cb827cb · 78b5852 · 7a646aa · dc6c3c7 · 4fb1cb3
@@ -388,7 +388,7 @@
This page is the front door. Everything else is a file of its own under
- [`docs/WEBSPEC-PREVIEWS.md`](docs/WEBSPEC-PREVIEWS.md) — the website specification run over every preview, report-only.
- [`docs/CREW.md`](docs/CREW.md) — the crew: agents, how a run works, review, live triage, the merge queue, spend, roles and invites, the sandbox, passports, and the direction a vision pull will write.
- [`docs/SENTINEL.md`](docs/SENTINEL.md) — the forge hunting its own faults; [`docs/HUNT.md`](docs/HUNT.md) is the bug hunters' detectors against one running app (`bun scripts/hunt.ts <origin>`).
- Flow only: a repository's admin (a person, never an agent) sets one switch from Settings → On its own, `PATCH /api/v1/repos/:owner/:name` with `flowOnly`, MCP `repo_settings`, or `w` on the terminal's About card (`I`); turning it on makes the `flow` label. While it is on, the repository header and its admin's home say so in one line (the line links to the setting for an admin only; on the home it appears under "Show everything", not the lean apps-first view). While it is on, builders start only `flow` issues; assigning any other issue is recorded but starts no run and reads "queued: flow only" (web, terminal, API and MCP `issue`) until it gets the `flow` label or the switch goes off, and then it dispatches. Rebase, re-check, red-fix and review runs always go.
- Flow only: a repository's admin (a person, never an agent) sets one switch from Settings → On its own, `PATCH /api/v1/repos/:owner/:name` with `flowOnly`, MCP `repo_settings`, or `w` on the terminal's About card (`I`); turning it on makes the `flow` label. While it is on, the repository header and its admin's home say so in one line (the line links to the setting for an admin only; on the home it appears under "Show everything", not the lean apps-first view). While it is on, builders start only `flow` issues; assigning any other issue is recorded but starts no run and reads "queued: flow only" (web, terminal, API and MCP `issue`) until it gets the `flow` label or the switch goes off, and then it dispatches. Rebase, re-check, red-fix and review runs always go. On the forge's own repository, while it is off, each admin's home carries one **Flow only** button after the flow alarms (it posts to the setting's route and lands on the setting, where it turns off again); and once it is on and no flow alarm has stood for 24 h (the alarms the home shows, with the same crew ceiling) the minute's tick turns it off, once, with one feed item for admins; the terminal's About row reads "on, off after 24 h clear". The auto-off applies to the forge's own repository only (`src/flow/flow_only_auto.ts`).
- Outsiders directing the crew: the terminal's About card (`I`) has a Crew row saying whether people who cannot write may direct the crew (the web page's words). A repository admin who is a person presses `d` to see the plan, then enter to confirm (esc changes nothing); it calls `setCrewOutsiders`, as MCP `outsiders` does. The key is `d`, not `o`, because `o` is the fork's upstream offer on the same card and `d` never clashes with it; a writer who is not an admin and an agent are not offered `d`.
- [`docs/FLOW.md`](docs/FLOW.md) — where every issue stands: `GET /api/v1/repos/:owner/:name/flow` returns each open issue's stage, since, stalled and unblock, plus what went live in the last 24 h.
- Flow reads: `bun scripts/flow-report.ts [--db <path>] [--public] [--json]` prints one line per read; see [`docs/FLOW.md`](docs/FLOW.md).
@@ -156,6 +156,8 @@
export function classifiedAudience(kind: string): EventAudience | undefined {
    kind.startsWith("backup.") ||
    // A clog is the whole forge's flow, the owner's to hear (`flow/clog_tick.ts`).
    kind.startsWith("clog.") ||
    // The forge letting go of FLOW ONLY after 24 h clear is the admins' to hear (`flow/flow_only_auto.ts`).
    kind === "flow_only.cleared" ||
    // A report from outside waits for a person who decides; its arrival is
    // theirs to see, never the readers' (`actions/reports.ts`).
    kind.startsWith("report.") ||
@@ -0,0 +1,1 @@
c229078000fd44afbf57673a3bdac0bfbc7f83af30a7ff3dce58f86661b60db4
@@ -0,0 +1,8 @@
// When a flow alarm last stood while a repository's FLOW ONLY switch was on
// (#6395), epoch ms: 24 h after it the forge turns the switch off itself.
export default `
  CREATE TABLE flow_only_watch (
    repo_id TEXT PRIMARY KEY REFERENCES repo(id) ON DELETE CASCADE,
    alarm_at INTEGER NOT NULL
  );
`;
@@ -695,6 +695,11 @@
function fromEvent(
        what: said === "" ? `replied on “${on}”` : `on “${on}”: ${clip(said)}`,
      };
    }
    case "flow_only.cleared": {
      const what = typeof p["note"] === "string" ? p["note"] : "";
      if (what === "") return undefined;
      return { ...common, kind: "map", link: `${base(repo)}/settings/crew#flow-only`, what, said: what };
      
        junipercrew
        17d ago
        
      
      The flow_only.cleared item reuses kind "map" and puts the note in both what and said, so the feed will show the sentence twice. Check that it renders once, and add a test on the rendered line.
    
    }
    case "clog.cleared": {
      const note = typeof p["note"] === "string" ? p["note"] : "";
      if (note === "") return undefined;
@@ -11,7 +11,9 @@
import { listEvents, type EventBus } from "../core/events.ts";
import { getRepo } from "../core/repos.ts";
import { createLog } from "../kernel/log.ts";
import { ownRepoPath } from "../kernel/own_repo.ts";
import { firedAlarms } from "./alarms.ts";
import { CLOG_APPROVED_HOURS, clogOf } from "./clog.ts";
import { stepFlowOnly } from "./flow_only_auto.ts";
import { CLOG_NOTE_WINDOW_MS, clogNote, flattenNote } from "./clog_note.ts";
import { clogStep, type ClogEvent, type ClogState } from "./clog_watch.ts";
import { readOldestApproved } from "./oldest_approved.ts";
@@ -87,10 +89,13 @@
export function startClogTick(
  bus: Pick<EventBus, "append">,
  onError: (error: unknown) => void,
  everyMs = 60_000,
  onFlowOnlyOff: () => void = () => {},
  ceilingUsd: () => number | null = () => null,
): () => void {
  const timer = setInterval(() => {
    try {
      tickClog(db, bus);
      if (tickFlowOnly(db, bus, undefined, ceilingUsd())) onFlowOnlyOff();
    } catch (error) {
      onError(error);
    }
@@ -139,3 +144,20 @@
export function tickClog(db: Database, bus: Pick<EventBus, "append">, now = new
    return { event: step.event };
  }).immediate();
}
/**
 * The own repository's FLOW ONLY watch, one step. It counts the alarms the home
 * shows, so it reads them with the same crew ceiling (`cachedAlarms`); without it
 * an idle-crew alarm the ceiling silences would hold the switch on.
 *  true when the forge turned the switch off. */
export function tickFlowOnly(
      
        junipercrew
        17d ago
        outdated
      
      firedAlarms(db, now) runs without the cost ceiling that cachedAlarms passes on the home, so the two disagree on which alarms stand. Pass the same ceiling.
    
  db: Database,
  bus: Pick<EventBus, "append">,
  now = new Date(),
  ceilingUsd: number | null = null,
): boolean {
  const [owner, name] = ownRepoPath().split("/");
  const repo = owner && name ? getRepo(db, owner, name) : undefined;
  if (!repo) return false;
  return db.transaction(() => stepFlowOnly(db, bus, repo, repo.flowOnly && firedAlarms(db, now, { ceilingUsd }).length > 0, now.getTime())).immediate();
}
@@ -0,0 +1,42 @@
/**
 * FLOW ONLY lets go by itself (#6395): once the switch is on and no flow alarm
 * has fired for 24 h, the minute's tick turns it off and says so on the feed,
 * once. The last alarm's time lives in `flow_only_watch`; a switch found on
 * with no record starts its 24 h then. Plain data and a clock in, one bool out.
 */
import type { Database } from "bun:sqlite";
import type { EventBus } from "../core/events.ts";
import { getRepoById, updateRepoSettings, type Repo } from "../core/repos.ts";
export const FLOW_ONLY_CLEAR_MS = 24 * 3_600_000;
/** The words on the feed when the forge lets go. */
export const FLOW_ONLY_OFF_NOTE = "No flow alarm for 24 h: Flow only is off again.";
/** Steps the watch for `repo`; true when it turned the switch off this call. */
export function stepFlowOnly(
  db: Database,
  bus: Pick<EventBus, "append">,
  repo: Repo,
  alarming: boolean,
  now: number,
): boolean {
  const fresh = getRepoById(db, repo.id);
  if (!fresh?.flowOnly) {
    db.query("DELETE FROM flow_only_watch WHERE repo_id = ?1").run(repo.id);
    return false;
  }
  const row = db.query<{ alarm_at: number }, [string]>("SELECT alarm_at FROM flow_only_watch WHERE repo_id = ?1").get(repo.id);
  if (alarming || !row) {
    db.query(
      `INSERT INTO flow_only_watch (repo_id, alarm_at) VALUES (?1, ?2)
       ON CONFLICT (repo_id) DO UPDATE SET alarm_at = ?2`,
    ).run(repo.id, now);
    return false;
  }
  if (now - row.alarm_at < FLOW_ONLY_CLEAR_MS) return false;
  updateRepoSettings(db, fresh, { flowOnly: false });
  db.query("DELETE FROM flow_only_watch WHERE repo_id = ?1").run(repo.id);
  bus.append({ kind: "flow_only.cleared", repoId: repo.id, payload: { note: FLOW_ONLY_OFF_NOTE } });
  return true;
}
@@ -48,7 +48,8 @@
import { failAbandonedRuns } from "./core/runs.ts";
import { DRAIN_LINGER_MAX_S, drainLingerMs, startDraining } from "./http/health.ts";
import { takePresence, warmBehind } from "./apps/presence.ts";
import { STALE_AFTER_MS } from "./runs/lease.ts";
import { startCrew } from "./crew/dispatch.ts";
import { forgeCeiling } from "./flow/ceiling.ts";
import { startCrew, sweepAssigned } from "./crew/dispatch.ts";
import { CREW_OFF_IN_PREVIEW, crewOffInPreview } from "./crew/preview.ts";
import { typeSafeDecider } from "./crew/decide.ts";
import { graphInstagram } from "./crew/instagram.ts";
@@ -582,7 +583,7 @@
const processTick = (): void => {
  }
};
// The clog watch (#6524, #6757) reads the flow every minute; its state is the database's.
const stopClogTick = startClogTick(app.db, app.bus, (error) => app.log.warn("clog tick failed", { error: String(error) }));
const stopClogTick = startClogTick(app.db, app.bus, (error) => app.log.warn("clog tick failed", { error: String(error) }), 60_000, () => sweepAssigned(app), () => forgeCeiling(app.config));
// An agent's hold that has stood 24 h is released each minute (#6918).
const holdTimer = setInterval(() => {
  try {
@@ -15,6 +15,7 @@
 * card is an OSC 8 hyperlink besides.
 */
import { ownRepoPath } from "../../kernel/own_repo.ts";
import { audienceFor } from "../../core/audience.ts";
import { isPinned } from "../../core/pins.ts";
import { parentReleases, releasesSentence } from "../../core/parent_releases.ts";
@@ -485,10 +486,14 @@
export function upstreamRows(
  ];
}
/** The FLOW ONLY switch, in the settings page's words; every reader sees it. */
/**
 * The FLOW ONLY switch, in the settings page's words; every reader sees it. On
 * the forge's own repository it also says the forge lets go by itself (#6395).
 */
export function flowRow(repo: Repo | undefined): [string, string][] {
  if (repo === undefined) return [];
  return [["Flow only", repo.flowOnly ? "on" : "off"]];
  const own = ownRepoPath() === `${repo.ownerName}/${repo.name}`;
  return [["Flow only", repo.flowOnly ? (own ? "on, off after 24 h clear" : "on") : "off"]];
}
/** Who may direct the crew, in `OUTSIDERS_NOTE`'s words; every reader sees it. */
@@ -8,7 +8,11 @@
import type { Database } from "bun:sqlite";
import { firedAlarms, type FiredAlarm } from "../../flow/alarms.ts";
import { writeStamp } from "../../core/write_clock.ts";
import { Stamped } from "../../kernel/stamped.ts";
import { canAdmin, getRepo } from "../../core/repos.ts";
import type { User } from "../../core/users.ts";
import { ownRepoPath } from "../../kernel/own_repo.ts";
import { html, type Html } from "../html.ts";
import { btn } from "../ui.ts";
import { HOME_MAX_AGE_MS } from "./home_cache.ts";
const caches = new WeakMap<Database, Stamped<FiredAlarm[]>>();
@@ -25,9 +29,30 @@
export function cachedAlarms(db: Database, now: Date, ceilingUsd: number | null)
  return cache.get("alarms", stamp, () => firedAlarms(db, now, { ceilingUsd }));
}
export function alarmLines(alarms: readonly FiredAlarm[]): Html {
/**
 * `offerFor` is the repository path whose FLOW ONLY switch is off and the
 * viewer administers (#6395): one button follows the block, a post to the same
 * switch the setting uses, so it is same-origin, admin-only and undoable there.
 * One for the block, not one per line, so a screen reader hears it once; the
 * post lands on the setting, where it is turned off again, and the title says so.
 */
export function alarmLines(alarms: readonly FiredAlarm[], offerFor?: string): Html {
  if (alarms.length === 0) return html``;
  const offer =
    offerFor === undefined
      ? null
      : html`<form method="post" action="/${offerFor}/settings/flow-only" class="inline" title="Turns Flow only on and opens its setting">
          <input type="hidden" name="flowOnly" value="1" />${btn("Flow only", { size: "sm" })}
        </form>`;
  return html`<div class="stack" role="alert">
      
        junipercrew
        17d ago
        outdated
      
      One form per alarm line repeats the same button name for a screen reader. Use one button for the block, or add an aria-label that says which alarm. The post redirects to settings, so the person leaves the home page; say so in the button's title or accept it knowingly.
    
    ${alarms.map((a) => html`<p class="small"><a href="${a.href}">${a.says}</a></p>`)}
    ${offer}
  </div>`;
}
/** The own repository's path when its switch is off and `user` administers it; else undefined. */
export function flowOnlyOffer(db: Database, user: User): string | undefined {
  const [owner, name] = ownRepoPath().split("/");
  const repo = owner && name ? getRepo(db, owner, name) : undefined;
  return repo && !repo.flowOnly && canAdmin(db, repo, user) ? `${repo.ownerName}/${repo.name}` : undefined;
}
@@ -53,7 +53,7 @@
import { writableAppsOf } from "./asks.ts";
import { needsYouSection } from "./asks_page.ts";
import { flowCards } from "./flow_card.ts";
import { composer, feedJs, feedNote, feedRegion } from "./feed.ts";
import { alarmLines, cachedAlarms } from "./alarm_lines.ts";
import { alarmLines, cachedAlarms, flowOnlyOffer } from "./alarm_lines.ts";
import { clogRow, kpiRow, vitalsRow, waitingLine } from "./kpi_row.ts";
import { feedCandidateCache } from "../../feed/feed.ts";
import { notePhase, notePhaseRest, takeSessionTime, timePhase, timePhaseAsync } from "../../core/route_timing.ts";
@@ -292,7 +292,7 @@
export async function studioHome(
      : liveLine(ctx)}
    ${figures ? timePhase(ctx.request, "vitals", () => vitalsRow(ctx.app.db)) : null}
    ${figures ? clogRow(ctx.app.db) : null}
    ${figures ? alarmLines(cachedAlarms(ctx.app.db, new Date(), ceilingUsd)) : null}
    ${figures ? alarmLines(cachedAlarms(ctx.app.db, new Date(), ceilingUsd), flowOnlyOffer(ctx.app.db, user)) : null}
    ${timePhase(ctx.request, "waiting", () => waitingLine(ctx.app.db, user), () => waitingCache(ctx.app.db))}
    ${figures
      ? await timePhaseAsync(ctx.request, "panels", () => pinnedPanels(ctx.app, user), () => panelCache(ctx.app.db))
@@ -0,0 +1,140 @@
/** FLOW ONLY (#6395): the alarm line offers the switch; 24 h clear turns it off, once. */
import { afterAll, beforeAll, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { createRepo, updateRepoSettings } from "../src/actions/repos.ts";
import { getRepoById, type Repo } from "../src/core/repos.ts";
import { createUser, type User } from "../src/core/users.ts";
import { candidatesFor } from "../src/feed/items.ts";
import { FLOW_ONLY_CLEAR_MS, stepFlowOnly } from "../src/flow/flow_only_auto.ts";
import { tickFlowOnly } from "../src/flow/clog_tick.ts";
import type { FiredAlarm } from "../src/flow/alarms.ts";
import { flowRow } from "../src/tui/screens/about.ts";
import { alarmLines, flowOnlyOffer } from "../src/web/studio/alarm_lines.ts";
import { quietLogs } from "./helpers/globals.ts";
quietLogs();
let dataDir = "";
let app: App;
let alice: User;
let repo: Repo;
let was: string | undefined;
const T0 = Date.UTC(2026, 9, 1);
const fresh = (): Repo => getRepoById(app.db, repo.id)!;
const events = (): number =>
  app.db.query<{ n: number }, []>("SELECT COUNT(*) AS n FROM event WHERE kind = 'flow_only.cleared'").get()!.n;
beforeAll(async () => {
  was = process.env.FORGE_SENTINEL_REPO;
  process.env.FORGE_SENTINEL_REPO = "alice/forge";
  dataDir = await mkdtemp(join(tmpdir(), "forge-flow-only-auto-"));
  app = createApp({ dataDir, port: 0 });
  const a = await createUser(app.db, {
    origin: "seed",
    trusted: true,
    username: "alice",
    email: "[email protected]",
    password: "a-long-flow-only-passphrase",
    adminIfFirst: true,
  });
  if (!a.ok) throw new Error(a.error);
  alice = a.value;
  const made = await createRepo(app, alice, { name: "forge", visibility: "public" });
  if (!made.ok) throw new Error(String(made.error));
  repo = made.value;
}, 60_000);
afterAll(async () => {
  if (was === undefined) delete process.env.FORGE_SENTINEL_REPO;
  else process.env.FORGE_SENTINEL_REPO = was;
  await rm(dataDir, { recursive: true, force: true });
});
const alarm: FiredAlarm = { key: "red_main", says: "Main is red", since: "x", href: "/boards" };
test("an alarm line carries the Flow only button while the switch is off, for the admin", () => {
  expect(flowOnlyOffer(app.db, alice)).toBe("alice/forge");
  const page = String(alarmLines([alarm], "alice/forge"));
  expect(page).toContain('action="/alice/forge/settings/flow-only"');
  expect(page).toContain('name="flowOnly" value="1"');
  expect(page).toContain("Flow only");
  expect(String(alarmLines([alarm]))).not.toContain("<form");
});
test("no offer once the switch is on", async () => {
  await updateRepoSettings(app, alice, repo, { flowOnly: true });
  expect(flowOnlyOffer(app.db, alice)).toBeUndefined();
});
test("24 h clear turns it off once and says so; an alarm within the 24 h keeps it on", () => {
  expect(fresh().flowOnly).toBe(true);
  // The clock starts when the switch is first seen on.
  expect(stepFlowOnly(app.db, app.bus, fresh(), false, T0)).toBe(false);
  // An alarm 23 h in restarts the clock.
  expect(stepFlowOnly(app.db, app.bus, fresh(), true, T0 + 23 * 3_600_000)).toBe(false);
  expect(stepFlowOnly(app.db, app.bus, fresh(), false, T0 + FLOW_ONLY_CLEAR_MS + 1)).toBe(false);
  expect(fresh().flowOnly).toBe(true);
  // 24 h after that alarm, quiet: off, once.
  const off = T0 + 23 * 3_600_000 + FLOW_ONLY_CLEAR_MS;
  expect(stepFlowOnly(app.db, app.bus, fresh(), false, off)).toBe(true);
  expect(fresh().flowOnly).toBe(false);
  expect(stepFlowOnly(app.db, app.bus, fresh(), false, off + 60_000)).toBe(false);
  expect(events()).toBe(1);
  const mine = candidatesFor(app.db, alice, off).filter((c) => c.what.includes("Flow only is off again"));
  expect(mine).toHaveLength(1);
});
test("the tick steps the own repository's watch", async () => {
  await updateRepoSettings(app, alice, fresh(), { flowOnly: true });
  const now = new Date(T0);
  expect(tickFlowOnly(app.db, app.bus, now)).toBe(false);
  expect(fresh().flowOnly).toBe(true);
  expect(tickFlowOnly(app.db, app.bus, new Date(T0 + FLOW_ONLY_CLEAR_MS + 1))).toBe(true);
  expect(fresh().flowOnly).toBe(false);
});
test("the tick counts the alarms the home shows: a crew ceiling that silences idle-crew does not hold the switch on", async () => {
  const { openIssue } = await import("../src/actions/issues.ts");
  const { createRun } = await import("../src/core/runs.ts");
  await updateRepoSettings(app, alice, fresh(), {
    autonomy: "assisted",
    autonomyDirection: "keep the shop open",
    autonomySlots: 2,
    autonomyCeilingUsd: 15,
    autonomyBy: alice.id,
  });
  const issue = openIssue(app, alice, fresh(), { title: "Waiting" });
  if (!issue.ok) throw new Error(String(issue.error));
  const now = T0 + 400 * 24 * 3_600_000 + 12 * 3_600_000;
  const iso = (ms: number): string => new Date(ms).toISOString();
  app.db.query("UPDATE issue SET created_at = ?1 WHERE id = ?2").run(iso(now - 3_600_000), issue.value.id);
  const run = createRun(app.db, { repoId: repo.id, kind: "agent", reason: "assigned" });
  app.db
    .query("UPDATE run SET created_at = ?1, started_at = ?1, state = 'ok', cost_usd = 50 WHERE id = ?2")
    .run(iso(now - 20 * 60_000), run.id);
  await updateRepoSettings(app, alice, fresh(), { flowOnly: true });
  app.db.query("DELETE FROM flow_only_watch").run();
  // No ceiling: the idle crew is an alarm that stands, and holds the switch on.
  expect(tickFlowOnly(app.db, app.bus, new Date(now))).toBe(false);
  expect(tickFlowOnly(app.db, app.bus, new Date(now + FLOW_ONLY_CLEAR_MS + 1))).toBe(false);
  expect(fresh().flowOnly).toBe(true);
  // A $40 ceiling the day's spend has reached: the home shows no such alarm, so the watch lets go.
  const later = now + 24 * 3_600_000 + 1 + FLOW_ONLY_CLEAR_MS;
  const spent = createRun(app.db, { repoId: repo.id, kind: "agent", reason: "assigned" });
  app.db
    .query("UPDATE run SET created_at = ?1, started_at = ?1, state = 'ok', cost_usd = 50 WHERE id = ?2")
    .run(iso(later - 20 * 60_000), spent.id);
  expect(tickFlowOnly(app.db, app.bus, new Date(later), 40)).toBe(true);
  expect(fresh().flowOnly).toBe(false);
});
test("the terminal's About row says the forge lets go by itself, on the own repository only", () => {
  const on = { ...fresh(), flowOnly: true };
  expect(flowRow(on)[0]![1]).toBe("on, off after 24 h clear");
  expect(flowRow({ ...on, name: "other" })[0]![1]).toBe("on");
  expect(flowRow({ ...on, flowOnly: false })[0]![1]).toBe("off");
});
@@ -0,0 +1,102 @@
/** FLOW ONLY on the home (#6395): one button after the alarms, for the admin alone; the auto-off item reads once. */
import { afterAll, beforeAll, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { openIssue } from "../src/actions/issues.ts";
import { createRepo, getRepoById, updateRepoSettings, type Repo } from "../src/core/repos.ts";
import { createSession } from "../src/core/sessions.ts";
import { createUser, type User } from "../src/core/users.ts";
import { FLOW_ONLY_CLEAR_MS, FLOW_ONLY_OFF_NOTE, stepFlowOnly } from "../src/flow/flow_only_auto.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { quietLogs } from "./helpers/globals.ts";
quietLogs();
let dataDir = "";
let app: App;
let servers: Servers;
let owner: User;
let guest: User;
let repo: Repo;
let was: string | undefined;
const fresh = (): Repo => getRepoById(app.db, repo.id)!;
const count = (s: string, needle: string): number => s.split(needle).length - 1;
const get = async (path: string, who?: User): Promise<string> =>
  (
    await fetch(`${servers.url}${path}`, {
      headers: who ? { cookie: `forge_session=${createSession(app.db, who.id).token}` } : {},
    })
  ).text();
beforeAll(async () => {
  was = process.env.FORGE_SENTINEL_REPO;
  process.env.FORGE_SENTINEL_REPO = "maker/svc";
  dataDir = await mkdtemp(join(tmpdir(), "forge-flow-home-"));
  app = createApp({ dataDir, port: 0 });
  servers = await serve(app);
  const made = await createUser(app.db, {
    origin: "seed",
    trusted: true,
    username: "maker",
    email: "[email protected]",
    password: "a-good-passphrase",
    adminIfFirst: true,
  });
  if (!made.ok) throw new Error("user");
  owner = made.value;
  const g = await createUser(app.db, {
    origin: "seed",
    trusted: true,
    username: "visitor",
    email: "[email protected]",
    password: "a-good-passphrase",
  });
  if (!g.ok) throw new Error("guest");
  guest = g.value;
  const r = await createRepo(app.db, app.reposRoot, { ownerId: owner.id, name: "svc", visibility: "public" });
  if (!r.ok) throw new Error("repo");
  repo = updateRepoSettings(app.db, r.value, {
    autonomy: "assisted",
    autonomyDirection: "keep the shop open",
    autonomySlots: 2,
    autonomyCeilingUsd: 15,
    autonomyBy: owner.id,
  });
  // A ready issue nobody has started: the idle-crew alarm stands.
  const issue = openIssue(app, owner, repo, { title: "Waiting" });
  if (!issue.ok) throw new Error(String(issue.error));
  app.db
    .query("UPDATE issue SET created_at = ?1 WHERE id = ?2")
    .run(new Date(Date.now() - 3_600_000).toISOString(), issue.value.id);
}, 30_000);
afterAll(async () => {
  if (was === undefined) delete process.env.FORGE_SENTINEL_REPO;
  else process.env.FORGE_SENTINEL_REPO = was;
  servers?.stop();
  app?.close();
  await rm(dataDir, { recursive: true, force: true });
});
test("the admin's home carries one Flow only button after the alarms; others get no form", async () => {
  const page = await get("/?all=1", owner);
  expect(page).toContain("no crew run has started");
  expect(count(page, 'action="/maker/svc/settings/flow-only"')).toBe(1);
  expect(await get("/?all=1", guest)).not.toContain("settings/flow-only");
  expect(await get("/")).not.toContain("settings/flow-only");
});
test("no button once the switch is on", async () => {
  updateRepoSettings(app.db, fresh(), { flowOnly: true });
  expect(await get("/?all=1", owner)).not.toContain('action="/maker/svc/settings/flow-only"');
});
test("the auto-off item reads once on the admin's home", async () => {
  const t = Date.now();
  stepFlowOnly(app.db, app.bus, fresh(), false, t - FLOW_ONLY_CLEAR_MS - 1);
  expect(stepFlowOnly(app.db, app.bus, fresh(), false, t)).toBe(true);
  const page = await get("/?all=1", owner);
  expect(count(page, FLOW_ONLY_OFF_NOTE)).toBe(1);
});
		@@ -388,7 +388,7 @@ This page is the front door. Everything else is a file of its own under
388	388	- [`docs/WEBSPEC-PREVIEWS.md`](docs/WEBSPEC-PREVIEWS.md) — the website specification run over every preview, report-only.
389	389	- [`docs/CREW.md`](docs/CREW.md) — the crew: agents, how a run works, review, live triage, the merge queue, spend, roles and invites, the sandbox, passports, and the direction a vision pull will write.
390	390	- [`docs/SENTINEL.md`](docs/SENTINEL.md) — the forge hunting its own faults; [`docs/HUNT.md`](docs/HUNT.md) is the bug hunters' detectors against one running app (`bun scripts/hunt.ts <origin>`).
391		- Flow only: a repository's admin (a person, never an agent) sets one switch from Settings → On its own, `PATCH /api/v1/repos/:owner/:name` with `flowOnly`, MCP `repo_settings`, or `w` on the terminal's About card (`I`); turning it on makes the `flow` label. While it is on, the repository header and its admin's home say so in one line (the line links to the setting for an admin only; on the home it appears under "Show everything", not the lean apps-first view). While it is on, builders start only `flow` issues; assigning any other issue is recorded but starts no run and reads "queued: flow only" (web, terminal, API and MCP `issue`) until it gets the `flow` label or the switch goes off, and then it dispatches. Rebase, re-check, red-fix and review runs always go.
	391	- Flow only: a repository's admin (a person, never an agent) sets one switch from Settings → On its own, `PATCH /api/v1/repos/:owner/:name` with `flowOnly`, MCP `repo_settings`, or `w` on the terminal's About card (`I`); turning it on makes the `flow` label. While it is on, the repository header and its admin's home say so in one line (the line links to the setting for an admin only; on the home it appears under "Show everything", not the lean apps-first view). While it is on, builders start only `flow` issues; assigning any other issue is recorded but starts no run and reads "queued: flow only" (web, terminal, API and MCP `issue`) until it gets the `flow` label or the switch goes off, and then it dispatches. Rebase, re-check, red-fix and review runs always go. On the forge's own repository, while it is off, each admin's home carries one Flow only button after the flow alarms (it posts to the setting's route and lands on the setting, where it turns off again); and once it is on and no flow alarm has stood for 24 h (the alarms the home shows, with the same crew ceiling) the minute's tick turns it off, once, with one feed item for admins; the terminal's About row reads "on, off after 24 h clear". The auto-off applies to the forge's own repository only (`src/flow/flow_only_auto.ts`).
392	392	- Outsiders directing the crew: the terminal's About card (`I`) has a Crew row saying whether people who cannot write may direct the crew (the web page's words). A repository admin who is a person presses `d` to see the plan, then enter to confirm (esc changes nothing); it calls `setCrewOutsiders`, as MCP `outsiders` does. The key is `d`, not `o`, because `o` is the fork's upstream offer on the same card and `d` never clashes with it; a writer who is not an admin and an agent are not offered `d`.
393	393	- [`docs/FLOW.md`](docs/FLOW.md) — where every issue stands: `GET /api/v1/repos/:owner/:name/flow` returns each open issue's stage, since, stalled and unblock, plus what went live in the last 24 h.
394	394	- Flow reads: `bun scripts/flow-report.ts [--db <path>] [--public] [--json]` prints one line per read; see [`docs/FLOW.md`](docs/FLOW.md).
		@@ -156,6 +156,8 @@ export function classifiedAudience(kind: string): EventAudience \| undefined {
156	156	kind.startsWith("backup.") \|\|
157	157	// A clog is the whole forge's flow, the owner's to hear (`flow/clog_tick.ts`).
158	158	kind.startsWith("clog.") \|\|
	159	// The forge letting go of FLOW ONLY after 24 h clear is the admins' to hear (`flow/flow_only_auto.ts`).
	160	kind === "flow_only.cleared" \|\|
159	161	// A report from outside waits for a person who decides; its arrival is
160	162	// theirs to see, never the readers' (`actions/reports.ts`).
161	163	kind.startsWith("report.") \|\|
		@@ -0,0 +1,1 @@
	1	c229078000fd44afbf57673a3bdac0bfbc7f83af30a7ff3dce58f86661b60db4
		@@ -0,0 +1,8 @@
	1	// When a flow alarm last stood while a repository's FLOW ONLY switch was on
	2	// (#6395), epoch ms: 24 h after it the forge turns the switch off itself.
	3	export default `
	4	CREATE TABLE flow_only_watch (
	5	repo_id TEXT PRIMARY KEY REFERENCES repo(id) ON DELETE CASCADE,
	6	alarm_at INTEGER NOT NULL
	7	);
	8	`;
		@@ -695,6 +695,11 @@ function fromEvent(
695	695	what: said === "" ? `replied on “${on}”` : `on “${on}”: ${clip(said)}`,
696	696	};
697	697	}
	698	case "flow_only.cleared": {
	699	const what = typeof p["note"] === "string" ? p["note"] : "";
	700	if (what === "") return undefined;
	701	return { ...common, kind: "map", link: `${base(repo)}/settings/crew#flow-only`, what, said: what };
		junipercrew 17d ago The `flow_only.cleared` item reuses kind "map" and puts the note in both `what` and `said`, so the feed will show the sentence twice. Check that it renders once, and add a test on the rendered line.
	702	}
698	703	case "clog.cleared": {
699	704	const note = typeof p["note"] === "string" ? p["note"] : "";
700	705	if (note === "") return undefined;
		@@ -11,7 +11,9 @@ import { listEvents, type EventBus } from "../core/events.ts";
11	11	import { getRepo } from "../core/repos.ts";
12	12	import { createLog } from "../kernel/log.ts";
13	13	import { ownRepoPath } from "../kernel/own_repo.ts";
	14	import { firedAlarms } from "./alarms.ts";
14	15	import { CLOG_APPROVED_HOURS, clogOf } from "./clog.ts";
	16	import { stepFlowOnly } from "./flow_only_auto.ts";
15	17	import { CLOG_NOTE_WINDOW_MS, clogNote, flattenNote } from "./clog_note.ts";
16	18	import { clogStep, type ClogEvent, type ClogState } from "./clog_watch.ts";
17	19	import { readOldestApproved } from "./oldest_approved.ts";
		@@ -87,10 +89,13 @@ export function startClogTick(
87	89	bus: Pick<EventBus, "append">,
88	90	onError: (error: unknown) => void,
89	91	everyMs = 60_000,
	92	onFlowOnlyOff: () => void = () => {},
	93	ceilingUsd: () => number \| null = () => null,
90	94	): () => void {
91	95	const timer = setInterval(() => {
92	96	try {
93	97	tickClog(db, bus);
	98	if (tickFlowOnly(db, bus, undefined, ceilingUsd())) onFlowOnlyOff();
94	99	} catch (error) {
95	100	onError(error);
96	101	}
		@@ -139,3 +144,20 @@ export function tickClog(db: Database, bus: Pick<EventBus, "append">, now = new
139	144	return { event: step.event };
140	145	}).immediate();
141	146	}
	147
	148	/**
	149	* The own repository's FLOW ONLY watch, one step. It counts the alarms the home
	150	* shows, so it reads them with the same crew ceiling (`cachedAlarms`); without it
	151	* an idle-crew alarm the ceiling silences would hold the switch on.
	152	* true when the forge turned the switch off. */
	153	export function tickFlowOnly(
		junipercrew 17d ago outdated firedAlarms(db, now) runs without the cost ceiling that cachedAlarms passes on the home, so the two disagree on which alarms stand. Pass the same ceiling.
	154	db: Database,
	155	bus: Pick<EventBus, "append">,
	156	now = new Date(),
	157	ceilingUsd: number \| null = null,
	158	): boolean {
	159	const [owner, name] = ownRepoPath().split("/");
	160	const repo = owner && name ? getRepo(db, owner, name) : undefined;
	161	if (!repo) return false;
	162	return db.transaction(() => stepFlowOnly(db, bus, repo, repo.flowOnly && firedAlarms(db, now, { ceilingUsd }).length > 0, now.getTime())).immediate();
	163	}
		@@ -0,0 +1,42 @@
	1	/**
	2	* FLOW ONLY lets go by itself (#6395): once the switch is on and no flow alarm
	3	* has fired for 24 h, the minute's tick turns it off and says so on the feed,
	4	* once. The last alarm's time lives in `flow_only_watch`; a switch found on
	5	* with no record starts its 24 h then. Plain data and a clock in, one bool out.
	6	*/
	7	import type { Database } from "bun:sqlite";
	8	import type { EventBus } from "../core/events.ts";
	9	import { getRepoById, updateRepoSettings, type Repo } from "../core/repos.ts";
	10
	11	export const FLOW_ONLY_CLEAR_MS = 24 * 3_600_000;
	12
	13	/** The words on the feed when the forge lets go. */
	14	export const FLOW_ONLY_OFF_NOTE = "No flow alarm for 24 h: Flow only is off again.";
	15
	16	/** Steps the watch for `repo`; true when it turned the switch off this call. */
	17	export function stepFlowOnly(
	18	db: Database,
	19	bus: Pick<EventBus, "append">,
	20	repo: Repo,
	21	alarming: boolean,
	22	now: number,
	23	): boolean {
	24	const fresh = getRepoById(db, repo.id);
	25	if (!fresh?.flowOnly) {
	26	db.query("DELETE FROM flow_only_watch WHERE repo_id = ?1").run(repo.id);
	27	return false;
	28	}
	29	const row = db.query<{ alarm_at: number }, [string]>("SELECT alarm_at FROM flow_only_watch WHERE repo_id = ?1").get(repo.id);
	30	if (alarming \|\| !row) {
	31	db.query(
	32	`INSERT INTO flow_only_watch (repo_id, alarm_at) VALUES (?1, ?2)
	33	ON CONFLICT (repo_id) DO UPDATE SET alarm_at = ?2`,
	34	).run(repo.id, now);
	35	return false;
	36	}
	37	if (now - row.alarm_at < FLOW_ONLY_CLEAR_MS) return false;
	38	updateRepoSettings(db, fresh, { flowOnly: false });
	39	db.query("DELETE FROM flow_only_watch WHERE repo_id = ?1").run(repo.id);
	40	bus.append({ kind: "flow_only.cleared", repoId: repo.id, payload: { note: FLOW_ONLY_OFF_NOTE } });
	41	return true;
	42	}
		@@ -48,7 +48,8 @@ import { failAbandonedRuns } from "./core/runs.ts";
48	48	import { DRAIN_LINGER_MAX_S, drainLingerMs, startDraining } from "./http/health.ts";
49	49	import { takePresence, warmBehind } from "./apps/presence.ts";
50	50	import { STALE_AFTER_MS } from "./runs/lease.ts";
51		import { startCrew } from "./crew/dispatch.ts";
	51	import { forgeCeiling } from "./flow/ceiling.ts";
	52	import { startCrew, sweepAssigned } from "./crew/dispatch.ts";
52	53	import { CREW_OFF_IN_PREVIEW, crewOffInPreview } from "./crew/preview.ts";
53	54	import { typeSafeDecider } from "./crew/decide.ts";
54	55	import { graphInstagram } from "./crew/instagram.ts";
		@@ -582,7 +583,7 @@ const processTick = (): void => {
582	583	}
583	584	};
584	585	// The clog watch (#6524, #6757) reads the flow every minute; its state is the database's.
585		const stopClogTick = startClogTick(app.db, app.bus, (error) => app.log.warn("clog tick failed", { error: String(error) }));
	586	const stopClogTick = startClogTick(app.db, app.bus, (error) => app.log.warn("clog tick failed", { error: String(error) }), 60_000, () => sweepAssigned(app), () => forgeCeiling(app.config));
586	587	// An agent's hold that has stood 24 h is released each minute (#6918).
587	588	const holdTimer = setInterval(() => {
588	589	try {
		@@ -15,6 +15,7 @@
15	15	* card is an OSC 8 hyperlink besides.
16	16	*/
17	17
	18	import { ownRepoPath } from "../../kernel/own_repo.ts";
18	19	import { audienceFor } from "../../core/audience.ts";
19	20	import { isPinned } from "../../core/pins.ts";
20	21	import { parentReleases, releasesSentence } from "../../core/parent_releases.ts";
		@@ -485,10 +486,14 @@ export function upstreamRows(
485	486	];
486	487	}
487	488
488		/** The FLOW ONLY switch, in the settings page's words; every reader sees it. */
	489	/**
	490	* The FLOW ONLY switch, in the settings page's words; every reader sees it. On
	491	* the forge's own repository it also says the forge lets go by itself (#6395).
	492	*/
489	493	export function flowRow(repo: Repo \| undefined): [string, string][] {
490	494	if (repo === undefined) return [];
491		return [["Flow only", repo.flowOnly ? "on" : "off"]];
	495	const own = ownRepoPath() === `${repo.ownerName}/${repo.name}`;
	496	return [["Flow only", repo.flowOnly ? (own ? "on, off after 24 h clear" : "on") : "off"]];
492	497	}
493	498
494	499	/** Who may direct the crew, in `OUTSIDERS_NOTE`'s words; every reader sees it. */
		@@ -8,7 +8,11 @@ import type { Database } from "bun:sqlite";
8	8	import { firedAlarms, type FiredAlarm } from "../../flow/alarms.ts";
9	9	import { writeStamp } from "../../core/write_clock.ts";
10	10	import { Stamped } from "../../kernel/stamped.ts";
	11	import { canAdmin, getRepo } from "../../core/repos.ts";
	12	import type { User } from "../../core/users.ts";
	13	import { ownRepoPath } from "../../kernel/own_repo.ts";
11	14	import { html, type Html } from "../html.ts";
	15	import { btn } from "../ui.ts";
12	16	import { HOME_MAX_AGE_MS } from "./home_cache.ts";
13	17
14	18	const caches = new WeakMap<Database, Stamped<FiredAlarm[]>>();
		@@ -25,9 +29,30 @@ export function cachedAlarms(db: Database, now: Date, ceilingUsd: number \| null)
25	29	return cache.get("alarms", stamp, () => firedAlarms(db, now, { ceilingUsd }));
26	30	}
27	31
28		export function alarmLines(alarms: readonly FiredAlarm[]): Html {
	32	/**
	33	* `offerFor` is the repository path whose FLOW ONLY switch is off and the
	34	* viewer administers (#6395): one button follows the block, a post to the same
	35	* switch the setting uses, so it is same-origin, admin-only and undoable there.
	36	* One for the block, not one per line, so a screen reader hears it once; the
	37	* post lands on the setting, where it is turned off again, and the title says so.
	38	*/
	39	export function alarmLines(alarms: readonly FiredAlarm[], offerFor?: string): Html {
29	40	if (alarms.length === 0) return html``;
	41	const offer =
	42	offerFor === undefined
	43	? null
	44	: html`<form method="post" action="/${offerFor}/settings/flow-only" class="inline" title="Turns Flow only on and opens its setting">
	45	<input type="hidden" name="flowOnly" value="1" />${btn("Flow only", { size: "sm" })}
	46	</form>`;
30	47	return html`<div class="stack" role="alert">
		junipercrew 17d ago outdated One form per alarm line repeats the same button name for a screen reader. Use one button for the block, or add an aria-label that says which alarm. The post redirects to settings, so the person leaves the home page; say so in the button's title or accept it knowingly.
31	48	${alarms.map((a) => html`<p class="small"><a href="${a.href}">${a.says}</a></p>`)}
	49	${offer}
32	50	</div>`;
33	51	}
	52
	53	/** The own repository's path when its switch is off and `user` administers it; else undefined. */
	54	export function flowOnlyOffer(db: Database, user: User): string \| undefined {
	55	const [owner, name] = ownRepoPath().split("/");
	56	const repo = owner && name ? getRepo(db, owner, name) : undefined;
	57	return repo && !repo.flowOnly && canAdmin(db, repo, user) ? `${repo.ownerName}/${repo.name}` : undefined;
	58	}