and the digest of what this page shows. */
+    scope: {
+        value: string;
+        label: string;
+        options: {
+            value: string;
+            label: string;
+        }[];
+        digest: string;
+    };
+    /** "Sized by job", "Opus for everything", or null for a custom set. */
+    inUse: string | null;
+    presets: {
+        name: string;
+        label: string;
+        words: string;
+        inUse: boolean;
+        recommended: boolean;
+    }[];
+    /** Newer models the watch has seen for exact ids in use here. */
+    newer: {
+        from: string;
+        to: string;
+        name: string;
+        roles: string;
+    }[];
+    /** A preset or switch's exact diff, shown before it applies. */
+    preview: {
+        title: string;
+        rows: DiffView[];
+        hidden: Record<string, string>;
+    } | null;
+    /** What still keeps tasks from being filed at this scope, or null. */
+    unresolved: string | null;
+    sizing: {
+        small: string;
+        routine: string;
+        large: string;
+        risky: string;
+        classifier: string;
+    };
+    routing: string;
+    recent: {
+        taskId: string;
+        runId: number;
+        role: string;
+        chosen: string;
+        ranOn: string;
+    }[];
+    waiting: {
+        taskId: string;
+        title: string;
+    }[];
 };
 export declare function modelsHtml(view: ModelsView): Html;
 /** Filters one long picker as you type; the saved choice always stays listed. */

package/dist/models-ui.js

@@ -1,10 +1,10 @@
 /** Settings → Models: the CLIs on this computer, the default agent for each
  * role picked from live lists, and the models that just arrived. */
-import { html, postForm } from "./html.js";
+import { html, postForm, reauth } from "./html.js";
 import { priceWords } from "./model-catalog.js";
 import { whenUtc } from "./when-html.js";
 const when = (iso) => iso === null ? "never" : whenUtc(iso);
-export const MODELS_CSS = `.models{max-width:780px;min-width:0;overflow-wrap:anywhere}.models .card{padding:16px 20px;margin:12px 0;min-width:0}.models h2{margin:24px 0 8px}.models form{margin:0}.models label{display:grid;gap:6px}.models select,.models input[type=search]{box-sizing:border-box;width:100%;max-width:100%;min-width:0}.models button,.models summary,.models .button-link{min-height:44px}.models button{white-space:nowrap}.models summary{padding:12px 0;cursor:pointer}.models .tool{display:flex;gap:12px;align-items:center;justify-content:space-between;flex-wrap:wrap}.models .role{display:grid;grid-template-columns:minmax(0,1fr);gap:8px}.models .role-row{display:flex;gap:12px;align-items:end;flex-wrap:wrap}.models .role-row select{flex:1 1 240px;width:auto;min-width:0}.models .role-name{font-weight:600}.models .new{font-weight:600}.models ul{padding-left:20px}.models .meta{font-size:.86rem}@media(max-width:600px){.models .card{padding:14px}}`;
+export const MODELS_CSS = `.models{max-width:780px;min-width:0;overflow-wrap:anywhere}.models .card{padding:16px 20px;margin:12px 0;min-width:0}.models h2{margin:24px 0 8px}.models form{margin:0}.models label{display:grid;gap:6px}.models select,.models input[type=search]{box-sizing:border-box;width:100%;max-width:100%;min-width:0}.models button,.models summary,.models .button-link{min-height:44px}.models button{white-space:nowrap}.models summary{padding:12px 0;cursor:pointer}.models .tool{display:flex;gap:12px;align-items:center;justify-content:space-between;flex-wrap:wrap}.models .role{display:grid;grid-template-columns:minmax(0,1fr);gap:8px}.models .role-row{display:flex;gap:12px;align-items:end;flex-wrap:wrap}.models .role-row select{flex:1 1 240px;width:auto;min-width:0}.models .role-name{font-weight:600}.models .new{font-weight:600}.models ul{padding-left:20px}.models .meta{font-size:.86rem}.models .role-read{display:grid;gap:2px;padding:8px 0}.models .editor{display:grid;gap:14px}.models .editor .role select{width:100%}.models .tiers{border-top:1px solid var(--so-line)}.models .tiers .role{margin:0 0 14px}.models .mono{font-family:var(--font-mono,ui-monospace,monospace);font-size:.84rem}.models .preset{display:flex;gap:12px;align-items:center;justify-content:space-between;flex-wrap:wrap}.models .preset p{margin:4px 0 0}.models .preset>div{flex:1 1 280px;min-width:0}.models .button-link{display:inline-flex;align-items:center;padding:0 14px;border:1px solid var(--so-input-line);border-radius:8px;text-decoration:none;color:var(--so-ink);font-weight:600}.models table{width:100%;border-collapse:collapse}.models th,.models td{text-align:left;vertical-align:top;padding:8px 6px;border-bottom:1px solid var(--so-line)}.models .diff th{width:38%;font-weight:600}.models .diff ul{margin:4px 0 0}.models .preview{border-color:var(--so-input-line)}.models .preview form{display:grid;gap:10px;margin-top:12px}.models .preview .cancel{justify-self:start;display:inline-flex;align-items:center;min-height:44px}.models .sizing dt{font-weight:600;margin-top:8px}.models .sizing dd{margin:2px 0 0}.models .editor label:has(input[type=password]){margin-top:4px}@media(max-width:600px){.models .card{padding:14px}.models .diff th,.models .diff td{display:block;width:auto;border:0;padding:4px 0}.models .diff tr{display:block;border-bottom:1px solid var(--so-line);padding:6px 0}.models .recent td{display:block;border:0;padding:2px 0}.models .recent tr{display:block;border-bottom:1px solid var(--so-line);padding:6px 0}.models .recent thead{display:none}}`;
 function toolRow(one, manage) {
     const state = one.installed === null ? "Version unknown"
         : one.behind ? html `${one.installed} · <strong>${one.latest} available</strong>`
@@ -16,18 +16,17 @@ function toolRow(one, manage) {
 }
 function roleForm(role, manage) {
     if (!manage)
-        return html `<div class="card role"><strong>${role.label}</strong><span>${role.words}</span></div>`;
+        return html `<div class="role-read"><span class="role-name">${role.label}</span><span>${role.words}</span></div>`;
     const known = role.groups.some(group => group.options.some(option => `${group.provider}|${option.value}` === role.current));
-    const saved = !known && role.current !== "inherit" && role.current !== "" ? html `<option value="${role.current}" selected>${role.words} · current</option>` : "";
+    const saved = !known && role.current !== "" ? html `<option value="${role.current}" selected>${role.words} · current</option>` : "";
     const groups = role.groups.map(group => html `<optgroup label="${group.label}">${group.options.map(option => {
         const value = `${group.provider}|${option.value}`;
         return html `<option value="${value}"${value === role.current ? html ` selected` : ""}>${option.label}</option>`;
     })}</optgroup>`);
-    const inherit = role.inherit ? html `<option value="inherit"${role.current === "inherit" ? html ` selected` : ""}>Same as the builder</option>` : "";
-    const long = role.groups.reduce((sum, group) => sum + group.options.length, 0) > 40;
+    const unset = html `<option value="clear"${role.current === "" ? html ` selected` : ""}>${role.unset}</option>`;
     const count = role.groups.reduce((sum, group) => sum + group.options.length, 0);
-    const id = `role-${role.phase}`;
-    return postForm("/settings/models/agent", html `<label class="role-name" for="${id}">${role.label}</label>${long ? html `<input type="search" data-model-filter hidden aria-label="Search ${role.label.toLowerCase()} models" placeholder="Search ${count} models" autocomplete="off">` : ""}<div class="role-row"><select id="${id}" name="agent">${inherit}${saved}${groups}</select><button type="submit" class="secondary">Save</button></div>`, { attrs: { class: "card role" }, hidden: { phase: role.phase } });
+    const id = `role-${role.key}`;
+    return html `<div class="role"><label class="role-name" for="${id}">${role.label}</label>${count > 40 ? html `<input type="search" data-model-filter hidden aria-label="Search ${role.label.toLowerCase()} models" placeholder="Search ${count} models" autocomplete="off">` : ""}<select id="${id}" name="${role.key}">${unset}${saved}${groups}</select>${role.current === "" ? html `<span class="meta">${role.words}</span>` : ""}</div>`;
 }
 export function modelsHtml(view) {
     const manage = view.canManage && view.csrf !== "";
@@ -44,11 +43,11 @@ export function modelsHtml(view) {
     const watch = manage
         ? html `<details><summary>Automatic checks · ${view.watch.enabled ? "On" : "Off"}</summary>${postForm("/settings/models/watch", html `<p>Check every 6 hours and send a message when a new model or CLI update appears. It uses public lists and sends nothing about you or your projects.</p><button type="submit" class="secondary">${view.watch.enabled ? "Turn off" : "Turn on"}</button>`, { hidden: { enabled: view.watch.enabled ? "0" : "1" } })}</details>`
         : "";
-    return html `<section class="models">${status}${problem}<h2>AI tools</h2>${tools}<p class="meta">Checked ${when(view.watch.checkedAt)} ${check}</p>${fresh}<h2>Default agents</h2><p class="meta">New tasks use these. Approved tasks keep the agents they were approved with.</p>${view.roles.map(role => roleForm(role, manage))}${view.chat === null ? "" : html `<h2>Chat</h2><p>${view.chat.words} · <a href="/settings/lead">Change</a></p>`}${watch}</section>`;
+    return html `<section class="models">${status}${problem}${previewCard(view, manage)}${editorSection(view, manage)}${presetsSection(view, manage)}${sizingSection(view)}${recentSection(view)}<h2>AI tools</h2>${tools}<p class="meta">Checked ${when(view.watch.checkedAt)} ${check}</p>${fresh}${view.chat === null ? "" : html `<h2>Chat</h2><p>${view.chat.words} · <a href="/settings/lead">Change</a></p>`}${watch}</section>`;
 }
 /** Filters one long picker as you type; the saved choice always stays listed. */
 export function modelsScript() {
-    return `(function(){document.querySelectorAll('.models form.role').forEach(function(form){
+    return `(function(){document.querySelectorAll('.models .role').forEach(function(form){
     var search=form.querySelector('[data-model-filter]'),select=form.querySelector('select');
     if(!search||!select)return;search.hidden=false;
     var groups=Array.from(select.querySelectorAll('optgroup')).map(function(g){return{g:g,options:Array.from(g.children)}});
@@ -57,3 +56,47 @@ export function modelsScript() {
       select.value=chosen;});
   })})();`;
 }
+const scopeQuery = (view) => view.scope.value === "installation" ? "" : `&scope=${encodeURIComponent(view.scope.value)}`;
+const password = () => reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label>`);
+/** The roles at the scope being edited: one form, one save, one password. Sizes and tiers sit behind a disclosure. */
+function editorSection(view, manage) {
+    const scopes = view.scope.options.length < 2 ? "" : html `<form method="get" action="/settings/models" class="models-scope"><label for="models-scope">Settings for</label><div class="role-row"><select id="models-scope" name="scope">${view.scope.options.map(one => html `<option value="${one.value}"${one.value === view.scope.value ? html ` selected` : ""}>${one.label}</option>`)}</select><button type="submit" class="secondary">Show</button></div></form>`;
+    const main = view.roles.filter(role => !role.tier), tiers = view.roles.filter(role => role.tier);
+    const inUse = html `<p class="meta">In use: ${view.inUse === null ? "a custom set" : view.inUse}${view.scope.value === "installation" ? "" : html ` · ${view.scope.label}`}</p>`;
+    const unresolved = view.unresolved === null ? "" : html `<p class="problem" role="alert">New tasks can't be filed here yet: ${view.unresolved}</p>`;
+    const rows = html `${main.map(role => roleForm(role, manage))}<details class="tiers"${manage ? "" : html ` open`}><summary>By task size</summary>${tiers.map(role => roleForm(role, manage))}</details>`;
+    const body = manage
+        ? postForm("/settings/models/agent", html `${rows}${password()}<button type="submit">Save</button>`, { attrs: { class: "card editor" }, hidden: { scope: view.scope.value, digest: view.scope.digest } })
+        : html `<div class="card editor">${rows}</div>`;
+    return html `<h2>Models for new tasks</h2>${scopes}${inUse}${unresolved}${body}<p class="meta">Changes apply to tasks filed from now on. Approved and waiting tasks keep the models they were filed with.</p>`;
+}
+/** A preset or a switch shows exactly what it changes, and applies only with a second, password-checked submit. */
+function previewCard(view, manage) {
+    const preview = view.preview;
+    if (preview === null || !manage)
+        return html ``;
+    const back = `/settings/models${view.scope.value === "installation" ? "" : `?scope=${encodeURIComponent(view.scope.value)}`}`;
+    if (preview.rows.length === 0)
+        return html `<div class="card preview" role="status"><h2>${preview.title}</h2><p>Already in use. Nothing would change.</p><a class="button-link" href="${back}">Back</a></div>`;
+    const rows = preview.rows.map(row => html `<tr><th scope="row">${row.role}</th><td><span class="mono">${row.before}</span> → <span class="mono">${row.after}</span>${row.notes.length === 0 ? "" : html `<ul class="meta">${row.notes.map(note => html `<li>${note}</li>`)}</ul>`}</td></tr>`);
+    return html `<div class="card preview"><h2>${preview.title}</h2><p>Review what changes for tasks filed from now on.</p><table class="diff"><tbody>${rows}</tbody></table>${postForm("/settings/models/apply", html `${password()}<button type="submit" class="primary">Apply ${preview.rows.length} change${preview.rows.length === 1 ? "" : "s"}</button><a class="cancel" href="${back}">Cancel</a>`, { hidden: preview.hidden })}</div>`;
+}
+function presetsSection(view, manage) {
+    const presets = view.presets.map(one => html `<div class="card preset"><div><strong>${one.label}</strong>${one.recommended ? html ` <span class="meta">Default</span>` : ""}<p>${one.words}</p></div>${one.inUse ? html `<span class="meta">In use</span>` : manage ? html `<a class="button-link" href="/settings/models?preset=${one.name}${scopeQuery(view)}">Review changes</a>` : ""}</div>`);
+    const newer = view.newer.length === 0 ? "" : html `<h2>Newer models</h2>${view.newer.map(one => html `<div class="card preset"><div><strong>${one.name}</strong><p>Newer than <span class="mono">${one.from}</span>, used by ${one.roles}.</p></div>${manage ? html `<a class="button-link" href="/settings/models?switch=${encodeURIComponent(one.from)}&to=${encodeURIComponent(one.to)}${scopeQuery(view)}">Switch to it</a>` : ""}</div>`)}`;
+    return html `<h2>Presets</h2>${presets}${newer}`;
+}
+/** How a task's size is decided, in plain words, and what routing does at filing. */
+function sizingSection(view) {
+    return html `<h2>How tasks are sized</h2><div class="card sizing"><p>Each task is sized once, when it is filed. ${view.sizing.classifier} If it doesn't answer within 5 seconds, the size comes from the description.</p><dl>
+<dt>Small</dt><dd>${view.sizing.small}. Built by the builder for small tasks, with no plan.</dd>
+<dt>Routine</dt><dd>${view.sizing.routine}. Planned and built by the planner and builder for routine tasks.</dd>
+<dt>Large or risky</dt><dd>Large: ${view.sizing.large}. Risky: ${view.sizing.risky} Planned and built by the large or risky models.</dd></dl>
+<details><summary>More about routing</summary><p>${view.routing}</p><p>Changing a model never re-sizes or re-routes a task that was already filed. One exception: an older build review saved without its own route uses the reviewer set here now.</p></details></div>${view.waiting.length === 0 ? "" : html `<details class="waiting"><summary>${view.waiting.length} plan${view.waiting.length === 1 ? "" : "s"} waiting for approval</summary><p class="meta">They keep the models they were filed with.</p><ul>${view.waiting.map(one => html `<li><a href="/t/${encodeURIComponent(one.taskId)}">${one.title}</a></li>`)}</ul></details>`}`;
+}
+/** The model each recent run was set to, next to the model its provider reported. */
+function recentSection(view) {
+    if (view.recent.length === 0)
+        return html ``;
+    return html `<h2>Recent work</h2><table class="recent"><thead><tr><th scope="col">Task</th><th scope="col">Chosen → ran on</th></tr></thead><tbody>${view.recent.map(one => html `<tr><td><a href="/t/${encodeURIComponent(one.taskId)}">${one.taskId}</a> <span class="meta">${one.role}</span></td><td><span class="mono">${one.chosen}</span> → <span class="mono">${one.ranOn}</span></td></tr>`)}</tbody></table>`;
+}

package/dist/needs-you.d.ts

@@ -15,6 +15,14 @@ export type NeedAction = {
     code: NeedActionCode;
     label: string;
 };
+/** Where "Connect a builder" and "Start the builder" lead (code `start-worker`): the Start a builder page, which shows
+ * the one command to run and the open project's builder state. Every signed-in person can open it, a project-limited
+ * one included (System is instance-only). Never the task's own page, which only repeats that nothing is connected. */
+export declare const START_BUILDER_HREF = "/start-builder";
+/** Start a builder for one task: the page reports that task's own project, whatever project is open. */
+export declare const startBuilderHref: (taskId: string | null) => string;
+/** What starts a builder: run on the machine where the project lives, in the project's folder. */
+export declare const START_BUILDER_COMMAND = "toolroll up";
 /** `build`: the run a sentence names; `provider`: the agent that signed out. */
 export type NeedContext = {
     build?: number | null;

package/dist/needs-you.js

@@ -5,6 +5,14 @@
  *
  * The words never name the machine's internals; `plainSentence` keeps a
  * recorded reason only when it is free of them. */
+/** Where "Connect a builder" and "Start the builder" lead (code `start-worker`): the Start a builder page, which shows
+ * the one command to run and the open project's builder state. Every signed-in person can open it, a project-limited
+ * one included (System is instance-only). Never the task's own page, which only repeats that nothing is connected. */
+export const START_BUILDER_HREF = "/start-builder";
+/** Start a builder for one task: the page reports that task's own project, whatever project is open. */
+export const startBuilderHref = (taskId) => taskId === null ? START_BUILDER_HREF : `${START_BUILDER_HREF}?task=${encodeURIComponent(taskId)}`;
+/** What starts a builder: run on the machine where the project lives, in the project's folder. */
+export const START_BUILDER_COMMAND = "toolroll up";
 const always = () => true;
 const build = (context) => context.build == null ? "the last build" : `build #${context.build}`;
 const Build = (context) => context.build == null ? "The last build" : `Build #${context.build}`;

package/dist/operate.d.ts

@@ -9,10 +9,12 @@ import { type Store } from "./store.js";
 import { type DispatchAdapter } from "./sync.js";
 import { type RolePort, type UpRoleStart } from "./up-processes.js";
 import { type TelegramTransport } from "./telegram.js";
+import { type ProjectIdentities } from "./project-identity.js";
 import { type FolderLookOptions } from "./folder-look.js";
 import { type LeadCliSeams } from "./lead-cli.js";
 import { type Principal, type RemoteRun, type RemoteSource } from "./operate-remote.js";
 import { type PublishExec } from "./publish.js";
+import { type ApplyResult, type ExtraWrite, type ModelChange, type Slot } from "./model-choices.js";
 import { type Runner as CommandRunner } from "./builder.js";
 import { type ReleaseIo } from "./releases.js";
 export type Write = (line: string) => void;
@@ -94,6 +96,8 @@ export type OperateOptions = {
     filingSizer?: Sizer;
     /** Set only by up-role-child.ts: this process is one role of a `toolroll up` (the console or the worker). */
     upRole?: UpRoleHost;
+    /** Injected by tests: how the console looks at project folders off its thread (folder-look.ts). */
+    folderLook?: FolderLookOptions;
 };
 export type OnboardSeams = Partial<Pick<OnboardIo, "home" | "env" | "cwd" | "interactive" | "confirm" | "findRepo" | "checkConnection" | "pullRequests">>;
 export declare const OPERATE_HELP: string;
@@ -153,6 +157,8 @@ export declare function runOperateAs(argv: string[], opts: {
     options?: OperateOptions;
 }): Promise<number>;
 type Context = {
+    /** Injected by tests: how the console looks at project folders off its thread. */
+    folderLook?: FolderLookOptions;
     /** A remote run's person (runOperateAs): every credential check resolves to them. Absent for every local command. */
     principal?: RemoteRun;
     /** The lead token this command runs under: it signs in as its owner. */
@@ -303,3 +309,18 @@ export declare function upProveSaved(gitRun: (file: string, args: readonly strin
 /** What `up` hands its next worker after the worker reports which saved projects it still holds start authority for:
  * only what both still hold. A worker's report can give up an authority, never add or give back one. */
 export declare function upNarrowDeferred(held: readonly string[], reported: readonly string[]): string[];
+/** Resolve the console's project identities after it is listening, never before: the deploy's health check and every
+ * page answer at once, and each project shows up as its folder answers (project-identity.ts `refresh`, its looks a
+ * few at a time under their deadline). Nothing waits on it; a pass that fails leaves those paths unresolved, which
+ * fails closed, for the background pass to try again. */
+export declare function consoleIdentitiesInBackground(identities: ProjectIdentities, paths: readonly string[]): void;
+/** `config set` and `config clear` on the command line, through Settings → Models' one write path (model-choices.ts,
+ * docs/plans/spend-dashboard.md slice 3), under the same target and resulting-configuration checks as the editor: the
+ * person proved themselves with their own password or login at `proved.generation`; a machine credential (a remote
+ * token, the lead's token) never changes which models run. The write re-proves them inside its transaction: still an
+ * unrestricted instance operator, at that very generation, by a proof that still stands. */
+export declare function writeModelRow(store: Store, proved: {
+    actor: string;
+    generation: number;
+    method: string;
+}, scope: string, knownProject: (repo: string) => boolean, slot: Slot | null, to: ModelChange["to"], now: Date, extra?: readonly ExtraWrite[]): ApplyResult;

package/dist/operate.js

@@ -222,6 +222,7 @@ import { fileTaskProposal, validateTaskText } from "./proposal.js";
 import { TEMPLATES, templateByName } from "./templates.js";
 import { isDirectChatProvider, isSubscriptionChatProvider, priceOf, PRICED_MODELS } from "./converse.js";
 import { resolvePhaseAgent, resolveScopeProfile, resolveRouteCandidates, routeOfTask, INSTALLATION_SCOPE } from "./agentconfig.js";
+import { applyModelChoices, stateDigest } from "./model-choices.js";
 import { isTaskSize, legOf, projectRoute, routeDigestOf, routeWords, TASK_SIZES, PHASES as ROUTE_PHASES } from "./phase-routing.js";
 import { observeProviderReadiness, reportProviderReadinessAuthed } from "./runner.js";
 import { parseDemoUrl, projectDemoUrl, saveProjectDemo } from "./project-demo.js";
@@ -967,6 +968,7 @@ async function dispatchOn(command, positional, flags, repoList, base, options, e
             ...(options.onboardSeams === undefined ? {} : { onboardSeams: options.onboardSeams }),
             ...(options.upSeams === undefined ? {} : { upSeams: options.upSeams }),
             ...(options.upRole === undefined ? {} : { upRole: options.upRole }),
+            ...(options.folderLook === undefined ? {} : { folderLook: options.folderLook }),
             ...(upNeedsOneProcess(options) ? { upOneProcess: true } : {}),
             ...(activeRemote() === null ? {} : { principal: activeRemote() }),
         });
@@ -3941,11 +3943,11 @@ async function startConsole(options) {
     const { context } = options;
     // A git incident (teardown-git.ts) raises an attention notification in this console's outbox.
     noticeGitIncidents(context.store, context.clock);
-    // Every project folder this console starts with is resolved off its thread, under a deadline: one that doesn't
-    // answer (a drive away, an iCloud folder macOS is holding) stays unresolved, kept restrictive, and is looked at again
-    // by the background pass; the console starts and answers either way (project-identity.ts).
-    const identities = projectIdentities();
-    await identities.refresh([...options.repos ?? [], ...options.projectRoots ?? [], ...context.store.listProjects().map(one => one.path), ...context.store.knownRepos()]);
+    // Every project folder this console starts with is resolved off its thread, under a deadline, after it is listening
+    // (consoleIdentitiesInBackground): the console answers at once, and a project shows up once its folder answers. Until
+    // then it is unresolved and kept restrictive; one that doesn't answer (a drive away, an iCloud folder macOS is
+    // holding) is looked at again by the background pass (project-identity.ts).
+    const identities = projectIdentities(context.folderLook);
     const server = createDecisionServer({
         identities,
         store: context.store,
@@ -3982,6 +3984,7 @@ async function startConsole(options) {
     }).catch(error => {
         throw new Error(`could not listen on ${options.host}:${options.port} — ${describe(error)}`);
     });
+    consoleIdentitiesInBackground(identities, [...options.repos ?? [], ...options.projectRoots ?? [], ...context.store.listProjects().map(one => one.path), ...context.store.knownRepos()]);
     // v104: monitoring runs beside the console (every setup has one): one loop sends the audit stream and traces where
     // Settings → Monitoring says, and stops when the console does. A lease keeps a second process from sending too.
     const stopMonitoring = startMonitoring({
@@ -5042,6 +5045,9 @@ async function configCommand(positional, flags, context) {
     if (phase === undefined || !["plan", "build", "repair", "review"].includes(phase))
         return fail(write, json, `config ${action}`, "usage", "which phase? plan, build, repair, review — or chat", EXIT.usage);
     const acting = await askCredentials(flags, context);
+    // The credential generation the proof below is checked against, read BEFORE it: a rotation after this read makes
+    // the write refuse (model-choices.ts re-checks it inside the transaction), never borrow the new generation.
+    const provedGeneration = acting === null ? -1 : store.accountOf(acting.name)?.generation ?? -1;
     const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
     if (acting === null || !verified?.ok)
         return refuseApprover(context, `config ${action}`, verified, "changing spend routing takes `--as <you> --token <t>`", phase);
@@ -5057,6 +5063,18 @@ async function configCommand(positional, flags, context) {
     // Clearing one left from before stays possible.
     if (tierGiven === "light" && phase !== "build" && !(action === "clear" && phase === "plan" && !flag(flags, "also")))
         return fail(write, json, `config ${action}`, "usage", "--tier light is for build only — a small change makes no plan, and repairs resume the builder's session", EXIT.usage);
+    // Every row below — plain, tier, `--also`, and a leftover light planner's removal — is written through the one write
+    // path (model-choices.ts): one transaction, the actor re-proved as an instance operator at the credential generation
+    // proved above by a proof that still stands, the target and the resulting configuration checked, every row ledgered.
+    // A project named with --repo must be one Toolroll knows (the editor's own rule).
+    const projectKnown = repoGiven === undefined || (await knownProject(context, repoGiven, { listed: true, canonical: true })) !== undefined;
+    const proof = { actor: acting.name, generation: provedGeneration, method: verified.method };
+    const written = (slot, to, extra = []) => writeModelRow(store, proof, scope, () => projectKnown, slot, to, clock(), extra);
+    // A configuration still missing a role's model is saved, and said (JSON: `incomplete`).
+    const said = (command, result, payload, lines) => {
+        const incomplete = result.ok ? result.unresolved : null;
+        return succeed(write, json, command, { ...payload, ...(incomplete === null ? {} : { incomplete }) }, () => [...lines(), ...(incomplete === null ? [] : [`  ! new tasks can't be filed here yet: ${incomplete}`])]);
+    };
     // Another provider's candidate on the same tier (`--also`): one per provider, and at filing the one whose plan
     // has more room runs.
     if (flag(flags, "also")) {
@@ -5067,8 +5085,11 @@ async function configCommand(positional, flags, context) {
         if (alsoProvider !== undefined && !isProviderId(alsoProvider))
             return fail(write, json, `config ${action}`, "usage", `--provider is one of ${PROVIDER_IDS.join(", ")}`, EXIT.usage);
         if (action === "clear") {
-            const removed = store.clearPhaseTierAlternates(scope, phase, tier, alsoProvider ?? null);
-            return succeed(write, json, "config clear", { scope, phase, tier, also: true, provider: alsoProvider ?? null, cleared: removed }, () => [
+            const alsoClear = written(null, null, [{ kind: "also-clear", phase, tier, provider: alsoProvider ?? null }]);
+            if (!alsoClear.ok)
+                return fail(write, json, "config clear", alsoClear.reason, alsoClear.problem, EXIT.refused);
+            const removed = alsoClear.extra;
+            return said("config clear", alsoClear, { scope, phase, tier, also: true, provider: alsoProvider ?? null, cleared: removed }, () => [
                 removed > 0 ? `Removed ${removed} other-provider ${tier} ${phase} agent${removed === 1 ? "" : "s"} at ${scope}; sealed routes are untouched.` : `No other-provider ${tier} ${phase} agent${alsoProvider === undefined ? "" : ` on ${alsoProvider}`} was configured at ${scope}.`,
             ]);
         }
@@ -5078,10 +5099,12 @@ async function configCommand(positional, flags, context) {
         const alsoValid = validateSpec({ provider: alsoProvider, model: alsoModel });
         if (!alsoValid.ok)
             return fail(write, json, "config set", "invalid", alsoValid.problem, EXIT.usage);
-        store.setPhaseTierAlternate(scope, phase, tier, alsoProvider, alsoModel, acting.name, clock());
+        const alsoSet = written(null, null, [{ kind: "also-set", phase, tier, provider: alsoProvider, model: alsoModel }]);
+        if (!alsoSet.ok)
+            return fail(write, json, "config set", alsoSet.reason, alsoSet.problem, EXIT.refused);
         const resolvedNow = resolveRouteCandidates(store, scope === INSTALLATION_SCOPE ? null : scope);
         const own = !resolvedNow.ok ? null : tier === "routine" ? resolvedNow.candidates[phase].routine : tier === "light" ? resolvedNow.candidates[phase].light ?? null : resolvedNow.candidates[phase].strong;
-        return succeed(write, json, "config set", { scope, phase, tier, also: true, provider: alsoProvider, model: alsoModel }, () => [
+        return said("config set", alsoSet, { scope, phase, tier, also: true, provider: alsoProvider, model: alsoModel }, () => [
             `${tier} ${phase} at ${scope === INSTALLATION_SCOPE ? "the installation" : scope} can also run ${alsoProvider} · ${alsoModel}, set by ${acting.name}.`,
             own !== null && own.provider === alsoProvider && !own.source.includes("also")
                 ? `  ! the ${tier} ${phase} agent already runs ${alsoProvider} (${own.model}) — this one is not used while it does.`
@@ -5089,20 +5112,39 @@ async function configCommand(positional, flags, context) {
         ]);
     }
     if (action === "clear") {
+        if (tierGiven === "light" && phase === "build") {
+            const lightWrite = written({ phase, tier: "light" }, null);
+            if (!lightWrite.ok)
+                return fail(write, json, "config clear", lightWrite.reason, lightWrite.problem, EXIT.refused);
+            const clearedLight = lightWrite.diff.length > 0;
+            return said("config clear", lightWrite, { scope, phase, tier: "light", cleared: clearedLight }, () => [
+                clearedLight ? `Cleared the light ${phase} agent at ${scope} — small changes keep the default and say so; sealed routes are untouched.` : `No light ${phase} agent was configured at ${scope}.`,
+            ]);
+        }
         if (tierGiven === "light") {
-            const clearedLight = store.clearPhaseTierConfig(scope, phase, "light");
-            return succeed(write, json, "config clear", { scope, phase, tier: "light", cleared: clearedLight }, () => [
+            // A light planner from before light became build-only: removed here, never written.
+            const legacyClear = written(null, null, [{ kind: "legacy-light-clear", phase: phase }]);
+            if (!legacyClear.ok)
+                return fail(write, json, "config clear", legacyClear.reason, legacyClear.problem, EXIT.refused);
+            const clearedLight = legacyClear.extra > 0;
+            return said("config clear", legacyClear, { scope, phase, tier: "light", cleared: clearedLight }, () => [
                 clearedLight ? `Cleared the light ${phase} agent at ${scope} — small changes keep the default and say so; sealed routes are untouched.` : `No light ${phase} agent was configured at ${scope}.`,
             ]);
         }
         if (tierGiven === "strong") {
-            const clearedStrong = store.clearPhaseTierConfig(scope, phase, "strong");
-            return succeed(write, json, "config clear", { scope, phase, tier: "strong", cleared: clearedStrong }, () => [
+            const strongWrite = written({ phase: phase, tier: "strong" }, null);
+            if (!strongWrite.ok)
+                return fail(write, json, "config clear", strongWrite.reason, strongWrite.problem, EXIT.refused);
+            const clearedStrong = strongWrite.diff.length > 0;
+            return said("config clear", strongWrite, { scope, phase, tier: "strong", cleared: clearedStrong }, () => [
                 clearedStrong ? `Cleared the strong ${phase} agent at ${scope} — demanding routes keep the default and say so; sealed routes are untouched.` : `No strong ${phase} agent was configured at ${scope}.`,
             ]);
         }
-        const cleared = store.clearPhaseConfig(scope, phase);
-        return succeed(write, json, "config clear", { scope, phase, cleared }, () => [
+        const routineWrite = written({ phase: phase, tier: "routine" }, null);
+        if (!routineWrite.ok)
+            return fail(write, json, "config clear", routineWrite.reason, routineWrite.problem, EXIT.refused);
+        const cleared = routineWrite.diff.length > 0;
+        return said("config clear", routineWrite, { scope, phase, cleared }, () => [
             cleared ? `Cleared ${phase} at ${scope} — it resolves one layer down now.` : `Nothing was configured for ${phase} at ${scope}.`,
         ]);
     }
@@ -5116,8 +5158,10 @@ async function configCommand(positional, flags, context) {
     if (tierGiven === "light") {
         if (modelGiven === null)
             return fail(write, json, "config set", "usage", `a light ${phase} agent names an exact --model — approvals bind exact routing`, EXIT.usage);
-        store.setPhaseTierConfig(scope, phase, "light", providerGiven, modelGiven, acting.name, clock());
-        return succeed(write, json, "config set", { scope, phase, tier: "light", provider: providerGiven, model: modelGiven }, () => [
+        const lightSet = written({ phase: phase, tier: "light" }, { provider: providerGiven, model: modelGiven });
+        if (!lightSet.ok)
+            return fail(write, json, "config set", lightSet.reason, lightSet.problem, EXIT.refused);
+        return said("config set", lightSet, { scope, phase, tier: "light", provider: providerGiven, model: modelGiven }, () => [
             `light ${phase} at ${scope === INSTALLATION_SCOPE ? "the installation" : scope} is ${providerGiven} · ${modelGiven}, set by ${acting.name}.`,
             "  small changes filed from now on build on it with no plan; sealed routes are untouched.",
         ]);
@@ -5127,14 +5171,19 @@ async function configCommand(positional, flags, context) {
             return fail(write, json, "config set", "invalid", "gemini has no isolation posture for the review phase yet — name claude or codex as the strong reviewer", EXIT.usage);
         if (modelGiven === null)
             return fail(write, json, "config set", "usage", `a strong ${phase} agent names an exact --model — approvals bind exact routing`, EXIT.usage);
-        store.setPhaseTierConfig(scope, phase, "strong", providerGiven, modelGiven, acting.name, clock());
-        return succeed(write, json, "config set", { scope, phase, tier: "strong", provider: providerGiven, model: modelGiven }, () => [
+        const strongSet = written({ phase: phase, tier: "strong" }, { provider: providerGiven, model: modelGiven });
+        if (!strongSet.ok)
+            return fail(write, json, "config set", strongSet.reason, strongSet.problem, EXIT.refused);
+        return said("config set", strongSet, { scope, phase, tier: "strong", provider: providerGiven, model: modelGiven }, () => [
             `strong ${phase} at ${scope === INSTALLATION_SCOPE ? "the installation" : scope} is ${providerGiven}${modelGiven === null ? "" : ` · ${modelGiven}`}, set by ${acting.name}.`,
             "  large or risky, strict, screenshot-proof, and automerge routes filed from now on reach for it; sealed routes are untouched.",
             ...(phase === "repair" ? ["  a strong repair agent applies only when its provider is the build's — cross-provider repair does not exist."] : []),
         ]);
     }
-    store.setPhaseConfig(scope, phase, providerGiven, modelGiven, acting.name, clock());
+    // A routine row may still name no model on the command line (said below); the editor never writes one.
+    const routineSet = written({ phase: phase, tier: "routine" }, { provider: providerGiven, model: modelGiven });
+    if (!routineSet.ok)
+        return fail(write, json, "config set", routineSet.reason, routineSet.problem, EXIT.refused);
     const warnings = [];
     if (modelGiven === null) {
         warnings.push(`no --model named: approvals bind exact routing, so scopes cannot file until ${phase} has an exact model — \`config set ${phase} --provider ${providerGiven} --model <model>\``);
@@ -5145,7 +5194,7 @@ async function configCommand(positional, flags, context) {
     if (providerGiven !== "claude") {
         warnings.push(`${providerGiven} does not report dollar cost: its runs land as UNMEASURED, and any schedule with a weekly limit fails closed on them by design.`);
     }
-    return succeed(write, json, "config set", { scope, phase, provider: providerGiven, model: modelGiven, warnings }, () => [
+    return said("config set", routineSet, { scope, phase, provider: providerGiven, model: modelGiven, warnings }, () => [
         `${phase} at ${scope === INSTALLATION_SCOPE ? "the installation" : scope} now runs ${providerGiven}${modelGiven === null ? "" : ` · ${modelGiven}`}, set by ${acting.name}.`,
         ...warnings.map(one => `  ! ${one}`),
     ]);
@@ -7493,11 +7542,14 @@ async function upCommand(flags, context) {
                 pendingLinks.set(id, value => { clearTimeout(timer); resolveLink(value); });
                 consoleRole?.send({ type: "sign-in-link", id, account });
             });
-            const home = homedir();
-            const file = approverPlan2.passwordFile === null ? null : approverPlan2.passwordFile.startsWith(`${home}/`) ? `~${approverPlan2.passwordFile.slice(home.length)}` : approverPlan2.passwordFile;
+            // Every start says where the saved password is and the exact command that shows it, browser or not (Settings
+            // revamp S4, D2). Only the path is printed, never what the file holds: absolute (a relative --db names this
+            // directory), single-quoted (no ~ or $ expands), after `--` (a leading dash is never an option).
+            const saved = approverPlan2.passwordFile === null ? null : resolve(approverPlan2.passwordFile);
+            const showCommand = saved === null ? null : `cat -- '${saved.replaceAll("'", "'\\''")}'`;
             const signInWords = account === null
                 ? `sign in as one of ${approverPlan2.approvers.join(", ")}`
-                : file === null ? `sign in as ${account} with your password` : `sign in as ${account}: the password is in ${file}`;
+                : showCommand === null ? `sign in as ${account} with your password` : `sign in as ${account}`;
             write("");
             write(`Toolroll is on ${url}`);
             if (link !== null) {
@@ -7507,8 +7559,11 @@ async function upCommand(flags, context) {
             }
             else {
                 write(`${signInWords.charAt(0).toUpperCase()}${signInWords.slice(1)}.`);
-                write("Ctrl-C stops it.");
             }
+            if (showCommand !== null)
+                write(`Your password: run \`${showCommand}\``);
+            if (link === null)
+                write("Ctrl-C stops it.");
         }
     }
     // A bounded run (--for) counts from readiness, so a slow start never eats the window it asked for.
@@ -11744,7 +11799,7 @@ function upNeedsOneProcess(options) {
         options.flowEveryMs !== undefined || options.platform !== undefined || options.fenceAvailable !== undefined || options.flowFetch !== undefined ||
         options.integrationIo !== undefined || options.shouldStop !== undefined || options.leadSeams !== undefined || options.waitSleep !== undefined ||
         options.releaseIo !== undefined || options.installBin !== undefined || options.tempRoots !== undefined || options.filingSizer !== undefined ||
-        options.now !== undefined;
+        options.now !== undefined || options.folderLook !== undefined;
 }
 /** The entry a role child runs: the built sibling when installed, the TypeScript source through tsx in a checkout. */
 /**
@@ -12688,3 +12743,18 @@ export function upNarrowDeferred(held, reported) {
     const kept = new Set(reported);
     return held.filter(one => kept.has(one));
 }
+/** Resolve the console's project identities after it is listening, never before: the deploy's health check and every
+ * page answer at once, and each project shows up as its folder answers (project-identity.ts `refresh`, its looks a
+ * few at a time under their deadline). Nothing waits on it; a pass that fails leaves those paths unresolved, which
+ * fails closed, for the background pass to try again. */
+export function consoleIdentitiesInBackground(identities, paths) {
+    void identities.refresh(paths).catch(() => false);
+}
+/** `config set` and `config clear` on the command line, through Settings → Models' one write path (model-choices.ts,
+ * docs/plans/spend-dashboard.md slice 3), under the same target and resulting-configuration checks as the editor: the
+ * person proved themselves with their own password or login at `proved.generation`; a machine credential (a remote
+ * token, the lead's token) never changes which models run. The write re-proves them inside its transaction: still an
+ * unrestricted instance operator, at that very generation, by a proof that still stands. */
+export function writeModelRow(store, proved, scope, knownProject, slot, to, now, extra = []) {
+    return applyModelChoices(store, { scope, change: slot === null ? [] : [{ slot, to }], expected: null, strict: false, knownProject, extra }, { ...proved, live: () => true }, now);
+}

package/dist/project-admission.d.ts

@@ -21,7 +21,7 @@ export type AdmissionActor = {
 };
 export type AdmissionFailure = {
     ok: false;
-    reason: "unavailable" | "not-git" | "locked" | "registry" | "abandoned" | "failed";
+    reason: "unavailable" | "not-git" | "locked" | "registry" | "abandoned" | "failed" | "moved";
     message: string;
 };
 /** `remote`: the origin URL this add recorded as the project's trusted remote (null: none), and why one wasn't. */
@@ -60,6 +60,9 @@ export declare function admitProject(store: Store, input: {
     captureOrigin?: boolean;
     /** Explicit value from the owner/instance-operator CLI boundary. */
     remoteUrl?: string;
+    /** The caller's authority, asked again about the proved repo inside the locked registry update and inside the
+     * database transaction (the console: nothing it proved before an await moved, and the repo is still visible). */
+    stillAllowed?: (repo: string) => boolean;
 }): Promise<Admitted | AdmissionFailure>;
 /**
  * Remove one project from the lists and the builder. Its tasks, results and

package/dist/project-admission.js

@@ -61,13 +61,29 @@ export async function admitProject(store, input) {
         ? await originOf(repo, input.exec ?? run) : null;
     let remote = { url: store.projectRemote(repo), why: null };
     let registryHad = true;
+    const allowed = () => input.stillAllowed === undefined || input.stillAllowed(repo);
+    const moved = { ok: false, reason: "moved", message: `${projectName(repo)} wasn't added: a project folder changed while it was being checked. Try again.` };
     if (input.registryFile !== null) {
-        const enrolled = await updateRepos(input.registryFile, repos => addRepos(repos, [repo]));
+        let refused = false;
+        let had = false;
+        const enrolled = await updateRepos(input.registryFile, repos => {
+            had = repos.includes(repo);
+            if (!allowed()) {
+                refused = true;
+                return repos;
+            }
+            return addRepos(repos, [repo]);
+        });
         if (!enrolled.ok)
             return { ok: false, reason: enrolled.reason, message: `${projectName(repo)} wasn't added: ${enrolled.message}` };
-        registryHad = before !== null && !("error" in before) && before.repos.includes(repo);
+        if (refused)
+            return moved;
+        registryHad = had;
     }
     const added = store.transact(() => {
+        // Re-asked with the write; a refusal writes nothing here and takes back the registry line this call added below.
+        if (!allowed())
+            return null;
         const rowHad = store.listProjects().some(one => one.path === repo);
         const previous = store.projectRemote(repo);
         const first = !known && !store.projectAdmissionKnown(repo);
@@ -81,6 +97,11 @@ export async function admitProject(store, input) {
         store.recordAction({ at: input.now.toISOString(), actor: input.actor.label, repo, taskId: null, runId: null, action: PROJECT_ADDED, outcome: "added", source: "access", detail: `from ${input.actor.origin}` });
         return true;
     });
+    if (added === null) {
+        if (input.registryFile !== null && !registryHad)
+            await updateRepos(input.registryFile, repos => removeRepos(repos, [repo]));
+        return moved;
+    }
     return { ok: true, repo, name: projectName(repo), added, remote };
 }
 /**