An outside agent gets a short-lived contribute token with no account #12033

An outside agent can now get a 24 h contribute token with no account. The earlier tries went red on a stale base and one comment line over 100 columns. I merged current main into the branch and rewrapped that line, so the gate, tsc --noEmit and design-lint are now clean.

I ran test/mcp-size.test.ts, test/contribute-token.test.ts, test/fuzz-mcp.test.ts and test/signup-gate-parent.test.ts; all 24 tests passed. That run was before the rewrap. The comment-only edit afterwards was checked by the gate and tsc only. I did not run the full suite; the forge's check does that on the push.

What changed

• POST /api/v1/contribute and the start MCP tool's contribute action (an action, no new tool) mint a token for a named agent and a target repo that allows outside contributions. The token is scoped to:

- reading public repos; - pushing contrib/<agent>/* on that repo; - opening and updating its own pulls; - reading the checks on those pulls.

• Tokens expire after 24 h and can be renewed once per call. Minting is rate-limited per address.
• The agent's name and claimed origin are stored and shown as claimed, not verified.
• The repo's settings page (src/web/pages/proposal-tokens.ts) lists live contribute tokens and revokes each after a confirm.
• The scope check is plain data in, plain data out in src/core/contribute_token.ts.
• test/contribute-token.test.ts covers minting, renewal, revocation, expiry, and refusal for a repo that does not allow outside contributions.
• The fuzz test's oversized string is now 8 kB so that all fields together stay under the 64 KiB anonymous body cap.

Left out

• Origin is never verified, only displayed as claimed.
• No new MCP tool was added, and I did not raise any ceiling.

Try it: POST /api/v1/contribute with an agent name and a repo that allows outside contributions, then git push to contrib/<agent>/x with the returned token.

Closes #12012

An outside agent can now get a 24 h contribute token with no account. The earlier tries went red on a stale base and one comment line over 100 columns. I merged current main into the branch and rewrapped that line, so the gate, tsc --noEmit and design-lint are now clean.

I ran test/mcp-size.test.ts, test/contribute-token.test.ts, test/fuzz-mcp.test.ts and test/signup-gate-parent.test.ts; all 24 tests passed. That run was before the rewrap. The comment-only edit afterwards was checked by the gate and tsc only. I did not run the full suite; the forge's check does that on the push.

What changed

• POST /api/v1/contribute and the start MCP tool's contribute action (an action, no new tool) mint a token for a named agent and a target repo that allows outside contributions. The token is scoped to:

- reading public repos; - pushing contrib/<agent>/* on that repo; - opening and updating its own pulls; - reading the checks on those pulls.

• Tokens expire after 24 h and can be renewed once per call. Minting is rate-limited per address.
• The agent's name and claimed origin are stored and shown as claimed, not verified.
• The repo's settings page (src/web/pages/proposal-tokens.ts) lists live contribute tokens and revokes each after a confirm.
• The scope check is plain data in, plain data out in src/core/contribute_token.ts.
• test/contribute-token.test.ts covers minting, renewal, revocation, expiry, and refusal for a repo that does not allow outside contributions.
• The fuzz test's oversized string is now 8 kB so that all fields together stay under the 64 KiB anonymous body cap.

Left out

• Origin is never verified, only displayed as claimed.
• No new MCP tool was added, and I did not raise any ceiling.

Try it: POST /api/v1/contribute with an agent name and a repo that allows outside contributions, then git push to contrib/<agent>/x with the returned token.

The attention-budget failure was mine and is fixed; the other three red tests are not, as far as I can show. The check named test/pages-budget.test.ts as red on main too, so I did not touch it.

The "Outside agents" section I added to settings put the crew page at 87 blocks against a budget of 85. I cut it to a single block: one explainer line with the Allow / Stop allowing button inline, and the token list below it only when tokens exist. The crew page now measures 85/85 and the budget is unchanged.

The other two failures did not reproduce here:

• test/llms-anonymous.test.ts: it passes locally, so I changed nothing for it.
• Blob page switch test: the check's log did not name its file as red on this pull or on main. I ran the file that holds it and it passes.

Locally bun scripts/gate.ts, bun scripts/design-lint.ts and bun x tsc --noEmit are clean. These pass: test/attention.test.ts, test/contribute-token.test.ts, test/llms-anonymous.test.ts, test/mcp-size.test.ts and the blob switch test's file. I merged the latest main into the branch and pushed.

The pull description from my earlier message still stands; the settings control is now a single line and button instead of a headed section.

I pushed a fix for the llms-anonymous failure, but I'm guessing at its cause. That test passed locally even before my change, and the check log didn't show why it failed. My best explanation is that the contribute hint I added to start's line in /llms.txt (24 bytes) pushed the text over its 7 KiB cap in the check's environment.

I removed that hint, so the line reads exactly as on main. The tool's own description still mentions action: contribute, so agents that list tools see it. Locally the text is 7066 bytes against the 7168 cap. I can't confirm it clears the cap under the check's conditions.

I merged the latest main first. tsc, the gate, test/llms-anonymous.test.ts, test/mcp-size.test.ts, test/contribute-token.test.ts and test/stall-in-flight.test.ts all pass locally (36 tests in total).

Three of the four failing tests I could not tie to this pull:

• pages-budget: it is red on main too, per the check's own comparison.
• "a real request held open across a stall…": it passes here. It failed in the check once and wasn't in the failure list from the previous run, so I'm treating it as flaky.
• Blob page switch: it was in both failure lists. The check didn't compare it against main, and it passes here, so I left it alone.

If the check fails again on those, they need a person's look rather than another change from me.

All three requested changes and both smaller ones are in, and I pushed. tsc, scripts/gate.ts and design-lint are clean. I ran 23 related test files rather than the full suite, and the forge runs that. They had 0 failures and 2 skips. The 2 skips are crew-settings-fit, which needs a chromium this sandbox doesn't have.

What changed

• Terminal door. The new screen is src/tui/screens/outsideagents.ts, reached from a per-repo palette command that only a repository's admins see, as on the page.

- a allows or stops allowing outside agents. x revokes the token under the cursor after a confirm. - Revoke had no event before. It is now revokeOutsideToken in actions/contribute_token.ts and emits contribute.revoked. The page and the terminal both use it, along with setOutsideContributions. - The settings page had no live client, so it now mounts it and swaps #contribute-tokens on any contribute.* event. A write from the terminal reaches an open page, and the reverse. - test/tui-outside-agents.test.ts covers the gate, a toggle, mint, a cancelled revoke and a confirmed one. It checks the bus events and the web page's text after each write. AGENTS.md and docs/features/contribute-token.md are updated.

• Pull spam. Each token may have 5 pulls open and open 20 a day. The repository takes 30 a day from all of its outside tokens together. All of it is counted from the issue rows (pullCapReached).

- Over a cap, the API answers 429 with Retry-After. - One pull per token is in flight at a time, so concurrent calls can't slip past the count. - The tests fail without the cap: the 6th pull gets 429, closing one frees a slot, and a repo-wide cap fires on seeded rows.

• Namespace. Branches are now contrib/<agent>/<segment>/…. The segment is derived from the token's own id, so there is no schema change. The mint answer, the hook and the pull-head check all use it.

- The test mints two tokens named twin. The second can't force-push over, delete or push into the first's branches, and can't use the bare contrib/twin/….

• Orphan account. I kept the check-then-create flow and delete the account when the in-transaction re-check refuses. Creating the user inside the transaction isn't possible, because createUser is async. The test races two mints at the cap and expects one account.
• MCP budget. I put the original description back and kept only action in the schema. I also dropped the required: [] line (it was ["name"] before). repo and origin are no longer in the schema. A call without them gets invalid_repo plus the hint text. The start entry is 387 bytes, up 29 from 358.

Left alone

• The repo-wide count joins through contribute_token. If an owner revokes a token, its pulls drop out of the repo's daily count. Only an owner can do that, and the per-token and mint caps still apply.
• I did not add refusal of non-fast-forward updates. The per-token segment already stops cross-token overwrites, and a token may still rewrite its own branches.

The gate failure was two comment lines over 100 columns, one in src/tui/screens/outsideagents.ts and one in src/core/contribute_token.ts. I rewrapped both and pushed.

bun scripts/gate.ts now exits clean (it only sees committed changes, so it passed only after I committed). tsc is clean. test/contribute-token.test.ts and test/tui-outside-agents.test.ts pass, 13 tests. I did not rerun the wider set of related tests from the earlier push; the change is comments only.

Nothing else in the pull changed: the terminal screen, the pull caps, the per-token push namespace, the orphan-account fix and the trimmed start entry are as described in the earlier description.

The size-ceiling failure is fixed and pushed. The other three are not confirmed fixed. The size test passes locally; the forge's full check will tell on this push.

What changed

• Cause: the live-refresh code for the outside-agents block sat in src/web/live.ts, which the repository page loads. That pushed its gzip JS to 34077 B against a 33905 B ceiling.
• Fix: I removed that code from live.ts, so the file is identical to main again. It now lives in a new src/web/pages/outside-agents-live.ts, which only the settings page loads. It opens its own stream, does nothing unless #contribute-tokens exists, and re-fetches the block on contribute.open, contribute.token and contribute.revoked. The wiring is in src/web/pages/settings.ts.
• Not touched: I did not raise the ceiling in docs/design/size-budget.json.

The other three failures

• every GET page is within its counted work (test/pages-budget.test.ts) is red on main at 7650df1 too, so the forge did not count it against this pull.
• tui system telemetry grant > the System command passes the session… and the terminal's shift > a writer's shift… were not named by the forge's main comparison. Run on their own, test/tui-system.test.ts and test/render-subtitles-shift.test.ts pass (the shift test is in that second file). I could not reproduce either failure, so I suspect they are order- or load-dependent.

Checks run before the push

• bun x tsc --noEmit is clean.
• bun scripts/gate.ts gave no output.
• bun scripts/design-lint.ts is clean.
• test/client-size.test.ts, test/contribute-token.test.ts, test/tui-system.test.ts and test/render-subtitles-shift.test.ts pass. Together with test/tui-system.test.ts and test/render-subtitles-shift.test.ts, that is 55 tests in the last run.

The commit is 3ddfef172.