3e6932d · f565a87 · 1ec9010 · 82f004f · 70f3fc1 · 9ccf0a5
@@ -747,7 +747,7 @@
the work repositories and nothing else. Two on one grant take turns, and
one the provider rests hands its runs to the other until the reset.
**Model budget.** A new account has none: its repositories' crew does not run, spends nothing, and says "This repository has no model account". A person adds their own subscription at Settings → Model (or the terminal's **Model budget** command, `a`); it is sealed, granted to their own repositories only, and one per account. A forge admin who is a person gives an account a capped grant, in dollars a month spent on the forge's own credential, from the account's page, the terminal's **Model grant** command, `POST /api/v1/admin/accounts/:name/model-grant` (`{"usdPerMonth": 20}`, `null` takes it back) or the MCP `model_grant` tool; each change is in the audit. The cap is the UTC month's spend in the usage ledger, checked when a run starts and on every spend tick: a run past it stops, and its page says the grant is spent. Two runs that start together each begin with the whole remainder; the tick check ends both once the sum crosses the cap, so the overshoot is at most what they spend between ticks.
**Roles.** An account is a guest, a member or an admin (`docs/ROLES.md` has the table of what each can do; `src/core/roles.ts` holds it). Admin is the admin flag, a member is promoted, everyone else is a guest. A guest is refused creating or forking a repository, making an app their own and starting a crew run, in the words "the owner has not made this account a member" (after the older refusals: unverified, suspended, agent, private); `guard_guests` in Capacity switches it off. A forge admin who is a person lists everyone with their role at Settings → People (`/settings/people`) and promotes a guest to member with one button, with an optional starter model allowance in dollars a month (none by default, given as a model grant and audited as one), or demotes a member (the allowance stays until taken back on the account's page). In the terminal it is the **People** command (`r` changes a role: `member 5`, or `guest`); over the API, `GET /api/v1/admin/people` and `POST /api/v1/admin/accounts/:name/role` (`{"role": "member", "usdPerMonth": 5}`); over MCP, the `account_role` tool (a plan unless `dryRun: false`, with an admin token). Anyone signed in sees their own role and its row of the table: the account page (`/settings`) shows "What you can do here"; over MCP, `whoami_can` returns `{username, role, can, abilities}` with any token; in the terminal it is the **What I can do** command (read only, agents included).
**Roles.** An account is a guest, a member or an admin (`docs/ROLES.md` has the table of what each can do; `src/core/roles.ts` holds it). Admin is the admin flag, a member is promoted, everyone else is a guest. A guest is refused creating or forking a repository, making an app their own and starting a crew run, in the words "the owner has not made this account a member" (after the older refusals: unverified, suspended, agent, private); nothing switches it off. A forge admin who is a person lists everyone with their role at Settings → People (`/settings/people`) and promotes a guest to member with one button, with an optional starter model allowance in dollars a month (none by default, given as a model grant and audited as one), or demotes a member (the allowance stays until taken back on the account's page). In the terminal it is the **People** command (`r` changes a role: `member 5`, or `guest`); over the API, `GET /api/v1/admin/people` and `POST /api/v1/admin/accounts/:name/role` (`{"role": "member", "usdPerMonth": 5}`); over MCP, the `account_role` tool (a plan unless `dryRun: false`, with an admin token). Anyone signed in sees their own role and its row of the table: the account page (`/settings`) shows "What you can do here"; over MCP, `whoami_can` returns `{username, role, can, abilities}` with any token; in the terminal it is the **What I can do** command (read only, agents included).
**Invites.** A forge admin who is a person mints a single-use invite link with `POST /api/v1/admin/invites` (`{"days": 14}`, 1 to 30, 7 by default); the response carries the link once and only its hash is kept. `GET /api/v1/admin/invites` lists them (open, used, revoked, expired) without tokens, and `DELETE /api/v1/admin/invites/:id` revokes one. Minting and revoking are events (`invite.minted`, `invite.revoked`). Signup does not read invites yet.
@@ -15,9 +15,13 @@
verify, a suspended one is refused, an agent and a stranger to a private
repository meet their own reasons first. A comment from a guest is still a
comment; it just starts no run. Agents and organizations are not guests.
The Capacity setting `guard_guests` (`FORGE_GUARD_GUESTS`, default `on`) is the
switch: `off` leaves the usual permissions. The test suite boots with it `off`
and `test/guests.test.ts` turns it on.
Nothing switches the refusal off: the test suite runs with it everywhere, and
a suite whose people make things promotes them first (`promote` in
`test/helpers/members.ts`). The crew's wake-up sweep, which starts a run on an
agent-assigned issue that never had one, skips an issue whose last assigner is
a guest, so an assignment made before the guard starts nothing either. A
spawned forge's founder is made a member, so its first boot can hand the
direction to the planner.
On `/settings/people` an admin promotes a guest to member, with a starter
model allowance (dollars a month, default none, through the grant of #1145),
@@ -25,6 +25,7 @@
import {
  updateAgent,
} from "../core/agents.ts";
import { createOrg, getOrg } from "../core/orgs.ts";
import { setMember } from "../core/roles.ts";
import {
  canRead,
  createRepo,
@@ -308,6 +309,9 @@
async function copyInto(
        return made.ok ? made.value : undefined;
      })());
    if (!founder) return err("could not make the child's founder");
    // A member, not a guest: the child's first boot acts as the founder to
    // open the direction and hand it to the planner, which starts a run.
    setMember(child.db, founder.id, true, founder.id, new Date());
    let org = getOrg(child.db, plan.org);
    if (!org) {
@@ -21,8 +21,7 @@
export type CapacityKey =
  | "checks.shards"
  | "children.max"
  | "cells.egress"
  | "guard_new_accounts"
  | "guard_guests";
  | "guard_new_accounts";
interface Definition {
  /** What the settings page and the API call it. */
@@ -81,13 +80,6 @@
export const CAPACITY: Record<CapacityKey, Definition> = {
    fallback: "off",
    help: "on refuses repository creation and forks for accounts younger than 7 days (agents and admins are exempt); off leaves it to the usual permissions. Takes effect immediately. Replaces the hand-installed database trigger that used to do this with no toggle.",
  },
  "guard_guests": {
    label: "Guest guard",
    env: "FORGE_GUARD_GUESTS",
    kind: { type: "choice", values: ["on", "off"] },
    fallback: "on",
    help: "on refuses a guest — an account the owner has not made a member — creating a repository, making an app their own, or starting a crew run; off leaves it to the usual permissions. Takes effect immediately.",
  },
};
export const CAPACITY_KEYS = Object.keys(CAPACITY) as CapacityKey[];
@@ -8,7 +8,6 @@
 */
import type { Database } from "bun:sqlite";
import { capacityValue } from "./capacity.ts";
export const ROLES = ["guest", "member", "admin"] as const;
export type Role = (typeof ROLES)[number];
@@ -52,18 +51,28 @@
export const NOT_A_MEMBER = "the owner has not made this account a member";
/**
 * Whether the table withholds `ability` from this account. Only a person
 * can be a guest: agents and organizations are not accounts the owner
 * promotes, and other rules govern them. The `guard_guests` setting can
 * turn the refusal off (the test suite boots with it off).
 * promotes, and other rules govern them. Nothing switches it off.
 */
export function lacks(
  db: Database,
  user: { id: string; isAdmin: boolean; kind: string },
  ability: Ability,
): boolean {
  if (user.kind !== "user" || capacityValue(db, "guard_guests") === "off") return false;
  if (user.kind !== "user") return false;
  return !can(roleOf(db, user), ability);
}
/**
 * `lacks(…, "run_crew")` as SQL, for a query that must not spend a row on
 * a guest: true when `userId` (a column or subquery, never input) names a
 * person who is neither an admin nor a member. Kept beside `roleOf` so the
 * two say the same thing.
 */
      
        sentinelcrew
        28d ago
        
      
      Not blocking: today this is safe, because the only caller passes a constant subquery. But it is an exported function that splices a string into SQL, and that is a sharp edge for the next caller. Consider not exporting a builder: either keep the fragment as a module-private constant next to sweepAssigned, or take a fixed column name and check it against an allow-list. The doc comment saying "never input" is the only thing guarding it right now.
    
export const guestSql = (userId: string): string =>
  `EXISTS (SELECT 1 FROM user g WHERE g.id = ${userId}
     AND g.kind = 'user' AND g.is_agent = 0 AND g.is_admin = 0
     AND NOT EXISTS (SELECT 1 FROM member m WHERE m.user_id = g.id))`;
export function roleOf(db: Database, user: { id: string; isAdmin: boolean }): Role {
  if (user.isAdmin) return "admin";
  const row = db.query<{ n: number }, [string]>("SELECT 1 AS n FROM member WHERE user_id = ?1").get(user.id);
@@ -53,7 +53,7 @@
import {
  type Run,
} from "../core/runs.ts";
import { getUserById, type User } from "../core/users.ts";
import { lacks } from "../core/roles.ts";
import { guestSql, lacks } from "../core/roles.ts";
import { createLog } from "../kernel/log.ts";
import { issueOfBranch, type RunReason } from "./brief.ts";
import { detectClaude } from "./claude.ts";
@@ -216,7 +216,7 @@
export async function startCrew(
    pump(app, ready, inFlight);
  }, TICK_MS);
  requeueInterrupted(app);
  sweep(app);
  sweepAssigned(app);
  pump(app, ready, inFlight);
  const handle: CrewHandle = {
@@ -1074,9 +1074,18 @@
export function taskOf(
/**
 * The sweep behind the wake-up: an open issue assigned to an agent that
 * has never had a run (assigned while the crew was off) gets one now.
 * has never had a run (assigned while the crew was off) gets one now —
 * unless the person who last assigned it is a guest. The assignment is
 * theirs to pay for, and an issue a guest assigned before the guard existed
 * would otherwise start the run the guard refuses them. An assignment with
 * no event (made by the crew itself) is the crew's, as before.
 */
function sweep(app: App): void {
export function sweepAssigned(app: App): void {
  // Who last assigned it: the newest `issue.assigned` or `pull.assigned`.
  const assigner = `(SELECT e.actor_id FROM event e
                WHERE e.repo_id = issue.repo_id AND e.kind = issue.kind || '.assigned'
                  AND json_extract(e.payload, '$.number') = issue.number
                ORDER BY e.id DESC LIMIT 1)`;
  const rows = app.db
    .query<{ id: string; repo_id: string }, []>(
      `SELECT issue.id, issue.repo_id FROM issue
@@ -1086,6 +1095,9 @@
function sweep(app: App): void {
         -- work landing, not a task waiting for a run.
         AND NOT (issue.kind = 'pull' AND issue.author_id = issue.assignee_id)
         AND NOT EXISTS (SELECT 1 FROM run WHERE run.issue_id = issue.id AND run.kind = 'agent')
         -- In the query, not after it: a guest's issues never take one of
         -- the hundred places, however many of them wait.
         AND NOT ${guestSql(assigner)}
       ORDER BY issue.id LIMIT 100`,
    )
    .all();
      
        sentinelcrew
        28d ago
        outdated
      
      Medium: this skip happens after LIMIT 100, so skipped issues keep their slots in every sweep. 100 old guest-assigned or demoted-member issues would starve every other wake-up for good. Filter in the SQL instead, and test it with more than 100 skipped rows.
    
@@ -2346,7 +2346,7 @@
const TOOLS: readonly Tool[] = [
      properties: {
        key: {
          type: "string",
          enum: ["crew.concurrency", "checks.concurrency", "checks.shards", "cells.egress", "guard_new_accounts", "guard_guests"],
          enum: ["crew.concurrency", "checks.concurrency", "checks.shards", "cells.egress", "guard_new_accounts"],
        },
        value: { type: "string", maxLength: 16 },
        dryRun: { type: "boolean", description: "Plan only (the default). Send false to change it." },
@@ -29,6 +29,7 @@
import {
  stopStandInCrew,
  type StandInCrew,
} from "./helpers/crew-standin.ts";
import { promote } from "./helpers/members.ts";
describe("per-account spend ceilings", () => {
  let standIn: StandInCrew;
@@ -52,6 +53,7 @@
describe("per-account spend ceilings", () => {
    });
    if (!made.ok) throw new Error(made.error);
    const user = made.value;
    promote(app.db, user);
    const r = await createRepo(app, user, { name: "yard", visibility: "private" });
    if (!r.ok) throw new Error(String(r.error));
    const seeded = await commitToBranch(app, user, r.value, {
@@ -13,6 +13,7 @@
import { listReposOwnedBy } from "../src/core/repos.ts";
import { repoDir } from "../src/git/repos.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { proveAll } from "./helpers/verified.ts";
import { promote } from "./helpers/members.ts";
describe("accounts: the confirm page for removing an organization too", () => {
  let dataDir: string;
@@ -181,6 +182,7 @@
describe("accounts: the confirm page for removing an organization too", () => {
  test("a person's own repository is named, and the lead no longer says only the account", async () => {
    await mkUser("rh");
    proveAll(app);
    promote(app.db, getUserByName(app.db, "rh")!);
    const made = await createRepo(app, getUserByName(app.db, "rh")!, { name: "notes" });
    if (!made.ok) throw new Error(made.error);
    const res = await fetch(`${base}/settings/accounts/rh/retire`, { headers: admin });
@@ -27,6 +27,7 @@
import { createUser as insertAgent, getUserByName } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { forgeSshSession, identityFor } from "../src/tui/ssh.ts";
import { proveAll } from "./helpers/verified.ts";
import { promote } from "./helpers/members.ts";
const EDGE = "edge-secret-for-accounts";
const KEY_LINE =
@@ -103,6 +104,8 @@
describe("accounts: the owner sees, suspends and removes", () => {
    // This suite is about standing, not email: its outsiders are proven.
    proveAll(app);
    const user = getUserByName(app.db, name)!;
    // Nor about roles: its outsiders are members (`test/guests.test.ts`).
    promote(app.db, user);
      
        sentinelcrew
        28d ago
        
      
      Low: the formatting is mangled here (return { user, followed by  token: ...). Restore the one-line return.
    
    return { user, token: createToken(app.db, user.id, "o", "admin").token };
  };
@@ -622,6 +625,7 @@
describe("accounts: the owner sees, suspends and removes", () => {
      password: "outsider-passphrase",
    });
    if (!made.ok) throw new Error(made.error);
    promote(app.db, made.value);
    const token = createToken(app.db, made.value.id, "t", "admin").token;
    const create = () =>
      api("/api/v1/repos", { method: "POST", token, body: JSON.stringify({ name: "first" }) });
@@ -33,6 +33,7 @@
import { getOrg, listTeams, OWNERS_TEAM } from "../src/core/orgs.ts";
import { getPull } from "../src/core/pulls.ts";
import { getRepo, type Repo } from "../src/core/repos.ts";
import type { User } from "../src/core/users.ts";
import { promote } from "./helpers/members.ts";
/** Event kinds in chronological order (listEvents returns newest first). */
const kinds = (app: App, repoId?: string) =>
@@ -64,6 +65,7 @@
describe("actions own authorization and events", () => {
    if (!a.ok || !b.ok) throw new Error("signup failed");
    alice = a.value;
    bob = b.value;
    promote(app.db, alice, bob);
      
        sentinelcrew
        28d ago
        
      
      Low: const s = await is split from createRepo(...) on the next line. The insertion broke the formatting; put the original line back.
    
    const s = await createRepo(app, alice, { name: "secret" });
    const o = await createRepo(app, alice, {
      name: "open",
@@ -32,6 +32,7 @@
import {
import { READER } from "../src/crew/direct.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { quietLogs } from "./helpers/globals.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
@@ -90,6 +91,7 @@
beforeAll(async () => {
      password: "a-good-passphrase",
    }),
  );
  promote(app.db, mallory);
  bot = ok(await createAgent(app, alice, { username: "bot" }));
  repo = ok(
    await createRepo(app, alice, { name: "square", visibility: "public" }),
@@ -28,6 +28,7 @@
import { local } from "../src/tui/screens/where.ts";
import { headlessTerminal } from "../src/tui/term/terminal.ts";
import { forgeHttp, type ForgeHttp } from "../src/http/server.ts";
import { quietLogs } from "./helpers/globals.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
@@ -99,6 +100,7 @@
describe("a local writer approval lets an origin fork's pull run", () => {
      people.push(made.value);
    }
    [alice, carol] = people as [User, User];
    promote(app.db, carol);
    const made = await createRepo(app, alice, {
      name: "lib",
      visibility: "public",
@@ -15,6 +15,7 @@
import { createUser, getUserByName, type User } from "../src/core/users.ts";
import { BREAKER_NOTE } from "../src/crew/breaker.ts";
import { askLinesFor } from "../src/web/studio/asks.ts";
import { quietLogs } from "./helpers/globals.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
@@ -35,6 +36,7 @@
describe("autonomous repositories ask no one about the crew's own stalls", () =>
    });
    if (!made.ok) throw new Error("no alice");
    alice = getUserByName(app.db, "alice")!;
    promote(app.db, alice);
    const r = await createRepo(app, alice, { name: "shelf", visibility: "public" });
    if (!r.ok) throw new Error(String(r.error));
    repo = r.value;
@@ -27,6 +27,7 @@
import { answerSetting, UNCLOSABLE_WORDS } from "../src/actions/setting_ask.ts";
import { hunt } from "../src/crew/sentinel.ts";
import { ASK_WORDS, decisionsFor } from "../src/web/studio/asks.ts";
import { quietLogs } from "./helpers/globals.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
@@ -401,6 +402,7 @@
describe("the asks page", () => {
      const carol = await signUp("carol");
      const carolUser = getUserByName(app.db, "carol")!;
      markVerified(app.db, carolUser.id, new Date().toISOString());
      promote(app.db, carolUser);
      const plot = await createRepo(app, carolUser, { name: "plot", visibility: "public" });
      if (!plot.ok) throw new Error(String(plot.error));
      away("cells.egress", "report");
@@ -47,6 +47,7 @@
import { createUser, type User } from "../src/core/users.ts";
import type { Repo } from "../src/core/repos.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { readRunLog } from "../src/runs/log.ts";
import { promote } from "./helpers/members.ts";
const checkJson = (run: string, extra = ""): string =>
  `{"check": {"run": ${JSON.stringify(run)}, "install": ""${extra}}}\n`;
@@ -351,6 +352,7 @@
describe("checks", () => {
    });
    if (!b.ok) throw new Error(b.error);
    bob = b.value;
    promote(app.db, bob);
    const made = await createRepo(app, alice, {
      name: "lib",
      visibility: "public",
@@ -29,6 +29,7 @@
import {
} from "../src/core/users.ts";
import { repoDir } from "../src/git/repos.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { promote } from "./helpers/members.ts";
describe("commitIdentity", () => {
  const person = {
@@ -148,6 +149,7 @@
describe("commits the forge makes for a person", () => {
    const opted = updateProfile(app, c.value, { commitEmail: "account" });
    if (!opted.ok) throw new Error(opted.error);
    carol = opted.value;
    promote(app.db, carol);
    repo = await madeRepo(alice, "app");
    carols = await madeRepo(carol, "notes");
    dir = dirOf(repo);
@@ -23,6 +23,7 @@
import { listRuns } from "../src/core/runs.ts";
import { createUser, type User } from "../src/core/users.ts";
import { resolveOid } from "../src/git/merge.ts";
import { repoDir } from "../src/git/repos.ts";
import { promote } from "./helpers/members.ts";
describe("a converge issue whose parent tip the fork already holds", () => {
  let dataDir: string;
@@ -59,6 +60,7 @@
describe("a converge issue whose parent tip the fork already holds", () => {
    if (!a.ok || !b.ok) throw new Error("users");
    alice = a.value;
    bob = b.value;
    promote(app.db, bob);
    const made = await createRepo(app, alice, { name: "game", visibility: "public" });
    if (!made.ok) throw new Error(String(made.error));
    parent = made.value;
@@ -14,6 +14,7 @@
import { addCrew } from "../src/core/agents.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { promote } from "./helpers/members.ts";
const BRIEF = "Q7BRIEFWORDS look after the parser";
@@ -54,6 +55,7 @@
describe("a crew agent's brief is the owner's configuration", () => {
    olive = await person("olive", true);
    rita = await person("rita");
    wren = await person("wren");
    promote(app.db, wren);
    const made = await createAgent(app, olive, {
      username: "scout",
      brief: BRIEF,
@@ -64,6 +64,7 @@
import { serve, type Servers } from "../src/http/server.ts";
import { mapJson, marksFor } from "../src/web/pages/map.ts";
import { listEvents } from "../src/core/events.ts";
import { quietLogs } from "./helpers/globals.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
@@ -154,6 +155,7 @@
beforeAll(async () => {
      password: "a-good-passphrase",
    }),
  );
  promote(app.db, mallory);
  for (const name of ["mason", "atlas", "judge"])
    ok(await createAgent(app, alice, { username: name }));
  mason = getUserByName(app.db, "mason")!;
@@ -38,6 +38,7 @@
import { convergeFork } from "../src/crew/converge.ts";
import { mayDirectCrew, readersAmong } from "../src/crew/direct.ts";
import { startCrew, type CrewHandle } from "../src/crew/dispatch.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { promote } from "./helpers/members.ts";
let dataDir: string;
let app: App;
@@ -115,6 +116,7 @@
fi
  });
  if (!m.ok) throw new Error(m.error);
  mallory = m.value;
  promote(app.db, mallory);
  const b = await createAgent(app, alice, { username: "bot", brief: "Be brief." });
  if (!b.ok) throw new Error(String(b.error));
  bot = b.value;
@@ -445,6 +447,7 @@
describe("every other door that queues a run", () => {
    });
    if (!u.ok) throw new Error(u.error);
    const uma = u.value;
    promote(app.db, uma);
    // Her own repository, with the bot on its crew: a writer in every way
    // but a verified address.
    const own = await createRepoRow(app.db, app.reposRoot, {
@@ -20,6 +20,7 @@
import {
  stopStandInCrew,
  type StandInCrew,
} from "./helpers/crew-standin.ts";
import { promote } from "./helpers/members.ts";
describe("the crew, with a stand-in Claude Code: no credential reaches the repository", () => {
  let standIn: StandInCrew;
@@ -37,6 +38,7 @@
describe("the crew, with a stand-in Claude Code: no credential reaches the repos
  test("a non-admin owner's run fails with a person-worded line, before any agent starts", async () => {
    app.db.query("UPDATE user SET is_admin = 0 WHERE id = ?1").run(alice.id);
    promote(app.db, alice);
    process.env.ANTHROPIC_API_KEY = "sk-forge-own-token";
    try {
      const issue = openIssue(app, alice, repo, {
@@ -78,6 +80,7 @@
describe("the crew, with a stand-in Claude Code: no credential reaches the repos
      });
      if (!o.ok) throw new Error(o.error);
      const otto = o.value;
      promote(app.db, otto);
      const made = await createRepo(app, otto, {
        name: "yard",
        visibility: "private",
@@ -70,6 +70,7 @@
import {
  parkReason,
  struckOut,
} from "../src/crew/parks.ts";
import { promote } from "./helpers/members.ts";
/**
 * One forge with alice's `engine` on its own: atlas plans, mason builds.
@@ -467,6 +468,7 @@
describe("an issue parked twice is the planner's", () => {
    });
    if (!b.ok) throw new Error(b.error);
    bob = b.value;
    promote(app.db, bob);
    for (const name of ["alice", "bob"]) cookies[name] = await signIn(name);
  }, 30_000);
@@ -6,6 +6,7 @@
import { createApp, type App } from "../src/app.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { gitClientEnv } from "./helpers/git-client.ts";
import { proveAll } from "./helpers/verified.ts";
import { promote } from "./helpers/members.ts";
const gitEnv = gitClientEnv({
  GIT_AUTHOR_NAME: "X",
@@ -79,6 +80,7 @@
describe("cross-repo pull requests (fork → upstream)", () => {
    ({ token: aliceToken, cookie: aliceCookie } = await mkUser("alice"));
    ({ token: bobToken, cookie: bobCookie } = await mkUser("bob"));
    proveAll(app);
    promote(app.db);
    // Alice's upstream repo with a seed commit.
    await fetch(`${base}/api/v1/repos`, {
@@ -20,6 +20,7 @@
import { createUser, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { quietLogs } from "./helpers/globals.ts";
import { proveAll } from "./helpers/verified.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
@@ -66,6 +67,7 @@
describe("explore", () => {
    });
    if (!made.ok) throw new Error(made.error);
    proveAll(app);
    promote(app.db, made.value);
    return made.value;
  };
  const appOf = async (
@@ -19,6 +19,7 @@
import { chipHides } from "../src/feed/chips.ts";
import type { FeedKind } from "../src/feed/items.ts";
import { readFeed } from "../src/feed/feed.ts";
import { feedJs } from "../src/web/studio/feed.ts";
import { promote } from "./helpers/members.ts";
const ALL: FeedKind[] = [
  "run", "ask", "pull", "decision", "map", "cost", "tell", "reply", "look", "milestone", "choose", "release",
@@ -79,6 +80,7 @@
describe("the chips of a forge", () => {
        adminIfFirst: first,
      });
      if (!r.ok) throw new Error(r.error);
      promote(app.db, r.value);
      return r.value;
    };
    await mk("root", true);
@@ -14,6 +14,7 @@
import type { Repo } from "../src/core/repos.ts";
import { createUser, type User } from "../src/core/users.ts";
import { readFeed } from "../src/feed/feed.ts";
import { chooseCandidates } from "../src/feed/choose.ts";
import { promote } from "./helpers/members.ts";
describe("the feed's choose item", () => {
  let dataDir: string;
@@ -36,6 +37,7 @@
describe("the feed's choose item", () => {
        adminIfFirst: first,
      });
      if (!r.ok) throw new Error(r.error);
      promote(app.db, r.value);
      return r.value;
    };
    await mk("root", true);
@@ -15,6 +15,7 @@
import { createUser, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { readFeed } from "../src/feed/feed.ts";
import { feedCard } from "../src/web/studio/feed.ts";
import { promote } from "./helpers/members.ts";
describe("the feed on the home page", () => {
  let dataDir: string;
@@ -43,6 +44,7 @@
describe("the feed on the home page", () => {
        adminIfFirst: first,
      });
      if (!r.ok) throw new Error(r.error);
      promote(app.db, r.value);
      return r.value;
    };
    await mk("root", true);
@@ -19,6 +19,7 @@
import { Affinity, affinityFor } from "../src/feed/affinity.ts";
import type { Candidate } from "../src/feed/items.ts";
import { readFeed } from "../src/feed/feed.ts";
import { rank } from "../src/feed/rank.ts";
import { promote } from "./helpers/members.ts";
const NOW = Date.parse("2026-10-02T12:00:00Z");
const HOUR = 3600_000;
@@ -141,6 +142,7 @@
describe("the feed of a forge", () => {
        adminIfFirst: first,
      });
      if (!r.ok) throw new Error(r.error);
      promote(app.db, r.value);
      return r.value;
    };
    // The first account is a site admin, who sees everything; neither of
@@ -293,6 +295,7 @@
describe("affinity", () => {
    });
    if (!u.ok) throw new Error(u.error);
    user = u.value;
    promote(app.db, user);
    const r = await createRepo(app, user, { name: "mine", visibility: "public" });
    if (!r.ok) throw new Error("repo");
    repo = r.value;
@@ -18,6 +18,7 @@
import {
import { createToken } from "../src/core/tokens.ts";
import { createUser, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { promote } from "./helpers/members.ts";
describe("a repository's feed", () => {
  let dataDir: string;
@@ -47,6 +48,7 @@
describe("a repository's feed", () => {
    });
    if (!b.ok) throw new Error(b.error);
    bob = b.value;
    promote(app.db, bob);
    const made = await createRepo(app, alice, {
      name: "game",
      visibility: "public",
@@ -25,6 +25,7 @@
import { createUser, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { niceCeiling, windowSvg } from "../src/web/fleet-graph.ts";
import { fleetGraphCsvText } from "../src/web/pages/fleet-graph.ts";
import { promote } from "./helpers/members.ts";
describe("the windows", () => {
  const now = new Date("2026-10-02T14:37:12.345Z");
@@ -147,6 +148,7 @@
describe("the graph", () => {
    if (!a.ok || !b.ok) throw new Error("users");
    alice = a.value;
    bob = b.value;
    promote(app.db, alice, bob);
    for (const name of ["one", "two"]) {
      const r = await createRepo(app, alice, { name, visibility: "private" });
      if (!r.ok) throw new Error("repo");
@@ -33,6 +33,7 @@
import { createToken } from "../src/core/tokens.ts";
import { createUser, type User } from "../src/core/users.ts";
import { parseQuery } from "../src/fleet/selection.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { promote } from "./helpers/members.ts";
describe("fleet operations", () => {
  let dataDir: string;
@@ -56,6 +57,7 @@
describe("fleet operations", () => {
      adminIfFirst,
    });
    if (!made.ok) throw new Error(made.error);
    promote(app.db, made.value);
    return made.value;
  };
  const repoOf = async (owner: User, name: string, visibility: "public" | "private") => {
@@ -29,6 +29,7 @@
import { stalledRows } from "../src/tui/screens/stalled.ts";
import { feedJs } from "../src/web/studio/feed.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { quietLogs } from "./helpers/globals.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
@@ -98,6 +99,7 @@
describe("stalled steps on the home", () => {
        adminIfFirst: first,
      });
      if (!r.ok) throw new Error(r.error);
      promote(app.db, r.value);
      return r.value;
    };
    await mk("keeper", true);
@@ -45,6 +45,7 @@
import { createUser, getUserByName, type User } from "../src/core/users.ts";
import { resolveOid } from "../src/git/merge.ts";
import { repoDir } from "../src/git/repos.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { promote } from "./helpers/members.ts";
describe("a fork that follows its parent", () => {
  let dataDir: string;
@@ -104,6 +105,7 @@
describe("a fork that follows its parent", () => {
    });
    if (!b.ok) throw new Error(b.error);
    bob = b.value;
    promote(app.db, bob);
    bobToken = createToken(app.db, bob.id, "t", "rw").token;
    const made = await createRepo(app, alice, {
      name: "game",
@@ -432,6 +434,7 @@
describe("a fork that follows its parent", () => {
      password: "a-good-passphrase",
    });
    if (!c.ok) throw new Error(c.error);
    promote(app.db, c.value);
    const forked = await forkRepo(app, c.value, fresh(parent), "game-carol");
    if (!forked.ok) throw new Error(String(forked.error));
    const carols = forked.value;
@@ -470,6 +473,7 @@
describe("a fork that follows its parent", () => {
      password: "a-good-passphrase",
    });
    if (!d.ok) throw new Error(d.error);
    promote(app.db, d.value);
    const forked = await forkRepo(app, d.value, fresh(parent), "game-dan");
    if (!forked.ok) throw new Error(String(forked.error));
    const dans = forked.value;
@@ -699,6 +703,7 @@
describe("a fork that follows its parent", () => {
      password: "a-good-passphrase",
    });
    if (!f.ok) throw new Error(f.error);
    promote(app.db, f.value);
    const grand = await forkRepo(app, f.value, fresh(fork), "game-fay");
    if (!grand.ok) throw new Error(String(grand.error));
@@ -921,6 +926,7 @@
describe("a landed pull moves the forks, like the push it amounts to", () => {
      people.push(made.value);
    }
    [alice, bob, carol] = people as [User, User, User];
    promote(app.db, bob, carol);
    const made = await createRepo(app, alice, {
      name: "engine",
      visibility: "public",
@@ -21,6 +21,7 @@
import { lineageOf } from "../src/core/following.ts";
import { canRead, type Repo } from "../src/core/repos.ts";
import { createUser, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { promote } from "./helpers/members.ts";
describe("fork counts hold only the forks the viewer may read", () => {
  let dataDir: string;
@@ -55,6 +56,7 @@
describe("fork counts hold only the forks the viewer may read", () => {
    }
    bob = users["bob"]!;
    carol = users["carol"]!;
    promote(app.db, bob, carol);
    const made = await createRepo(app, users["alice"]!, {
      name: "lib",
      visibility: "public",
@@ -15,6 +15,7 @@
import {
  type FakeState,
} from "./fake-origin.ts";
import { proveAll } from "./helpers/verified.ts";
import { promote } from "./helpers/members.ts";
/**
 * The fork flow: grab a repository you cannot push to, branch, edit, and
@@ -165,6 +166,7 @@
describe("the fork flow", () => {
    await mkAccount(originServers, UPSTREAM_OWNER);
    originToken = await mkAccount(originServers, ORIGIN_LOGIN);
    proveAll(originApp);
    promote(originApp.db);
    await seedUpstream("gears");
    await seedUpstream("widgets");
@@ -232,6 +234,7 @@
describe("the fork flow", () => {
    aliceToken = await mkAccount(servers, "alice");
    bobToken = await mkAccount(servers, "bob");
    proveAll(app);
    promote(app.db);
    forgejoOrigin = await connect(forgejo);
    githubOrigin = await connect(github, "github");
@@ -23,6 +23,7 @@
import { listRuns } from "../src/core/runs.ts";
import { createUser, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { quietLogs } from "./helpers/globals.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
@@ -127,6 +128,7 @@
describe("a reader's fork pull runs nothing until a writer approves its head", (
      people.push(made.value);
    }
    [alice, carol] = people as [User, User];
    promote(app.db, carol);
    const agent = await createAgent(app, alice, { username: "bot" });
    if (!agent.ok) throw new Error(String(agent.error));
    bot = agent.value.user;
@@ -19,6 +19,7 @@
import { commitFiles } from "../src/git/write.ts";
import { resolveOid } from "../src/git/merge.ts";
import { repoDir } from "../src/git/repos.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { promote } from "./helpers/members.ts";
/**
 * The invariants, one line each (the old file proved them through git over
@@ -91,6 +92,7 @@
describe("forks", () => {
        adminIfFirst: name === "alice",
      });
      users[name] = must(made);
      promote(app.db, users[name]!);
      cookies[name] =
        `forge_session=${createSession(app.db, users[name]!.id).token}; forge_mode=dev`;
    }
@@ -43,6 +43,7 @@
import { serve, type Servers } from "../src/http/server.ts";
import { startLooks } from "../src/looks/service.ts";
import { quietLogs } from "./helpers/globals.ts";
import { proveAll } from "./helpers/verified.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
@@ -235,6 +236,7 @@
describe("the front page", () => {
        adminIfFirst: true,
      });
      if (!made.ok) throw new Error(made.error);
      promote(app.db, made.value);
      return made.value;
    };
    admin = await user("owner");
@@ -637,6 +639,7 @@
describe("the front page", () => {
    });
    if (!sus.ok) throw new Error(sus.error);
    proveAll(app);
    promote(app.db, sus.value);
    await make(sus.value, "sus-app");
    expect((await put(adminToken, { pinned: ["suspended-maker/sus-app"], hidden: [] })).status).toBe(200);
    forgetFrontScores(app);
@@ -714,6 +717,7 @@
describe("the front page", () => {
    const forked = await make(other, "weighed-forks");
    const forkerA = await createUser(app.db, { trusted: true, username: "forker-a", email: "[email protected]", password: "a-good-passphrase" });
    if (!forkerA.ok) throw new Error(forkerA.error);
    promote(app.db, forkerA.value);
    const forkA = await createRepo(app, forkerA.value, { name: "my-weighed", visibility: "public" });
    if (!forkA.ok) throw new Error(String(forkA.error));
    app.db.query(`UPDATE repo SET fork_parent_id = ?1 WHERE id = ?2`).run(forked.repo.id, forkA.value.id);
@@ -23,6 +23,7 @@
import { createToken } from "../src/core/tokens.ts";
import { createUser, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { NEW_FOR_MS } from "../src/actions/accounts.ts";
import { promote } from "./helpers/members.ts";
describe("guard_new_accounts", () => {
  let dataDir: string;
@@ -54,6 +55,7 @@
describe("guard_new_accounts", () => {
        ...(opts.adminIfFirst === true ? { adminIfFirst: true as const } : {}),
      });
      if (!made.ok) throw new Error(made.error);
      promote(app.db, made.value);
      if (opts.backdate)
        app.db
          .query("UPDATE user SET created_at = ?1 WHERE id = ?2")
@@ -10,6 +10,12 @@
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { changeCapacity } from "../src/actions/capacity.ts";
import { proposePlan } from "../src/actions/plan.ts";
import { redirectProposal } from "../src/actions/proposals.ts";
import { setCrewRole } from "../src/core/agents.ts";
import { getProposal } from "../src/core/proposals.ts";
import { listComments } from "../src/core/issues.ts";
import { ensureDirectionIssue } from "../src/crew/autonomy.ts";
import { addToCrew, createAgent } from "../src/actions/crew.ts";
import { assignIssue, openIssue } from "../src/actions/issues.ts";
import { newApp } from "../src/actions/apps.ts";
@@ -24,7 +30,7 @@
import { cancelRun, createRun, listRuns } from "../src/core/runs.ts";
import { addComment } from "../src/actions/issues.ts";
import { requeueRepoRun } from "../src/actions/runs.ts";
import { proposeResolution } from "../src/crew/proposal.ts";
import { agentFor, queueAgentRun } from "../src/crew/dispatch.ts";
import { agentFor, queueAgentRun, sweepAssigned } from "../src/crew/dispatch.ts";
import { getIssueById } from "../src/core/issues.ts";
import { convergeFork } from "../src/crew/converge.ts";
import { convergeWords } from "../src/actions/follow.ts";
@@ -95,8 +101,6 @@
describe("a guest cannot own, copy or run", () => {
    helper = agent.value.user;
    const crewed = addToCrew(app, bob, lab, "helper");
    if (!crewed.ok) throw new Error(crewed.error);
    // The suite boots with the guard off; this one turns it on.
    expect(changeCapacity(app, alice, "guard_guests", "on").ok).toBe(true);
  }, 60_000);
  afterAll(async () => {
@@ -183,11 +187,12 @@
describe("a guest cannot own, copy or run", () => {
    expect(hidden.status).toBe(404);
  });
  test("an admin is never a guest, and the guard can be turned off", async () => {
  test("an admin is never a guest, and no setting turns the guard off", async () => {
    expect((await api("/api/v1/repos", alice, { name: "admins" })).status).toBe(201);
    expect(changeCapacity(app, alice, "guard_guests", "off").ok).toBe(true);
    expect((await api("/api/v1/repos", bob, { name: "open-door" })).status).toBe(201);
    expect(changeCapacity(app, alice, "guard_guests", "on").ok).toBe(true);
    expect(changeCapacity(app, alice, "guard_guests" as never, "off").ok).toBe(false);
    const capacity = await mcpTool(servers.url, createToken(app.db, alice.id, "admin", "admin").token, "capacity", {});
    expect(JSON.stringify(capacity)).not.toContain("guard_guests");
    expect((await api("/api/v1/repos", bob, { name: "open-door" })).status).toBe(403);
  });
  test("push-to-create: a guest's push to a new repository is refused with the words; a member's is not", async () => {
@@ -257,4 +262,60 @@
describe("a guest cannot own, copy or run", () => {
      .get(lab.id)!.n;
    expect(assigned).toBe(0);
  });
  test("redirecting a wave: a guest's own pending proposal is refused before anything is written", async () => {
    setCrewRole(app.db, lab.id, helper.id, "planner");
    const direction = ensureDirectionIssue(app, alice, lab)!;
    const proposed = proposePlan(app, alice, lab, [{ key: "a", title: "Weed", body: "", blockedBy: [] }], {
      title: "Spring",
    });
    if (!proposed.ok) throw new Error(JSON.stringify(proposed.error));
    const id = proposed.value.id;
    const comments = listComments(app.db, direction.id).length;
    expect(redirectProposal(app, bob, id, "Roses first")).toEqual({
      ok: false,
      error: { code: "forbidden", message: NOT_A_MEMBER },
    });
    expect(getProposal(app.db, id)!.state).toBe("pending");
    expect(listComments(app.db, direction.id)).toHaveLength(comments);
    expect(getIssueById(app.db, direction.id)!.assigneeId).toBe(direction.assigneeId);
    expect(listRuns(app.db, lab.id, { kind: "agent", limit: 50 }).some((r) => r.issueId === direction.id)).toBe(false);
    // Promoted, the same words go through.
    setMember(app.db, bob.id, true, alice.id, new Date());
    expect(redirectProposal(app, bob, id, "Roses first").ok).toBe(true);
    setMember(app.db, bob.id, false, alice.id, new Date());
    expect(getProposal(app.db, id)!.state).toBe("redirected");
  });
  test("the wake-up sweep starts no run on an issue a guest assigned, and a hundred of them do not hold back a member's", async () => {
    // As an assignment made before the guard (or by a member since demoted):
    // the agent set, the event kept.
    const assignedBy = (who: User, title: string) => {
      const opened = openIssue(app, alice, lab, { title, body: "" });
      if (!opened.ok) throw new Error(String(opened.error));
      app.db.query("UPDATE issue SET assignee_id = ?1 WHERE id = ?2").run(helper.id, opened.value.id);
      app.bus.append({
        kind: "issue.assigned",
        repoId: lab.id,
        actorId: who.id,
        payload: { number: opened.value.number, assignee: helper.username, agent: true },
      });
      return opened.value;
    };
    const runsOn = (id: string) => listRuns(app.db, lab.id, { kind: "agent", limit: 500 }).filter((r) => r.issueId === id);
    // More than the sweep takes at once, all older than the member's.
    const guests = Array.from({ length: 101 }, (_, n) => assignedBy(bob, `a guest's old assignment ${n}`));
    const admins = assignedBy(alice, "an admin's assignment");
    sweepAssigned(app);
    expect(guests.filter((g) => runsOn(g.id).length > 0)).toHaveLength(0);
    expect(runsOn(admins.id)).toHaveLength(1);
    // The same assignment, once its assigner is a member, is picked up.
    setMember(app.db, bob.id, true, alice.id, new Date());
    sweepAssigned(app);
    setMember(app.db, bob.id, false, alice.id, new Date());
    expect(runsOn(guests[0]!.id)).toHaveLength(1);
  });
});
@@ -31,6 +31,7 @@
import { createForgeApp } from "../src/tui/forge.ts";
import { headlessTerminal } from "../src/tui/term/terminal.ts";
import { settleApp } from "./helpers/tui.ts";
import { quietLogs } from "./helpers/globals.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
@@ -101,6 +102,7 @@
describe("let the decider answer a hand-over", () => {
    });
    cookie = `${(signin.headers.get("set-cookie") ?? "").split(";")[0]!}; forge_mode=studio`;
    alice = getUserByName(app.db, "alice")!;
    promote(app.db, alice);
    const r = await createRepo(app, alice, { name: "shelf", visibility: "public" });
    if (!r.ok) throw new Error(String(r.error));
    repo = r.value;
@@ -0,0 +1,23 @@
import type { Database } from "bun:sqlite";
import { setMember } from "../../src/core/roles.ts";
/**
 * Make accounts members. A guest cannot own a repository, make an app their
 * own or start a crew run (`test/guests.test.ts` holds that); suites about
 * something else whose people make things promote them first, as an owner
 * would. With no accounts named, every person not yet a member is promoted:
 * for suites whose people sign up over HTTP.
 */
export function promote(db: Database, ...users: readonly { readonly id: string }[]): void {
  const now = new Date();
  const ids =
    users.length > 0
      ? users.map((u) => u.id)
      : db
          .query<{ id: string }, []>(
            "SELECT id FROM user WHERE kind = 'user' AND is_agent = 0 AND id NOT IN (SELECT user_id FROM member)",
          )
          .all()
          .map((r) => r.id);
  for (const id of ids) setMember(db, id, true, id, now);
}
@@ -6,7 +6,3 @@
import { installCheapHash } from "./cheap-hash.ts";
installCheapHash();
// Most suites make plain accounts and expect them to own things; the guest
// guard (`guard_guests`, on in production) has its own suite that turns it on.
process.env["FORGE_GUARD_GUESTS"] = "off";
@@ -19,6 +19,7 @@
import { openPull } from "../src/actions/pulls.ts";
import { commitToBranch, createRepo, forkRepo } from "../src/actions/repos.ts";
import { getRepo } from "../src/core/repos.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { promote } from "./helpers/members.ts";
describe("the manifest: what you can do here, as who you are", () => {
  let dataDir: string;
@@ -50,6 +51,7 @@
describe("the manifest: what you can do here, as who you are", () => {
      if (!made.ok) throw new Error(made.error);
      users[name] = made.value;
    }
    promote(app.db, ...Object.values(users));
    const alice = users["alice"]!;
    const org = createOrg(app.db, "acme", alice.id);
    if (!org.ok) throw new Error(org.error);
@@ -21,6 +21,7 @@
import { createToken } from "../src/core/tokens.ts";
import { createUser, type User } from "../src/core/users.ts";
import { readFeed } from "../src/feed/feed.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { promote } from "./helpers/members.ts";
describe("home is the feed", () => {
  let dataDir: string;
@@ -52,6 +53,7 @@
describe("home is the feed", () => {
        adminIfFirst: first,
      });
      if (!r.ok) throw new Error(r.error);
      promote(app.db, r.value);
      return r.value;
    };
    await mk("keeper", true);
@@ -15,6 +15,7 @@
import { createSession } from "../src/core/sessions.ts";
import { createUser, type User } from "../src/core/users.ts";
import { share } from "../src/feed/share.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { promote } from "./helpers/members.ts";
let dataDir: string;
let app: App;
@@ -42,6 +43,7 @@
test("composer, timeline, a tell, a crew member's run and pull, a share, the app
      adminIfFirst: first,
    });
    if (!r.ok) throw new Error(r.error);
    promote(app.db, r.value);
    return r.value;
  };
  const root = await mk("keeper", true);
@@ -13,6 +13,7 @@
import { createSession } from "../src/core/sessions.ts";
import { createUser, type User } from "../src/core/users.ts";
import { liveClientJs } from "../src/web/live.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { promote } from "./helpers/members.ts";
async function readEvents(
  res: Response,
@@ -67,6 +68,7 @@
describe("the viewer's stream", () => {
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    promote(app.db, alice);
    const session = createSession(app.db, alice.id);
    cookie = `forge_session=${session.token}`;
  });
@@ -24,6 +24,7 @@
import { createToken } from "../src/core/tokens.ts";
import { createUser, getUserById, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { quietLogs } from "./helpers/globals.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
@@ -62,6 +63,7 @@
describe("make it yours", () => {
        adminIfFirst: first,
      });
      if (!r.ok) throw new Error(r.error);
      promote(app.db, r.value);
      return r.value;
    };
    alice = await mk("alice", true);
@@ -258,6 +260,7 @@
describe("make it yours", () => {
        password: "a-good-passphrase",
      });
      if (!r.ok) throw new Error(r.error);
      promote(app.db, r.value);
      return r.value;
    };
    // A private repository, and a public one whose app is private.
@@ -332,6 +335,7 @@
describe("make it yours", () => {
      password: "a-good-passphrase",
    });
    if (!frank.ok) throw new Error(frank.error);
    promote(app.db, frank.value);
    const plan = await makeItYours(app, frank.value, garden, { dryRun: true });
    expect(plan.ok && plan.value.visibility).toBe("private");
    const made = await makeItYours(app, frank.value, garden, { dryRun: false });
@@ -365,6 +369,7 @@
describe("make it yours", () => {
      password: "a-good-passphrase",
    });
    if (!gina.ok) throw new Error(gina.error);
    promote(app.db, gina.value);
    const token = createToken(app.db, gina.value.id, "rw", "rw").token;
    for (let n = 0; n < COPIES_PER_DAY; n++) {
      const src = await newApp(app, alice, { name: `bed-${n}`, visibility: "public" });
@@ -403,6 +408,7 @@
describe("make it yours", () => {
        password: "a-good-passphrase",
      });
      if (!r.ok) throw new Error(r.error);
      promote(app.db, r.value);
      return r.value;
    };
    const source = async (name: string) => {
@@ -32,6 +32,7 @@
import {
  wrapTitle,
  type Layout,
} from "../src/web/pages/map.ts";
import { promote } from "./helpers/members.ts";
// ---- the layout, on paper ----
@@ -197,6 +198,7 @@
describe("the map, per app and across the forge", () => {
      adminIfFirst: admin,
    });
    if (!made.ok) throw new Error(made.error);
    promote(app.db, made.value);
    return made.value;
  };
  const repoOf = async (
@@ -25,6 +25,7 @@
import { createUser, type User } from "../src/core/users.ts";
import { savePlacement } from "../src/core/placements.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { limitChanges, limitValue } from "../src/settings/limits.ts";
import { promote } from "./helpers/members.ts";
describe("the forge over MCP", () => {
  let dataDir: string;
@@ -89,6 +90,7 @@
describe("the forge over MCP", () => {
    });
    if (!b.ok) throw new Error(b.error);
    bob = b.value;
    promote(app.db, bob);
    rw = createToken(app.db, alice.id, "rw", "rw").token;
    ro = createToken(app.db, alice.id, "ro", "ro").token;
    bobRw = createToken(app.db, bob.id, "rw", "rw").token;
@@ -933,6 +935,7 @@
describe("the forge over MCP", () => {
  });
  test("whoami_can: the caller's role and its row, for a guest, a member and an admin", async () => {
    setMember(app.db, bob.id, false, alice.id, new Date());
    const guest = (await tool(bobRw, "whoami_can")).value;
    expect(guest.role).toBe("guest");
    expect(guest.can).toEqual({ read: true, comment: true, make_it_yours: false, run_crew: false, administer: false });
@@ -940,7 +943,6 @@
describe("the forge over MCP", () => {
    const member = (await tool(bobRw, "whoami_can")).value;
    expect(member.role).toBe("member");
    expect(member.can).toEqual({ read: true, comment: true, make_it_yours: true, run_crew: true, administer: false });
    setMember(app.db, bob.id, false, alice.id, new Date());
    const admin = (await tool(ro, "whoami_can")).value;
    expect(admin.role).toBe("admin");
    expect(admin.can.administer).toBe(true);
@@ -43,6 +43,7 @@
import { newFakeState, serveFakeForge, type FakeForge } from "./fake-origin.ts";
import { gitClientEnv } from "./helpers/git-client.ts";
import { prefill } from "../src/web/pages/migrate-prefill.ts";
import { quietLogs } from "./helpers/globals.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
@@ -112,6 +113,7 @@
describe("migrate", () => {
      adminIfFirst,
    });
    if (!made.ok) throw new Error(String(made.error));
    promote(app.db, made.value);
    return made.value;
  };
@@ -24,6 +24,7 @@
import {
  stopStandInCrew,
  type StandInCrew,
} from "./helpers/crew-standin.ts";
import { promote } from "./helpers/members.ts";
describe("model budget: zero, an own subscription, a capped grant", () => {
  let standIn: StandInCrew;
@@ -54,6 +55,7 @@
describe("model budget: zero, an own subscription, a capped grant", () => {
    });
    if (!made.ok) throw new Error(made.error);
    const user = made.value;
    promote(app.db, user);
    const r = await createRepo(app, user, { name: "yard", visibility: "private" });
    if (!r.ok) throw new Error(String(r.error));
    const seeded = await commitToBranch(app, user, r.value, {
@@ -18,6 +18,7 @@
import { getRepo } from "../src/core/repos.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { gitClientEnv } from "./helpers/git-client.ts";
import { proveAll } from "./helpers/verified.ts";
import { promote } from "./helpers/members.ts";
const gitEnv = gitClientEnv({
  GIT_AUTHOR_NAME: "A",
@@ -123,6 +124,7 @@
describe("parity: full control through actions and the API", () => {
      expect(res.status).toBe(201);
    }
    proveAll(app);
    promote(app.db);
    aliceRw = await mint("alice", "rw");
    aliceAdmin = await mint("alice", "admin");
    aliceRo = await mint("alice", "ro");
@@ -32,6 +32,7 @@
import { settleApp } from "./helpers/tui.ts";
import { proposalLimiter } from "../src/http/proposal_gate.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { quietLogs } from "./helpers/globals.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
@@ -165,6 +166,7 @@
describe("over HTTP", () => {
      people.push(made.value);
    }
    [alice, carol] = people as [User, User];
    promote(app.db, carol);
    const made = await createRepo(app, alice, { name: "lib", visibility: "public" });
    if (!made.ok) throw new Error(String(made.error));
    lib = made.value;
@@ -28,6 +28,7 @@
import { startCrew } from "../src/crew/dispatch.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { readRunLog } from "../src/runs/log.ts";
import { QUOTA_KEYS, getQuota, runningLimitSentence, setQuota } from "../src/settings/quotas.ts";
import { promote } from "./helpers/members.ts";
async function until<T>(read: () => T | undefined, ms = 60_000): Promise<T> {
  const deadline = Date.now() + ms;
@@ -52,6 +53,7 @@
async function twoUsers(app: App): Promise<{ alice: User; bob: User }> {
    if (!made.ok) throw new Error(made.error);
    users.push(made.value);
  }
  promote(app.db, ...users);
  return { alice: users[0]!, bob: users[1]! };
}
@@ -27,6 +27,7 @@
import { setQuota } from "../src/settings/quotas.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { gitClientEnv } from "./helpers/git-client.ts";
import { proveAll } from "./helpers/verified.ts";
import { promote } from "./helpers/members.ts";
describe("storage quota", () => {
  let dataDir: string;
@@ -50,6 +51,7 @@
describe("storage quota", () => {
    carolId = carol.value.id;
    carolToken = createToken(app.db, carolId, "t", "admin").token;
    proveAll(app);
    promote(app.db);
    expect(ada.value.isAdmin).toBe(true);
    expect(bob.value.isAdmin).toBe(false);
    adaId = ada.value.id;
@@ -240,6 +242,7 @@
describe("storage quota", () => {
    const dave = await signUp(app, { username: "dave", email: "[email protected]", password: "dave-passphrase" });
    if (!dave.ok) throw new Error("signup");
    proveAll(app);
    promote(app.db);
    const daveToken = createToken(app.db, dave.value.id, "t", "admin").token;
    const state = newFakeState("forgejo", "someone", "tok");
    state.repos.push({
@@ -282,6 +285,7 @@
describe("storage quota", () => {
    const gina = await signUp(app, { username: "gina", email: "[email protected]", password: "gina-passphrase" });
    if (!gina.ok) throw new Error("signup");
    proveAll(app);
    promote(app.db);
    const token = createToken(app.db, gina.value.id, "t", "admin").token;
    const state = newFakeState("forgejo", "someone", "tok");
    state.repos.push({
@@ -320,6 +324,7 @@
describe("storage quota", () => {
    const made = await signUp(app, { username, email: `${username}@f.dev`, password: `${username}-passphrase` });
    if (!made.ok) throw new Error("signup");
    proveAll(app);
    promote(app.db);
    setQuota(app.db, "storage", 2, adaId);
    const token = createToken(app.db, made.value.id, "t", "admin").token;
    expect((await push(username, token, "data", 1_500_000)).code).toBe(0);
@@ -363,6 +368,7 @@
describe("storage quota", () => {
    const gwen = await signUp(app, { username: "gwen", email: "[email protected]", password: "gwen-passphrase" });
    if (!gwen.ok) throw new Error("signup");
    proveAll(app);
    promote(app.db);
    const org = createOrg(app.db, "guild", gwen.value.id);
    if (!org.ok) throw new Error("org");
    setQuota(app.db, "storage", 2, adaId);
@@ -25,6 +25,7 @@
import { createForgeApp } from "../src/tui/forge.ts";
import { forkScreen, newRepoScreen } from "../src/tui/screens/newrepo.ts";
import { headlessTerminal } from "../src/tui/term/terminal.ts";
import { settleApp } from "./helpers/tui.ts";
import { promote } from "./helpers/members.ts";
const NONE = { repositories: null, apps: null, storage: null, previews: null, runs: null, checks: null };
@@ -48,6 +49,7 @@
describe("quotas", () => {
        adminIfFirst: username === "alice",
      });
      if (!made.ok) throw new Error(made.error);
      promote(app.db, made.value);
      if (username === "alice") alice = made.value;
      else bob = made.value;
    }
@@ -254,6 +256,7 @@
describe("quotas", () => {
    });
    if (!made.ok) throw new Error(made.error);
    const carol = made.value;
    promote(app.db, carol);
    const source = await newApp(app, alice, { name: "seed", visibility: "public" });
    if (!source.ok) throw new Error(String(source.error));
    await api(admin, "PATCH", { quotas: { apps: 1 } });
@@ -352,6 +355,7 @@
describe("the repositories limit", () => {
      if (!made.ok) throw new Error(made.error);
      users.push(made.value);
    }
    promote(app.db, ...users);
    freshUser = users[1]!;
    boss = users[0]!;
    admin = createToken(app.db, users[0]!.id, "t", "admin").token;
@@ -454,6 +458,7 @@
describe("the repositories limit", () => {
    });
    if (!made.ok) throw new Error(made.error);
    const exact = made.value;
    promote(app.db, exact);
    expect((await setLimit(2)).status).toBe(200);
    for (const name of ["x1", "x2"]) expect((await createRepo(app, exact, { name })).ok).toBe(true);
@@ -503,6 +508,7 @@
describe("the repositories limit", () => {
    });
    if (!made.ok) throw new Error(made.error);
    const doors = made.value;
    promote(app.db, doors);
    const source = await newApp(app, boss, { name: "doorsrc", visibility: "public" });
    if (!source.ok) throw new Error(String(source.error));
    expect((await setLimit(2)).status).toBe(200);
@@ -53,6 +53,7 @@
import {
} from "../src/git/read.ts";
import { quietLogs } from "./helpers/globals.ts";
import type { User } from "../src/core/users.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
@@ -91,6 +92,7 @@
describe("the index carries the hot queries", () => {
    if (!a.ok || !b.ok) throw new Error("seed users");
    alice = a.value;
    bob = b.value;
    promote(app.db, bob);
    const made = await createRepo(app, alice, {
      name: "public-one",
@@ -422,6 +424,7 @@
describe("visibility is enforced in SQL, not after the fact", () => {
    if (!a.ok || !b.ok) throw new Error("seed");
    alice = a.value;
    bob = b.value;
    promote(app.db, bob);
    const one = await createRepo(app, bob, {
      name: "open-book",
      visibility: "public",
@@ -23,6 +23,7 @@
import { readFeed } from "../src/feed/feed.ts";
import { share } from "../src/feed/share.ts";
import { parseTargets } from "../src/http/feed.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { promote } from "./helpers/members.ts";
const HOUR = 3600_000;
const DAILY_BUDGET = LIMITS["share.daily_max"].default;
@@ -61,6 +62,7 @@
describe("share", () => {
        adminIfFirst: first,
      });
      if (!r.ok) throw new Error(r.error);
      promote(app.db, r.value);
      return r.value;
    };
    const root = await mk("root", true);
@@ -21,6 +21,7 @@
import { createUser, type User } from "../src/core/users.ts";
import { holdOpen, sweepStanding } from "../src/http/caller.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { forgeSshSession } from "../src/tui/ssh.ts";
import { promote } from "./helpers/members.ts";
const KEY_LINE =
  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB2S7bF0R4NmuTUvVJXPPjdI1AF8XHXeYSNfr8DJ5eDo sam";
@@ -46,6 +47,7 @@
describe("a suspension holds in every process serving the forge", () => {
      adminIfFirst,
    });
    if (!made.ok) throw new Error(made.error);
    promote(fresh.db, made.value);
    return made.value;
  };
  /** Resolves true once `p` settles, false if it has not within `ms`. */
@@ -26,6 +26,7 @@
import { sweepStanding } from "../src/crew/standing.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { askLinesFor } from "../src/web/studio/asks.ts";
import { quietLogs } from "./helpers/globals.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
@@ -82,6 +83,7 @@
describe("a standing rule per repository", () => {
    });
    cookie = (signin.headers.get("set-cookie") ?? "").split(";")[0]!;
    alice = getUserByName(app.db, "alice")!;
    promote(app.db, alice);
    const r = await createRepo(app, alice, { name: "shelf", visibility: "public" });
    if (!r.ok) throw new Error(String(r.error));
    repo = r.value;
@@ -31,6 +31,7 @@
import { claimRun, createRun, finishRun } from "../src/core/runs.ts";
import { createUser, getUserByName, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { PNG, serving } from "./helpers/studio.ts";
import { promote } from "./helpers/members.ts";
describe("the studio, continued", () => {
  let dataDir: string;
@@ -66,6 +67,7 @@
describe("the studio, continued", () => {
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    promote(app.db, a.value);
    alice = a.value;
    cookie = (
      (
@@ -549,6 +551,7 @@
describe("the studio, continued", () => {
      password: "a-good-passphrase",
    });
    if (!stranger.ok) throw new Error(stranger.error);
    promote(app.db, stranger.value);
    const strangerCookie = (
      (
        await fetch(`${base}/signin`, {
@@ -772,6 +775,7 @@
describe("the studio, continued", () => {
      password: "a-good-passphrase",
    });
    if (!bob.ok) throw new Error(bob.error);
    promote(app.db, bob.value);
    const hidden = await createRepo(app, bob.value, {
      name: "hidden",
      visibility: "private",
@@ -861,6 +865,7 @@
describe("the studio, continued", () => {
      password: "a-good-passphrase",
    });
    if (!carol.ok) throw new Error(carol.error);
    promote(app.db, carol.value);
    const carolCookie = (
      (
        await fetch(`${base}/signin`, {
@@ -1080,6 +1085,7 @@
describe("the studio, continued", () => {
      password: "a-good-passphrase",
    });
    if (!erin.ok) throw new Error(erin.error);
    promote(app.db, erin.value);
    const erinCookie = (
      (
        await fetch(`${base}/signin`, {
@@ -1136,6 +1142,7 @@
describe("the studio, continued", () => {
        password: "a-good-passphrase",
      });
      if (!owner.ok) throw new Error(owner.error);
      promote(app2.db, owner.value);
      const plain = await createRepo(app2, owner.value, {
        name: "just-code",
        visibility: "public",
@@ -1182,6 +1189,7 @@
describe("the studio, continued", () => {
        password: "a-good-passphrase",
      });
      if (!made.ok) throw new Error(made.error);
      promote(app2.db, made.value);
      const pia = made.value;
      const appOf = async (name: string) => {
        const created = await createRepo(app2, pia, {
@@ -48,6 +48,7 @@
import { liveClientJs } from "../src/web/live.ts";
import { createUser, getUserByName, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { serving } from "./helpers/studio.ts";
import { promote } from "./helpers/members.ts";
describe("an owner's page lists an app once, not once in each vocabulary (#221)", () => {
  let dataDir: string;
@@ -90,6 +91,7 @@
describe("an owner's page lists an app once, not once in each vocabulary (#221)"
      adminIfFirst: true,
    });
    if (!dan.ok) throw new Error(dan.error);
    promote(app.db, dan.value);
    const cookie = await signIn("dan", "a-good-passphrase");
    const madeApp = await createRepo(app, dan.value, {
@@ -149,6 +151,7 @@
describe("an owner's page lists an app once, not once in each vocabulary (#221)"
      password: "a-good-passphrase",
    });
    if (!gus.ok) throw new Error(gus.error);
    promote(app.db, gus.value);
    const plainOnly = await createRepo(app, gus.value, {
      name: "notebook",
      visibility: "public",
@@ -173,6 +176,7 @@
describe("an owner's page lists an app once, not once in each vocabulary (#221)"
      password: "a-good-passphrase",
    });
    if (!eve.ok) throw new Error(eve.error);
    promote(app.db, eve.value);
    const cookie = await signIn("eve", "a-good-passphrase");
    const madeApp = await createRepo(app, eve.value, {
@@ -208,6 +212,7 @@
describe("an owner's page lists an app once, not once in each vocabulary (#221)"
      password: "a-good-passphrase",
    });
    if (!hal.ok) throw new Error(hal.error);
    promote(app.db, hal.value);
    const ownerCookie = await signIn("hal", "a-good-passphrase");
    const made = await createRepo(app, hal.value, {
      name: "ledger",
@@ -231,6 +236,7 @@
describe("an owner's page lists an app once, not once in each vocabulary (#221)"
      password: "a-good-passphrase",
    });
    if (!ivy.ok) throw new Error(ivy.error);
    promote(app.db, ivy.value);
    const strangerCookie = await signIn("ivy", "a-good-passphrase");
    const visit = (cookie?: string) =>
@@ -257,6 +263,7 @@
describe("an owner's page lists an app once, not once in each vocabulary (#221)"
      password: "a-good-passphrase",
    });
    if (!fay.ok) throw new Error(fay.error);
    promote(app.db, fay.value);
    const cookie = await signIn("fay", "a-good-passphrase");
    const org = await createOrg(app, fay.value, "vega");
@@ -373,6 +380,7 @@
describe("every open pull's preview on the studio page", () => {
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    promote(app.db, a.value);
    cookie = (
      (
        await fetch(`${base}/signin`, {
@@ -528,6 +536,7 @@
describe("the studio home keeps itself current", () => {
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    promote(app.db, a.value);
    alice = a.value;
    cookie = (
      (
@@ -778,12 +787,14 @@
describe("the studio head says why the app is not up", () => {
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    promote(app.db, a.value);
    const b = await createUser(app.db, { trusted: true,
      username: "bob",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!b.ok) throw new Error(b.error);
    promote(app.db, b.value);
    writer = await signIn("alice");
    reader = await signIn("bob");
    const made = await createRepo(app, a.value, {
@@ -1043,12 +1054,14 @@
describe("the studio app page's terminal", () => {
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    promote(app.db, a.value);
    const b = await createUser(app.db, { trusted: true,
      username: "bob",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!b.ok) throw new Error(b.error);
    promote(app.db, b.value);
    writer = await signIn("alice");
    reader = await signIn("bob");
    const made = await createRepo(app, a.value, {
@@ -1198,12 +1211,14 @@
describe("the app's live fragment: /:owner/:name/app/state", () => {
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    promote(app.db, a.value);
    const c = await createUser(app.db, { trusted: true,
      username: "carol",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!c.ok) throw new Error(c.error);
    promote(app.db, c.value);
    owner = await signIn("alice");
    stranger = await signIn("carol");
    const made = await createRepo(app, a.value, {
@@ -37,6 +37,7 @@
import {
import { createUser, getUserByName, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { serving } from "./helpers/studio.ts";
import { promote } from "./helpers/members.ts";
describe("finding things in the studio: /search", () => {
  let dataDir: string;
@@ -61,6 +62,7 @@
describe("finding things in the studio: /search", () => {
      password: "a-good-passphrase",
    });
    if (!a.ok) throw new Error(a.error);
    promote(app.db, a.value);
    alice = a.value;
    aliceCookie = (
      (
@@ -121,6 +123,7 @@
describe("finding things in the studio: /search", () => {
      password: "a-good-passphrase",
    });
    if (!bob.ok) throw new Error(bob.error);
    promote(app.db, bob.value);
    const secret = await createRepo(app, bob.value, {
      name: "secret",
      visibility: "private",
@@ -266,6 +269,7 @@
describe("finding things in the studio: /search", () => {
      password: "a-good-passphrase",
    });
    if (!carol.ok) throw new Error(carol.error);
    promote(app.db, carol.value);
    const carolCookie = (
      (
        await fetch(`${base}/signin`, {
@@ -362,6 +366,7 @@
describe("the studio home says what the crew cost you today", () => {
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    promote(app.db, a.value);
    alice = a.value;
    const c = await createUser(app.db, { trusted: true,
      username: "carol",
@@ -369,6 +374,7 @@
describe("the studio home says what the crew cost you today", () => {
      password: "a-good-passphrase",
    });
    if (!c.ok) throw new Error(c.error);
    promote(app.db, c.value);
    aliceCookie = await signIn("alice");
    carolCookie = await signIn("carol");
@@ -508,6 +514,7 @@
describe("every studio page's headings form one outline", () => {
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    promote(app.db, a.value);
    alice = a.value;
    cookie = (
      (
@@ -707,6 +714,7 @@
describe("the studio's Stop and Redeploy come back to the page they were pressed
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    promote(app.db, a.value);
    cookie = (
      (
        await fetch(`${base}/signin`, {
@@ -1024,6 +1032,7 @@
describe("the studio names a person on the app's page, and the crew only for the
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    promote(app.db, a.value);
    alice = a.value;
    ownerCookie = await signIn("ivy");
@@ -1192,6 +1201,7 @@
describe("the studio's empty lists", () => {
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    promote(app.db, a.value);
    alice = a.value;
    cookie = (
      (
@@ -1302,12 +1312,14 @@
describe("the studio can change what an app says it is (#230)", () => {
      adminIfFirst: true,
    });
    if (!alice.ok) throw new Error(alice.error);
    promote(app.db, alice.value);
    const carol = await createUser(app.db, { trusted: true,
      username: "carol",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!carol.ok) throw new Error(carol.error);
    promote(app.db, carol.value);
    ownerCookie = await signIn("alice");
    readerCookie = await signIn("carol");
    const made = await createRepo(app, alice.value, {
@@ -12,6 +12,7 @@
import { createSession } from "../src/core/sessions.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { promote } from "./helpers/members.ts";
// A suspended account's repositories are kept, and hidden: a stranger and
// a signed-in reader find them in no list, page or route; the forge's owner
@@ -36,6 +37,7 @@
describe("a suspended account's repositories leave every list", () => {
      adminIfFirst,
    });
    if (!made.ok) throw new Error(made.error);
    promote(app.db, made.value);
    return made.value;
  };
  const get = (path: string, cookie?: string, mode?: "dev") => {
@@ -16,6 +16,7 @@
import { serve } from "../src/http/server.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser, type User } from "../src/core/users.ts";
import { quietLogs } from "./helpers/globals.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
const DAY = 24 * 60 * 60 * 1000;
@@ -37,6 +38,7 @@
describe("thought stream", () => {
        password: "a-good-passphrase", adminIfFirst: first,
      });
      if (!u.ok) throw new Error(u.error);
      promote(app.db, u.value);
      return u.value;
    };
    // The first account is the forge's admin, who reads everything: not the viewer.
@@ -17,6 +17,7 @@
import { askedLines, askedScreen } from "../src/tui/screens/asked.ts";
import { headlessTerminal } from "../src/tui/term/terminal.ts";
import { quietLogs } from "./helpers/globals.ts";
import { settleApp } from "./helpers/tui.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
@@ -69,6 +70,7 @@
beforeAll(async () => {
      password: "a-good-passphrase", adminIfFirst: first,
    });
    if (!r.ok) throw new Error(r.error);
    promote(app.db, r.value);
    return r.value;
  };
  carol = await mk("carol", true);
@@ -27,6 +27,7 @@
import { createForgeApp } from "../src/tui/forge.ts";
import { headlessTerminal } from "../src/tui/term/terminal.ts";
import { quietLogs } from "./helpers/globals.ts";
import { settleApp } from "./helpers/tui.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
@@ -86,6 +87,7 @@
describe("terminal On you: mutes and many in one move", () => {
    alice = a.value;
    bob = b.value;
    markVerified(forge.db, bob.id, new Date().toISOString());
    promote(forge.db, bob);
    const mk = async (name: string) => {
      const r = await createRepo(forge, alice, { name, visibility: "public" });
      if (!r.ok) throw new Error("repo failed");
@@ -13,6 +13,7 @@
import { emailVerified } from "../src/core/verify.ts";
import { missing } from "./helpers/tools.ts";
import { sendMail, type Mail } from "../src/kernel/mail.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { promote } from "./helpers/members.ts";
// A fresh outsider signs up and, until the link in its email is followed,
// can read but cannot make or cost anything.
@@ -126,6 +127,7 @@
describe("verified email", () => {
  test("following the link verifies, and the account can create at once", async () => {
    const { user, token, link } = await join_("grace");
    promote(app.db, user);
    expect(emailVerified(app.db, user.id)).toBe(false);
    const before = await api("/api/v1/repos", token, {
      method: "POST",
@@ -41,6 +41,7 @@
import { clearViewCache } from "../src/view/cache.ts";
import { quietLogs } from "./helpers/globals.ts";
import { newFakeState, serveFakeForge, type FakeForge } from "./fake-origin.ts";
import { proveAll } from "./helpers/verified.ts";
import { promote } from "./helpers/members.ts";
quietLogs();
@@ -122,6 +123,7 @@
describe("fork at the origin, and propose a change through it", () => {
      redirect: "manual",
    });
    proveAll(app);
    promote(app.db);
    return (response.headers.get("set-cookie") ?? "").split(";")[0]!;
  };
@@ -137,6 +139,7 @@
describe("fork at the origin, and propose a change through it", () => {
      }),
    });
    proveAll(upApp);
    promote(upApp.db);
    const made = await fetch(`${upServers.url}/api/v1/tokens`, {
      method: "POST",
      headers: { "content-type": "application/json" },
@@ -573,6 +576,7 @@
describe("verdicts, threads, and the gate they open", () => {
    });
    cookies[username] = (signed.headers.get("set-cookie") ?? "").split(";")[0]!;
    proveAll(app);
    promote(app.db);
    const token = await fetch(`${base}/api/v1/tokens`, {
      method: "POST",
      headers: { "content-type": "application/json" },
		@@ -747,7 +747,7 @@ the work repositories and nothing else. Two on one grant take turns, and
747	747	one the provider rests hands its runs to the other until the reset.
748	748	Model budget. A new account has none: its repositories' crew does not run, spends nothing, and says "This repository has no model account". A person adds their own subscription at Settings → Model (or the terminal's Model budget command, `a`); it is sealed, granted to their own repositories only, and one per account. A forge admin who is a person gives an account a capped grant, in dollars a month spent on the forge's own credential, from the account's page, the terminal's Model grant command, `POST /api/v1/admin/accounts/:name/model-grant` (`{"usdPerMonth": 20}`, `null` takes it back) or the MCP `model_grant` tool; each change is in the audit. The cap is the UTC month's spend in the usage ledger, checked when a run starts and on every spend tick: a run past it stops, and its page says the grant is spent. Two runs that start together each begin with the whole remainder; the tick check ends both once the sum crosses the cap, so the overshoot is at most what they spend between ticks.
749	749
750		Roles. An account is a guest, a member or an admin (`docs/ROLES.md` has the table of what each can do; `src/core/roles.ts` holds it). Admin is the admin flag, a member is promoted, everyone else is a guest. A guest is refused creating or forking a repository, making an app their own and starting a crew run, in the words "the owner has not made this account a member" (after the older refusals: unverified, suspended, agent, private); `guard_guests` in Capacity switches it off. A forge admin who is a person lists everyone with their role at Settings → People (`/settings/people`) and promotes a guest to member with one button, with an optional starter model allowance in dollars a month (none by default, given as a model grant and audited as one), or demotes a member (the allowance stays until taken back on the account's page). In the terminal it is the People command (`r` changes a role: `member 5`, or `guest`); over the API, `GET /api/v1/admin/people` and `POST /api/v1/admin/accounts/:name/role` (`{"role": "member", "usdPerMonth": 5}`); over MCP, the `account_role` tool (a plan unless `dryRun: false`, with an admin token). Anyone signed in sees their own role and its row of the table: the account page (`/settings`) shows "What you can do here"; over MCP, `whoami_can` returns `{username, role, can, abilities}` with any token; in the terminal it is the What I can do command (read only, agents included).
	750	Roles. An account is a guest, a member or an admin (`docs/ROLES.md` has the table of what each can do; `src/core/roles.ts` holds it). Admin is the admin flag, a member is promoted, everyone else is a guest. A guest is refused creating or forking a repository, making an app their own and starting a crew run, in the words "the owner has not made this account a member" (after the older refusals: unverified, suspended, agent, private); nothing switches it off. A forge admin who is a person lists everyone with their role at Settings → People (`/settings/people`) and promotes a guest to member with one button, with an optional starter model allowance in dollars a month (none by default, given as a model grant and audited as one), or demotes a member (the allowance stays until taken back on the account's page). In the terminal it is the People command (`r` changes a role: `member 5`, or `guest`); over the API, `GET /api/v1/admin/people` and `POST /api/v1/admin/accounts/:name/role` (`{"role": "member", "usdPerMonth": 5}`); over MCP, the `account_role` tool (a plan unless `dryRun: false`, with an admin token). Anyone signed in sees their own role and its row of the table: the account page (`/settings`) shows "What you can do here"; over MCP, `whoami_can` returns `{username, role, can, abilities}` with any token; in the terminal it is the What I can do command (read only, agents included).
751	751
752	752	Invites. A forge admin who is a person mints a single-use invite link with `POST /api/v1/admin/invites` (`{"days": 14}`, 1 to 30, 7 by default); the response carries the link once and only its hash is kept. `GET /api/v1/admin/invites` lists them (open, used, revoked, expired) without tokens, and `DELETE /api/v1/admin/invites/:id` revokes one. Minting and revoking are events (`invite.minted`, `invite.revoked`). Signup does not read invites yet.
753	753
		@@ -15,9 +15,13 @@ verify, a suspended one is refused, an agent and a stranger to a private
15	15	repository meet their own reasons first. A comment from a guest is still a
16	16	comment; it just starts no run. Agents and organizations are not guests.
17	17
18		The Capacity setting `guard_guests` (`FORGE_GUARD_GUESTS`, default `on`) is the
19		switch: `off` leaves the usual permissions. The test suite boots with it `off`
20		and `test/guests.test.ts` turns it on.
	18	Nothing switches the refusal off: the test suite runs with it everywhere, and
	19	a suite whose people make things promotes them first (`promote` in
	20	`test/helpers/members.ts`). The crew's wake-up sweep, which starts a run on an
	21	agent-assigned issue that never had one, skips an issue whose last assigner is
	22	a guest, so an assignment made before the guard starts nothing either. A
	23	spawned forge's founder is made a member, so its first boot can hand the
	24	direction to the planner.
21	25
22	26	On `/settings/people` an admin promotes a guest to member, with a starter
23	27	model allowance (dollars a month, default none, through the grant of #1145),
		@@ -25,6 +25,7 @@ import {
25	25	updateAgent,
26	26	} from "../core/agents.ts";
27	27	import { createOrg, getOrg } from "../core/orgs.ts";
	28	import { setMember } from "../core/roles.ts";
28	29	import {
29	30	canRead,
30	31	createRepo,
		@@ -308,6 +309,9 @@ async function copyInto(
308	309	return made.ok ? made.value : undefined;
309	310	})());
310	311	if (!founder) return err("could not make the child's founder");
	312	// A member, not a guest: the child's first boot acts as the founder to
	313	// open the direction and hand it to the planner, which starts a run.
	314	setMember(child.db, founder.id, true, founder.id, new Date());
311	315
312	316	let org = getOrg(child.db, plan.org);
313	317	if (!org) {
		@@ -21,8 +21,7 @@ export type CapacityKey =
21	21	\| "checks.shards"
22	22	\| "children.max"
23	23	\| "cells.egress"
24		\| "guard_new_accounts"
25		\| "guard_guests";
	24	\| "guard_new_accounts";
26	25
27	26	interface Definition {
28	27	/** What the settings page and the API call it. */
		@@ -81,13 +80,6 @@ export const CAPACITY: Record<CapacityKey, Definition> = {
81	80	fallback: "off",
82	81	help: "on refuses repository creation and forks for accounts younger than 7 days (agents and admins are exempt); off leaves it to the usual permissions. Takes effect immediately. Replaces the hand-installed database trigger that used to do this with no toggle.",
83	82	},
84		"guard_guests": {
85		label: "Guest guard",
86		env: "FORGE_GUARD_GUESTS",
87		kind: { type: "choice", values: ["on", "off"] },
88		fallback: "on",
89		help: "on refuses a guest — an account the owner has not made a member — creating a repository, making an app their own, or starting a crew run; off leaves it to the usual permissions. Takes effect immediately.",
90		},
91	83	};
92	84
93	85	export const CAPACITY_KEYS = Object.keys(CAPACITY) as CapacityKey[];
		@@ -8,7 +8,6 @@
8	8	*/
9	9
10	10	import type { Database } from "bun:sqlite";
11		import { capacityValue } from "./capacity.ts";
12	11
13	12	export const ROLES = ["guest", "member", "admin"] as const;
14	13	export type Role = (typeof ROLES)[number];
		@@ -52,18 +51,28 @@ export const NOT_A_MEMBER = "the owner has not made this account a member";
52	51	/**
53	52	* Whether the table withholds `ability` from this account. Only a person
54	53	* can be a guest: agents and organizations are not accounts the owner
55		* promotes, and other rules govern them. The `guard_guests` setting can
56		* turn the refusal off (the test suite boots with it off).
	54	* promotes, and other rules govern them. Nothing switches it off.
57	55	*/
58	56	export function lacks(
59	57	db: Database,
60	58	user: { id: string; isAdmin: boolean; kind: string },
61	59	ability: Ability,
62	60	): boolean {
63		if (user.kind !== "user" \|\| capacityValue(db, "guard_guests") === "off") return false;
	61	if (user.kind !== "user") return false;
64	62	return !can(roleOf(db, user), ability);
65	63	}
66	64
	65	/**
	66	* `lacks(…, "run_crew")` as SQL, for a query that must not spend a row on
	67	* a guest: true when `userId` (a column or subquery, never input) names a
	68	* person who is neither an admin nor a member. Kept beside `roleOf` so the
	69	* two say the same thing.
	70	*/
		sentinelcrew 28d ago Not blocking: today this is safe, because the only caller passes a constant subquery. But it is an exported function that splices a string into SQL, and that is a sharp edge for the next caller. Consider not exporting a builder: either keep the fragment as a module-private constant next to `sweepAssigned`, or take a fixed column name and check it against an allow-list. The doc comment saying "never input" is the only thing guarding it right now.
	71	export const guestSql = (userId: string): string =>
	72	`EXISTS (SELECT 1 FROM user g WHERE g.id = ${userId}
	73	AND g.kind = 'user' AND g.is_agent = 0 AND g.is_admin = 0
	74	AND NOT EXISTS (SELECT 1 FROM member m WHERE m.user_id = g.id))`;
	75
67	76	export function roleOf(db: Database, user: { id: string; isAdmin: boolean }): Role {
68	77	if (user.isAdmin) return "admin";
69	78	const row = db.query<{ n: number }, [string]>("SELECT 1 AS n FROM member WHERE user_id = ?1").get(user.id);
		@@ -53,7 +53,7 @@ import {
53	53	type Run,
54	54	} from "../core/runs.ts";
55	55	import { getUserById, type User } from "../core/users.ts";
56		import { lacks } from "../core/roles.ts";
	56	import { guestSql, lacks } from "../core/roles.ts";
57	57	import { createLog } from "../kernel/log.ts";
58	58	import { issueOfBranch, type RunReason } from "./brief.ts";
59	59	import { detectClaude } from "./claude.ts";
		@@ -216,7 +216,7 @@ export async function startCrew(
216	216	pump(app, ready, inFlight);
217	217	}, TICK_MS);
218	218	requeueInterrupted(app);
219		sweep(app);
	219	sweepAssigned(app);
220	220	pump(app, ready, inFlight);
221	221
222	222	const handle: CrewHandle = {
		@@ -1074,9 +1074,18 @@ export function taskOf(
1074	1074
1075	1075	/**
1076	1076	* The sweep behind the wake-up: an open issue assigned to an agent that
1077		* has never had a run (assigned while the crew was off) gets one now.
	1077	* has never had a run (assigned while the crew was off) gets one now —
	1078	* unless the person who last assigned it is a guest. The assignment is
	1079	* theirs to pay for, and an issue a guest assigned before the guard existed
	1080	* would otherwise start the run the guard refuses them. An assignment with
	1081	* no event (made by the crew itself) is the crew's, as before.
1078	1082	*/
1079		function sweep(app: App): void {
	1083	export function sweepAssigned(app: App): void {
	1084	// Who last assigned it: the newest `issue.assigned` or `pull.assigned`.
	1085	const assigner = `(SELECT e.actor_id FROM event e
	1086	WHERE e.repo_id = issue.repo_id AND e.kind = issue.kind \|\| '.assigned'
	1087	AND json_extract(e.payload, '$.number') = issue.number
	1088	ORDER BY e.id DESC LIMIT 1)`;
1080	1089	const rows = app.db
1081	1090	.query<{ id: string; repo_id: string }, []>(
1082	1091	`SELECT issue.id, issue.repo_id FROM issue
		@@ -1086,6 +1095,9 @@ function sweep(app: App): void {
1086	1095	-- work landing, not a task waiting for a run.
1087	1096	AND NOT (issue.kind = 'pull' AND issue.author_id = issue.assignee_id)
1088	1097	AND NOT EXISTS (SELECT 1 FROM run WHERE run.issue_id = issue.id AND run.kind = 'agent')
	1098	-- In the query, not after it: a guest's issues never take one of
	1099	-- the hundred places, however many of them wait.
	1100	AND NOT ${guestSql(assigner)}
1089	1101	ORDER BY issue.id LIMIT 100`,
1090	1102	)
1091	1103	.all();
		sentinelcrew 28d ago outdated Medium: this skip happens after `LIMIT 100`, so skipped issues keep their slots in every sweep. 100 old guest-assigned or demoted-member issues would starve every other wake-up for good. Filter in the SQL instead, and test it with more than 100 skipped rows.
		@@ -2346,7 +2346,7 @@ const TOOLS: readonly Tool[] = [
2346	2346	properties: {
2347	2347	key: {
2348	2348	type: "string",
2349		enum: ["crew.concurrency", "checks.concurrency", "checks.shards", "cells.egress", "guard_new_accounts", "guard_guests"],
	2349	enum: ["crew.concurrency", "checks.concurrency", "checks.shards", "cells.egress", "guard_new_accounts"],
2350	2350	},
2351	2351	value: { type: "string", maxLength: 16 },
2352	2352	dryRun: { type: "boolean", description: "Plan only (the default). Send false to change it." },
		@@ -29,6 +29,7 @@ import {
29	29	stopStandInCrew,
30	30	type StandInCrew,
31	31	} from "./helpers/crew-standin.ts";
	32	import { promote } from "./helpers/members.ts";
32	33
33	34	describe("per-account spend ceilings", () => {
34	35	let standIn: StandInCrew;
		@@ -52,6 +53,7 @@ describe("per-account spend ceilings", () => {
52	53	});
53	54	if (!made.ok) throw new Error(made.error);
54	55	const user = made.value;
	56	promote(app.db, user);
55	57	const r = await createRepo(app, user, { name: "yard", visibility: "private" });
56	58	if (!r.ok) throw new Error(String(r.error));
57	59	const seeded = await commitToBranch(app, user, r.value, {
		@@ -13,6 +13,7 @@ import { listReposOwnedBy } from "../src/core/repos.ts";
13	13	import { repoDir } from "../src/git/repos.ts";
14	14	import { serve, type Servers } from "../src/http/server.ts";
15	15	import { proveAll } from "./helpers/verified.ts";
	16	import { promote } from "./helpers/members.ts";
16	17
17	18	describe("accounts: the confirm page for removing an organization too", () => {
18	19	let dataDir: string;
		@@ -181,6 +182,7 @@ describe("accounts: the confirm page for removing an organization too", () => {
181	182	test("a person's own repository is named, and the lead no longer says only the account", async () => {
182	183	await mkUser("rh");
183	184	proveAll(app);
	185	promote(app.db, getUserByName(app.db, "rh")!);
184	186	const made = await createRepo(app, getUserByName(app.db, "rh")!, { name: "notes" });
185	187	if (!made.ok) throw new Error(made.error);
186	188	const res = await fetch(`${base}/settings/accounts/rh/retire`, { headers: admin });
		@@ -27,6 +27,7 @@ import { createUser as insertAgent, getUserByName } from "../src/core/users.ts";
27	27	import { serve, type Servers } from "../src/http/server.ts";
28	28	import { forgeSshSession, identityFor } from "../src/tui/ssh.ts";
29	29	import { proveAll } from "./helpers/verified.ts";
	30	import { promote } from "./helpers/members.ts";
30	31
31	32	const EDGE = "edge-secret-for-accounts";
32	33	const KEY_LINE =
		@@ -103,6 +104,8 @@ describe("accounts: the owner sees, suspends and removes", () => {
103	104	// This suite is about standing, not email: its outsiders are proven.
104	105	proveAll(app);
105	106	const user = getUserByName(app.db, name)!;
	107	// Nor about roles: its outsiders are members (`test/guests.test.ts`).
	108	promote(app.db, user);
		sentinelcrew 28d ago Low: the formatting is mangled here (`return { user,` followed by `token: ...`). Restore the one-line return.
106	109	return { user, token: createToken(app.db, user.id, "o", "admin").token };
107	110	};
108	111
		@@ -622,6 +625,7 @@ describe("accounts: the owner sees, suspends and removes", () => {
622	625	password: "outsider-passphrase",
623	626	});
624	627	if (!made.ok) throw new Error(made.error);
	628	promote(app.db, made.value);
625	629	const token = createToken(app.db, made.value.id, "t", "admin").token;
626	630	const create = () =>
627	631	api("/api/v1/repos", { method: "POST", token, body: JSON.stringify({ name: "first" }) });