@lovek4d/kickflip 0.1.0 → 0.4.0

package/board/public/view-settings.js

@@ -1,7 +1,9 @@
 // Board Settings, a modal the app shell (shell.js) mounts over its board for /<route>/settings.html.
-// Saving reviewers sends a `reviewers` event {add: [name], remove: [name]}; Claude finds each new person's Slack and
-// GitHub accounts, writes the list with board.mjs reviewers, and replies. An unsaved edit marks [data-dirty], and the
-// shell asks before closing the modal then.
+// Saving reviewers sends a `reviewers` event {add: [name], remove: [name]}; the server removes names itself and the list
+// redraws from its answer, while Claude finds each new person's Slack and GitHub accounts, adds them with board.mjs
+// reviewers, and replies. Tickets save on each change, and Done, ✕,
+// Escape and the backdrop wait for that save to land before closing. An unsaved edit marks [data-dirty], and the shell
+// asks before closing the modal then.
 (globalThis.AppViews ||= {}).settings = {
   className: 'view-settings',
   title: () => 'Board Settings',
@@ -12,21 +14,50 @@
   <p class="muted small" id="boardRepoStatus"></p>
   <h2>Tickets</h2>
   <p class="muted small">Every card on this board has a ticket from here. A new card gets a new ticket unless you name one.</p>
-  <form id="ticketsForm" class="tk-section"><div id="boardTickets">Loading…</div><button type="submit" id="ticketsSave" disabled>Save</button></form>
+  <form id="ticketsForm" class="tk-section"><div id="boardTickets">Loading…</div></form>
+  <div class="tk-inline" id="ticketsKey" hidden></div>
   <p class="muted small" id="ticketsStatus" role="status"></p>
-  <h2>Merging</h2>
-  <label class="who" for="autoMerge">
-    <span><span>Auto-merge approved PRs</span>
-      <span class="muted small sub">On: Claude merges a PR once it is approved, CI is green and it merges cleanly. Off: its card shows you a Merge button.</span></span>
-    <input type="checkbox" class="toggle" id="autoMerge" disabled>
-  </label>
-  <p class="muted small" id="autoMergeStatus"></p>
-  <h2>Builds</h2>
+  <h2>Auto</h2>
+  <label class="who" for="autoPull"><span><span>Auto implement Todo cards</span>
+    <span class="muted small sub">Claude starts a Todo card as soon as it’s ready and nothing blocks or holds it, while an implementer slot is free.</span></span>
+    <input type="checkbox" class="toggle" id="autoPull" disabled></label>
+  <p class="muted small" id="autoPullStatus" role="status"></p>
+  <label class="who" for="maxImplementers"><span><span>Maximum parallel implementers</span>
+    <span class="muted small sub">Cards building or waiting in Orchestrator review count. Grills and cards waiting on you don’t.</span></span>
+    <input type="number" class="count" id="maxImplementers" min="1" max="99" step="1" inputmode="numeric" disabled></label>
+  <p class="muted small" id="maxImplementersStatus" role="status"></p>
+  <label class="who" for="headlessBuilders"><span><span>Builders launch headless</span>
+    <span class="muted small sub">The board launches each ready card’s builder from its notes, and the builder lands its own work. Ready needs a size and notes.</span></span>
+    <input type="checkbox" class="toggle" id="headlessBuilders" disabled></label>
+  <p class="muted small" id="headlessBuildersStatus" role="status"></p>
   <label class="who" for="autoBuild"><span><span>Auto-build cards</span>
     <span class="muted small sub" id="autoBuildSub">${BoardUI.esc(BoardUI.tryWords('web').autoSub)}</span></span>
     <input type="checkbox" class="toggle" id="autoBuild" disabled></label>
   <p class="muted small" id="autoBuildStatus" role="status"></p>
+  <label class="who" for="autoReview"><span><span>Auto review</span>
+    <span class="muted small sub">Claude reviews teammates’ PRs that touch this board’s work. May use a lot of usage.</span></span>
+    <input type="checkbox" class="toggle" id="autoReview" disabled></label>
+  <p class="muted small" id="autoReviewStatus" role="status"></p>
+  <label class="who" for="autoMerge"><span><span>Auto-merge</span>
+    <span class="muted small sub">Claude merges a PR once it is approved, green and merges cleanly.</span></span>
+    <input type="checkbox" class="toggle" id="autoMerge" disabled></label>
+  <p class="muted small" id="autoMergeStatus" role="status"></p>
+  <div id="skipDraftRow" hidden><label class="who" for="skipDraft"><span><span>Skip the draft</span>
+    <span class="muted small sub">A builder’s PR opens as a draft and is marked ready for review once CI passes, so it goes to reviewers without waiting for you.</span></span>
+    <input type="checkbox" class="toggle" id="skipDraft" disabled></label>
+  <p class="muted small">With Auto-merge on too, a builder’s PR can merge once reviewers approve it, without you seeing it.</p>
+  <p class="muted small" id="skipDraftStatus" role="status"></p></div>
+  <label class="who" for="autoTriage"><span><span>Triage overnight</span>
+    <span class="muted small sub">Once a night, when two or more cards wait on your answers, Claude merges their overlapping questions and duplicate cards, and tidies Todo.</span></span>
+    <input type="checkbox" class="toggle" id="autoTriage" disabled></label>
+  <p class="muted small" id="autoTriageStatus" role="status"></p>
+  <label class="who" for="idleNotification"><span><span>Idle notification</span>
+    <span class="muted small sub">Pushes once when the board has been idle for 15 minutes, with what closed since the last one.</span></span>
+    <input type="checkbox" class="toggle" id="idleNotification" disabled></label>
+  <p class="muted small" id="idleNotificationStatus" role="status"></p>
   <p class="muted small">The hub runs <code>.kickflip/build</code> from each card’s branch and from main. Claude wrote it when it set up this board; if builds break, file a card.</p>
+  <h2>Permissions</h2>
+  <div id="permissions"><p class="muted small">Loading…</p></div>
   <h2>Reviewers</h2>
   <p class="muted small">Everyone here gets each PR link on this board once it's ready, and the weekday digest. Someone you add also gets the links of PRs already in review.</p>
   <div id="list"><p class="muted small">Loading…</p></div>
@@ -66,12 +97,20 @@
     const modal = $('#boardSettingsModal');
     const previous = document.activeElement;
     const unfitModal = BoardDialogs.fitSheet(modal);
-    B.on(modal, 'cancel', (e) => { e.preventDefault(); ctx.dismiss?.(); });
+    let dismissing = false;
+    function close() {
+      if (tickets) saveTickets();
+      if (!savingTickets) { ctx.dismiss?.(); return; }
+      if (dismissing) return;
+      dismissing = true;
+      savingTickets.then(() => { dismissing = false; if (B.alive()) ctx.dismiss?.(); });
+    }
+    B.on(modal, 'cancel', (e) => { e.preventDefault(); close(); });
     B.on(modal, 'click', (e) => {
-      if (e.target.closest?.('[data-settings-dismiss]')) ctx.dismiss?.();
+      if (e.target.closest?.('[data-settings-dismiss]')) close();
       else if (e.target === modal) {
         const rect = modal.getBoundingClientRect();
-        if (e.clientX < rect.left || e.clientX > rect.right || e.clientY < rect.top || e.clientY > rect.bottom) ctx.dismiss?.();
+        if (e.clientX < rect.left || e.clientX > rect.right || e.clientY < rect.top || e.clientY > rect.bottom) close();
       }
     });
     B.atUnmount(() => { unfitModal(); modal.close(); if (previous?.isConnected) previous.focus({ preventScroll: true }); });
@@ -89,13 +128,13 @@
       const { body: d } = await get(`/_hub/close-board/${encodeURIComponent(route)}`);
       if (!B.alive()) return;
       closure = d;
-      closeRow.disabled = d.hub === true;
-      $('#closeBoardReason').textContent = d.hub ? 'The hub board cannot be closed while it is flagged as the hub.' : '';
+      closeRow.disabled = false;
+      $('#closeBoardReason').textContent = '';
       $('#closeBoardName').textContent = d.title;
       $('#closeBoardTypeName').textContent = d.title;
       const warnings = [...(d.prs || []).map((p) => `<li>PR #${esc(p.pr)} (${esc(p.repo)}) — ${esc(p.wave)}/${esc(p.id)}</li>`),
         ...(d.builders || []).map((b) => `<li>${esc(b.label)} — ${esc(b.key)}</li>`)];
-      $('#closeBoardWarning').innerHTML = warnings.length ? `<h3>This board still has active work</h3><ul>${warnings.join('')}</ul><p>Running builder records will be closed with a note. PRs stay open on GitHub; this board stops polling them.</p>` : '';
+      $('#closeBoardWarning').innerHTML = warnings.length ? `<h3>This board still has active work</h3><ul>${warnings.join('')}</ul><p>Running implementers will be stopped with a note. PRs stay open on GitHub; this board stops polling them.</p>` : '';
     };
     loadClosure().catch(() => { if (B.alive()) $('#closeBoardReason').textContent = 'Could not load Close board. Is the host awake?'; });
     B.on(closeRow, 'click', async () => {
@@ -103,7 +142,7 @@
       closeRow.disabled = true;
       try {
         await loadClosure();
-        if (!B.alive() || closure.hub) return;
+        if (!B.alive()) return;
         typed.value = '';
         closeConfirm.disabled = true;
         $('#closeBoardError').textContent = '';
@@ -119,13 +158,17 @@
     B.on(closeSheet, 'click', (e) => { if (e.target === closeSheet && !closing) closeSheet.close(); });
     B.on($('#closeBoardForm'), 'submit', async (e) => {
       e.preventDefault();
-      if (closing || closure?.hub || typed.value !== closure?.title) return;
+      if (closing || typed.value !== closure?.title) return;
       closing = true;
-      closeConfirm.disabled = true;
-      try {
+      // Close board waits until the hub has stopped the board's session and server.
+      const post = (async () => {
         const r = await fetch('/_hub/close-board', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ route, name: typed.value }) });
         const out = await r.json();
         if (!r.ok) throw new Error(out.error || 'Could not close board.');
+        return out;
+      })();
+      try {
+        const out = await BoardUI.waitOn(closeConfirm, post);
         if (!B.alive()) return;
         closeSheet.close();
         ctx.sidebarChanged?.();
@@ -140,19 +183,17 @@
     B.atUnmount(() => { unfit?.(); closeSheet.close(); });
     const repoURL = `/_hub/board-repo/${encodeURIComponent(B.route)}`;
     let repo = {}, closeRepo = () => {};
-    let tickets, savedTickets, savingTickets = false, ticketsTouched = false;
-    const showRepo = () => { $('#boardRepoValue').textContent = repo.github ? `${repo.github} · ${repo.branch || 'Branch not recorded'}` : 'No GitHub repo'; };
+    let tickets, savedTickets, savingTickets = null, ticketsTouched = false;
+    // Skip the draft is only for a board with pull requests, on GitHub (docs/adr/2026-11-04-1913-a-board-can-skip-the-draft.md).
+    const showRepo = () => {
+      $('#boardRepoValue').textContent = repo.github || repo.remote ? `${repo.github || repo.remote} · ${repo.branch || 'Branch not recorded'}` : 'No GitHub repo';
+      $('#skipDraftRow').hidden = !repo.github;
+    };
     get(repoURL).then(({ body }) => {
       if (!B.alive()) return;
       repo = body;
       tickets?.render();
       if (tickets) syncTickets();
-      if (repo.hub) {
-        $('#boardRepoValue').textContent = 'Kickflip’s own clone';
-        $('#boardRepoChange').hidden = true;
-        $('#boardRepoStatus').textContent = `${repo.repo} · The hub board’s builders branch from its main.`;
-        return;
-      }
       showRepo();
       $('#boardRepo').disabled = false;
     }).catch(() => { $('#boardRepoValue').textContent = 'Could not load repo.'; });
@@ -172,30 +213,56 @@
     B.atUnmount(() => closeRepo());
     B.atUnmount(() => tickets?.destroy());
     const ticketsForm = $('#ticketsForm');
-    const ticketsSave = $('#ticketsSave');
     const ticketsStatus = $('#ticketsStatus');
+    const unsaved = () => ticketsTouched && JSON.stringify(tickets.read()) !== JSON.stringify(savedTickets);
     function syncTickets() {
-      const dirty = ticketsTouched && JSON.stringify(tickets.read()) !== JSON.stringify(savedTickets);
-      if (dirty) ticketsForm.setAttribute('data-dirty', '');
+      if (unsaved()) ticketsForm.setAttribute('data-dirty', '');
       else ticketsForm.removeAttribute('data-dirty');
-      ticketsSave.disabled = savingTickets || !dirty || !tickets.valid();
     }
-    B.on(ticketsForm, 'submit', async (e) => {
-      e.preventDefault();
-      if (!tickets || ticketsSave.disabled || savingTickets) return;
-      savingTickets = true;
-      const value = tickets.read();
-      syncTickets();
+    async function postTickets(value) {
       try {
         const r = await fetch(site.url('api/settings'), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ tickets: value }) });
         const out = await r.json();
         if (!r.ok) throw new Error(out.error || 'Could not save tickets.');
-        if (!B.alive()) return;
         savedTickets = out.settings.tickets;
-        ticketsStatus.textContent = 'Saved.';
-      } catch (e) { if (B.alive()) ticketsStatus.textContent = e.message || 'Could not save. Is the host awake?'; }
-      finally { savingTickets = false; if (B.alive()) syncTickets(); }
-    });
+        return true;
+      } catch (e) {
+        if (B.alive()) ticketsStatus.textContent = e.message || 'Could not save. Is the host awake?';
+        return false;
+      }
+    }
+    // A save waits on the control last tapped or changed, found by selector since ticketsControl redraws it, and every
+    // other tickets control is disabled meanwhile (ui.js waitOn).
+    let ticketsTapped = '[data-tk-source][aria-pressed="true"]';
+    const tapped = (e) => {
+      const source = e.target.closest?.('[data-tk-source]');
+      if (source) ticketsTapped = `[data-tk-source="${source.dataset.tkSource}"]`;
+      else if (e.target.dataset?.tk) ticketsTapped = `[data-tk="${e.target.dataset.tk}"]`;
+    };
+    B.on(ticketsForm, 'click', tapped, true);
+    B.on(ticketsForm, 'change', tapped, true);
+    // One save at a time: a change made while one is out saves once it lands.
+    function saveTickets() {
+      syncTickets();
+      if (savingTickets || !unsaved() || !tickets.valid()) return;
+      ticketsStatus.textContent = '';
+      LinearKey.doneBusy(modal.querySelectorAll('[data-settings-dismiss]'), true);
+      savingTickets = (async () => {
+        let saved, value;
+        do {
+          value = tickets.read();
+          saved = await postTickets(value);
+        } while (saved && B.alive() && tickets.valid() && JSON.stringify(tickets.read()) !== JSON.stringify(value));
+        savingTickets = null;
+        if (!B.alive()) return;
+        if (saved) ticketsStatus.textContent = 'Saved';
+        LinearKey.doneBusy(modal.querySelectorAll('[data-settings-dismiss]'), false);
+        syncTickets();
+      })();
+      BoardUI.waitOn(ticketsForm.querySelector(ticketsTapped) || ticketsForm.querySelector('[data-tk-source][aria-pressed="true"]'), savingTickets,
+        { group: ticketsForm.querySelectorAll('button, select, input') });
+    }
+    B.on(ticketsForm, 'submit', (e) => { e.preventDefault(); saveTickets(); });
     let buildKind = 'web';
     let current = [];
     const add = new Set();
@@ -237,25 +304,32 @@
     B.on($('#save'), 'click', async () => {
       const status = $('#saveStatus');
       try {
-        await site.send('reviewers', { add: [...add], remove: [...remove] });
+        const out = await BoardUI.waitOn($('#save'), site.send('reviewers', { add: [...add], remove: [...remove] }));
+        status.textContent = add.size ? 'Sent. Claude updates the list and replies below.' : 'Saved';
+        current = out.board.reviewers;
         add.clear(); remove.clear(); render();
-        status.textContent = 'Sent. Claude updates the list and replies below.';
-      } catch { status.textContent = 'Could not send. Is the host awake?'; }
+      } catch (e) { status.textContent = e?.reason || 'Could not send. Is the host awake?'; }
     });
     B.watch((events) => {
       $('#replies').innerHTML = events.map((e) => `<div class="reply">${e.reply ? (e.reply.html ?? '') : '<span class="muted small">Waiting for Claude…</span>'}</div>`).join('');
     }, { kind: 'reviewers' });
 
     // The toggle saves at once through POST api/settings, which writes board.json itself, so it takes effect with no
-    // session awake (docs/adr/0052-auto-merge-is-a-board-setting-off-by-default.md).
+    // session awake (docs/adr/2026-10-29-1752-auto-merge-is-a-board-setting-off-by-default.md).
     const autoMerge = $('#autoMerge');
     const autoMergeStatus = $('#autoMergeStatus');
+    let savedMax = '';
     get(site.url('api/settings'), waitIn('#autoMergeStatus')).then(({ body: d }) => {
       if (!B.alive()) return;
       savedTickets = d.settings?.tickets || null;
       tickets = BoardDialogs.ticketsControl($('#boardTickets'), { value: savedTickets || { source: 'internal', prefix: 'INT' }, repo: () => repo.github || '', title: () => ctx.siteTitle || '',
         loadLinear: async () => (await get('/_hub/api/linear')).body,
-        change(_value, _valid, { loaded } = {}) { if (!loaded) ticketsTouched = true; syncTickets(); }, createProject: async (team, name) => {
+        keyState: async () => (await get('/_hub/api/settings')).body.linear, keySlot: $('#ticketsKey'),
+        keyBusy: (on) => LinearKey.doneBusy(modal.querySelectorAll('[data-settings-dismiss]'), on),
+        change(_value, _valid, { loaded, typing } = {}) {
+          if (!loaded) ticketsTouched = true;
+          if (typing) syncTickets(); else saveTickets();
+        }, createProject: async (team, name) => {
           const r = await fetch('/_hub/linear/projects', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ team, name }) });
           const out = await r.json().catch(() => ({}));
           if (!r.ok) throw new Error(out.error || 'Could not create the project. Is the host awake?');
@@ -266,7 +340,29 @@
       autoMerge.disabled = false;
       $('#autoBuild').checked = d.settings?.auto_build === true;
       $('#autoBuild').disabled = false;
+      $('#autoPull').checked = d.settings?.auto_pull === true;
+      $('#autoPull').disabled = false;
+      $('#maxImplementers').value = savedMax = String(d.settings?.max_implementers);
+      $('#maxImplementers').disabled = false;
+      $('#autoTriage').checked = d.settings?.auto_triage === true;
+      $('#autoTriage').disabled = false;
+      $('#autoReview').checked = d.settings?.auto_review === true;
+      $('#autoReview').disabled = false;
+      $('#headlessBuilders').checked = d.settings?.headless_builders === true;
+      $('#headlessBuilders').disabled = false;
+      $('#idleNotification').checked = d.settings?.idle_notification === true;
+      $('#idleNotification').disabled = false;
+      $('#skipDraft').checked = d.settings?.skip_draft === true;
+      $('#skipDraft').disabled = false;
     }).catch(() => { autoMergeStatus.textContent = ticketsStatus.textContent = 'Offline. Is the host awake?'; });
+    // An Auto toggle keeps its face, disabled with a spinner beside it (ui.js waitOn), while POST api/settings saves it.
+    // → the saved settings
+    const saveToggle = (toggle, body) => BoardUI.waitOn(toggle, (async () => {
+      const r = await fetch(site.url('api/settings'), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
+      const out = await r.json().catch(() => ({}));
+      if (!r.ok) throw new Error(out.error);
+      return out.settings;
+    })());
     B.on(autoMerge, 'change', async () => {
       const want = autoMerge.checked;
       if (want && !(await BoardDialogs.confirm('Turn on auto-merge? Claude merges each approved PR on this board once CI is green and it merges cleanly, without asking you.'))) {
@@ -274,36 +370,113 @@
         return;
       }
       if (!B.alive()) return;
-      autoMerge.disabled = true;
       try {
-        const r = await fetch(site.url('api/settings'), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ auto_merge: want }) });
-        const out = await r.json().catch(() => ({}));
-        if (!r.ok) throw new Error(out.error);
-        autoMerge.checked = out.settings.auto_merge === true;
+        autoMerge.checked = (await saveToggle(autoMerge, { auto_merge: want })).auto_merge === true;
         autoMergeStatus.textContent = autoMerge.checked ? 'Saved. Claude merges approved, green PRs itself.' : 'Saved. Approved, green PRs wait for your Merge.';
       } catch (e) {
         autoMerge.checked = !want;
         autoMergeStatus.textContent = e.message || 'Could not save. Is the host awake?';
       }
-      autoMerge.disabled = false;
     });
 
     B.on($('#autoBuild'), 'change', async () => {
       const toggle = $('#autoBuild');
       const want = toggle.checked;
-      toggle.disabled = true;
       try {
-        const r = await fetch(site.url('api/settings'), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ auto_build: want }) });
-        const out = await r.json();
-        if (!r.ok) throw new Error(out.error);
+        const settings = await saveToggle(toggle, { auto_build: want });
         if (!B.alive()) return;
-        toggle.checked = out.settings.auto_build === true;
+        toggle.checked = settings.auto_build === true;
         $('#autoBuildStatus').textContent = BoardUI.tryWords(buildKind).saved(toggle.checked);
       } catch (e) {
         if (!B.alive()) return;
         toggle.checked = !want;
         $('#autoBuildStatus').textContent = e.message || 'Could not save. Is the host awake?';
-      } finally { if (B.alive()) toggle.disabled = false; }
+      }
+    });
+
+    // These Auto toggles save with no confirmation: docs/adr/2026-11-02-1754-an-idle-board-pulls-in-its-top-todo-card.md,
+    // docs/adr/2026-11-04-1900-triage-runs-once-overnight-on-cards-waiting-on-your-answers.md and
+    // docs/adr/2026-11-03-1731-each-board-reviews-incoming-prs-that-touch-its-work.md; Idle notification too:
+    // docs/adr/2026-11-04-0257-an-idle-board-pushes-once-when-it-has-gone-idle.md.
+    const autoToggle = (id, key, saved) => B.on($(`#${id}`), 'change', async () => {
+      const toggle = $(`#${id}`);
+      const want = toggle.checked;
+      try {
+        const settings = await saveToggle(toggle, { [key]: want });
+        if (!B.alive()) return;
+        toggle.checked = settings[key] === true;
+        $(`#${id}Status`).textContent = saved(toggle.checked);
+      } catch (e) {
+        if (!B.alive()) return;
+        toggle.checked = !want;
+        $(`#${id}Status`).textContent = e.message || 'Could not save. Is the host awake?';
+      }
+    });
+    autoToggle('autoPull', 'auto_pull', (on) => (on ? 'Saved. Claude starts ready Todo cards while an implementer slot is free.' : 'Saved. Todo cards wait for you.'));
+
+    // docs/adr/2026-11-04-0057-auto-implement-fills-in-progress-up-to-a-cap.md: Maximum parallel implementers saves on
+    // change, waiting on the server like a toggle; a number outside 1 to 99 or a refusal puts the saved one back.
+    B.on($('#maxImplementers'), 'change', async () => {
+      const input = $('#maxImplementers');
+      const status = $('#maxImplementersStatus');
+      const want = /^\d+$/.test(input.value) ? Number(input.value) : 0;
+      if (want < 1 || want > 99) { input.value = savedMax; status.textContent = 'Pick a whole number from 1 to 99.'; return; }
+      try {
+        const settings = await saveToggle(input, { max_implementers: want });
+        if (!B.alive()) return;
+        input.value = savedMax = String(settings.max_implementers);
+        status.textContent = `Saved. Up to ${settings.max_implementers === 1 ? '1 card builds or waits' : `${settings.max_implementers} cards build or wait`} in Orchestrator review at once.`;
+      } catch (e) {
+        if (!B.alive()) return;
+        input.value = savedMax;
+        status.textContent = e.message || 'Could not save. Is the host awake?';
+      }
+    });
+    autoToggle('autoReview', 'auto_review', (on) => (on ? 'Saved. When idle, Claude reviews incoming PRs that touch this board’s work.' : 'Saved. Claude leaves incoming PRs alone.'));
+    autoToggle('headlessBuilders', 'headless_builders', (on) => (on ? 'Saved. The board launches each ready card’s builder itself, and the builder lands its own work.' : 'Saved. Claude briefs and launches each builder.'));
+    autoToggle('idleNotification', 'idle_notification', (on) => (on ? 'Saved. One push once the board has been idle for 15 minutes.' : 'Saved. No push when the board goes idle.'));
+    autoToggle('autoTriage', 'auto_triage', (on) => (on ? 'Saved. Once a night, when cards wait on your answers, Claude triages them.' : 'Saved. Questions and Todo are left as they are.'));
+    autoToggle('skipDraft', 'skip_draft', (on) => (on ? 'Saved. A builder’s draft PR is marked ready for review once CI passes.' : 'Saved. A builder’s draft PR waits for your review.'));
+
+    // Each switch writes or removes one allow rule in the board folder's .claude/settings.local.json through POST
+    // api/permissions, which only the host's own browser may send; elsewhere the switches are read-only
+    // (docs/adr/2026-11-03-1921-board-settings-grant-a-boards-session-permissions.md). A tap waits on the server with the
+    // switch as it was and a spinner beside it, then draws the server's answer.
+    const permissions = $('#permissions');
+    const REFUSED = {
+      denied: (command) => `Auto mode still refused this once: ${command}. Approve it under /permissions, Recently blocked.`,
+      asked: (command) => `The session still asked before running ${command}, so it hasn’t picked the rule up yet. It applies once the session restarts.`,
+    };
+    const permRow = (p, owner) => `<label class="who" for="perm-${esc(p.id)}"><span><span>${esc(p.name)}</span>
+      <span class="muted small sub">${esc(p.allows)} Writes <code>${esc(p.rule)}</code></span></span>
+      <span class="toggle-slot"><span class="try-spin toggle-spin" aria-hidden="true"></span><input type="checkbox" class="toggle" data-perm="${esc(p.id)}" id="perm-${esc(p.id)}"${p.on ? ' checked' : ''}${owner ? '' : ' disabled'}></span></label>
+      <p class="muted small" id="perm-${esc(p.id)}Status" role="status"></p>
+      ${p.refused ? `<p class="muted small refused-note">${esc(REFUSED[p.refused.how](p.refused.command))}</p>` : ''}`;
+    const drawPermissions = (d) => {
+      permissions.innerHTML = d.permissions.map((p) => permRow(p, d.owner)).join('')
+        + (d.owner ? '' : '<p class="muted small" id="permissionsNotOwner">Only the signed-in owner can change these.</p>');
+    };
+    get(site.url('api/permissions'), waitIn('#permissions')).then(({ ok, body }) => {
+      if (!B.alive()) return;
+      if (!ok) { permissions.innerHTML = `<p class="muted small">${esc(body.error || 'Could not load permissions.')}</p>`; return; }
+      drawPermissions(body);
+    }).catch(() => { if (B.alive()) permissions.innerHTML = '<p class="muted">Offline. Is the host awake?</p>'; });
+    B.on(permissions, 'change', async (e) => {
+      const toggle = e.target.closest?.('input[data-perm]');
+      if (!toggle) return;
+      const id = toggle.dataset.perm;
+      const on = toggle.checked;
+      toggle.checked = !on;
+      try {
+        const r = await BoardUI.waitOn(toggle, fetch(site.url('api/permissions'), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ id, on }) }));
+        const out = await r.json().catch(() => ({}));
+        if (!r.ok) throw new Error(out.error);
+        if (!B.alive()) return;
+        drawPermissions(out);
+        $(`#perm-${id}Status`).textContent = on ? 'Saved. The session runs it without asking.' : 'Saved. The session asks first again.';
+      } catch (error) {
+        if (B.alive()) $(`#perm-${id}Status`).textContent = error.message || 'Could not save. Is the host awake?';
+      }
     });
 
     // Saving writes board.json through POST api/rules, whose `rules {scope: "board"}` event wakes Claude to acknowledge

package/board/review.mjs

@@ -0,0 +1 @@
+var d=Object.defineProperty;var l=(t,e)=>d(t,"name",{value:e,configurable:!0});import m from"node:fs";import p from"node:path";import w from"node:os";import{routeRecord as a}from"../hub/routes.mjs";import{storedPRs as b}from"../shared/card-prs.mjs";function N(){const t=p.join(w.homedir(),".claude","slack-bridge","topics"),e=Object.create(null);let r=[];try{r=m.readdirSync(t).filter(o=>o.endsWith(".json")).sort()}catch{}for(const o of r)try{const i=JSON.parse(m.readFileSync(p.join(t,o),"utf8"));for(const[f,s]of Object.entries(i.items||{}))e[f]={...e[f],...s}}catch{}return e}l(N,"topicItems");function k(t,e,r,o={}){const i=Object.create(null),f=[e?.review_link_ts,e?.review_sent,a(t?.review_link_ts,b(e)[0]?.number),a(t?.review_link_ts,r),a(o,r)?.review_link_ts];for(const s of f)for(const[u,n]of Array.isArray(s)?s.map(c=>[c,null]):Object.entries(s||{})){if(Object.hasOwn(i,u))continue;const c=typeof n=="string"?n:n?.ts;n!==null&&(typeof c!="string"||!/^\d+(?:\.\d+)?$/.test(c))||(i[u]={ts:c||null,...typeof n?.channel=="string"?{channel:n.channel}:{}})}return i}l(k,"reviewLinks");const g=l(t=>{const e=t?Number(t)*1e3:NaN;return Number.isFinite(e)&&!Number.isNaN(new Date(e).getTime())?new Date(e).toISOString():null},"reviewTime");function S(t,e=[]){return[...new Map([...e,...t.reviewers||[]].map(r=>[r.name,r])).values()]}l(S,"reviewersOf");export{k as reviewLinks,g as reviewTime,S as reviewersOf,N as topicItems};