2818575 · 3a5ac6a · 183cb6c · af117b3 · fda08db · 95d22dd
@@ -100,6 +100,7 @@
Machine routes are not pages and have no entry: `/audit.csv`,
- `/settings/capacity` — `pages/capacity.ts` · how many runs and checks go at once · `/admin/limits`, `/settings/usage` · none seen.
- `/settings/usage` — `pages/usage.ts` · route patterns by use, unused first · `/settings/telemetry`, `/board/returns` · none seen. Not about cost, despite the name.
- `/settings/telemetry` — `pages/telemetry.ts` · which agents may read telemetry · `/settings/crew` (agent grants) · none seen.
- `/settings/trusted` — `pages/trusted.ts` · who may fold in without review, until when, and the kill switch · `/review`, `/settings/crew` · none seen.
- `/settings/spend` — `pages/spend-tab.ts` · what the crew's runs spent, by credential, app, agent, issue and run kind · `/settings/subscriptions`, `/board/returns` · none seen. First tab of Usage (#2692).
- `/settings/resilience` — `pages/domains.ts` · failure domains and their last drill · `/resilience` · none seen.
- `/settings/backups` — `pages/backups.ts` (621 lines) · backups and restore · `/settings/resilience`, `/releases` · none seen.
@@ -0,0 +1,14 @@
# Trusted sources (#8937)
Settings → Trusted sources lists who folds in without a person's review: an account **on a named forge**, until a date, set by whom. The same name on another forge is a stranger. Remove is one click; past its date an entry falls to review by itself, with a `trust.expiring` note 3 days before. Every change is an event (`trust.set`, `trust.removed`). The list starts empty: an owner fills it (nothing is seeded by a migration).
A trusted source's pull (recorded in `pull_source`, from a followed upstream's address) is admitted by the autonomy tick like the crew's own: its check, the boot proof and the walls still stand, then it lands by true merge with `Landed-from` / `Landed-via` trailers. The walls (`src/crew/fold_walls.ts`) are an allowlist: a trusted pull may change `src/`, `test/`, `docs/`, `examples/` and the README; any other path waits for a person, and so do secrets, credentials, permissions, the contract, release machinery, every migration and the machinery that enforces these walls (fold-in, autonomy, the trust list's actions, page and screen, the auth routes, event audiences). Everyone else is a guest: nothing runs with secrets and the pull waits on `/review` with Approve and Decline.
Work whose `Landed-via` already names this forge is not taken again, so forges following each other in a ring do not re-land it. The kill switch ("Stop all folding in") ends all of it at once; "Revert landings" opens a revert pull for everything one source landed.
**Where it comes from.** A pull is stamped with its source only when the upstream follow opens it, from the followed address (`https://forge/account/repo`), once; a person's or a guest's pull under the same branch name is never stamped. The account is the owner of the followed repository, **not a verified commit author**: trust is "work from the repository this account owns", and commits keep whatever author they carry. There is no other intake: the autonomy tick's sweep is how it lands.
**Visible.** A landing carries `Landed-from` / `Landed-via` trailers, the `pull.merged` event names `source`, and the changelog (which swaps live when a pull merges) credits the row "folded in from account@forge".
**Both doors.** Settings → Trusted sources on the web, and **Trusted sources** in the terminal's command palette (a forge admin's): `a` trusts, `x` removes, `s` is the kill switch (stop or resume), `v` reverts what the one under the cursor landed. Both ask before reverting, and both go through `src/actions/trusted_sources.ts`.
@@ -81,6 +81,7 @@
import {
import { canWrite } from "../core/repos.ts";
import { refreshPullHead as refreshHead } from "../core/following.ts";
import { carryBranchThrough } from "../origins/push-through.ts";
import { ownHost, pullSourceOf, sourceTrailers } from "../core/trusted_sources.ts";
export interface OpenPullInput {
  title: string;
@@ -402,10 +403,14 @@
export async function mergePull(
  const asked = toldBy(app.db, pull);
  const requester =
    asked === null ? undefined : getUserByName(app.db, asked);
  const trailers = landingTrailers(
    requester ? commitIdentity(app.config, requester) : null,
    lander,
  );
  const from = pullSourceOf(app.db, pull.id);
  const trailers = [
    landingTrailers(
      requester ? commitIdentity(app.config, requester) : null,
      lander,
    ),
    ...(from === undefined ? [] : [sourceTrailers(from, ownHost(app.config))]),
  ].join("\n");
  const baseDir = repoDir(app.reposRoot, repo.ownerName, repo.name);
  const at = await pullDir(app.db, app.reposRoot, repo, pull);
  const carriedBefore =
@@ -465,6 +470,7 @@
export async function mergePull(
      number: pull.number,
      strategy,
      mergeOid: merged.value.mergeOid,
      ...(from === undefined ? {} : { source: `${from.account}@${from.host}` }),
    },
  });
  // A vision pull, landed by an admin, rewrites the direction's fenced block.
@@ -0,0 +1,73 @@
/**
 * Changing who is trusted (#8937): the owner's list, the kill switch and
 * the revert of one source's landings. Only a forge admin who is a person
 * may; each change is an event, so it is audited and the feed shows it.
 */
import type { App } from "../app.ts";
import { listEveryRepo } from "../core/repos.ts";
import {
  resumeFoldIn,
  stopFoldIn,
  trustSource,
  untrust,
  type TrustError,
  type TrustedSource,
} from "../core/trusted_sources.ts";
import type { User } from "../core/users.ts";
import { revertSource } from "../crew/fold_in.ts";
import { err, ok, type Result } from "../kernel/result.ts";
const mayChange = (actor: User | undefined): actor is User =>
  actor !== undefined && actor.isAdmin && actor.kind !== "agent";
export function addTrust(
  app: App,
  actor: User | undefined,
  input: { host: string; account: string; until: string },
): Result<TrustedSource, TrustError | "not_found"> {
  if (!mayChange(actor)) return err("not_found");
  const made = trustSource(app.db, { ...input, setBy: actor.username });
  if (typeof made === "string") return err(made);
  app.bus.append({
    kind: "trust.set",
    actorId: actor.id,
    payload: { account: made.account, host: made.host, until: made.until },
  });
  return ok(made);
}
export function removeTrust(app: App, actor: User | undefined, sourceId: string): Result<TrustedSource, "not_found"> {
  if (!mayChange(actor)) return err("not_found");
  const gone = untrust(app.db, sourceId);
  if (gone === undefined) return err("not_found");
  app.bus.append({ kind: "trust.removed", actorId: actor.id, payload: { account: gone.account, host: gone.host } });
  return ok(gone);
}
/** The kill switch: all folding in stops at once, and resumes on one action too. */
export function setFoldInStopped(app: App, actor: User | undefined, stopped: boolean): Result<boolean, "not_found"> {
  if (!mayChange(actor)) return err("not_found");
  if (stopped) stopFoldIn(app.db, actor.username);
  else resumeFoldIn(app.db);
  app.bus.append({ kind: stopped ? "foldin.stopped" : "foldin.resumed", actorId: actor.id, payload: {} });
  return ok(stopped);
}
/** Open a revert for everything one source landed, in every repository. */
export async function revertBySource(
  app: App,
  actor: User | undefined,
  host: string,
  account: string,
): Promise<Result<{ opened: number; refused: number }, "not_found">> {
  if (!mayChange(actor)) return err("not_found");
  let opened = 0;
  let refused = 0;
  for (const repo of listEveryRepo(app.db)) {
    const r = await revertSource(app, actor, repo, host, account);
    opened += r.opened.length;
    refused += r.refused.length;
  }
  app.bus.append({ kind: "trust.reverted", actorId: actor.id, payload: { account, host, opened, refused } });
  return ok({ opened, refused });
}
@@ -44,6 +44,7 @@
import { isSafeOid, isSafeRef } from "../git/guard.ts";
import { aheadCount, mergeBase, mergeable, resolveOid, writeRef } from "../git/merge.ts";
import { REMOTE_PROTOCOLS } from "../git/remote-env.ts";
import { repoDir } from "../git/repos.ts";
import { ownHost, recordPullSource, sourceOfUrl, takeable, viaOf } from "../core/trusted_sources.ts";
import { err, ok, type Result } from "../kernel/result.ts";
import { providerForOrigin } from "../origins/credential.ts";
import { redact, secretsIn } from "../origins/credentials.ts";
@@ -301,6 +302,12 @@
async function checkOnce(app: App, repo: Repo): Promise<Result<Checked, CheckErr
    return ok({ tip: staged, behind, outcome: "none" });
  }
  // Work that already landed here and came back round a ring of forges is not taken again (#8937).
  const seenVia = viaOf((await runGitCapture(["log", "-1", "--format=%B", staged], { cwd: dir })).stdout);
  if (!takeable(seenVia, ownHost(app.config))) {
    noteCheck(app.db, repo.id, { at, tip: staged, behind: 0, error: "" });
    return ok({ tip: staged, behind: 0, outcome: "none" });
  }
  const merged = await mergeable(dir, main, staged);
  if (!merged.ok) {
    if (merged.error.kind !== "conflict") return failed("git");
@@ -323,6 +330,12 @@
async function checkOnce(app: App, repo: Repo): Promise<Result<Checked, CheckErr
  const known = pullForBranch(app.db, repo.id, name);
  const pending = follow.pendingId === null ? undefined : getIssueById(app.db, follow.pendingId);
  const open = pending !== undefined && pending.kind === "pull" && pending.state === "open";
  // Where the work came from, so a landing can say, and a trusted source's folds in by itself.
  // Only a pull this follow opened is stamped (a person's or a guest's under the same branch name never is).
  const from = sourceOfUrl(follow.url);
  const came = (pullId: string): void => {
    if (from !== undefined) recordPullSource(app.db, { pullId, ...from, via: seenVia });
  };
  let number: number;
  if (known !== undefined) {
      
        sentinelcrew
        11d ago
        outdated
      
      HIGH: this stamps a trusted source on any pull matching the branch name, including a person's or guest's pull. Stamp only pulls this follow opened, and do not overwrite.
    
    // This tip was proposed already, whatever came of it: nothing new.
@@ -330,12 +343,14 @@
async function checkOnce(app: App, repo: Repo): Promise<Result<Checked, CheckErr
  } else if (open) {
    // The upstream moved on: the open pull follows it instead of a second opening.
    retargetPull(app.db, pending.id, name, staged);
    came(pending.id);
    await writeRef(dir, `refs/pull/${pending.number}/head`, staged);
    updateIssueText(app.db, pending.id, text);
    number = pending.number;
  } else {
    const opened = await openPull(app, by, repo, { ...text, baseBranch: repo.defaultBranch, headBranch: name });
    if (!opened.ok) return failed("git", `The proposal could not be opened: ${opened.error}`);
    came(opened.value.id);
    noteCheck(app.db, repo.id, { at, tip: staged, behind, error: "", pendingId: opened.value.id, opened: true });
    return ok({ tip: staged, behind, outcome: "proposed", pull: opened.value.number });
  }
@@ -169,6 +169,9 @@
export function classifiedAudience(kind: string): EventAudience | undefined {
    kind.startsWith("clog.") ||
    // What the throughput keeper did to lift a brake is the owner's too (`flow/keeper.ts`).
    kind.startsWith("keeper.") ||
    // Who is trusted to fold in, and the switch that stops it, are the owner's (`actions/trusted_sources.ts`).
    kind.startsWith("trust.") ||
    kind.startsWith("foldin.") ||
    // Events the retired FLOW ONLY switch wrote stay the admins' to hear.
    kind === "flow_only.cleared" ||
    // A report from outside waits for a person who decides; its arrival is
@@ -0,0 +1,1 @@
87833aad18c42e1ed7a8f5bcef1cabfd61257af51c205970898ac142add0a0c1
@@ -0,0 +1,28 @@
// Trusted sources (#8937): who, on which forge, until when, set by whom;
// where each pull from another forge came from; and the one switch that
// stops all folding in. Additive; the list starts empty and the owner fills it.
export default `
  CREATE TABLE trusted_source (
    id         TEXT PRIMARY KEY,
    host       TEXT NOT NULL,
    account    TEXT NOT NULL,
    until      TEXT NOT NULL,
    set_by     TEXT NOT NULL,
    created_at TEXT NOT NULL,
    warned_at  TEXT,
    UNIQUE (host, account)
  );
  CREATE TABLE pull_source (
    pull_id     TEXT PRIMARY KEY,
    host        TEXT NOT NULL,
    account     TEXT NOT NULL,
    via         TEXT NOT NULL DEFAULT '',
    received_at TEXT NOT NULL
  );
  CREATE INDEX pull_source_by_source ON pull_source (host, account);
  CREATE TABLE fold_in_stop (
    id INTEGER PRIMARY KEY CHECK (id = 1),
    by TEXT NOT NULL,
    at TEXT NOT NULL
  );
  `;
@@ -22,6 +22,7 @@
import { getIssueById, getPull, type Pull } from "./pulls.ts";
import { canWrite, getRepoById, onCrew, type Repo } from "./repos.ts";
import { listReviews } from "./reviews.ts";
import { runGrantedAt } from "./run_grant.ts";
import { foldsIn } from "./trusted_sources.ts";
import { getUserById, type User } from "./users.ts";
const trusted = (db: Database, repo: Repo, user: User | undefined): boolean =>
@@ -40,6 +41,8 @@
export function pullMayRun(
  headOid: string,
): boolean {
  const proposed = isProposed(db, pull);
  // A trusted source's code runs its checks like the crew's (#8937).
  if (foldsIn(db, pull.id)) return true;
  if (!proposed && !pull.crossRepo && pull.originHeadRepo === null) return true;
  if (!proposed && pull.crossRepo && pull.originHeadRepo === null) {
    const author = getUserById(db, pull.authorId);
@@ -0,0 +1,252 @@
/**
 * Trusted sources (#8937): an account on a named forge, until a date, set by
 * a person. An account name means nothing without its forge — the same name
 * elsewhere is a stranger — so a source is always the pair. Trust ends by
 * itself: past `until` a source is no longer listed as active and its work
 * waits for review like anyone's. Pure data, no authz, no events;
 * `actions/trusted_sources.ts` decides who may change it and audits it.
 */
import type { Database } from "bun:sqlite";
import { id } from "../kernel/id.ts";
export interface TrustedSource {
  readonly id: string;
  readonly host: string;
  readonly account: string;
  readonly until: string;
  readonly setBy: string;
  readonly createdAt: string;
  readonly warnedAt: string | null;
}
interface Row {
  id: string;
  host: string;
  account: string;
  until: string;
  set_by: string;
  created_at: string;
  warned_at: string | null;
}
const toSource = (r: Row): TrustedSource => ({
  id: r.id,
  host: r.host,
  account: r.account,
  until: r.until,
  setBy: r.set_by,
  createdAt: r.created_at,
  warnedAt: r.warned_at,
});
/** Days before expiry that the note is sent. */
export const WARN_DAYS = 3;
const DAY_MS = 86_400_000;
const HOST = /^[a-z0-9]([a-z0-9.-]{0,251}[a-z0-9])?(:\d{1,5})?$/;
const ACCOUNT = /^[a-z0-9][a-z0-9._-]{0,63}$/;
/** A forge's name as a source is kept: lowercase host, no scheme, no path. */
export function cleanHost(raw: string): string | undefined {
  const text = raw.trim().toLowerCase();
  const host = URL.parse(text)?.host || text.replace(/^[a-z]+:\/\//, "").replace(/\/.*$/, "");
  return HOST.test(host) ? host : undefined;
}
export function cleanAccount(raw: string): string | undefined {
  const name = raw.trim().replace(/^@/, "").toLowerCase();
  return ACCOUNT.test(name) ? name : undefined;
}
export type TrustError = "bad_host" | "bad_account" | "bad_date" | "in_the_past";
/** Keep (or renew) a source. The end is a calendar date, read as the end of that UTC day. */
export function trustSource(
  db: Database,
  input: { host: string; account: string; until: string; setBy: string },
  now: Date = new Date(),
): TrustedSource | TrustError {
  const host = cleanHost(input.host);
  if (host === undefined) return "bad_host";
  const account = cleanAccount(input.account);
  if (account === undefined) return "bad_account";
  if (!/^\d{4}-\d{2}-\d{2}$/.test(input.until)) return "bad_date";
  const end = new Date(`${input.until}T23:59:59.999Z`);
  if (Number.isNaN(end.getTime())) return "bad_date";
  if (end.getTime() <= now.getTime()) return "in_the_past";
  const until = end.toISOString();
  db.query(
    `INSERT INTO trusted_source (id, host, account, until, set_by, created_at)
     VALUES (?1, ?2, ?3, ?4, ?5, ?6)
     ON CONFLICT (host, account)
     DO UPDATE SET until = excluded.until, set_by = excluded.set_by, warned_at = NULL`,
  ).run(id(), host, account, until, input.setBy, now.toISOString());
  return sourceOf(db, host, account)!;
}
export function sourceOf(db: Database, host: string, account: string): TrustedSource | undefined {
  const row = db
    .query<Row, [string, string]>("SELECT * FROM trusted_source WHERE host = ?1 AND account = ?2")
    .get(host.toLowerCase(), account.toLowerCase());
  return row === null ? undefined : toSource(row);
}
export function untrust(db: Database, sourceId: string): TrustedSource | undefined {
  const row = db.query<Row, [string]>("SELECT * FROM trusted_source WHERE id = ?1").get(sourceId);
  if (row === null) return undefined;
  db.query("DELETE FROM trusted_source WHERE id = ?1").run(sourceId);
  return toSource(row);
}
/** Every entry, expired ones included (the page shows them as lapsed), soonest end first. */
export function listTrusted(db: Database): TrustedSource[] {
  return db.query<Row, []>("SELECT * FROM trusted_source ORDER BY until, host, account").all().map(toSource);
}
/** Whether the account on that forge is trusted at `now`. */
export function isTrusted(db: Database, host: string, account: string, now: Date = new Date()): boolean {
  const source = sourceOf(db, host, account);
  return source !== undefined && source.until > now.toISOString();
}
/** Entries that end within the warning window and have not been told about yet. */
export function dueWarning(db: Database, now: Date = new Date()): TrustedSource[] {
  const soon = new Date(now.getTime() + WARN_DAYS * DAY_MS).toISOString();
  return db
    .query<Row, [string, string]>(
      "SELECT * FROM trusted_source WHERE warned_at IS NULL AND until > ?1 AND until <= ?2",
    )
    .all(now.toISOString(), soon)
    .map(toSource);
}
export function markWarned(db: Database, sourceId: string, now: Date = new Date()): void {
  db.query("UPDATE trusted_source SET warned_at = ?2 WHERE id = ?1").run(sourceId, now.toISOString());
}
/** Whether the entry ends within the warning window (or already has). */
export const endsSoon = (s: TrustedSource, now: Date = new Date()): boolean =>
  Date.parse(s.until) - now.getTime() <= WARN_DAYS * DAY_MS;
// --- the kill switch -------------------------------------------------------
export function foldInStopped(db: Database): { by: string; at: string } | undefined {
  const row = db.query<{ by: string; at: string }, []>("SELECT by, at FROM fold_in_stop WHERE id = 1").get();
  return row ?? undefined;
}
export function stopFoldIn(db: Database, by: string, now: Date = new Date()): void {
  db.query("INSERT OR REPLACE INTO fold_in_stop (id, by, at) VALUES (1, ?1, ?2)").run(by, now.toISOString());
}
export function resumeFoldIn(db: Database): void {
  db.query("DELETE FROM fold_in_stop WHERE id = 1").run();
}
// --- where a pull came from ------------------------------------------------
export interface PullSource {
  readonly pullId: string;
  readonly host: string;
  readonly account: string;
  /** Forges the work passed through before it reached this one, oldest first. */
  readonly via: readonly string[];
}
/** Where a pull came from; the first word stands, a later call never rewrites it. */
export function recordPullSource(
  db: Database,
  input: { pullId: string; host: string; account: string; via: readonly string[] },
  now: Date = new Date(),
): void {
  db.query(
    `INSERT OR IGNORE INTO pull_source (pull_id, host, account, via, received_at)
     VALUES (?1, ?2, ?3, ?4, ?5)`,
  ).run(input.pullId, input.host.toLowerCase(), input.account.toLowerCase(), input.via.join(","), now.toISOString());
}
export function pullSourceOf(db: Database, pullId: string): PullSource | undefined {
  const row = db
    .query<{ host: string; account: string; via: string }, [string]>(
      "SELECT host, account, via FROM pull_source WHERE pull_id = ?1",
    )
    .get(pullId);
  return row === null
    ? undefined
    : { pullId, host: row.host, account: row.account, via: row.via === "" ? [] : row.via.split(",") };
}
/** `account@host` of the pulls (by number, in one repository) that came from another forge. */
export function sourcesOfPulls(db: Database, repoId: string, numbers: readonly number[]): Map<number, string> {
  const out = new Map<number, string>();
  if (numbers.length === 0) return out;
  const rows = db
    .query<{ number: number; account: string; host: string }, (string | number)[]>(
      `SELECT i.number, s.account, s.host FROM issue i JOIN pull_source s ON s.pull_id = i.id
        WHERE i.repo_id = ?1 AND i.number IN (${numbers.map((_, n) => `?${n + 2}`).join(",")})`,
    )
    .all(repoId, ...numbers);
  for (const r of rows) out.set(r.number, `${r.account}@${r.host}`);
  return out;
}
/** Pull ids that came from one source, newest first. */
export function pullIdsFrom(db: Database, host: string, account: string): string[] {
  return db
    .query<{ pull_id: string }, [string, string]>(
      "SELECT pull_id FROM pull_source WHERE host = ?1 AND account = ?2 ORDER BY received_at DESC",
    )
    .all(host.toLowerCase(), account.toLowerCase())
    .map((r) => r.pull_id);
}
// --- a landing says where it came from -------------------------------------
/**
 * Whether a pull's source is trusted right now and folding in is not
 * stopped: the one question the crew's landing path asks. Trust skips the
 * person's review and nothing else.
 */
export function foldsIn(db: Database, pullId: string, now: Date = new Date()): boolean {
  const from = pullSourceOf(db, pullId);
  return from !== undefined && foldInStopped(db) === undefined && isTrusted(db, from.host, from.account, now);
}
/**
 * The trailers a landing from another forge carries. `Landed-via` lists
 * every forge the work passed through, this one last: a forge that finds
 * itself in the list will not take the work again (`takeable`).
 */
export function sourceTrailers(from: PullSource, selfHost: string): string {
  const via = [...from.via, from.host, selfHost.toLowerCase()].filter((h, i, all) => all.indexOf(h) === i);
  return `Landed-from: ${from.account}@${from.host}\nLanded-via: ${via.join(",")}`;
}
/** `Landed-via` read back from a commit message; empty when it has none. */
export function viaOf(message: string): string[] {
  const line = /^Landed-via: ([a-z0-9.,:-]{1,500})$/m.exec(message);
  return line === null ? [] : line[1]!.split(",").filter((h) => HOST.test(h));
}
/** Work that already passed through this forge is not taken in again: that is how a ring of forges stops. */
export const takeable = (via: readonly string[], selfHost: string): boolean => !via.includes(selfHost.toLowerCase());
/** This forge's own name as other forges' trust lists spell it. */
export function ownHost(config: { url?: string | undefined; host?: string | undefined }): string {
  return (config.url === undefined ? undefined : URL.parse(config.url)?.host.toLowerCase()) ?? (config.host ?? "localhost").toLowerCase();
}
/**
 * Who an upstream's address names: the forge, and the account that owns the
 * repository (`https://host/account/name.git`). This is the owner of the
 * followed repository, not a verified commit author: trust here means "work
 * from the repository this account owns", and commits in it keep whatever
 * author they carry.
 */
export function sourceOfUrl(url: string): { host: string; account: string } | undefined {
  const parsed = URL.parse(url);
  if (parsed === null || (parsed.protocol !== "https:" && parsed.protocol !== "http:")) return undefined;
  const host = cleanHost(parsed.host);
  const account = cleanAccount(parsed.pathname.split("/").filter((s) => s !== "")[0] ?? "");
  return host === undefined || account === undefined ? undefined : { host, account };
}
@@ -132,6 +132,9 @@
import {
  landsOnItsOwn,
  markReaders,
} from "./direct.ts";
import { foldsIn } from "../core/trusted_sources.ts";
import { foldWall } from "./fold_walls.ts";
import { warnExpiring } from "./fold_in.ts";
import { crewOffInPreview } from "./preview.ts";
import { approvedOnHead, finishApproved, finishFields } from "./finishing.ts";
import { recheckRedApproved } from "./red_approved.ts";
@@ -1150,7 +1153,7 @@
function answeredWithoutChange(
 * was turned on, or one the event missed — land on the tick, so nothing
 * green waits on chance.
 */
export async function sweepGreen(app: App, repo: Repo): Promise<number> {
export async function sweepGreen(app: App, repo: Repo, now: Date = new Date()): Promise<number> {
  if (repo.autonomy !== "autonomous") return 0;
  // Admitted one by one, queued together, oldest first: the green pulls of
  // one sweep are one candidate and one gate (#2036).
@@ -1158,7 +1161,7 @@
export async function sweepGreen(app: App, repo: Repo): Promise<number> {
  // Why each approved pull waits, for the tick line (#3055).
  const waits: Wait[] = [];
  for (const pull of listOpenPulls(app.db, repo.id)) {
    const admitted = await admit(app, repo, pull);
    const admitted = await admit(app, repo, pull, now);
    if (admitted.ok) entries.push(admitted.value);
    const seen = reviewSummary(app.db, pull.id, pull.headOid);
    if (seen.approvals > 0 && seen.changesRequested === 0)
@@ -1281,6 +1284,12 @@
export async function autonomyTick(
  } catch (error) {
    log.error("stranded sweep failed", { error: String(error) });
  }
  // Three days before a trusted source lapses, a note (#8937).
  try {
    warnExpiring(app, now);
  } catch (error) {
    log.error("trust note failed", { error: String(error) });
  }
  for (const repo of listAutonomousRepos(app.db)) {
    // An archived repository is put away: the crew starts nothing in it.
    if (repo.archivedAt !== null) continue;
@@ -1919,10 +1928,14 @@
async function reviewed(
  app: App,
  repo: Repo,
  pull: Pull,
  now: Date = new Date(),
): Promise<"pass" | "hold" | "lapsed"> {
  const seen = reviewSummary(app.db, pull.id, pull.headOid);
  if (seen.changesRequested > 0) return "hold";
  if (seen.approvals > 0) return "pass";
  // A trusted source's pull needs no person's review (#8937); its check, the
  // boot proof and the walls above still stood before this point.
  if (foldsIn(app.db, pull.id, now)) return "pass";
  // An agent's pull ships only on an approving review — the crew's reviewer
  // or a person's. With no reviewer, or a review that lapsed, it waits for
  // a person (`waitsForPerson` puts it where a person looks); never by lapse.
@@ -1965,6 +1978,7 @@
async function admit(
  app: App,
  repo: Repo,
  pull: Pull,
  now: Date = new Date(),
): Promise<Result<Queued, Wait>> {
  if (repo.autonomy !== "autonomous" || repo.autonomyBy === null) return err("off");
  if (pull.state !== "open" || pull.mergedAt !== null) return err("closed");
@@ -1980,7 +1994,7 @@
async function admit(
  // Only work the crew wrote, or a writer's, lands on green by itself: a
  // reader's pull — from a fork, say — waits for a person, outsiders
  // switch or not, and is never sent to the crew's reviewer (#619).
  if (!landsOnItsOwn(app.db, repo, pull)) return err("outsider");
  if (!landsOnItsOwn(app.db, repo, pull, now)) return err("outsider");
  const by = getUserById(app.db, repo.autonomyBy);
  if (!by) return err("off");
  // The newest run of each kind is what the head says: a red that a re-run
@@ -2070,6 +2084,27 @@
async function admit(
    }
    return err("wall");
  }
  // A trusted source's pull that touches secrets, credentials, permissions,
  // the contract or release machinery waits for a person like a guest's.
  const folded = await foldWall(app, repo, pull, baseTip, now);
  if (folded.length > 0) {
    const earlier = latestDecision(app.db, pull.id, "land");
    const told =
      earlier?.answer === "wall" &&
      (earlier.state as { head?: unknown } | null)?.head === pull.headOid;
    if (!told)
      recordDecision(app.db, {
        kind: "land",
        repoId: repo.id,
        issueId: pull.id,
        state: { head: pull.headOid, cells: folded, plain: folded, unsound: false },
        answer: "wall",
        p: 1,
        by: "wall",
        ms: 0,
      });
    return err("wall");
  }
  // One gate for every pull, whoever wrote it: when the crew has a
  // reviewer, a green head is queued for review and waits for an approval
  // on that very head (a person's counts the same). A push is a new head,
@@ -2077,7 +2112,7 @@
async function admit(
  // long it takes — with no reviewer, or after one lapsed, a person's
  // (#597). Only a person's own pull lands without a reviewer, or after a
  // review lapsed.
  const review = await reviewed(app, repo, pull);
  const review = await reviewed(app, repo, pull, now);
  if (review === "hold") return err("review");
  // The full tier, once, on the queue's candidate (#1198, #2036). Red is
  // told to the pull once per head and base, and the pull is out of the
@@ -2214,7 +2249,11 @@
export async function landingStrategy(
  repo: Repo,
  pull: Pull,
  baseOid: string,
  now: Date = new Date(),
): Promise<"merge" | "squash"> {
  // A trusted source's work lands as a true merge: its commits stay
  // ancestors of main and each author keeps their name (#8937).
  if (foldsIn(app.db, pull.id, now)) return "merge";
  return (await carriesUpstream(
    app,
    repo,
@@ -19,6 +19,7 @@
import { crewRole } from "../core/agents.ts";
import { canRead, canWrite, type Repo } from "../core/repos.ts";
import type { Issue } from "../core/issues.ts";
import { isProposed } from "../core/pull_trust.ts";
import { foldsIn } from "../core/trusted_sources.ts";
import { openPullsClosing, type Pull } from "../core/pulls.ts";
import { getUserById, getUserByName, type User } from "../core/users.ts";
@@ -223,7 +224,10 @@
export function unadoptedAmong(
 * outsiders switch says — the switch lets a reader's words reach the
 * crew, not a reader's code reach the default branch unread by a person.
 */
export function landsOnItsOwn(db: Database, repo: Repo, pull: Pull): boolean {
export function landsOnItsOwn(db: Database, repo: Repo, pull: Pull, now: Date = new Date()): boolean {
  // A trusted source's pull (#8937) lands on its checks, wall and boot proof
  // alone; trust skips the person and nothing else.
  if (foldsIn(db, pull.id, now)) return true;
  if (pull.originAuthor !== null) return false;
  // A child's code, whoever holds its token: a grant lets it run, a person's
  // review lands it.
@@ -0,0 +1,55 @@
/**
 * Folding in (#8937): work from a trusted source flows to the default
 * branch without a person's review, and without skipping anything else —
 * its check, the boot proof and the walls still stand. A branch becomes a
 * pull only through the upstream follow (`actions/upstream_follow.ts`),
 * which records where it came from; the autonomy tick's own `sweepGreen`
 * then admits it like the crew's. This module is what is left: the note
 * before a trust lapses and the revert of one source's work. The walls are
 * in `fold_walls.ts`.
 */
import type { App } from "../app.ts";
import { getIssueById } from "../core/issues.ts";
import { getPull } from "../core/pulls.ts";
import type { Repo } from "../core/repos.ts";
import { dueWarning, markWarned, pullIdsFrom } from "../core/trusted_sources.ts";
import type { User } from "../core/users.ts";
import { revertPull } from "../actions/revert.ts";
/** The note 3 days before a trust ends: an event the owner's feed shows, once per entry. */
export function warnExpiring(app: App, now: Date = new Date()): number {
  const due = dueWarning(app.db, now);
  for (const source of due) {
    app.bus.append({
      kind: "trust.expiring",
      payload: { account: source.account, host: source.host, until: source.until },
    });
    markWarned(app.db, source.id, now);
  }
  return due.length;
}
/**
 * A bad landing reverts by source: every merged pull of one source in this
 * repository becomes a revert pull, newest first, for a person to land.
 * Which pulls were reverted, and which could not be.
 */
export async function revertSource(
  app: App,
  actor: User,
  repo: Repo,
  host: string,
  account: string,
): Promise<{ opened: number[]; refused: number[] }> {
  const opened: number[] = [];
  const refused: number[] = [];
  for (const id of pullIdsFrom(app.db, host, account)) {
    const issue = getIssueById(app.db, id);
    if (issue === undefined || issue.repoId !== repo.id) continue;
    const pull = getPull(app.db, repo.id, issue.number);
    if (pull === undefined || pull.mergedAt === null) continue;
    const reverted = await revertPull(app, actor, repo, pull, `Reverts #${pull.number}, folded in from ${account}@${host}.`);
    (reverted.ok ? opened : refused).push(pull.number);
  }
  return { opened, refused };
}
@@ -0,0 +1,63 @@
/**
 * The walls a trusted source's pull still stops at (#8937): secrets and
 * credentials, permissions and the contract's walls, release machinery.
 * Trust skips the person's review, never these.
 */
import type { App } from "../app.ts";
import { pullDir, type Pull } from "../core/pulls.ts";
import type { Repo } from "../core/repos.ts";
import { foldsIn } from "../core/trusted_sources.ts";
import { runGitCapture } from "../git/env.ts";
/**
 * Paths a person decides on whoever wrote them: secrets and credentials,
 * who may do what, the contract's walls, the machinery that releases and
 * the machinery that enforces these very walls (fold-in, autonomy, the
 * trust list's actions and page, the auth routes, event audiences) and
 * every migration. Each rule says why in the words a person reads on the card.
 */
const WALLS: readonly { readonly test: RegExp; readonly why: string }[] = [
  { test: /(^|\/)\.env([./]|$)|(^|\/)(secrets?|credentials?)([./_-]|$)|\.(pem|key|p12|pfx)$|(^|\/)id_(rsa|ed25519|ecdsa)/i, why: "secrets or credentials" },
      
        sentinelcrew
        11d ago
        outdated
      
      HIGH: crew/fold_in is walled but fold_walls.ts, autonomy.ts and actions/trusted_sources.ts are not. A trusted pull can remove the walls. Wall these, and every migration, or switch to an allowlist.
    
  { test: /^src\/(auth|origins\/credential|kernel\/secret|core\/(secret|tokens|keys|sessions|passkeys|run_token|run_grant|proposal_token))/, why: "secrets or credentials" },
  { test: /^src\/(contract|core\/(roles|access_fingerprint|pull_trust|trusted_sources|event_audience)|crew\/(fold_|autonomy|direct|finishing)|http\/(run_gate|[^/]*auth[^/]*|settings_routes|admin_gate)|actions\/(access|app_members|egress_grants|model_grant|trusted_sources|pulls|upstream_follow)|web\/pages\/trusted|tui\/screens\/trusted)/, why: "permissions or the contract's walls" },
  { test: /^(src\/(release|keeper)\/|src\/core\/migration|scripts\/(gate|check|cut-release|roll|dark-roll|rehearse-roll|roll-preflight|pin-migrations)\.ts$|Dockerfile$|charts\/|infra\/|forge\.json$|package\.json$|bun\.lock$|bunfig\.toml$|\.github\/)/, why: "release machinery" },
];
/**
 * Where a trusted source's work may land alone: the code, its tests and the
 * docs. Any other path (the repository's root files, scripts, charts) is one
 * nobody listed, and unlisted waits for a person.
 */
const ALLOWED = /^(src\/|test\/|docs\/|examples\/|README\.md$)/;
/** What the walls hold a set of files for, as plain sentences; empty when it touches none. */
export function wallsTouched(files: readonly string[]): string[] {
  const reasons = new Set<string>();
  for (const file of files) {
    const walled = WALLS.filter((w) => w.test.test(file));
    for (const w of walled) reasons.add(w.why);
    if (walled.length === 0 && !ALLOWED.test(file)) reasons.add("a path a trusted source's work may not change alone");
  }
  return [...reasons].map((why) => `a trusted source's pull touches ${why}`);
}
/** The files a pull changes against its base, or undefined when git could not say. */
export async function touchedFiles(dir: string, base: string, head: string): Promise<string[] | undefined> {
  const out = await runGitCapture(["diff", "--name-only", "-z", "--no-renames", `${base}...${head}`, "--"], { cwd: dir });
  if (out.code !== 0) return undefined;
  return out.stdout.split("\0").filter((f) => f !== "");
}
/**
 * What waits for a person on a trusted pull even though its source is
 * trusted: the walls. Empty for a guest's pull (it waits for a person
 * anyway) and for a trusted pull that touches none. A diff git cannot read
 * is a wall too: unread is not clear.
 */
export async function foldWall(app: App, repo: Repo, pull: Pull, baseTip: string, now: Date = new Date()): Promise<string[]> {
  if (!foldsIn(app.db, pull.id, now)) return [];
  const dir = await pullDir(app.db, app.reposRoot, repo, pull);
  const files = await touchedFiles(dir, baseTip, pull.headOid);
  return files === undefined ? ["a trusted source's pull could not be read"] : wallsTouched(files);
}
@@ -15,6 +15,7 @@
import { capacityPage, capacitySet } from "../web/pages/capacity.ts";
import { teamSet, teamsPage, teamsStream } from "../web/pages/teams.ts";
import { telemetryPage, telemetrySet } from "../web/pages/telemetry.ts";
import { flagsPage, flagsSet } from "../web/pages/flags.ts";
import { trustedAdd, trustedPage, trustedRemove, trustedRevert, trustedStop } from "../web/pages/trusted.ts";
import { usagePage } from "../web/pages/usage.ts";
import { spendPage } from "../web/pages/spend-tab.ts";
import {
@@ -112,6 +113,11 @@
import { originFlowPage, originFlowPoll } from "../web/pages/origin-flow.ts";
import { originMirrorSubmit, originReposPage } from "../web/pages/origin-repos.ts";
export function settingsRoutes(router: Router<Handler>, knownPatterns: () => readonly string[]): void {
  router.add("GET", "/settings/trusted", trustedPage);
  router.add("POST", "/settings/trusted", trustedAdd);
  router.add("POST", "/settings/trusted/stop", trustedStop);
  router.add("POST", "/settings/trusted/revert", trustedRevert);
  router.add("POST", "/settings/trusted/:id/remove", trustedRemove);
  router.add("GET", "/settings/telemetry", telemetryPage);
  router.add("POST", "/settings/telemetry", telemetrySet);
  router.add("GET", "/settings", accountPage);
@@ -28,6 +28,8 @@
export interface Landing {
  readonly live: boolean;
  /** The bet whose scopes this pull built (#8713), set by the page that shows it. */
  readonly bet?: string;
  /** `account@host` when a trusted source's work folded in (#8937), set by the page that shows it. */
  readonly from?: string;
}
export interface Landings {
@@ -54,6 +54,7 @@
import { talkChatsScreen } from "./screens/talk_chats.ts";
import { sshKeysScreen } from "./screens/sshkeys.ts";
import { passkeysScreen } from "./screens/passkeys.ts";
import { confirmsScreen } from "./screens/confirms.ts";
import { mayTrust, trustedScreen } from "./screens/trusted.ts";
import { proposalTokensPrompt } from "./screens/proposal_tokens.ts";
import { signInsScreen } from "./screens/signins.ts";
import { originAppsScreen } from "./screens/originapps.ts";
@@ -317,6 +318,14 @@
export function forgeCommands(session: Session): (ctx: Ctx) => Command[] {
        hint: "what the forge's agent asked to do; y does it once",
        run: () => ctx.push(confirmsScreen(session, ctx)),
      });
    // Who folds in without a person's review, and the kill switch (#8937): a forge admin's.
    if (session.signedIn && mayTrust(session))
      commands.push({
        id: "trusted",
        title: "Trusted sources",
        hint: "who folds in without review; a trusts, x removes, s stops all, v reverts",
        run: () => ctx.push(trustedScreen(session, ctx)),
      });
    // The forge's agent keeps many conversations, as /talk lists them (#8814).
    if (session.signedIn && session.user?.kind !== "agent")
      commands.push({
@@ -255,11 +255,12 @@
export function resilienceScreen(f: Session, ctx: Ctx): Screen {
    const out: string[] = [];
    if (asking !== undefined) out.push(QUESTION[asking], "");
    else if (said !== "") out.push(...wrap(said, INNER), "");
    // A refusal or a result of a change stays up here too, above where a prompt opens over the middle.
    if (note !== "") out.push(...wrap(note, INNER), "");
    out.push(...wrap(backupsLine(f.app).says, INNER), ...verdictLines(f), "");
    for (const line of nightlyLines(f.app.config.dataDir)) out.push(...wrap(line, INNER));
    out.push("");
    out.push(...wrap(destinationLine(f), INNER), ...wrap(mirrorLine(f), INNER));
    if (note !== "") out.push(...wrap(note, INNER));
    if (mayChange()) out.push("d sets where snapshots go, x forgets it.", "m sets the mirror, f forgets it.", "t tests where snapshots go.");
    out.push("", "Snapshots, newest first:");
    if (snapshots === undefined) out.push("  reading…");
@@ -0,0 +1,141 @@
/**
 * Trusted sources in the terminal (#8937), a forge admin's: the list
 * Settings → Trusted sources has, with the same doors — `a` trusts an
 * account on a forge until a date, `x` removes the one under the cursor, `s`
 * is the kill switch (stops all folding in, or resumes it), `v` reverts what
 * the one under the cursor landed. Each goes through `actions/trusted_sources.ts`,
 * so it is the same check, the same audit and the same event as the web's.
 * Anyone else is not offered it.
 */
import { addTrust, removeTrust, revertBySource, setFoldInStopped } from "../../actions/trusted_sources.ts";
import { endsSoon, foldInStopped, listTrusted, type TrustError } from "../../core/trusted_sources.ts";
import type { Ctx, Screen } from "../app/app.ts";
import { binding } from "../app/keys.ts";
import { style } from "../term/style.ts";
import { truncate } from "../term/width.ts";
import type { Session } from "../session.ts";
import { fill, len, split } from "../ui/layout.ts";
import { ListState, confirmScreen, drawList, promptScreen, runAsync, type ListRow } from "./common.ts";
const WORDS: Record<TrustError | "not_found", string> = {
  bad_host: "That is not a forge address.",
  bad_account: "That is not an account name.",
  bad_date: "Give the end as a date, year-month-day.",
  in_the_past: "That date has passed.",
  not_found: "Only a forge admin changes who is trusted.",
};
/** Whether the palette offers the screen: a signed-in admin who is a person. */
export const mayTrust = (f: Session): boolean => f.user !== undefined && f.user.isAdmin && f.user.kind !== "agent";
export function trustedScreen(f: Session, ctx: Ctx): Screen {
  const state = new ListState();
  const entries = () => (mayTrust(f) ? listTrusted(f.db) : []);
  const rows = (): ListRow[] => {
    const now = new Date();
    return entries().map((s) => ({
      
        sentinelcrew
        11d ago
        
      
      No test drives this screen (a/x/s/v and the non-admin refusal). Add one.
    
      title: `${s.account}  ${s.host}`,
      meta:
        s.until <= now.toISOString()
          ? "lapsed, waits for review"
          : `until ${s.until.slice(0, 10)}${endsSoon(s, now) ? " (ends soon)" : ""}`,
    }));
  };
  const screen: Screen = {
    title: "Trusted sources",
    keys: [binding(["j", "k"], "move cursor"), binding(["a"], "trust"), binding(["x"], "remove"), binding(["s"], "stop or resume"), binding(["v"], "revert landings")],
    render(area, s) {
      const c = ctx.theme.c;
      const [head, body] = split(area, "v", [len(1), fill(1)]);
      const stopped = foldInStopped(f.db);
      const text = !mayTrust(f)
        ? "Only a forge admin changes who is trusted."
        : stopped !== undefined
          ? `Folding in is stopped (by ${stopped.by}); s resumes it.`
          : "Who folds in without a person's review; s stops all of it.";
      s.text(head!.x, head!.y, truncate(text, head!.w), style(c.mutedFg, c.bg), head!.x + head!.w);
      drawList(s, body!, c, state, rows());
    },
    key(e) {
      if (!mayTrust(f) || e.ctrl || e.alt) return false;
      if (state.key(e, entries().length)) return true;
      const user = f.user;
      const at = entries()[state.index];
      if (e.key === "a") {
        ctx.push(
          promptScreen(ctx, screen, {
            title: "Trust a source",
            label: "account forge until, e.g. jmoran git.open-platform.sh 2026-12-02",
            hint: "account, forge, end date",
            onSubmit: (raw) => {
              const [account = "", host = "", until = ""] = raw.trim().split(/\s+/);
              const made = addTrust(f.app, user, { account, host, until });
              if (!made.ok) return WORDS[made.error];
              ctx.toast(`${made.value.account} on ${made.value.host} is trusted until ${made.value.until.slice(0, 10)}.`, "success");
              ctx.invalidate();
              return undefined;
            },
          }),
        );
        return true;
      }
      if (e.key === "s") {
        const stop = foldInStopped(f.db) === undefined;
        ctx.push(
          confirmScreen(ctx, screen, {
            title: stop ? "Stop all folding in" : "Resume folding in",
            body: [stop ? "Every trusted source's work waits for review until you resume." : "Trusted sources' work folds in again."],
            actions: [{ label: "Cancel", variant: "ghost" }, { label: stop ? "Stop" : "Resume", variant: "default" }],
            onChoose: (i) => {
              if (i !== 1) return;
              setFoldInStopped(f.app, user, stop);
              ctx.toast(stop ? "Folding in is stopped." : "Folding in resumed.", "success");
              ctx.invalidate();
            },
          }),
        );
        return true;
      }
      if (at === undefined) return false;
      if (e.key === "x") {
        ctx.push(
          confirmScreen(ctx, screen, {
            title: "Remove trust",
            body: [`${at.account} on ${at.host} will wait for review.`],
            actions: [{ label: "Keep", variant: "ghost" }, { label: "Remove", variant: "default" }],
            onChoose: (i) => {
              if (i !== 1) return;
              const gone = removeTrust(f.app, user, at.id);
              ctx.toast(gone.ok ? `${at.account} on ${at.host} now waits for review.` : WORDS.not_found, gone.ok ? "success" : "danger");
              ctx.invalidate();
            },
          }),
        );
        return true;
      }
      if (e.key === "v") {
        ctx.push(
          confirmScreen(ctx, screen, {
            title: "Revert landings",
            body: [`Opens a revert pull for everything ${at.account} on ${at.host} landed, for you to land.`],
            actions: [{ label: "Cancel", variant: "ghost" }, { label: "Open reverts", variant: "default" }],
            onChoose: (i) => {
              if (i !== 1) return;
              runAsync(ctx, async () => {
                const done = await revertBySource(f.app, user, at.host, at.account);
                ctx.toast(done.ok ? `${done.value.opened} revert pull${done.value.opened === 1 ? "" : "s"} opened.` : WORDS.not_found, done.ok ? "success" : "danger");
                ctx.invalidate();
              });
            },
          }),
        );
        return true;
      }
      return false;
    },
  };
  return screen;
}
@@ -9,6 +9,7 @@
import { notePhase, takeSessionTime, timePhaseAsync } from "../../core/route_timing.ts";
import type { Ctx } from "../../http/context.ts";
import { betNamesOfPulls } from "../../core/bets.ts";
import { sourcesOfPulls } from "../../core/trusted_sources.ts";
import { canRead, getRepo, type Repo } from "../../core/repos.ts";
import { newestLive, secondsWords } from "../../keeper/landed.ts";
import { dayHeading, dayOf, daysJs, shippedToday } from "../../release/days.ts";
@@ -30,7 +31,7 @@
function landingRow(l: Landing, own: string | undefined, showRepo: boolean): Htm
  return row({
    href: `/${l.repo}/pulls/${l.number}`,
    title: l.title,
    meta: html`${showRepo || l.repo !== own ? html`${l.repo} · ` : null}#${l.number}${l.bet === undefined ? null : html` · ${badge(l.bet, { variant: "outline" })}`}`,
    meta: html`${showRepo || l.repo !== own ? html`${l.repo} · ` : null}#${l.number}${l.bet === undefined ? null : html` · ${badge(l.bet, { variant: "outline" })}`}${l.from === undefined ? null : html` · folded in from ${l.from}`}`,
    trail: time(l.at),
  });
}
@@ -184,8 +185,15 @@
export async function changelogJson(ctx: Ctx): Promise<Response> {
 */
function withBets(ctx: Ctx, read: Landings, repo: Repo | undefined): { read: Landings; bets: string[]; bet: string } {
  if (repo === undefined) return { read, bets: [], bet: "" };
  const names = betNamesOfPulls(ctx.app.db, repo.id, [...read.live, ...read.onItsWay].filter((l) => l.repo === read.own).map((l) => l.number));
  const mark = (l: Landing): Landing => (l.repo === read.own && names.has(l.number) ? { ...l, bet: names.get(l.number)! } : l);
  const numbers = [...read.live, ...read.onItsWay].filter((l) => l.repo === read.own).map((l) => l.number);
  const names = betNamesOfPulls(ctx.app.db, repo.id, numbers);
  const froms = sourcesOfPulls(ctx.app.db, repo.id, numbers);
  const mark = (l: Landing): Landing => {
    if (l.repo !== read.own) return l;
    const bet = names.get(l.number);
    const from = froms.get(l.number);
    return { ...l, ...(bet === undefined ? {} : { bet }), ...(from === undefined ? {} : { from }) };
  };
  const live = read.live.map(mark);
  const onItsWay = read.onItsWay.map(mark);
  const bets = [...new Set([...live, ...onItsWay].flatMap((l) => (l.bet === undefined ? [] : [l.bet])))].sort();
@@ -93,6 +93,7 @@
export type AccountSection =
  | "spend"
  | "crew"
  | "accounts"
  | "trusted"
  | "people"
  | "subscriptions"
  | "backups"
@@ -137,6 +138,12 @@
export function accountSections(
            icon: "bot" as const,
            current: current === "crew",
          },
          {
            label: "Trusted sources",
            href: "/settings/trusted",
            icon: "lock" as const,
            current: current === "trusted",
          },
          {
            label: "Subscriptions",
            href: "/settings/subscriptions",
@@ -0,0 +1,169 @@
/**
 * Settings → Trusted sources (#8937), for the owner: who may fold in without
 * a person's review, until when; a one-click remove; the kill switch that
 * stops all folding in; and the revert of one source's landings.
 */
import { addTrust, removeTrust, revertBySource, setFoldInStopped } from "../../actions/trusted_sources.ts";
import {
  endsSoon,
  foldInStopped,
  listTrusted,
  type TrustError,
} from "../../core/trusted_sources.ts";
import type { Ctx } from "../../http/context.ts";
import { notFoundPage, settingsLayout, signInFirst } from "../chrome.ts";
import { notePhase, takeSessionTime } from "../../core/route_timing.ts";
import { field, readForm } from "../form.ts";
import { html } from "../html.ts";
import { flashTo, page } from "../layout.ts";
import { badge, btn, card, icon, row, time } from "../ui.ts";
import { accountSections } from "./origins.ts";
function owner(ctx: Ctx): Response | undefined {
  if (!ctx.auth.user) return signInFirst(ctx);
  return ctx.auth.user.isAdmin && ctx.auth.user.kind !== "agent" ? undefined : notFoundPage(ctx);
}
const WORDS: Record<TrustError | "not_found", string> = {
  bad_host: "That is not a forge address.",
  bad_account: "That is not an account name.",
  bad_date: "Give the end as a date, year-month-day.",
  in_the_past: "That date has passed.",
  not_found: "Not found.",
};
// GET /settings/trusted
export function trustedPage(ctx: Ctx): Response {
  notePhase(ctx.request, "session", takeSessionTime(ctx.request));
  const denied = owner(ctx);
  if (denied) return denied;
  const rendering = performance.now();
  const now = new Date();
  const stopped = foldInStopped(ctx.app.db);
  const entries = listTrusted(ctx.app.db);
  const body = html`${card(
      html`<div class="card-body"><p class="muted small">
        Work from a trusted source flows in as it appears and lands by true merge when its checks pass,
        with no person's review. It never skips the check, the boot proof or the walls: a pull touching
        secrets, credentials, permissions, the contract or release machinery still waits for you. Anyone
        else is a guest, and their pull waits on <a href="/review">review</a>. An account name means
        nothing without its forge.
      </p>
      <form method="post" action="/settings/trusted/stop" class="row-fields">
        <input type="hidden" name="stop" value="${stopped ? "0" : "1"}" />
        ${stopped
          ? html`${badge("Folding in is stopped", { variant: "outline" })}
              <span class="muted small">by ${stopped.by}, <time datetime="${stopped.at}">${stopped.at.slice(0, 10)}</time></span>
              ${btn("Resume folding in", { size: "sm" })}`
          : btn("Stop all folding in", { size: "sm", variant: "outline" })}
      </form></div>`,
      { head: html`${icon("lock")}<h2>Fold-in</h2>` },
    )}
    ${card(
      html`<ul class="list setting-list">
        ${entries.length === 0
          ? html`<li class="muted small">No one is trusted. Everyone waits for review.</li>`
          : entries.map((s) => {
              const lapsed = s.until <= now.toISOString();
              return row({
                lead: icon("user"),
                title: html`${s.account} <span class="muted small mono">${s.host}</span>`,
                meta: html`${lapsed ? "Lapsed, waits for review" : "Until"} ${time(s.until)}${
                  !lapsed && endsSoon(s, now) ? " (ends soon)" : ""
                } · set by ${s.setBy}`,
                trail: html`<form class="row-fields" method="post" action="/settings/trusted/${s.id}/remove">
                    ${btn("Remove", { size: "sm", variant: "outline", label: `Remove ${s.account} on ${s.host}` })}
                  </form>
                  <form class="row-fields" method="post" action="/settings/trusted/revert">
                    <input type="hidden" name="host" value="${s.host}" />
                    <input type="hidden" name="account" value="${s.account}" />
                    <label class="muted small"><input type="checkbox" name="confirm" value="1" required /> Open reverts</label>
                    ${btn("Revert landings", { size: "sm", variant: "outline", label: `Revert what ${s.account} on ${s.host} landed` })}
                  </form>`,
              });
            })}
      </ul>`,
      { head: html`${icon("users")}<h2>Trusted sources</h2>`, pad: false },
    )}
    ${card(
      html`<form method="post" action="/settings/trusted" class="stack">
        <label>Account <input class="input" name="account" required maxlength="64" autocomplete="off" /></label>
        <label>Forge <input class="input" name="host" required maxlength="260" placeholder="git.open-platform.sh" autocomplete="off" /></label>
        <label>Until <input class="input" name="until" type="date" required /></label>
        ${btn("Trust", { icon: "check" })}
      </form>`,
      { head: html`${icon("plus")}<h2>Trust a source</h2>` },
    )}`;
  notePhase(ctx.request, "render", performance.now() - rendering);
  return page({
    ctx,
    title: "Trusted sources",
    body: html`<div class="page-head"><h1>Trusted sources</h1></div>
      ${settingsLayout(accountSections("trusted", { admin: true }), body, "Account settings")}`,
  });
}
// POST /settings/trusted
export async function trustedAdd(ctx: Ctx): Promise<Response> {
  const denied = owner(ctx);
  if (denied) return denied;
  const form = await readForm(ctx, "admin");
  if (form instanceof Response) return form;
  const made = addTrust(ctx.app, ctx.auth.user, {
    host: field(form, "host"),
    account: field(form, "account"),
    until: field(form, "until"),
  });
  return flashTo(
    ctx,
    "/settings/trusted",
    made.ok
      ? { message: `${made.value.account} on ${made.value.host} is trusted until ${made.value.until.slice(0, 10)}.` }
      : { tone: "danger", message: WORDS[made.error] },
  );
}
// POST /settings/trusted/:id/remove
export async function trustedRemove(ctx: Ctx): Promise<Response> {
  const denied = owner(ctx);
  if (denied) return denied;
  const form = await readForm(ctx, "admin");
  if (form instanceof Response) return form;
  const gone = removeTrust(ctx.app, ctx.auth.user, ctx.params.id ?? "");
  return flashTo(
    ctx,
    "/settings/trusted",
    gone.ok
      ? { message: `${gone.value.account} on ${gone.value.host} now waits for review.` }
      : { tone: "danger", message: WORDS.not_found },
  );
}
// POST /settings/trusted/stop
export async function trustedStop(ctx: Ctx): Promise<Response> {
  const denied = owner(ctx);
  if (denied) return denied;
  const form = await readForm(ctx, "admin");
  if (form instanceof Response) return form;
  const stop = field(form, "stop") === "1";
  setFoldInStopped(ctx.app, ctx.auth.user, stop);
  return flashTo(ctx, "/settings/trusted", { message: stop ? "Folding in is stopped." : "Folding in resumed." });
}
// POST /settings/trusted/revert
export async function trustedRevert(ctx: Ctx): Promise<Response> {
  const denied = owner(ctx);
  if (denied) return denied;
  const form = await readForm(ctx, "admin");
  if (form instanceof Response) return form;
  if (field(form, "confirm") !== "1")
    return flashTo(ctx, "/settings/trusted", { tone: "danger", message: "Tick “Open reverts” to confirm." });
  const done = await revertBySource(ctx.app, ctx.auth.user, field(form, "host"), field(form, "account"));
  return flashTo(
    ctx,
    "/settings/trusted",
    done.ok
      ? { message: `${done.value.opened} revert pull${done.value.opened === 1 ? "" : "s"} opened for you to land.` }
      : { tone: "danger", message: WORDS.not_found },
  );
}
@@ -44,8 +44,8 @@
export function verbsFor(a: Ask): readonly Verb[] {
  return a.pull !== undefined ? VERBS : a.issue !== undefined ? ["close", "reply"] : [];
}
/** The buttons and boxes under a row, a sibling of its link; `undefined` when it offers none. */
export function actRow(a: Ask): Html | undefined {
/** The buttons and boxes under a row (a guest's pull from another forge says Approve and Decline), a sibling of its link; `undefined` when it offers none. */
export function actRow(a: Ask, guest = false): Html | undefined {
  const verbs = verbsFor(a);
  const number = a.pull?.number ?? a.issue?.number;
  if (verbs.length === 0 || number === undefined) return undefined;
@@ -66,7 +66,7 @@
export function actRow(a: Ask): Html | undefined {
  const quick = verbs.filter((v) => v === "merge" || v === "close");
  return html`<li data-act-forms>
    <div class="form-actions">${quick.map((v) =>
      form(v, btn(v === "merge" ? "Merge" : "Close")),
      form(v, btn(guest ? (v === "merge" ? "Approve" : "Decline") : v === "merge" ? "Merge" : "Close")),
    )}</div>
    ${verbs.includes("changes") ? box("changes", "Request changes: what must change", "Request changes") : null}
    ${box("reply", "Reply", "Reply")}
@@ -20,6 +20,7 @@
import { badge, empty, listCard, row, runStateBadge, time } from "../ui.ts";
import { lookThumb, lookThumbPlain, thumbLook } from "../pages/looks.ts";
import { stepOfStored } from "../../flow/path.ts";
import { stepLink } from "./step_link.ts";
import { isTrusted, pullSourceOf } from "../../core/trusted_sources.ts";
import { actRow, rowId } from "./review_act.ts";
import { reviewSet } from "./review_set.ts";
import { staleArchive } from "./review_stale.ts";
@@ -121,7 +122,9 @@
export function reviewPage(ctx: Ctx): Response {
        : stat === "failed"
        ? " · Diff size unavailable — open the pull to see it"
        : "";
    const act = actRow(a);
    const from = a.pull === undefined ? undefined : pullSourceOf(ctx.app.db, a.pull.id);
    // A guest's pull from another forge says Approve and Decline; a trusted source's (here for a wall) is a person's plain Merge.
    const act = actRow(a, from !== undefined && !isTrusted(ctx.app.db, from.host, from.account));
    const step = a.pull === undefined ? null : stepOfStored(ctx.app.db, a.repo, a.pull);
    return row({
      href,
@@ -72,6 +72,7 @@
test("a site-admin person is offered the whole roster", () => {
    ["decider", "Decider", "what it closed, deferred and asked you about today"],
    ["notify", "Phone notifications", "where the crew reaches your phone; s sets, x turns off"],
    ["confirms", "Confirms", "what the forge's agent asked to do; y does it once"],
    ["trusted", "Trusted sources", "who folds in without review; a trusts, x removes, s stops all, v reverts"],
    ["conversations", "Conversations", "your talks with the forge's agent; n starts one, r renames, x archives"],
    ["ssh-keys", "SSH keys", "list, add and remove the keys that sign in as you"],
    ["passkeys", "Passkeys", "the passkeys that sign in as you"],
@@ -0,0 +1,291 @@
/**
 * Folding in, end to end (#8937): the autonomy tick's own sweep admits a
 * trusted source's pull and lands it by true merge, offline, with the check
 * and the boot proof still standing and the walls still sending a pull back
 * to a person; a ring of forges stops itself; and the doors refuse a stranger.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { openPull } from "../src/actions/pulls.ts";
import { commitToBranch, createRepo } from "../src/actions/repos.ts";
import { addTrust, setFoldInStopped } from "../src/actions/trusted_sources.ts";
import { createApp, type App } from "../src/app.ts";
import { provideChecksForTest, type ChecksHandle } from "../src/checks/service.ts";
import { createSession } from "../src/core/sessions.ts";
import { getPull, type Pull } from "../src/core/pulls.ts";
import { getRepoById, type Repo } from "../src/core/repos.ts";
import { claimRun, createRun, finishRun } from "../src/core/runs.ts";
import { ownHost, recordPullSource, takeable, viaOf } from "../src/core/trusted_sources.ts";
import { createUser, type User } from "../src/core/users.ts";
import { landingStrategy, sweepGreen } from "../src/crew/autonomy.ts";
import { runGitCapture } from "../src/git/env.ts";
import { repoDir } from "../src/git/repos.ts";
import { serve } from "../src/http/server.ts";
import { logLevel, setLogLevel } from "../src/kernel/log.ts";
interface Forge {
  readonly app: App;
  readonly alice: User;
  readonly repo: Repo;
  readonly gated: string[];
  readonly dir: string;
}
const FROM = "git.open-platform.sh";
const dirs: string[] = [];
const apps: App[] = [];
let level: ReturnType<typeof logLevel>;
async function forge(host: string): Promise<Forge> {
  const dir = await mkdtemp(join(tmpdir(), "forge-fold-"));
  dirs.push(dir);
  const app = createApp({ dataDir: dir, port: 0, host });
  apps.push(app);
  const a = await createUser(app.db, {
    origin: "seed",
    trusted: true,
    username: "alice",
    email: "[email protected]",
    password: "a-good-passphrase",
    isAdmin: true,
  });
  if (!a.ok) throw new Error(a.error);
  const gated: string[] = [];
  provideChecksForTest(app, {
    gate: async (_repo: Repo, _pull: Pull, commitOid: string) => {
      gated.push(commitOid);
      return { ok: true, error: "", lines: [] };
    },
    spareSlots: () => 0,
  } as unknown as ChecksHandle);
  const made = await createRepo(app, a.value, { name: "lib", visibility: "private" });
  if (!made.ok) throw new Error(String(made.error));
  const seeded = await commitToBranch(app, a.value, made.value, {
    message: "Start",
    files: [
      { path: "README.md", content: "# lib\n" },
      { path: "forge.json", content: JSON.stringify({ check: { run: "true", fast: "true" } }) },
    ],
  });
  if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
  app.db.query("UPDATE repo SET autonomy = 'autonomous', autonomy_by = ?2 WHERE id = ?1").run(made.value.id, a.value.id);
  const trusted = addTrust(app, a.value, { host: FROM, account: "jmoran", until: "2099-12-02" });
  if (!trusted.ok) throw new Error(trusted.error);
  return { app, alice: a.value, repo: getRepoById(app.db, made.value.id)!, gated, dir };
}
/** A pull from `source` (the follow's stamp), written by an outsider so only trust can land it; its check `state`, if any. */
async function pullFrom(
  f: Forge,
  branch: string,
  file: string,
  source: { host: string; account: string; via?: string[] },
  check: "ok" | "failed" | "none" = "ok",
): Promise<Pull> {
  const pushed = await commitToBranch(f.app, f.alice, f.repo, {
    branch,
    base: "main",
    message: `Add ${file}`,
    files: [{ path: file, content: "export const n = 1;\n" }],
  });
  if (!pushed.ok) throw new Error(JSON.stringify(pushed.error));
  const opened = await openPull(f.app, f.alice, f.repo, { title: branch, baseBranch: "main", headBranch: branch });
  if (!opened.ok) throw new Error(String(opened.error));
  f.app.db.query("UPDATE issue SET origin_author = 'outsider' WHERE id = ?1").run(opened.value.id);
  recordPullSource(f.app.db, { pullId: opened.value.id, host: source.host, account: source.account, via: source.via ?? [] });
  const pull = getPull(f.app.db, f.repo.id, opened.value.number)!;
  if (check !== "none") {
    const run = createRun(f.app.db, {
      repoId: f.repo.id,
      kind: "check",
      issueId: pull.id,
      env: `pull-${pull.number}`,
      commitOid: pull.headOid,
      reason: "pull",
    });
    claimRun(f.app.db, run.id);
    finishRun(f.app.db, run.id, { state: check, summary: check });
  }
  return pull;
}
const merged = (f: Forge, pull: Pull): boolean => getPull(f.app.db, f.repo.id, pull.number)!.mergedAt !== null;
async function mergeMessage(f: Forge): Promise<string> {
  const dir = repoDir(f.app.reposRoot, f.repo.ownerName, f.repo.name);
  return (await runGitCapture(["log", "-1", "--format=%B", "refs/heads/main"], { cwd: dir })).stdout;
}
beforeAll(() => {
  level = logLevel();
  setLogLevel("error");
});
afterAll(async () => {
  setLogLevel(level);
  for (const app of apps) await app.close?.();
  for (const dir of dirs) await rm(dir, { recursive: true, force: true });
});
describe("the tick's sweep admits a trusted source's pull", () => {
  let f: Forge;
  beforeAll(async () => {
    f = await forge("forge.test");
  });
  test("it lands by true merge, offline, with the check and the boot proof run and a credit trailer", async () => {
    const pull = await pullFrom(f, "t/fine", "src/fine.ts", { host: FROM, account: "jmoran" });
    const realFetch = globalThis.fetch;
    globalThis.fetch = (() => {
      throw new Error("folding reached the network");
    }) as unknown as typeof fetch;
    try {
      expect(await sweepGreen(f.app, f.repo)).toBe(1);
    } finally {
      globalThis.fetch = realFetch;
    }
    expect(merged(f, pull)).toBe(true);
    expect(f.gated.length).toBe(1);
    const message = await mergeMessage(f);
    expect(message).toContain(`Landed-from: jmoran@${FROM}`);
    expect(viaOf(message)).toEqual([FROM, "forge.test"]);
    const dir = repoDir(f.app.reposRoot, f.repo.ownerName, f.repo.name);
    const parents = (await runGitCapture(["log", "-1", "--format=%P", "refs/heads/main"], { cwd: dir })).stdout.trim().split(" ");
    expect(parents.length).toBe(2);
  });
  test("a pull with no check yet, or a red one, goes back", async () => {
    const none = await pullFrom(f, "t/nocheck", "src/nocheck.ts", { host: FROM, account: "jmoran" }, "none");
    const red = await pullFrom(f, "t/red", "src/red.ts", { host: FROM, account: "jmoran" }, "failed");
    expect(await sweepGreen(f.app, f.repo)).toBe(0);
    expect(merged(f, none)).toBe(false);
    expect(merged(f, red)).toBe(false);
  });
  test("a pull touching the walls goes back to a person, green or not, with the reason on the ledger", async () => {
    const pull = await pullFrom(f, "t/wall", "src/crew/fold_walls.ts", { host: FROM, account: "jmoran" });
    expect(await sweepGreen(f.app, f.repo)).toBe(0);
    expect(merged(f, pull)).toBe(false);
    const row = f.app.db
      .query<{ answer: string; state: string }, [string]>("SELECT answer, state FROM decision WHERE kind = 'land' AND issue_id = ?1")
      .get(pull.id);
    expect(row?.answer).toBe("wall");
    expect(row?.state).toContain("permissions or the contract's walls");
  });
  test("a pull at a path nobody listed goes back too", async () => {
    const pull = await pullFrom(f, "t/root", "Makefile", { host: FROM, account: "jmoran" });
    expect(await sweepGreen(f.app, f.repo)).toBe(0);
    expect(merged(f, pull)).toBe(false);
  });
  test("a stranger's, the same name on another forge, waits for review", async () => {
    const pull = await pullFrom(f, "t/stranger", "src/stranger.ts", { host: "evil.example", account: "jmoran" });
    expect(await sweepGreen(f.app, f.repo)).toBe(0);
    expect(merged(f, pull)).toBe(false);
  });
  test("the kill switch holds a green trusted pull until folding resumes", async () => {
    const pull = await pullFrom(f, "t/stop", "src/stop.ts", { host: FROM, account: "jmoran" });
    setFoldInStopped(f.app, f.alice, true);
    expect(await sweepGreen(f.app, f.repo)).toBe(0);
    expect(merged(f, pull)).toBe(false);
    setFoldInStopped(f.app, f.alice, false);
    expect(await sweepGreen(f.app, f.repo)).toBe(1);
    expect(merged(f, pull)).toBe(true);
  });
  test("a lapsed trust is not honoured at the tick's own time", async () => {
    const pull = await pullFrom(f, "t/lapsed", "src/lapsed.ts", { host: FROM, account: "jmoran" });
    expect(await sweepGreen(f.app, f.repo, new Date("2100-01-01T00:00:00Z"))).toBe(0);
    expect(merged(f, pull)).toBe(false);
  });
});
describe("a ring of three forges", () => {
  test("each lands the work once and the third's hand-back to the first is refused", async () => {
    const ring = [await forge("a.test"), await forge("b.test"), await forge("c.test")];
    let via: string[] = [];
    let from = FROM;
    const taken: string[] = [];
    for (let hop = 0; hop < 6; hop++) {
      const f = ring[hop % 3]!;
      const self = ownHost(f.app.config);
      // What the follow checks before it opens anything.
      if (!takeable(via, self)) break;
      addTrust(f.app, f.alice, { host: from, account: "jmoran", until: "2099-12-02" });
      const pull = await pullFrom(f, `ring/${hop}`, `src/ring${hop}.ts`, { host: from, account: "jmoran", via });
      expect(await sweepGreen(f.app, f.repo)).toBe(1);
      expect(merged(f, pull)).toBe(true);
      via = viaOf(await mergeMessage(f));
      from = self;
      taken.push(self);
    }
    expect(taken).toEqual(["a.test", "b.test", "c.test"]);
    expect(via).toEqual([FROM, "a.test", "b.test", "c.test"]);
  });
});
describe("the doors", () => {
  test("a non-admin is refused every change; the review page labels a guest's pull Approve and a walled trusted one Merge", async () => {
    const f = await forge("doors.test");
    const bob = await createUser(f.app.db, { origin: "seed", trusted: true, username: "bob", email: "[email protected]", password: "a-good-passphrase" });
    if (!bob.ok) throw new Error(bob.error);
    const servers = await serve(f.app);
    try {
      const as = (u: User) => ({ cookie: `forge_session=${createSession(f.app.db, u.id).token}`, origin: servers.url });
      const post = (path: string, u: User, body: string) =>
        fetch(`${servers.url}${path}`, {
          method: "POST",
          redirect: "manual",
          headers: { ...as(u), "content-type": "application/x-www-form-urlencoded" },
          body,
        });
      for (const [path, body] of [
        ["/settings/trusted", "account=zed&host=x.test&until=2099-01-01"],
        ["/settings/trusted/stop", "stop=1"],
        ["/settings/trusted/revert", `host=${FROM}&account=jmoran&confirm=1`],
        ["/settings/trusted/anything/remove", ""],
      ] as const) {
        const res = await post(path, bob.value, body);
        await res.arrayBuffer();
        expect(res.status).toBe(404);
      }
      const { listTrusted, foldInStopped } = await import("../src/core/trusted_sources.ts");
      expect(listTrusted(f.app.db).map((s) => s.account)).toEqual(["jmoran"]);
      expect(foldInStopped(f.app.db)).toBeUndefined();
      // The revert asks first: no tick, no reverts.
      const unasked = await post("/settings/trusted/revert", f.alice, `host=${FROM}&account=jmoran`);
      await unasked.arrayBuffer();
      expect(f.app.db.query("SELECT COUNT(*) AS n FROM event WHERE kind = 'trust.reverted'").get()).toEqual({ n: 0 });
      // Assisted, so a green pull waits on /review: a trusted source's that hit a wall is a person's plain Merge …
      f.app.db.query("UPDATE repo SET autonomy = 'assisted' WHERE id = ?1").run(f.repo.id);
      await pullFrom(f, "g/walled", "src/crew/autonomy.ts", { host: FROM, account: "jmoran" });
      const walled = await (await fetch(`${servers.url}/review`, { headers: as(f.alice) })).text();
      expect(walled).toContain("g/walled");
      expect(walled).toContain(">\n    Merge");
      expect(walled).not.toContain("Approve");
      // … and a guest's, from a source nobody trusts, says Approve and Decline.
      await pullFrom(f, "g/guest", "src/guest.ts", { host: "evil.example", account: "zed" });
      const both = await (await fetch(`${servers.url}/review`, { headers: as(f.alice) })).text();
      expect(both).toContain("Approve");
      expect(both).toContain("Decline");
    } finally {
      servers.stop();
    }
  });
});
describe("the landing reads the clock it is given", () => {
  test("a trusted source's pull merges while the trust holds, and squashes once it has lapsed", async () => {
    const f = await forge("clock.test");
    const pull = await pullFrom(f, "g/clock", "src/clock.ts", { host: FROM, account: "jmoran" });
    const dir = repoDir(f.app.reposRoot, f.repo.ownerName, f.repo.name);
    const base = (await runGitCapture(["rev-parse", "refs/heads/main"], { cwd: dir })).stdout.trim();
    expect(await landingStrategy(f.app, f.repo, pull, base, new Date("2099-12-01T00:00:00Z"))).toBe("merge");
    expect(await landingStrategy(f.app, f.repo, pull, base, new Date("2099-12-03T00:00:00Z"))).toBe("squash");
  });
});
@@ -0,0 +1,242 @@
/** Trusted sources fold in by themselves (#8937): trust skips the person, nothing else. */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { openPull } from "../src/actions/pulls.ts";
import { addTrust, removeTrust, setFoldInStopped } from "../src/actions/trusted_sources.ts";
import { commitToBranch, createRepo } from "../src/actions/repos.ts";
import { createApp, type App } from "../src/app.ts";
import { pullMayRun } from "../src/core/pull_trust.ts";
import { getPull } from "../src/core/pulls.ts";
import type { Repo } from "../src/core/repos.ts";
import {
  dueWarning,
  foldsIn,
  isTrusted,
  listTrusted,
  pullSourceOf,
  recordPullSource,
  sourceOfUrl,
  sourceTrailers,
  takeable,
  trustSource,
  viaOf,
} from "../src/core/trusted_sources.ts";
import type { User } from "../src/core/users.ts";
import { landsOnItsOwn } from "../src/crew/direct.ts";
import { warnExpiring } from "../src/crew/fold_in.ts";
import { wallsTouched } from "../src/crew/fold_walls.ts";
import { quietLogs } from "./helpers/globals.ts";
import { seedAdmin } from "./helpers/admin.ts";
quietLogs();
let dataDir = "";
let app: App;
let alice: User;
let repo: Repo;
beforeAll(async () => {
  dataDir = await mkdtemp(join(tmpdir(), "forge-trusted-"));
  app = createApp({ dataDir, port: 0, host: "forge.test" });
  const made = await seedAdmin(app, { username: "alice", email: "[email protected]", password: "correct-horse-battery" });
  if (!made.ok) throw new Error(made.error);
  alice = made.value;
  const r = await createRepo(app, alice, { name: "lib", visibility: "public" });
  if (!r.ok) throw new Error(String(r.error));
  repo = r.value;
  const first = await commitToBranch(app, alice, repo, { message: "First", files: [{ path: "README.md", content: "hi\n" }] });
  if (!first.ok) throw new Error(JSON.stringify(first.error));
  // The owner's list is theirs to fill: nothing is trusted until an owner action says so.
  expect(listTrusted(app.db)).toEqual([]);
  for (const who of ["tdobbertin-espo", "jmoran", "benjivers"])
    if (!addTrust(app, alice, { host: "git.open-platform.sh", account: who, until: "2099-12-02" }).ok) throw new Error(who);
});
afterAll(async () => {
  app.close();
  await rm(dataDir, { recursive: true, force: true });
});
const HOST = "git.open-platform.sh";
describe("the list", () => {
  test("nothing is trusted until an owner says so, then the name on that forge only", () => {
    const now = new Date("2026-11-03T00:00:00Z");
    for (const who of ["tdobbertin-espo", "jmoran", "benjivers"]) {
      expect(isTrusted(app.db, HOST, who, now)).toBe(true);
      expect(isTrusted(app.db, "evil.example", who, now)).toBe(false);
    }
    expect(listTrusted(app.db).every((s) => s.until.startsWith("2099-12-02"))).toBe(true);
  });
  test("expiry falls to review on its own, with a note 3 days before, once", () => {
    expect(isTrusted(app.db, HOST, "jmoran", new Date("2099-12-03T00:00:00Z"))).toBe(false);
    expect(dueWarning(app.db, new Date("2099-11-20T00:00:00Z"))).toEqual([]);
    expect(dueWarning(app.db, new Date("2099-11-30T00:00:00Z")).length).toBe(3);
    expect(warnExpiring(app, new Date("2099-11-30T00:00:00Z"))).toBe(3);
    expect(warnExpiring(app, new Date("2099-11-30T01:00:00Z"))).toBe(0);
    expect(app.db.query("SELECT COUNT(*) AS n FROM event WHERE kind = 'trust.expiring'").get()).toEqual({ n: 3 });
  });
  test("a change is audited, only an admin person may make it, and input is validated", () => {
    const bob = { ...alice, id: "x", isAdmin: false };
    expect(addTrust(app, bob, { host: HOST, account: "zed", until: "2027-01-01" }).ok).toBe(false);
    expect(addTrust(app, alice, { host: "no spaces", account: "zed", until: "2027-01-01" })).toEqual({ ok: false, error: "bad_host" });
    expect(addTrust(app, alice, { host: HOST, account: "../x", until: "2027-01-01" })).toEqual({ ok: false, error: "bad_account" });
    expect(addTrust(app, alice, { host: HOST, account: "zed", until: "soon" })).toEqual({ ok: false, error: "bad_date" });
    expect(addTrust(app, alice, { host: HOST, account: "zed", until: "2020-01-01" })).toEqual({ ok: false, error: "in_the_past" });
    const added = addTrust(app, alice, { host: `https://${HOST}/`, account: "@Zed", until: "2027-01-01" });
    if (!added.ok) throw new Error(added.error);
    expect(added.value).toMatchObject({ host: HOST, account: "zed", setBy: "alice" });
    const removed = removeTrust(app, alice, added.value.id);
    expect(removed.ok).toBe(true);
    expect(isTrusted(app.db, HOST, "zed")).toBe(false);
    const kinds = app.db.query<{ kind: string }, []>("SELECT kind FROM event WHERE kind LIKE 'trust.%'").all().map((e) => e.kind);
    expect(kinds).toContain("trust.set");
    expect(kinds).toContain("trust.removed");
  });
});
describe("what trust skips, and what it never does", () => {
  const push = async (branch: string, path: string) => {
    const done = await commitToBranch(app, alice, repo, {
      branch,
      message: path,
      files: [{ path, content: "x\n" }],
    });
    if (!done.ok) throw new Error(JSON.stringify(done.error));
    return done.value.commitOid;
  };
  const pullFrom = async (branch: string, account: string, host = HOST) => {
    await push(branch, `${branch}.md`);
    const opened = await openPull(app, alice, repo, { title: branch, baseBranch: "main", headBranch: branch });
    if (!opened.ok) throw new Error(String(opened.error));
    recordPullSource(app.db, { pullId: opened.value.id, host, account, via: [] });
    return getPull(app.db, repo.id, opened.value.number)!;
  };
  test("a trusted source's pull lands without a person, a guest's does not", async () => {
    const trusted = await pullFrom("t/one", "jmoran");
    const guest = await pullFrom("t/two", "jmoran", "other.example");
    expect(foldsIn(app.db, trusted.id)).toBe(true);
    expect(landsOnItsOwn(app.db, repo, trusted)).toBe(true);
    expect(foldsIn(app.db, guest.id)).toBe(false);
    expect(pullMayRun(app.db, repo, trusted, trusted.headOid)).toBe(true);
  });
  test("the kill switch stops all folding in, and resuming restores it", async () => {
    const pull = await pullFrom("t/three", "benjivers");
    expect(foldsIn(app.db, pull.id)).toBe(true);
    expect(setFoldInStopped(app, alice, true).ok).toBe(true);
    expect(foldsIn(app.db, pull.id)).toBe(false);
    setFoldInStopped(app, alice, false);
    expect(foldsIn(app.db, pull.id)).toBe(true);
  });
  test("an expired source's pull waits for review", async () => {
    const pull = await pullFrom("t/four", "tdobbertin-espo");
    expect(foldsIn(app.db, pull.id, new Date("2100-01-01T00:00:00Z"))).toBe(false);
  });
  const walls: [string, string][] = [
    [".env", "secrets or credentials"],
    ["config/secrets.json", "secrets or credentials"],
    ["deploy/server.pem", "secrets or credentials"],
    ["src/core/sessions.ts", "secrets or credentials"],
    ["src/core/roles.ts", "permissions or the contract's walls"],
    ["src/contract/walls.ts", "permissions or the contract's walls"],
    ["src/core/pull_trust.ts", "permissions or the contract's walls"],
    ["src/crew/fold_walls.ts", "permissions or the contract's walls"],
    ["src/crew/autonomy.ts", "permissions or the contract's walls"],
    ["src/core/event_audience.ts", "permissions or the contract's walls"],
    ["src/actions/trusted_sources.ts", "permissions or the contract's walls"],
    ["src/http/passport_auth.ts", "permissions or the contract's walls"],
    ["src/core/migrations/20270101000000-x.ts", "release machinery"],
    ["src/core/migration-pins/20270101000000-x.pin", "release machinery"],
    ["scripts/cut-release.ts", "release machinery"],
    ["forge.json", "release machinery"],
    ["Dockerfile", "release machinery"],
  ];
  for (const [file, why] of walls)
    test(`a pull touching ${file} still waits for a person`, () => {
      expect(wallsTouched([file])).toEqual([`a trusted source's pull touches ${why}`]);
    });
  test("ordinary files are no wall", () => {
    expect(wallsTouched(["src/web/pages/home.ts", "README.md", "test/a.test.ts", "docs/a.md"])).toEqual([]);
  });
  test("a path nobody listed waits for a person: an allowlist, not a denylist", () => {
    expect(wallsTouched(["scripts/new-thing.ts"]).length).toBe(1);
    expect(wallsTouched(["AGENTS.md"]).length).toBe(1);
    expect(wallsTouched(["somewhere/else.txt"]).length).toBe(1);
  });
  test("a pull's source is stamped once: a later claim never rewrites it", async () => {
    const pull = await pullFrom("t/stamp", "jmoran");
    recordPullSource(app.db, { pullId: pull.id, host: "evil.example", account: "mallory", via: [] });
    expect(pullSourceOf(app.db, pull.id)).toMatchObject({ host: HOST, account: "jmoran" });
  });
});
describe("a ring of forges", () => {
  test("work that passed through a forge is not taken by it again", () => {
    const names = ["a.test", "b.test", "c.test"];
    // A lands work by someone on x.test; B follows A, C follows B, A follows C.
    let via: string[] = [];
    let origin = "x.test";
    const trail: string[] = [];
    for (let hop = 0; hop < 6; hop++) {
      const self = names[hop % 3]!;
      if (!takeable(via, self)) break;
      const trailers = sourceTrailers({ pullId: "p", host: origin, account: "jmoran", via }, self);
      via = viaOf(`Merge\n\n${trailers}`);
      origin = self;
      trail.push(self);
    }
    expect(trail).toEqual(["a.test", "b.test", "c.test"]);
    expect(via).toEqual(["x.test", "a.test", "b.test", "c.test"]);
  });
  test("a landing says where it came from", () => {
    const text = sourceTrailers({ pullId: "p", host: HOST, account: "jmoran", via: [] }, "forge.test");
    expect(text).toContain(`Landed-from: jmoran@${HOST}`);
    expect(viaOf(text)).toEqual([HOST, "forge.test"]);
  });
  test("an upstream's address names its forge and account", () => {
    expect(sourceOfUrl(`https://${HOST}/jmoran/app.git`)).toEqual({ host: HOST, account: "jmoran" });
    expect(sourceOfUrl("ssh://x/y")).toBeUndefined();
  });
  test("a pull's source is read back", () => {
    recordPullSource(app.db, { pullId: "zz", host: HOST, account: "jmoran", via: ["a.test"] });
    expect(pullSourceOf(app.db, "zz")?.via).toEqual(["a.test"]);
    expect(trustSource(app.db, { host: HOST, account: "q", until: "2020-01-01", setBy: "t" })).toBe("in_the_past");
  });
});
describe("the settings page", () => {
  test("lists the entries with a one-click remove and refuses a stranger", async () => {
    const { serve } = await import("../src/http/server.ts");
    const { createSession } = await import("../src/core/sessions.ts");
    const servers = await serve(app);
    try {
      const anon = await fetch(`${servers.url}/settings/trusted`, { redirect: "manual" });
      await anon.arrayBuffer();
      expect(anon.status).not.toBe(200);
      const res = await fetch(`${servers.url}/settings/trusted`, {
        headers: { cookie: `forge_session=${createSession(app.db, alice.id).token}` },
      });
      const text = await res.text();
      expect(res.status).toBe(200);
      expect(text).toContain("tdobbertin-espo");
      expect(text).toContain("/remove");
      expect(text).toContain("Stop all folding in");
    } finally {
      servers.stop();
    }
  });
});
@@ -0,0 +1,140 @@
/**
 * Trusted sources in the terminal (#8937): a forge admin who is a person is
 * offered the screen, `a` trusts, `x` removes, `s` stops and resumes folding
 * in, `v` opens reverts — each through `actions/trusted_sources.ts`, so each
 * leaves the web's event. Anyone else is not offered it, and its keys do
 * nothing when it is pushed anyway.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { foldInStopped, listTrusted, trustSource } from "../src/core/trusted_sources.ts";
import { createUser, type User } from "../src/core/users.ts";
import { createForgeApp } from "../src/tui/forge.ts";
import { trustedScreen } from "../src/tui/screens/trusted.ts";
import { headlessTerminal } from "../src/tui/term/terminal.ts";
import { quietLogs } from "./helpers/globals.ts";
import { settleApp } from "./helpers/tui.ts";
quietLogs();
const ENTER = "\r";
const RIGHT = "\x1b[C";
let dir: string;
let app: App;
let ada: User; // the forge admin
let bob: User; // signed in, not an admin
const identity = (user: User) => ({ sshUsername: user.username, remoteAddress: "127.0.0.1", fingerprint: "SHA256:test", user });
const events = (kind: string): number =>
  app.db.query<{ n: number }, [string]>("SELECT COUNT(*) AS n FROM event WHERE kind = ?1").get(kind)!.n;
/** Opens the screen as `user`, feeds each key in turn, and returns what is drawn. */
async function drive(user: User, keys: readonly string[] = []) {
  const terminal = headlessTerminal(120, 30);
  const { app: tui, session } = createForgeApp(app, identity(user), { terminal, exitHooks: false });
  tui.start();
  const offered = tui.commands.some((c) => c.id === "trusted");
  tui.ctx.push(trustedScreen(session, tui.ctx));
  await settleApp(tui);
  for (const key of keys) {
    terminal.feed(key);
    await settleApp(tui);
  }
  const text = tui.screen.toText();
  tui.stop?.();
  return { offered, text };
}
beforeAll(async () => {
  dir = await mkdtemp(join(tmpdir(), "forge-tui-trusted-"));
  app = createApp({ dataDir: dir, port: 0 });
  const mk = async (username: string, first = false) => {
    const r = await createUser(app.db, {
      origin: "seed",
      trusted: true,
      username,
      email: `${username}@forge.local`,
      password: "a-good-passphrase",
      adminIfFirst: first,
    });
    if (!r.ok) throw new Error(r.error);
    return r.value;
  };
  ada = await mk("ada", true);
  bob = await mk("bob");
}, 30_000);
afterAll(async () => {
  app.close();
  await rm(dir, { recursive: true, force: true });
});
describe("trusted sources in the terminal", () => {
  test("a non-admin is not offered the screen, and its keys change nothing", async () => {
    const made = trustSource(app.db, { host: "elsewhere.test", account: "zed", until: "2099-01-01", setBy: "ada" });
    if (typeof made === "string") throw new Error(made);
    const { offered, text } = await drive(bob, ["a", "zoe elsewhere.test 2099-01-01", ENTER, "x", RIGHT, ENTER, "s", RIGHT, ENTER, "v", RIGHT, ENTER]);
    expect(offered).toBe(false);
    expect(text).toContain("Only a forge admin changes who is trusted.");
    expect(text).not.toContain("zed");
    expect(listTrusted(app.db).map((s) => s.account)).toEqual(["zed"]);
    expect(foldInStopped(app.db)).toBeUndefined();
    for (const kind of ["trust.set", "trust.removed", "foldin.stopped", "trust.reverted"]) expect(events(kind)).toBe(0);
    app.db.query("DELETE FROM trusted_source").run();
  });
  test("an admin is offered it; a trusts a source until a date", async () => {
    const { offered, text } = await drive(ada, ["a", "jmoran git.open-platform.sh 2099-12-02", ENTER]);
    expect(offered).toBe(true);
    expect(text).toContain("jmoran  git.open-platform.sh");
    expect(text).toContain("until 2099-12-02");
    expect(listTrusted(app.db).map((s) => [s.account, s.host])).toEqual([["jmoran", "git.open-platform.sh"]]);
    expect(events("trust.set")).toBe(1);
  });
  test("a refuses a bad entry with the page's sentence and trusts nobody", async () => {
    const { text } = await drive(ada, ["a", "jmoran git.open-platform.sh 2001-01-01", ENTER]);
    expect(text).toContain("That date has passed.");
    expect(listTrusted(app.db)).toHaveLength(1);
    expect(events("trust.set")).toBe(1);
  });
  test("s stops all folding in after a confirm, and s again resumes it", async () => {
    // Cancel is the default: Enter alone stops nothing.
    await drive(ada, ["s", ENTER]);
    expect(foldInStopped(app.db)).toBeUndefined();
    const stopped = await drive(ada, ["s", RIGHT, ENTER]);
    expect(foldInStopped(app.db)?.by).toBe("ada");
    expect(stopped.text).toContain("Folding in is stopped (by ada)");
    expect(events("foldin.stopped")).toBe(1);
    await drive(ada, ["s", RIGHT, ENTER]);
    expect(foldInStopped(app.db)).toBeUndefined();
    expect(events("foldin.resumed")).toBe(1);
  });
  test("v opens reverts for the source under the cursor after a confirm", async () => {
    await drive(ada, ["v", ENTER]);
    expect(events("trust.reverted")).toBe(0);
    await drive(ada, ["v", RIGHT, ENTER]);
    const said = app.db
      .query<{ payload: string }, []>("SELECT payload FROM event WHERE kind = 'trust.reverted'")
      .all()
      .map((e) => JSON.parse(e.payload));
    expect(said).toHaveLength(1);
    expect(said[0]).toMatchObject({ account: "jmoran", host: "git.open-platform.sh", opened: 0 });
  });
  test("x removes the source under the cursor after a confirm", async () => {
    await drive(ada, ["x", ENTER]);
    expect(listTrusted(app.db)).toHaveLength(1);
    const { text } = await drive(ada, ["x", RIGHT, ENTER]);
    expect(listTrusted(app.db)).toHaveLength(0);
    expect(text).not.toContain("jmoran  git.open-platform.sh");
    expect(events("trust.removed")).toBe(1);
  });
});
		@@ -100,6 +100,7 @@ Machine routes are not pages and have no entry: `/audit.csv`,
100	100	- `/settings/capacity` — `pages/capacity.ts` · how many runs and checks go at once · `/admin/limits`, `/settings/usage` · none seen.
101	101	- `/settings/usage` — `pages/usage.ts` · route patterns by use, unused first · `/settings/telemetry`, `/board/returns` · none seen. Not about cost, despite the name.
102	102	- `/settings/telemetry` — `pages/telemetry.ts` · which agents may read telemetry · `/settings/crew` (agent grants) · none seen.
	103	- `/settings/trusted` — `pages/trusted.ts` · who may fold in without review, until when, and the kill switch · `/review`, `/settings/crew` · none seen.
103	104	- `/settings/spend` — `pages/spend-tab.ts` · what the crew's runs spent, by credential, app, agent, issue and run kind · `/settings/subscriptions`, `/board/returns` · none seen. First tab of Usage (#2692).
104	105	- `/settings/resilience` — `pages/domains.ts` · failure domains and their last drill · `/resilience` · none seen.
105	106	- `/settings/backups` — `pages/backups.ts` (621 lines) · backups and restore · `/settings/resilience`, `/releases` · none seen.
		@@ -0,0 +1,14 @@
	1	# Trusted sources (#8937)
	2
	3	Settings → Trusted sources lists who folds in without a person's review: an account on a named forge, until a date, set by whom. The same name on another forge is a stranger. Remove is one click; past its date an entry falls to review by itself, with a `trust.expiring` note 3 days before. Every change is an event (`trust.set`, `trust.removed`). The list starts empty: an owner fills it (nothing is seeded by a migration).
	4
	5	A trusted source's pull (recorded in `pull_source`, from a followed upstream's address) is admitted by the autonomy tick like the crew's own: its check, the boot proof and the walls still stand, then it lands by true merge with `Landed-from` / `Landed-via` trailers. The walls (`src/crew/fold_walls.ts`) are an allowlist: a trusted pull may change `src/`, `test/`, `docs/`, `examples/` and the README; any other path waits for a person, and so do secrets, credentials, permissions, the contract, release machinery, every migration and the machinery that enforces these walls (fold-in, autonomy, the trust list's actions, page and screen, the auth routes, event audiences). Everyone else is a guest: nothing runs with secrets and the pull waits on `/review` with Approve and Decline.
	6
	7	Work whose `Landed-via` already names this forge is not taken again, so forges following each other in a ring do not re-land it. The kill switch ("Stop all folding in") ends all of it at once; "Revert landings" opens a revert pull for everything one source landed.
	8
	9
	10	Where it comes from. A pull is stamped with its source only when the upstream follow opens it, from the followed address (`https://forge/account/repo`), once; a person's or a guest's pull under the same branch name is never stamped. The account is the owner of the followed repository, not a verified commit author: trust is "work from the repository this account owns", and commits keep whatever author they carry. There is no other intake: the autonomy tick's sweep is how it lands.
	11
	12	Visible. A landing carries `Landed-from` / `Landed-via` trailers, the `pull.merged` event names `source`, and the changelog (which swaps live when a pull merges) credits the row "folded in from account@forge".
	13
	14	Both doors. Settings → Trusted sources on the web, and Trusted sources in the terminal's command palette (a forge admin's): `a` trusts, `x` removes, `s` is the kill switch (stop or resume), `v` reverts what the one under the cursor landed. Both ask before reverting, and both go through `src/actions/trusted_sources.ts`.
		@@ -81,6 +81,7 @@ import {
81	81	import { canWrite } from "../core/repos.ts";
82	82	import { refreshPullHead as refreshHead } from "../core/following.ts";
83	83	import { carryBranchThrough } from "../origins/push-through.ts";
	84	import { ownHost, pullSourceOf, sourceTrailers } from "../core/trusted_sources.ts";
84	85
85	86	export interface OpenPullInput {
86	87	title: string;
		@@ -402,10 +403,14 @@ export async function mergePull(
402	403	const asked = toldBy(app.db, pull);
403	404	const requester =
404	405	asked === null ? undefined : getUserByName(app.db, asked);
405		const trailers = landingTrailers(
406		requester ? commitIdentity(app.config, requester) : null,
407		lander,
408		);
	406	const from = pullSourceOf(app.db, pull.id);
	407	const trailers = [
	408	landingTrailers(
	409	requester ? commitIdentity(app.config, requester) : null,
	410	lander,
	411	),
	412	...(from === undefined ? [] : [sourceTrailers(from, ownHost(app.config))]),
	413	].join("\n");
409	414	const baseDir = repoDir(app.reposRoot, repo.ownerName, repo.name);
410	415	const at = await pullDir(app.db, app.reposRoot, repo, pull);
411	416	const carriedBefore =
		@@ -465,6 +470,7 @@ export async function mergePull(
465	470	number: pull.number,
466	471	strategy,
467	472	mergeOid: merged.value.mergeOid,
	473	...(from === undefined ? {} : { source: `${from.account}@${from.host}` }),
468	474	},
469	475	});
470	476	// A vision pull, landed by an admin, rewrites the direction's fenced block.
		@@ -0,0 +1,73 @@
	1	/**
	2	* Changing who is trusted (#8937): the owner's list, the kill switch and
	3	* the revert of one source's landings. Only a forge admin who is a person
	4	* may; each change is an event, so it is audited and the feed shows it.
	5	*/
	6	import type { App } from "../app.ts";
	7	import { listEveryRepo } from "../core/repos.ts";
	8	import {
	9	resumeFoldIn,
	10	stopFoldIn,
	11	trustSource,
	12	untrust,
	13	type TrustError,
	14	type TrustedSource,
	15	} from "../core/trusted_sources.ts";
	16	import type { User } from "../core/users.ts";
	17	import { revertSource } from "../crew/fold_in.ts";
	18	import { err, ok, type Result } from "../kernel/result.ts";
	19
	20	const mayChange = (actor: User \| undefined): actor is User =>
	21	actor !== undefined && actor.isAdmin && actor.kind !== "agent";
	22
	23	export function addTrust(
	24	app: App,
	25	actor: User \| undefined,
	26	input: { host: string; account: string; until: string },
	27	): Result<TrustedSource, TrustError \| "not_found"> {
	28	if (!mayChange(actor)) return err("not_found");
	29	const made = trustSource(app.db, { ...input, setBy: actor.username });
	30	if (typeof made === "string") return err(made);
	31	app.bus.append({
	32	kind: "trust.set",
	33	actorId: actor.id,
	34	payload: { account: made.account, host: made.host, until: made.until },
	35	});
	36	return ok(made);
	37	}
	38
	39	export function removeTrust(app: App, actor: User \| undefined, sourceId: string): Result<TrustedSource, "not_found"> {
	40	if (!mayChange(actor)) return err("not_found");
	41	const gone = untrust(app.db, sourceId);
	42	if (gone === undefined) return err("not_found");
	43	app.bus.append({ kind: "trust.removed", actorId: actor.id, payload: { account: gone.account, host: gone.host } });
	44	return ok(gone);
	45	}
	46
	47	/** The kill switch: all folding in stops at once, and resumes on one action too. */
	48	export function setFoldInStopped(app: App, actor: User \| undefined, stopped: boolean): Result<boolean, "not_found"> {
	49	if (!mayChange(actor)) return err("not_found");
	50	if (stopped) stopFoldIn(app.db, actor.username);
	51	else resumeFoldIn(app.db);
	52	app.bus.append({ kind: stopped ? "foldin.stopped" : "foldin.resumed", actorId: actor.id, payload: {} });
	53	return ok(stopped);
	54	}
	55
	56	/** Open a revert for everything one source landed, in every repository. */
	57	export async function revertBySource(
	58	app: App,
	59	actor: User \| undefined,
	60	host: string,
	61	account: string,
	62	): Promise<Result<{ opened: number; refused: number }, "not_found">> {
	63	if (!mayChange(actor)) return err("not_found");
	64	let opened = 0;
	65	let refused = 0;
	66	for (const repo of listEveryRepo(app.db)) {
	67	const r = await revertSource(app, actor, repo, host, account);
	68	opened += r.opened.length;
	69	refused += r.refused.length;
	70	}
	71	app.bus.append({ kind: "trust.reverted", actorId: actor.id, payload: { account, host, opened, refused } });
	72	return ok({ opened, refused });
	73	}
		@@ -44,6 +44,7 @@ import { isSafeOid, isSafeRef } from "../git/guard.ts";
44	44	import { aheadCount, mergeBase, mergeable, resolveOid, writeRef } from "../git/merge.ts";
45	45	import { REMOTE_PROTOCOLS } from "../git/remote-env.ts";
46	46	import { repoDir } from "../git/repos.ts";
	47	import { ownHost, recordPullSource, sourceOfUrl, takeable, viaOf } from "../core/trusted_sources.ts";
47	48	import { err, ok, type Result } from "../kernel/result.ts";
48	49	import { providerForOrigin } from "../origins/credential.ts";
49	50	import { redact, secretsIn } from "../origins/credentials.ts";
		@@ -301,6 +302,12 @@ async function checkOnce(app: App, repo: Repo): Promise<Result<Checked, CheckErr
301	302	return ok({ tip: staged, behind, outcome: "none" });
302	303	}
303	304
	305	// Work that already landed here and came back round a ring of forges is not taken again (#8937).
	306	const seenVia = viaOf((await runGitCapture(["log", "-1", "--format=%B", staged], { cwd: dir })).stdout);
	307	if (!takeable(seenVia, ownHost(app.config))) {
	308	noteCheck(app.db, repo.id, { at, tip: staged, behind: 0, error: "" });
	309	return ok({ tip: staged, behind: 0, outcome: "none" });
	310	}
304	311	const merged = await mergeable(dir, main, staged);
305	312	if (!merged.ok) {
306	313	if (merged.error.kind !== "conflict") return failed("git");
		@@ -323,6 +330,12 @@ async function checkOnce(app: App, repo: Repo): Promise<Result<Checked, CheckErr
323	330	const known = pullForBranch(app.db, repo.id, name);
324	331	const pending = follow.pendingId === null ? undefined : getIssueById(app.db, follow.pendingId);
325	332	const open = pending !== undefined && pending.kind === "pull" && pending.state === "open";
	333	// Where the work came from, so a landing can say, and a trusted source's folds in by itself.
	334	// Only a pull this follow opened is stamped (a person's or a guest's under the same branch name never is).
	335	const from = sourceOfUrl(follow.url);
	336	const came = (pullId: string): void => {
	337	if (from !== undefined) recordPullSource(app.db, { pullId, ...from, via: seenVia });
	338	};
326	339	let number: number;
327	340	if (known !== undefined) {
		sentinelcrew 11d ago outdated HIGH: this stamps a trusted source on any pull matching the branch name, including a person's or guest's pull. Stamp only pulls this follow opened, and do not overwrite.
328	341	// This tip was proposed already, whatever came of it: nothing new.
		@@ -330,12 +343,14 @@ async function checkOnce(app: App, repo: Repo): Promise<Result<Checked, CheckErr
330	343	} else if (open) {
331	344	// The upstream moved on: the open pull follows it instead of a second opening.
332	345	retargetPull(app.db, pending.id, name, staged);
	346	came(pending.id);
333	347	await writeRef(dir, `refs/pull/${pending.number}/head`, staged);
334	348	updateIssueText(app.db, pending.id, text);
335	349	number = pending.number;
336	350	} else {
337	351	const opened = await openPull(app, by, repo, { ...text, baseBranch: repo.defaultBranch, headBranch: name });
338	352	if (!opened.ok) return failed("git", `The proposal could not be opened: ${opened.error}`);
	353	came(opened.value.id);
339	354	noteCheck(app.db, repo.id, { at, tip: staged, behind, error: "", pendingId: opened.value.id, opened: true });
340	355	return ok({ tip: staged, behind, outcome: "proposed", pull: opened.value.number });
341	356	}
		@@ -169,6 +169,9 @@ export function classifiedAudience(kind: string): EventAudience \| undefined {
169	169	kind.startsWith("clog.") \|\|
170	170	// What the throughput keeper did to lift a brake is the owner's too (`flow/keeper.ts`).
171	171	kind.startsWith("keeper.") \|\|
	172	// Who is trusted to fold in, and the switch that stops it, are the owner's (`actions/trusted_sources.ts`).
	173	kind.startsWith("trust.") \|\|
	174	kind.startsWith("foldin.") \|\|
172	175	// Events the retired FLOW ONLY switch wrote stay the admins' to hear.
173	176	kind === "flow_only.cleared" \|\|
174	177	// A report from outside waits for a person who decides; its arrival is
		@@ -0,0 +1,1 @@
	1	87833aad18c42e1ed7a8f5bcef1cabfd61257af51c205970898ac142add0a0c1
		@@ -0,0 +1,28 @@
	1	// Trusted sources (#8937): who, on which forge, until when, set by whom;
	2	// where each pull from another forge came from; and the one switch that
	3	// stops all folding in. Additive; the list starts empty and the owner fills it.
	4	export default `
	5	CREATE TABLE trusted_source (
	6	id TEXT PRIMARY KEY,
	7	host TEXT NOT NULL,
	8	account TEXT NOT NULL,
	9	until TEXT NOT NULL,
	10	set_by TEXT NOT NULL,
	11	created_at TEXT NOT NULL,
	12	warned_at TEXT,
	13	UNIQUE (host, account)
	14	);
	15	CREATE TABLE pull_source (
	16	pull_id TEXT PRIMARY KEY,
	17	host TEXT NOT NULL,
	18	account TEXT NOT NULL,
	19	via TEXT NOT NULL DEFAULT '',
	20	received_at TEXT NOT NULL
	21	);
	22	CREATE INDEX pull_source_by_source ON pull_source (host, account);
	23	CREATE TABLE fold_in_stop (
	24	id INTEGER PRIMARY KEY CHECK (id = 1),
	25	by TEXT NOT NULL,
	26	at TEXT NOT NULL
	27	);
	28	`;
		@@ -22,6 +22,7 @@ import { getIssueById, getPull, type Pull } from "./pulls.ts";
22	22	import { canWrite, getRepoById, onCrew, type Repo } from "./repos.ts";
23	23	import { listReviews } from "./reviews.ts";
24	24	import { runGrantedAt } from "./run_grant.ts";
	25	import { foldsIn } from "./trusted_sources.ts";
25	26	import { getUserById, type User } from "./users.ts";
26	27
27	28	const trusted = (db: Database, repo: Repo, user: User \| undefined): boolean =>
		@@ -40,6 +41,8 @@ export function pullMayRun(
40	41	headOid: string,
41	42	): boolean {
42	43	const proposed = isProposed(db, pull);
	44	// A trusted source's code runs its checks like the crew's (#8937).
	45	if (foldsIn(db, pull.id)) return true;
43	46	if (!proposed && !pull.crossRepo && pull.originHeadRepo === null) return true;
44	47	if (!proposed && pull.crossRepo && pull.originHeadRepo === null) {
45	48	const author = getUserById(db, pull.authorId);
		@@ -0,0 +1,252 @@
	1	/**
	2	* Trusted sources (#8937): an account on a named forge, until a date, set by
	3	* a person. An account name means nothing without its forge — the same name
	4	* elsewhere is a stranger — so a source is always the pair. Trust ends by
	5	* itself: past `until` a source is no longer listed as active and its work
	6	* waits for review like anyone's. Pure data, no authz, no events;
	7	* `actions/trusted_sources.ts` decides who may change it and audits it.
	8	*/
	9	import type { Database } from "bun:sqlite";
	10	import { id } from "../kernel/id.ts";
	11
	12	export interface TrustedSource {
	13	readonly id: string;
	14	readonly host: string;
	15	readonly account: string;
	16	readonly until: string;
	17	readonly setBy: string;
	18	readonly createdAt: string;
	19	readonly warnedAt: string \| null;
	20	}
	21
	22	interface Row {
	23	id: string;
	24	host: string;
	25	account: string;
	26	until: string;
	27	set_by: string;
	28	created_at: string;
	29	warned_at: string \| null;
	30	}
	31
	32	const toSource = (r: Row): TrustedSource => ({
	33	id: r.id,
	34	host: r.host,
	35	account: r.account,
	36	until: r.until,
	37	setBy: r.set_by,
	38	createdAt: r.created_at,
	39	warnedAt: r.warned_at,
	40	});
	41
	42	/** Days before expiry that the note is sent. */
	43	export const WARN_DAYS = 3;
	44	const DAY_MS = 86_400_000;
	45
	46	const HOST = /^[a-z0-9]([a-z0-9.-]{0,251}[a-z0-9])?(:\d{1,5})?$/;
	47	const ACCOUNT = /^[a-z0-9][a-z0-9._-]{0,63}$/;
	48
	49	/** A forge's name as a source is kept: lowercase host, no scheme, no path. */
	50	export function cleanHost(raw: string): string \| undefined {
	51	const text = raw.trim().toLowerCase();
	52	const host = URL.parse(text)?.host \|\| text.replace(/^[a-z]+:\/\//, "").replace(/\/.*$/, "");
	53	return HOST.test(host) ? host : undefined;
	54	}
	55
	56	export function cleanAccount(raw: string): string \| undefined {
	57	const name = raw.trim().replace(/^@/, "").toLowerCase();
	58	return ACCOUNT.test(name) ? name : undefined;
	59	}
	60
	61	export type TrustError = "bad_host" \| "bad_account" \| "bad_date" \| "in_the_past";
	62
	63	/** Keep (or renew) a source. The end is a calendar date, read as the end of that UTC day. */
	64	export function trustSource(
	65	db: Database,
	66	input: { host: string; account: string; until: string; setBy: string },
	67	now: Date = new Date(),
	68	): TrustedSource \| TrustError {
	69	const host = cleanHost(input.host);
	70	if (host === undefined) return "bad_host";
	71	const account = cleanAccount(input.account);
	72	if (account === undefined) return "bad_account";
	73	if (!/^\d{4}-\d{2}-\d{2}$/.test(input.until)) return "bad_date";
	74	const end = new Date(`${input.until}T23:59:59.999Z`);
	75	if (Number.isNaN(end.getTime())) return "bad_date";
	76	if (end.getTime() <= now.getTime()) return "in_the_past";
	77	const until = end.toISOString();
	78	db.query(
	79	`INSERT INTO trusted_source (id, host, account, until, set_by, created_at)
	80	VALUES (?1, ?2, ?3, ?4, ?5, ?6)
	81	ON CONFLICT (host, account)
	82	DO UPDATE SET until = excluded.until, set_by = excluded.set_by, warned_at = NULL`,
	83	).run(id(), host, account, until, input.setBy, now.toISOString());
	84	return sourceOf(db, host, account)!;
	85	}
	86
	87	export function sourceOf(db: Database, host: string, account: string): TrustedSource \| undefined {
	88	const row = db
	89	.query<Row, [string, string]>("SELECT * FROM trusted_source WHERE host = ?1 AND account = ?2")
	90	.get(host.toLowerCase(), account.toLowerCase());
	91	return row === null ? undefined : toSource(row);
	92	}
	93
	94	export function untrust(db: Database, sourceId: string): TrustedSource \| undefined {
	95	const row = db.query<Row, [string]>("SELECT * FROM trusted_source WHERE id = ?1").get(sourceId);
	96	if (row === null) return undefined;
	97	db.query("DELETE FROM trusted_source WHERE id = ?1").run(sourceId);
	98	return toSource(row);
	99	}
	100
	101	/** Every entry, expired ones included (the page shows them as lapsed), soonest end first. */
	102	export function listTrusted(db: Database): TrustedSource[] {
	103	return db.query<Row, []>("SELECT * FROM trusted_source ORDER BY until, host, account").all().map(toSource);
	104	}
	105
	106	/** Whether the account on that forge is trusted at `now`. */
	107	export function isTrusted(db: Database, host: string, account: string, now: Date = new Date()): boolean {
	108	const source = sourceOf(db, host, account);
	109	return source !== undefined && source.until > now.toISOString();
	110	}
	111
	112	/** Entries that end within the warning window and have not been told about yet. */
	113	export function dueWarning(db: Database, now: Date = new Date()): TrustedSource[] {
	114	const soon = new Date(now.getTime() + WARN_DAYS * DAY_MS).toISOString();
	115	return db
	116	.query<Row, [string, string]>(
	117	"SELECT * FROM trusted_source WHERE warned_at IS NULL AND until > ?1 AND until <= ?2",
	118	)
	119	.all(now.toISOString(), soon)
	120	.map(toSource);
	121	}
	122
	123	export function markWarned(db: Database, sourceId: string, now: Date = new Date()): void {
	124	db.query("UPDATE trusted_source SET warned_at = ?2 WHERE id = ?1").run(sourceId, now.toISOString());
	125	}
	126
	127	/** Whether the entry ends within the warning window (or already has). */
	128	export const endsSoon = (s: TrustedSource, now: Date = new Date()): boolean =>
	129	Date.parse(s.until) - now.getTime() <= WARN_DAYS * DAY_MS;
	130
	131	// --- the kill switch -------------------------------------------------------
	132
	133	export function foldInStopped(db: Database): { by: string; at: string } \| undefined {
	134	const row = db.query<{ by: string; at: string }, []>("SELECT by, at FROM fold_in_stop WHERE id = 1").get();
	135	return row ?? undefined;
	136	}
	137
	138	export function stopFoldIn(db: Database, by: string, now: Date = new Date()): void {
	139	db.query("INSERT OR REPLACE INTO fold_in_stop (id, by, at) VALUES (1, ?1, ?2)").run(by, now.toISOString());
	140	}
	141
	142	export function resumeFoldIn(db: Database): void {
	143	db.query("DELETE FROM fold_in_stop WHERE id = 1").run();
	144	}
	145
	146	// --- where a pull came from ------------------------------------------------
	147
	148	export interface PullSource {
	149	readonly pullId: string;
	150	readonly host: string;
	151	readonly account: string;
	152	/** Forges the work passed through before it reached this one, oldest first. */
	153	readonly via: readonly string[];
	154	}
	155
	156	/** Where a pull came from; the first word stands, a later call never rewrites it. */
	157	export function recordPullSource(
	158	db: Database,
	159	input: { pullId: string; host: string; account: string; via: readonly string[] },
	160	now: Date = new Date(),
	161	): void {
	162	db.query(
	163	`INSERT OR IGNORE INTO pull_source (pull_id, host, account, via, received_at)
	164	VALUES (?1, ?2, ?3, ?4, ?5)`,
	165	).run(input.pullId, input.host.toLowerCase(), input.account.toLowerCase(), input.via.join(","), now.toISOString());
	166	}
	167
	168	export function pullSourceOf(db: Database, pullId: string): PullSource \| undefined {
	169	const row = db
	170	.query<{ host: string; account: string; via: string }, [string]>(
	171	"SELECT host, account, via FROM pull_source WHERE pull_id = ?1",
	172	)
	173	.get(pullId);
	174	return row === null
	175	? undefined
	176	: { pullId, host: row.host, account: row.account, via: row.via === "" ? [] : row.via.split(",") };
	177	}
	178
	179	/** `account@host` of the pulls (by number, in one repository) that came from another forge. */
	180	export function sourcesOfPulls(db: Database, repoId: string, numbers: readonly number[]): Map<number, string> {
	181	const out = new Map<number, string>();
	182	if (numbers.length === 0) return out;
	183	const rows = db
	184	.query<{ number: number; account: string; host: string }, (string \| number)[]>(
	185	`SELECT i.number, s.account, s.host FROM issue i JOIN pull_source s ON s.pull_id = i.id
	186	WHERE i.repo_id = ?1 AND i.number IN (${numbers.map((_, n) => `?${n + 2}`).join(",")})`,
	187	)
	188	.all(repoId, ...numbers);
	189	for (const r of rows) out.set(r.number, `${r.account}@${r.host}`);
	190	return out;
	191	}
	192
	193	/** Pull ids that came from one source, newest first. */
	194	export function pullIdsFrom(db: Database, host: string, account: string): string[] {
	195	return db
	196	.query<{ pull_id: string }, [string, string]>(
	197	"SELECT pull_id FROM pull_source WHERE host = ?1 AND account = ?2 ORDER BY received_at DESC",
	198	)
	199	.all(host.toLowerCase(), account.toLowerCase())
	200	.map((r) => r.pull_id);
	201	}
	202
	203	// --- a landing says where it came from -------------------------------------
	204
	205	/**
	206	* Whether a pull's source is trusted right now and folding in is not
	207	* stopped: the one question the crew's landing path asks. Trust skips the
	208	* person's review and nothing else.
	209	*/
	210	export function foldsIn(db: Database, pullId: string, now: Date = new Date()): boolean {
	211	const from = pullSourceOf(db, pullId);
	212	return from !== undefined && foldInStopped(db) === undefined && isTrusted(db, from.host, from.account, now);
	213	}
	214
	215	/**
	216	* The trailers a landing from another forge carries. `Landed-via` lists
	217	* every forge the work passed through, this one last: a forge that finds
	218	* itself in the list will not take the work again (`takeable`).
	219	*/
	220	export function sourceTrailers(from: PullSource, selfHost: string): string {
	221	const via = [...from.via, from.host, selfHost.toLowerCase()].filter((h, i, all) => all.indexOf(h) === i);
	222	return `Landed-from: ${from.account}@${from.host}\nLanded-via: ${via.join(",")}`;
	223	}
	224
	225	/** `Landed-via` read back from a commit message; empty when it has none. */
	226	export function viaOf(message: string): string[] {
	227	const line = /^Landed-via: ([a-z0-9.,:-]{1,500})$/m.exec(message);
	228	return line === null ? [] : line[1]!.split(",").filter((h) => HOST.test(h));
	229	}
	230
	231	/** Work that already passed through this forge is not taken in again: that is how a ring of forges stops. */
	232	export const takeable = (via: readonly string[], selfHost: string): boolean => !via.includes(selfHost.toLowerCase());
	233
	234	/** This forge's own name as other forges' trust lists spell it. */
	235	export function ownHost(config: { url?: string \| undefined; host?: string \| undefined }): string {
	236	return (config.url === undefined ? undefined : URL.parse(config.url)?.host.toLowerCase()) ?? (config.host ?? "localhost").toLowerCase();
	237	}
	238
	239	/**
	240	* Who an upstream's address names: the forge, and the account that owns the
	241	* repository (`https://host/account/name.git`). This is the owner of the
	242	* followed repository, not a verified commit author: trust here means "work
	243	* from the repository this account owns", and commits in it keep whatever
	244	* author they carry.
	245	*/
	246	export function sourceOfUrl(url: string): { host: string; account: string } \| undefined {
	247	const parsed = URL.parse(url);
	248	if (parsed === null \|\| (parsed.protocol !== "https:" && parsed.protocol !== "http:")) return undefined;
	249	const host = cleanHost(parsed.host);
	250	const account = cleanAccount(parsed.pathname.split("/").filter((s) => s !== "")[0] ?? "");
	251	return host === undefined \|\| account === undefined ? undefined : { host, account };
	252	}