@miadi/connector 0.1.17 → 0.1.19

package/README.md

@@ -70,9 +70,11 @@ A mission is found by the issue it implements (jgwill/Miadi#913). `request_autho
 
 In a client that renders MCP Apps (ChatGPT among them), `show_decisions` draws one card per request awaiting a decision: what is asked, by whom, and what approving does. The person decides on the card with their own click: Approve, Approve with my changes, Send back for revision, or Decline. The card then shows the receipt.
 
+A decision is recorded once. An approved run that calls another service (a review operation, Deep Diver, an episode door, a steer) is written to the ledger as approved and running before the call, so a restart can never offer the request for a second approval; a run the connector was recording when it stopped reads as failed and may be run again. A decision whose run takes longer than `MIADI_CONNECTOR_DECISION_WAIT_MS` is answered as recorded and running, and the card reads `get_run_result` every 3 seconds until the outcome is in. The same decision sent again (a host retrying a call, a second click, the page form sent twice) answers with the first one's receipt, marked `replayed`, and runs nothing. A different decision is refused as `decision_conflict`, with where the request stands. When the host gives up on a call, the card reads where the request stands before it offers the buttons again.
+
 The model that asked cannot decide for the person:
 - `decide_request` is declared for the card only (`_meta.ui.visibility: ["app"]`), so the host does not offer it to the model.
-- It requires a decision token that travels only in the `_meta` of the `show_decisions` result. Hosts deliver that metadata to the card and keep it from the model. The token is bound to one request at the version its card shows, one person and one OAuth client, and expires after 30 minutes. A decided request no longer awaits a decision, so a token works once.
+- It requires a decision token that travels only in the `_meta` of the `show_decisions` result. Hosts deliver that metadata to the card and keep it from the model. The token is bound to one request at the version its card shows, one person and one OAuth client, and expires after 7 days (`MIADI_CONNECTOR_DECISION_TOKEN_TTL`). A decided request no longer awaits a decision, so a token works once. The request itself does not expire: a card whose token expired names the request's approval page, and `show_decisions` gives a fresh card for the same request.
 - The sign-in must carry `miadi:approve`. A person grants it by ticking "Let me approve requests on cards inside this client" on the sign-in page. Only a person with Miadi's write tier receives it, only for a client that sends people back to chatgpt.com, and it ends when Miadi no longer gives them the write tier. A person token used directly as Bearer never carries it.
 
 The approval page itself (`/approve/<record>`) names only the kind of request until someone signs in. A write-tier person then reads and decides it, and whoever asked can read it.
@@ -99,6 +101,8 @@ MIADI_CONNECTOR_PUBLIC_URL=https://mcp.sanctuaireagentique.com node packages/con
 | `MIADI_FACTORY_DIR` | `~/.miadi/factory` | the queue approved runs are written to |
 | `MIADI_INQUIRY_DIR` | `/a/src/IAIP/prototypes/artefacts` | the inquiry shelf `save_research` writes to, inside a git checkout it pushes |
 | `MIADI_INQUIRY_GITHUB_REPO` | `miadisabelle/Etuaptmumk-RSM` | where a saved report's inquiry issue is opened, with the host's `gh` login |
+| `MIADI_CONNECTOR_DECISION_TOKEN_TTL` | `604800` (7 days) | seconds a card's decision token stays usable, held between 300 and 2592000 |
+| `MIADI_CONNECTOR_DECISION_WAIT_MS` | `20000` | how long a decision answer waits for its run before answering it as recorded and running, at most 50000 |
 
 On gaia it runs as the user service `miadi-connector.service`, and the Cloudflare tunnel `gaia` routes `mcp.sanctuaireagentique.com` to it.
 
@@ -109,6 +113,8 @@ On gaia it runs as the user service `miadi-connector.service`, and the Cloudflar
 - Miadi decides who a token belongs to (`GET /api/identity/me`), and is asked again at most every 5 minutes while a sign-in is used. A token Miadi no longer recognises ends the sign-in, and the tier Miadi returns now is the one applied. When Miadi cannot be reached, sign-in says so (503) and an existing sign-in keeps the person as last known.
 - What a requester wrote is placed in an approved run's brief with every tag-opening `<` neutralised, so the brief holds one block with the connector's own attributes.
 - Only the loopback hop (cloudflared) is trusted for the client address. The OAuth endpoints, the forms that take a person token, and failed `/mcp` authentications are rate limited per address.
+- A card's decision token lasts 7 days. Its lifetime is not what protects a request: using it also needs the same person's bearer, for the same client, carrying `miadi:approve`, and the write tier Miadi gives that person now. That bearer can already ask `show_decisions` for a fresh token, so a longer lifetime gives a stolen token nothing a stolen bearer does not.
+- Each step of a decision is one JSON line on stdout (`"evt":"connector.decision"`, read with `journalctl --user -u miadi-connector`): the request, a correlation id, the door, timings, the outcome and the HTTP status the run met. No token and no instructions are logged.
 - Outbound calls time out: Miadi 30 s (episode doors 120 s), the review service 15 s (approved review operations 290 s), GitHub 15 s.
 
 ## Test

package/dist/approve.d.ts

@@ -10,7 +10,7 @@
  * is appended as a record that supersedes the request (state, approval, receipt).
  */
 import { type Express } from "express";
-import type { ConnectorConfig } from "./config.js";
+import { type ConnectorConfig } from "./config.js";
 import type { Ledger } from "./store.js";
 import type { MiadiClient } from "./miadi.js";
 import { type MiadiPerson } from "./people.js";
@@ -31,7 +31,21 @@ export interface ApprovalDeps {
     tmux?: TmuxLike;
     /** Re-peek delay after a steer is typed (default 4000ms; tests pass 0). */
     steerSettleMs?: number;
+    /** Where decision events go (default: one JSON line on stdout, the service journal); tests collect them. */
+    log?: (event: Record<string, unknown>) => void;
 }
+/**
+ * One line per step of a decision, for the journal: the request, a correlation id,
+ * the door it came through, timings, the outcome and the HTTP status the run met.
+ * Never a token, never instructions (jgwill/Miadi#924).
+ */
+export declare function logDecision(deps: Pick<ApprovalDeps, "log">, event: Record<string, unknown>): void;
+/** How long a decision answer waits for its run before saying it is recorded and still running. */
+export declare function decisionWaitOf(deps: Pick<ApprovalDeps, "config">): number;
+/** What `settleWithin` answers when the promise has not settled in time; the promise goes on. */
+export declare const STILL_RUNNING: unique symbol;
+/** The promise's value if it settles within `ms`, else STILL_RUNNING. A rejection after the bound is caught, never unhandled. */
+export declare function settleWithin<T>(p: Promise<T>, ms: number): Promise<T | typeof STILL_RUNNING>;
 /**
  * What a person may decide on a request. Approving with changes runs it with the
  * approver's instructions carried into what runs; a revision sends it back to
@@ -54,27 +68,55 @@ export declare function executeApproved(record: ConnectorRecord, approver: Miadi
  * caller has already checked who the person is, their write tier, and that the
  * request still awaits approval.
  */
-/** A request is decided once: a second decision while one runs, or after it, is refused. */
+/** A request is decided once: a second, different decision while one runs, or after it, is refused. */
 export declare class AlreadyDecided extends Error {
 }
+/**
+ * A decision that differs from the one recorded or being recorded (another choice, or other
+ * instructions). The same decision sent again is not refused: it answers with the first one's receipt (#924).
+ */
+export declare class DecisionConflict extends AlreadyDecided {
+}
 /** A decision on a version the request no longer holds: it was revised after the page or card was read (#919). */
 export declare class StaleVersion extends AlreadyDecided {
     readonly currentVersion: number;
     readonly decidedVersion: number;
     constructor(currentVersion: number, decidedVersion: number);
 }
+/** What a decision answers: the state it left, its receipt, and `replayed` when it repeats a decision already taken. */
+export interface Decided {
+    decision: NonNullable<ConnectorRecord["approval_state"]>;
+    state: ConnectorRecord["state"];
+    receipt: Record<string, unknown>;
+    /** The same decision was sent again (a retried call, a second click): this is the first one's answer, nothing ran twice. */
+    replayed?: boolean;
+}
 /** Whether a decision on this request is being recorded now, its run may still be going. */
 export declare function isBeingDecided(recordId: string): boolean;
+/** The approval state a choice leaves a request in. */
+export declare function approvalStateOf(choice: Decision): NonNullable<ConnectorRecord["approval_state"]>;
+/**
+ * Record a person's decision once. The page and the card (or two cards, or a host
+ * that retries a call it gave up waiting on) may send it more than once:
+ * - the same decision while the first is being recorded waits for that one and
+ *   answers with its receipt, marked `replayed`; nothing runs twice;
+ * - the same decision after it was recorded answers with the recorded receipt;
+ * - a different decision is refused as a DecisionConflict (jgwill/Miadi#924).
+ */
 export declare function decide(r: ConnectorRecord, person: MiadiPerson, choice: Decision, deps: ApprovalDeps, opts: {
     instructions?: string;
     note?: string;
     via: string;
     expectedVersion?: number;
-}): Promise<{
-    decision: NonNullable<ConnectorRecord["approval_state"]>;
-    state: ConnectorRecord["state"];
-    receipt: Record<string, unknown>;
-}>;
+}): Promise<Decided>;
+/** What the receipt of a run the connector lost to a restart says (jgwill/Miadi#924). */
+export declare const INTERRUPTED_MESSAGE = "The connector stopped while this ran, so whether it finished is not known. Read what it was to change before running it again. A review create is safe to run again: the review service answers with the review it already holds for that video.";
+/**
+ * A run recorded as running whose process is gone (the connector restarted mid-run)
+ * becomes a failed run that a person may run again. Called once when the connector
+ * starts; a run this process is still recording is left alone.
+ */
+export declare function reconcileInterrupted(deps: Pick<ApprovalDeps, "ledger" | "log">): string[];
 /** Whether a request was approved and its run failed, so a person may run it again. */
 export declare function isRerunnable(r: ConnectorRecord | undefined): boolean;
 /**

package/dist/approve.js

@@ -12,8 +12,10 @@
 import express from "express";
 import { mkdirSync, writeFileSync } from "node:fs";
 import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
 import { join } from "node:path";
 import { escapeHtml } from "@miadi/node-service-kit/format";
+import { DEFAULT_DECISION_WAIT_MS } from "./config.js";
 import { MiadiError } from "./miadi.js";
 import { MiadiUnavailable } from "./people.js";
 import { current, newRecordId } from "./records.js";
@@ -23,6 +25,42 @@ import { factoryLedgerPath, readFactoryReceipts, receiptsForRecord } from "./fac
 import { steerAttempts, steerSession, tmuxAdapter } from "./steer.js";
 import { contentHash, versionOf } from "./revisions.js";
 export { factoryDir, runBriefFile, readQueueState } from "./queue-state.js";
+/**
+ * One line per step of a decision, for the journal: the request, a correlation id,
+ * the door it came through, timings, the outcome and the HTTP status the run met.
+ * Never a token, never instructions (jgwill/Miadi#924).
+ */
+export function logDecision(deps, event) {
+    const line = { evt: "connector.decision", at: new Date().toISOString(), ...event };
+    try {
+        (deps.log ?? ((e) => console.log(JSON.stringify(e))))(line);
+    }
+    catch {
+        /* a log that fails never fails a decision */
+    }
+}
+/** How long a decision answer waits for its run before saying it is recorded and still running. */
+export function decisionWaitOf(deps) {
+    return deps.config.decisionWaitMs ?? DEFAULT_DECISION_WAIT_MS;
+}
+/** What `settleWithin` answers when the promise has not settled in time; the promise goes on. */
+export const STILL_RUNNING = Symbol("still_running");
+/** The promise's value if it settles within `ms`, else STILL_RUNNING. A rejection after the bound is caught, never unhandled. */
+export async function settleWithin(p, ms) {
+    let timer;
+    const bound = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(STILL_RUNNING), ms);
+    });
+    try {
+        const out = await Promise.race([p, bound]);
+        if (out === STILL_RUNNING)
+            p.catch(() => { });
+        return out;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /**
  * What a person may decide on a request. Approving with changes runs it with the
  * approver's instructions carried into what runs; a revision sends it back to
@@ -300,9 +338,15 @@ ${versionOf(r) > 1 ? `<dt>Version</dt><dd>${versionOf(r)}, the one a decision he
  * caller has already checked who the person is, their write tier, and that the
  * request still awaits approval.
  */
-/** A request is decided once: a second decision while one runs, or after it, is refused. */
+/** A request is decided once: a second, different decision while one runs, or after it, is refused. */
 export class AlreadyDecided extends Error {
 }
+/**
+ * A decision that differs from the one recorded or being recorded (another choice, or other
+ * instructions). The same decision sent again is not refused: it answers with the first one's receipt (#924).
+ */
+export class DecisionConflict extends AlreadyDecided {
+}
 /** A decision on a version the request no longer holds: it was revised after the page or card was read (#919). */
 export class StaleVersion extends AlreadyDecided {
     currentVersion;
@@ -313,32 +357,110 @@ export class StaleVersion extends AlreadyDecided {
         this.decidedVersion = decidedVersion;
     }
 }
-const deciding = new Set();
+/** The decisions being recorded now, by request id: one at a time per request, in this process. */
+const deciding = new Map();
 /** Whether a decision on this request is being recorded now, its run may still be going. */
 export function isBeingDecided(recordId) {
     return deciding.has(recordId);
 }
+const APPROVAL_OF = {
+    approve: "approved",
+    approve_with_changes: "approved",
+    request_revision: "revision_requested",
+    decline: "declined",
+};
+/** The approval state a choice leaves a request in. */
+export function approvalStateOf(choice) {
+    return APPROVAL_OF[choice];
+}
+const sameDecision = (a, b) => a.choice === b.choice && String(a.instructions ?? "").trim() === String(b.instructions ?? "").trim();
+/**
+ * Record a person's decision once. The page and the card (or two cards, or a host
+ * that retries a call it gave up waiting on) may send it more than once:
+ * - the same decision while the first is being recorded waits for that one and
+ *   answers with its receipt, marked `replayed`; nothing runs twice;
+ * - the same decision after it was recorded answers with the recorded receipt;
+ * - a different decision is refused as a DecisionConflict (jgwill/Miadi#924).
+ */
 export async function decide(r, person, choice, deps, opts) {
     // Checked again here, with no await between the check and the claim: the
     // page and the card (or two cards) may decide the same request at once, and
     // a revision may land between reading a version and deciding it (#919).
-    const live = current(deps.ledger.all()).find((x) => x.id === r.id);
-    if (!live || live.approval_state !== "awaiting_approval" || deciding.has(r.id)) {
-        throw new AlreadyDecided(deciding.has(r.id) ? "A decision on this request is being recorded." : `This request is already ${live?.approval_state ?? "gone"}.`);
+    const asked = { choice, instructions: opts.instructions };
+    const inflight = deciding.get(r.id);
+    if (inflight) {
+        if (inflight.promise && inflight.choice !== "rerun" && sameDecision({ choice: inflight.choice, instructions: inflight.instructions }, asked)) {
+            logDecision(deps, { phase: "replay", record: r.id, correlation: inflight.correlation, via: opts.via, choice, while: "recording" });
+            return { ...(await inflight.promise), replayed: true };
+        }
+        logDecision(deps, { phase: "conflict", record: r.id, correlation: inflight.correlation, via: opts.via, choice, while: "recording" });
+        throw new DecisionConflict(inflight.choice === "rerun" ? "This request is being run again." : "A different decision on this request is being recorded.");
     }
+    const live = current(deps.ledger.all()).find((x) => x.id === r.id);
+    if (!live)
+        throw new AlreadyDecided("This request is gone.");
     // A decision that names no version (a page opened before versions, a surface that sends none) decides version 1:
     // a request revised since is refused, never decided blind (#919 review F1).
     const decidedVersion = opts.expectedVersion ?? 1;
+    if (live.approval_state !== "awaiting_approval") {
+        const prior = (live.completion_receipt ?? {});
+        const priorVersion = typeof prior.version === "number" ? prior.version : 1;
+        if (typeof prior.decision === "string" && sameDecision({ choice: prior.decision, instructions: prior.instructions }, asked) && priorVersion === decidedVersion) {
+            logDecision(deps, { phase: "replay", record: r.id, via: opts.via, choice, while: "recorded", state: live.state });
+            return { decision: live.approval_state, state: live.state, receipt: prior, replayed: true };
+        }
+        logDecision(deps, { phase: "conflict", record: r.id, via: opts.via, choice, while: "recorded", recorded: prior.decision });
+        throw new DecisionConflict(`This request is already ${live.approval_state ?? "gone"}.`);
+    }
     if (versionOf(live) !== decidedVersion)
         throw new StaleVersion(versionOf(live), decidedVersion);
-    deciding.add(r.id);
+    const entry = { ...asked, correlation: randomUUID(), started: Date.now() };
+    deciding.set(r.id, entry);
+    entry.promise = decideOnce(live, person, choice, deps, { ...opts, correlation: entry.correlation, started: entry.started });
     try {
-        return await decideOnce(live, person, choice, deps, opts);
+        return await entry.promise;
     }
     finally {
         deciding.delete(r.id);
     }
 }
+/**
+ * The kinds whose run is done at once on this host (a brief written to the
+ * factory queue, an ending recorded): nothing outside is called, so nothing is
+ * written ahead of it. Every other approved run is recorded as running first.
+ */
+const RUNS_AT_ONCE = new Set(["run_request", "work_proposal", "session_completion_proposal"]);
+/** What the receipt of a run the connector lost to a restart says (jgwill/Miadi#924). */
+export const INTERRUPTED_MESSAGE = "The connector stopped while this ran, so whether it finished is not known. Read what it was to change before running it again. A review create is safe to run again: the review service answers with the review it already holds for that video.";
+/**
+ * A run recorded as running whose process is gone (the connector restarted mid-run)
+ * becomes a failed run that a person may run again. Called once when the connector
+ * starts; a run this process is still recording is left alone.
+ */
+export function reconcileInterrupted(deps) {
+    const out = [];
+    for (const r of current(deps.ledger.all())) {
+        const receipt = (r.completion_receipt ?? {});
+        if (r.approval_state !== "approved" || r.state !== "in_progress" || receipt.outcome !== "running" || deciding.has(r.id))
+            continue;
+        deps.ledger.append({
+            id: newRecordId(r.kind),
+            kind: r.kind,
+            created_at: new Date().toISOString(),
+            actor: { person_id: "system:miadi-connector", name: "Miadi connector", client_id: "restart" },
+            refs: r.refs,
+            evidence_refs: [],
+            supersedes: r.id,
+            approval_state: "approved",
+            state: "blocked",
+            completion_receipt: { ...receipt, outcome: "failed", interrupted: true, message: INTERRUPTED_MESSAGE, interrupted_at: new Date().toISOString() },
+            body: { decision: "interrupted" },
+        });
+        logDecision(deps, { phase: "interrupted", record: r.id, correlation: receipt.correlation, started_at: receipt.started_at });
+        out.push(r.id);
+    }
+    return out;
+}
 /** Whether a request was approved and its run failed, so a person may run it again. */
 export function isRerunnable(r) {
     return !!r && r.approval_state === "approved" && r.state === "blocked";
@@ -355,7 +477,7 @@ export async function rerun(r, person, deps, opts) {
     if (!isRerunnable(live) || deciding.has(r.id)) {
         throw new AlreadyDecided(deciding.has(r.id) ? "This request is being run." : `This request is ${live?.approval_state ?? "gone"} and ${live?.state ?? "unknown"}; only an approved request whose run failed is run again.`);
     }
-    deciding.add(r.id);
+    deciding.set(r.id, { choice: "rerun", correlation: randomUUID(), started: Date.now() });
     try {
         const prior = (live.completion_receipt ?? {});
         const instructions = typeof prior.instructions === "string" ? prior.instructions : undefined;
@@ -403,7 +525,8 @@ export async function rerun(r, person, deps, opts) {
 }
 async function decideOnce(r, person, choice, deps, opts) {
     const { instructions } = opts;
-    const decision = choice === "approve" || choice === "approve_with_changes" ? "approved" : choice === "request_revision" ? "revision_requested" : "declined";
+    const decision = approvalStateOf(choice);
+    logDecision(deps, { phase: "start", record: r.id, kind: r.kind, correlation: opts.correlation, via: opts.via, choice, version: versionOf(r) });
     let receipt = {
         decided_by: { person_id: person.id, name: person.name },
         decided_at: new Date().toISOString(),
@@ -414,9 +537,28 @@ async function decideOnce(r, person, choice, deps, opts) {
         via: opts.via,
         ...(instructions ? { instructions } : {}),
         note: opts.note,
+        correlation: opts.correlation,
     };
     let state = decision === "approved" ? "completed" : decision === "revision_requested" ? "pending" : "withdrawn";
     if (decision === "approved") {
+        if (!RUNS_AT_ONCE.has(r.kind)) {
+            // Written ahead of the run: the decision is in the ledger before anything is called, so a restart
+            // mid-run can never offer the request for a second approval, and every surface reads it as running (#924).
+            deps.ledger.append({
+                id: newRecordId(r.kind),
+                kind: r.kind,
+                created_at: new Date().toISOString(),
+                actor: { person_id: person.id, name: person.name, client_id: opts.via },
+                refs: r.refs,
+                evidence_refs: [],
+                supersedes: r.id,
+                approval_state: decision,
+                state: "in_progress",
+                completion_receipt: { ...receipt, outcome: "running", started_at: new Date(opts.started).toISOString() },
+                body: { decision: choice, ...(instructions ? { instructions } : {}) },
+            });
+            logDecision(deps, { phase: "running", record: r.id, correlation: opts.correlation, ms: Date.now() - opts.started });
+        }
         try {
             const outcome = await executeApproved(r, person, deps, instructions);
             receipt = { ...receipt, ...outcome };
@@ -444,6 +586,16 @@ async function decideOnce(r, person, choice, deps, opts) {
         completion_receipt: receipt,
         body: { decision: choice, ...(instructions ? { instructions } : {}) },
     });
+    logDecision(deps, {
+        phase: "done",
+        record: r.id,
+        correlation: opts.correlation,
+        decision,
+        state,
+        outcome: receipt.outcome,
+        ...(typeof receipt.status === "number" ? { status: receipt.status } : {}),
+        ms: Date.now() - opts.started,
+    });
     return { decision, state, receipt };
 }
 export function isApprovable(r) {
@@ -523,12 +675,11 @@ export function registerApprovalRoutes(app, deps) {
             const failedAgain = ran.receipt.outcome === "failed";
             return void res.type("html").send(page("Recorded", `<h1>${failedAgain ? "Run again, and it failed again" : "Run again"}</h1>${summary(find(r.id))}<pre>${escapeHtml(JSON.stringify(ran.receipt, null, 2))}</pre>`));
         }
-        if (r.approval_state !== "awaiting_approval") {
-            return void res.status(409).type("html").send(approvePage(deps, r, { error: `This request is already ${r.approval_state}.` }));
-        }
         const choice = DECISIONS.includes(String(body.decision)) ? body.decision : "decline";
         const instructions = String(body.instructions ?? "").trim().slice(0, 20000) || undefined;
-        if ((choice === "approve_with_changes" || choice === "request_revision") && !instructions) {
+        const via = String(body.via ?? "approval-page").slice(0, 60);
+        // Only a decision that would be recorded now needs its instructions; a form sent again after it was recorded is answered below (#924).
+        if (r.approval_state === "awaiting_approval" && !isBeingDecided(r.id) && (choice === "approve_with_changes" || choice === "request_revision") && !instructions) {
             return void res
                 .status(400)
                 .type("html")
@@ -537,12 +688,21 @@ export function registerApprovalRoutes(app, deps) {
         let decided;
         try {
             const shown = Number(body.version);
-            decided = await decide(r, person, choice, deps, {
+            const running = decide(r, person, choice, deps, {
                 instructions,
                 note: body.note || undefined,
-                via: String(body.via ?? "approval-page").slice(0, 60),
+                via,
                 ...(Number.isInteger(shown) && shown >= 1 ? { expectedVersion: shown } : {}),
             });
+            // A run that takes longer than a proxy waits (the review service may take minutes) is answered as
+            // recorded and running; the run goes on, and signing in again shows how it ended (#924).
+            const settled = await settleWithin(running, decisionWaitOf(deps));
+            if (settled === STILL_RUNNING) {
+                logDecision(deps, { phase: "answered_running", record: r.id, via, choice });
+                const now = find(r.id);
+                return void res.status(202).type("html").send(page("Recorded", `<h1>${escapeHtml(projectionOf(now, deps)?.label ?? "Being recorded")}</h1>${summary(now)}${projectionBlock(projectionOf(now, deps), undefined)}${refreshForm(token)}`));
+            }
+            decided = settled;
         }
         catch (error) {
             if (error instanceof StaleVersion)
@@ -551,18 +711,21 @@ export function registerApprovalRoutes(app, deps) {
                 return void res.status(409).type("html").send(approvePage(deps, find(r.id), { error: error.message }));
             throw error;
         }
-        const { decision, receipt } = decided;
+        const { decision, receipt, replayed } = decided;
         const p = projectionOf(find(r.id), deps);
         const heading = decision === "approved"
             ? p?.stage === "failed"
                 ? "Approved, but running it failed"
-                : p?.outstanding.length
-                    ? "Approved, changes still to do"
-                    : "Approved"
+                : p?.stage === "recording"
+                    ? "Approved, running"
+                    : p?.outstanding.length
+                        ? "Approved, changes still to do"
+                        : "Approved"
             : decision === "revision_requested"
                 ? "Sent back for revision"
                 : "Declined";
-        res.type("html").send(page("Recorded", `<h1>${heading}</h1>${summary(find(r.id))}${projectionBlock(p, receipt)}`));
+        const again = replayed ? "<p>This decision was already recorded. Nothing ran again; here is where it stands.</p>" : "";
+        res.type("html").send(page("Recorded", `<h1>${heading}</h1>${again}${summary(find(r.id))}${projectionBlock(p, receipt)}${p?.stage === "recording" ? refreshForm(token) : ""}`));
     });
     // A record's own page, for citations in ChatGPT: its author and anyone with Miadi's read tier may read it.
     app.get("/records/:id", (req, res) => {
@@ -589,6 +752,10 @@ export function registerApprovalRoutes(app, deps) {
         res.type("html").send(page("Miadi record", `<h1>${escapeHtml(r.kind)}</h1>${summary(r)}`));
     });
 }
+/** A button that shows where a running request stands now, signed in with the token the person just used. */
+function refreshForm(token) {
+    return `<form method="post"><input type="hidden" name="person_token" value="${escapeHtml(token)}"><div class="row"><button class="primary" type="submit">Show where it stands now</button></div></form>`;
+}
 function recordForm(id, error) {
     return `<h1>Miadi record</h1><p>${escapeHtml(id)}</p>
 ${error ? `<p class="err" role="alert">${escapeHtml(error)}</p>` : ""}
@@ -658,12 +825,14 @@ ${actionable && o.token
 </div></form>`
         : actionable
             ? "<p>A person with Miadi's write tier decides this request.</p>"
-            : isRerunnable(r) && o.token
-                ? `<p>It was approved, and running it failed. When what it calls has been fixed, it can be run again with the same approval and instructions; the ledger records who ran it again.</p>
+            : o.token && projectionOf(r, deps)?.stage === "recording"
+                ? refreshForm(o.token)
+                : isRerunnable(r) && o.token
+                    ? `<p>It was approved, and running it failed. When what it calls has been fixed, it can be run again with the same approval and instructions; the ledger records who ran it again.</p>
 <form method="post">
 <input type="hidden" name="person_token" value="${escapeHtml(o.token)}">
 <div class="row"><button class="primary" type="submit" name="decision" value="rerun">Run it again</button></div></form>`
-                : ""}`);
+                    : ""}`);
 }
 /** How a request is named to a person. */
 export const KIND_LABELS = {

package/dist/config.d.ts

@@ -14,5 +14,17 @@ export interface ConnectorConfig {
     inquiryRoot?: string;
     /** owner/repo a saved report's inquiry issue is opened in (MIADI_INQUIRY_GITHUB_REPO). */
     inquiryRepo?: string;
+    /**
+     * How long a card's decision token stays usable, in seconds (MIADI_CONNECTOR_DECISION_TOKEN_TTL).
+     * Default 7 days, held between 5 minutes and 30 days. The request itself does not expire (jgwill/Miadi#924).
+     */
+    decisionTokenTtl?: number;
+    /**
+     * How long a decision answer waits for the run it starts, in milliseconds (MIADI_CONNECTOR_DECISION_WAIT_MS).
+     * Past it the answer says the decision is recorded and still running, and the run goes on. Default 20 s, at most 50 s.
+     */
+    decisionWaitMs?: number;
 }
+export declare const DEFAULT_DECISION_TOKEN_TTL: number;
+export declare const DEFAULT_DECISION_WAIT_MS = 20000;
 export declare function configFromEnv(env?: NodeJS.ProcessEnv): ConnectorConfig;

package/dist/config.js

@@ -1,5 +1,14 @@
 import { resolveEnv } from "@miadi/inquiry-weave";
 import { reviewToken } from "./reviews.js";
+export const DEFAULT_DECISION_TOKEN_TTL = 7 * 24 * 3600;
+export const DEFAULT_DECISION_WAIT_MS = 20_000;
+/** A number from the environment held between two bounds; anything unreadable is the default. */
+function bounded(raw, fallback, min, max) {
+    const n = Number(raw);
+    if (raw === undefined || raw.trim() === "" || !Number.isFinite(n))
+        return fallback;
+    return Math.min(max, Math.max(min, Math.round(n)));
+}
 export function configFromEnv(env = process.env) {
     const port = Number(env.MIADI_CONNECTOR_PORT || 3337);
     const shelf = resolveEnv({}, env);
@@ -14,5 +23,7 @@ export function configFromEnv(env = process.env) {
         stateDir: env.MIADI_CONNECTOR_STATE_DIR || "/srv/miadi/connector",
         inquiryRoot: shelf.inquiryRoot,
         inquiryRepo: shelf.repo,
+        decisionTokenTtl: bounded(env.MIADI_CONNECTOR_DECISION_TOKEN_TTL, DEFAULT_DECISION_TOKEN_TTL, 300, 30 * 24 * 3600),
+        decisionWaitMs: bounded(env.MIADI_CONNECTOR_DECISION_WAIT_MS, DEFAULT_DECISION_WAIT_MS, 0, 50_000),
     };
 }

package/dist/decisions.d.ts

@@ -1,10 +1,12 @@
 export declare const DECISIONS_CARD_URI = "ui://miadi/decisions-v1.html";
+/** The default lifetime of a card's decision token, in seconds; MIADI_CONNECTOR_DECISION_TOKEN_TTL changes it. */
 export declare const DECISION_TOKEN_TTL: number;
 /** Where the tokens travel in a result's `_meta`, keyed by record id. */
 export declare const DECISION_TOKENS_META = "miadi/decisionTokens";
 export declare class DecisionTokens {
+    readonly ttl: number;
     private readonly secret;
-    constructor(stateDir: string);
+    constructor(stateDir: string, ttl?: number);
     private sign;
     /** A token for one card: one request, at the version the card shows, for one person in one client. */
     issue(recordId: string, personId: string, clientId: string, now?: number, version?: number): string;
@@ -17,4 +19,4 @@ export declare class DecisionTokens {
  * and calls `decide_request` through the host. In a host without that bridge it
  * shows each request's approval page instead.
  */
-export declare const DECISIONS_CARD_HTML = "<!doctype html>\n<html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<style>\n:root{color-scheme:light dark;--fg:#1d1b18;--muted:#5b5650;--line:#d9d4cc;--accent:#7a4a00;--ok:#1d6b3a;--err:#b00020;--chip:#f1ede6}\n@media (prefers-color-scheme:dark){:root{--fg:#ece8e1;--muted:#b3ada4;--line:#3a3631;--accent:#ffd700;--ok:#7fd49b;--err:#ff8a80;--chip:#24211d}}\n*{box-sizing:border-box}\nbody{margin:0;color:var(--fg);font:15px/1.45 system-ui,sans-serif;background:transparent}\nmain{padding:12px;display:grid;gap:12px}\n.empty,.note{color:var(--muted)}\narticle{border:1px solid var(--line);border-radius:10px;padding:12px}\nh2{font-size:15px;margin:0 0 4px}\n.kind{display:inline-block;font-size:12px;padding:1px 8px;border-radius:999px;background:var(--chip);color:var(--muted);margin-bottom:6px}\n.meta{font-size:13px;color:var(--muted);margin:0 0 6px}\n.does{margin:6px 0;font-weight:600}\ndetails{margin:6px 0}\nsummary{cursor:pointer;color:var(--muted);font-size:13px}\npre{white-space:pre-wrap;overflow-wrap:anywhere;font-size:12px;margin:6px 0 0;max-height:240px;overflow:auto}\ntextarea{width:100%;min-height:64px;padding:8px;border:1px solid var(--line);border-radius:8px;background:transparent;color:var(--fg);font:inherit;margin-top:8px}\n.row{display:flex;flex-wrap:wrap;gap:8px;margin-top:8px}\nbutton{padding:8px 12px;border-radius:8px;border:1px solid var(--line);background:transparent;color:var(--fg);font:inherit;cursor:pointer;min-height:40px}\nbutton.primary{border-color:var(--accent);outline:1px solid var(--accent)}\nbutton:focus-visible,a:focus-visible,textarea:focus-visible{outline:2px solid var(--accent);outline-offset:2px}\nbutton[disabled]{opacity:.55;cursor:default}\na{color:inherit}\n.done{color:var(--ok);font-weight:600}\n.fail{color:var(--err);font-weight:600}\n</style></head><body><main id=\"root\" aria-live=\"polite\"><p class=\"note\">Loading requests\u2026</p></main>\n<script>\n(function(){\n  var root=document.getElementById(\"root\");\n  var decided={};\n  // A redraw while a decision is being recorded must not offer the buttons again.\n  var pending={};\n  var errors={};\n  function el(tag,attrs,text){var e=document.createElement(tag);if(attrs)for(var k in attrs){if(k===\"class\")e.className=attrs[k];else e.setAttribute(k,attrs[k]);}if(text!=null)e.textContent=text;return e;}\n  function host(){return window.openai||null;}\n  function data(){var h=host();return h&&h.toolOutput?h.toolOutput:null;}\n  function tokens(){var h=host();var m=h&&h.toolResponseMetadata;return (m&&m[\"miadi/decisionTokens\"])||{};}\n  function render(){\n    var d=data();root.textContent=\"\";\n    if(!d){root.appendChild(el(\"p\",{class:\"note\"},\"Waiting for the request list.\"));return;}\n    var list=d.decisions||[];\n    if(!list.length){root.appendChild(el(\"p\",{class:\"empty\"},d.message||\"No request is waiting for a decision.\"));return;}\n    if(!d.can_decide_here&&d.reason){root.appendChild(el(\"p\",{class:\"note\"},d.reason));}\n    var t=tokens();\n    list.forEach(function(r){root.appendChild(card(r,t[r.id]));});\n  }\n  // Where a request stands, as the connector projected it: the label, its lines, and the review it produced.\n  function decidedBlock(d){\n    var box=el(\"div\",{role:\"status\",class:d.cls});\n    if(d.note)box.appendChild(el(\"p\",{class:\"line\"},d.note));\n    box.appendChild(el(\"p\",{class:\"label\"},d.label));\n    (d.lines||[]).forEach(function(l){box.appendChild(el(\"p\",{class:\"line\"},l));});\n    if(d.url){var p=el(\"p\",{class:\"line\"});p.appendChild(el(\"a\",{href:d.url,target:\"_blank\",rel:\"noopener\"},d.url));box.appendChild(p);}\n    return box;\n  }\n  function toolResult(res){\n    var out=(res&&(res.structuredContent||res.structured_content))||null;\n    if(!out&&res&&res.content&&res.content[0]&&res.content[0].text){try{out=JSON.parse(res.content[0].text);}catch(e){out={message:res.content[0].text};}}\n    return out;\n  }\n  function projectionView(p,note){return {cls:p.stage===\"failed\"?\"fail\":\"done\",stage:p.stage,label:p.label,lines:p.lines||[],url:p.receipt_url||null,note:note||null};}\n  function card(r,token){\n    var a=el(\"article\",{\"aria-label\":r.title});\n    a.appendChild(el(\"span\",{class:\"kind\"},r.kind_label||r.kind));\n    a.appendChild(el(\"h2\",null,r.title));\n    a.appendChild(el(\"p\",{class:\"meta\"},\"Asked by \"+r.by+(r.via?\" through \"+r.via:\"\")+\" \u00B7 \"+new Date(r.created_at).toLocaleString()+(r.circle?\" \u00B7 \"+r.circle+\" circle\":\"\")));\n    a.appendChild(el(\"p\",{class:\"does\"},r.consequence));\n    if(r.intention)a.appendChild(el(\"p\",null,r.intention));\n    var det=el(\"details\");det.appendChild(el(\"summary\",null,\"What exactly is asked\"));det.appendChild(el(\"pre\",null,r.detail||\"\"));a.appendChild(det);\n    var status=el(\"p\",{role:\"status\"});\n    if(r.projection&&r.projection.stage!==\"awaiting_decision\"&&(!decided[r.id]||[\"recording\",\"dispatching\"].indexOf(r.projection.stage)===-1)){decided[r.id]=projectionView(r.projection);}\n    if(decided[r.id]){\n      var shown=decided[r.id];a.appendChild(decidedBlock(shown));\n      if([\"recording\",\"dispatching\"].indexOf(shown.stage)!==-1&&host()&&host().callTool){\n        var refresh=el(\"button\",{type:\"button\"},\"Refresh status\");\n        refresh.addEventListener(\"click\",function(){\n          refresh.disabled=true;\n          host().callTool(\"get_run_result\",{record_id:r.id}).then(function(res){\n            var out=toolResult(res);var p=out&&(out.projection||(out.data&&out.data.projection));\n            if(p){decided[r.id]=projectionView(p);delete errors[r.id];}\n            else{errors[r.id]=(out&&out.message)||\"Status could not be refreshed.\";}\n            render();\n          },function(err){errors[r.id]=\"Status could not be refreshed: \"+String(err&&err.message||err);render();});\n        });\n        a.appendChild(refresh);\n      }\n      if(errors[r.id])a.appendChild(el(\"p\",{class:\"fail\",role:\"status\"},errors[r.id]));\n      return a;\n    }\n    if(pending[r.id]){status.className=\"note\";status.textContent=\"Recording your decision\u2026\";a.appendChild(status);return a;}\n    if(!token||!host()||!host().callTool){\n      var p=el(\"p\",{class:\"note\"});p.appendChild(document.createTextNode(\"Decide on its approval page: \"));\n      var link=el(\"a\",{href:r.approval_url,target:\"_blank\",rel:\"noopener\"},\"open the approval page\");p.appendChild(link);a.appendChild(p);return a;\n    }\n    var ta=el(\"textarea\",{\"aria-label\":\"Instructions or changes (needed to approve with changes or send back)\",placeholder:\"Instructions or changes (needed to approve with changes or send back)\"});\n    a.appendChild(ta);\n    var row=el(\"div\",{class:\"row\"});\n    var buttons=[[\"approve\",\"Approve\",\"primary\"],[\"approve_with_changes\",\"Approve with my changes\",\"\"],[\"request_revision\",\"Send back for revision\",\"\"],[\"decline\",\"Decline\",\"\"]];\n    var btns=[];\n    buttons.forEach(function(b){var x=el(\"button\",{type:\"button\",class:b[2]},b[1]);x.addEventListener(\"click\",function(){go(b[0]);});btns.push(x);row.appendChild(x);});\n    a.appendChild(row);a.appendChild(status);\n    if(errors[r.id]){status.className=\"fail\";status.textContent=errors[r.id];}\n    function go(choice){\n      var text=ta.value.trim();\n      if((choice===\"approve_with_changes\"||choice===\"request_revision\")&&!text){status.className=\"fail\";status.textContent=choice===\"request_revision\"?\"Say what to revise.\":\"Write the changes to apply.\";ta.focus();return;}\n      btns.forEach(function(x){x.disabled=true;});status.className=\"note\";status.textContent=\"Recording your decision\u2026\";pending[r.id]=true;delete errors[r.id];\n      host().callTool(\"decide_request\",{record_id:r.id,decision:choice,instructions:text||undefined,decision_token:token}).then(function(res){\n        var out=toolResult(res);\n        // The connector answers with the request's projection, also when a click finds it decided already.\n        var proj=out&&out.projection;\n        var already=!!(out&&out.error===\"already_decided\");\n        var ok=out&&!out.error;\n        delete pending[r.id];\n        if(proj){decided[r.id]=projectionView(proj,already?\"This request was already decided. Here is where it stands.\":null);}\n        else{decided[r.id]={cls:ok?\"done\":\"fail\",label:ok?(out.summary||\"Recorded.\"):((out&&out.message)||\"Not recorded.\"),lines:[],url:null,note:null};}\n        render();\n      },function(err){delete pending[r.id];errors[r.id]=\"Not recorded: \"+(err&&err.message?err.message:String(err));render();});\n    }\n    return a;\n  }\n  window.addEventListener(\"openai:set_globals\",render);\n  render();\n})();\n</script></body></html>";
+export declare const DECISIONS_CARD_HTML = "<!doctype html>\n<html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<style>\n:root{color-scheme:light dark;--fg:#1d1b18;--muted:#5b5650;--line:#d9d4cc;--accent:#7a4a00;--ok:#1d6b3a;--err:#b00020;--chip:#f1ede6}\n@media (prefers-color-scheme:dark){:root{--fg:#ece8e1;--muted:#b3ada4;--line:#3a3631;--accent:#ffd700;--ok:#7fd49b;--err:#ff8a80;--chip:#24211d}}\n*{box-sizing:border-box}\nbody{margin:0;color:var(--fg);font:15px/1.45 system-ui,sans-serif;background:transparent}\nmain{padding:12px;display:grid;gap:12px}\n.empty,.note{color:var(--muted)}\narticle{border:1px solid var(--line);border-radius:10px;padding:12px}\nh2{font-size:15px;margin:0 0 4px}\n.kind{display:inline-block;font-size:12px;padding:1px 8px;border-radius:999px;background:var(--chip);color:var(--muted);margin-bottom:6px}\n.meta{font-size:13px;color:var(--muted);margin:0 0 6px}\n.does{margin:6px 0;font-weight:600}\ndetails{margin:6px 0}\nsummary{cursor:pointer;color:var(--muted);font-size:13px}\npre{white-space:pre-wrap;overflow-wrap:anywhere;font-size:12px;margin:6px 0 0;max-height:240px;overflow:auto}\ntextarea{width:100%;min-height:64px;padding:8px;border:1px solid var(--line);border-radius:8px;background:transparent;color:var(--fg);font:inherit;margin-top:8px}\n.row{display:flex;flex-wrap:wrap;gap:8px;margin-top:8px}\nbutton{padding:8px 12px;border-radius:8px;border:1px solid var(--line);background:transparent;color:var(--fg);font:inherit;cursor:pointer;min-height:40px}\nbutton.primary{border-color:var(--accent);outline:1px solid var(--accent)}\nbutton:focus-visible,a:focus-visible,textarea:focus-visible{outline:2px solid var(--accent);outline-offset:2px}\nbutton[disabled]{opacity:.55;cursor:default}\na{color:inherit}\n.done{color:var(--ok);font-weight:600}\n.fail{color:var(--err);font-weight:600}\n</style></head><body><main id=\"root\" aria-live=\"polite\"><p class=\"note\">Loading requests\u2026</p></main>\n<script>\n(function(){\n  var root=document.getElementById(\"root\");\n  var decided={};\n  // A redraw while a decision is being recorded must not offer the buttons again.\n  var pending={};\n  var errors={};\n  // A decision still running is followed to its outcome (jgwill/Miadi#924): one read every POLL_MS, at most POLL_MAX.\n  var POLL_MS=3000,POLL_MAX=100,polls={};\n  // An error that leaves the request open offers its approval page under it.\n  var relink={};\n  function el(tag,attrs,text){var e=document.createElement(tag);if(attrs)for(var k in attrs){if(k===\"class\")e.className=attrs[k];else e.setAttribute(k,attrs[k]);}if(text!=null)e.textContent=text;return e;}\n  function host(){return window.openai||null;}\n  function data(){var h=host();return h&&h.toolOutput?h.toolOutput:null;}\n  function tokens(){var h=host();var m=h&&h.toolResponseMetadata;return (m&&m[\"miadi/decisionTokens\"])||{};}\n  function render(){\n    var d=data();root.textContent=\"\";\n    if(!d){root.appendChild(el(\"p\",{class:\"note\"},\"Waiting for the request list.\"));return;}\n    var list=d.decisions||[];\n    if(!list.length){root.appendChild(el(\"p\",{class:\"empty\"},d.message||\"No request is waiting for a decision.\"));return;}\n    if(!d.can_decide_here&&d.reason){root.appendChild(el(\"p\",{class:\"note\"},d.reason));}\n    var t=tokens();\n    list.forEach(function(r){root.appendChild(card(r,t[r.id]));});\n  }\n  // Where a request stands, as the connector projected it: the label, its lines, and the review it produced.\n  function decidedBlock(d){\n    var box=el(\"div\",{role:\"status\",class:d.cls});\n    if(d.note)box.appendChild(el(\"p\",{class:\"line\"},d.note));\n    box.appendChild(el(\"p\",{class:\"label\"},d.label));\n    (d.lines||[]).forEach(function(l){box.appendChild(el(\"p\",{class:\"line\"},l));});\n    if(d.url){var p=el(\"p\",{class:\"line\"});p.appendChild(el(\"a\",{href:d.url,target:\"_blank\",rel:\"noopener\"},d.url));box.appendChild(p);}\n    return box;\n  }\n  function toolResult(res){\n    var out=(res&&(res.structuredContent||res.structured_content))||null;\n    if(!out&&res&&res.content&&res.content[0]&&res.content[0].text){try{out=JSON.parse(res.content[0].text);}catch(e){out={message:res.content[0].text};}}\n    return out;\n  }\n  function projectionView(p,note){return {cls:p.stage===\"failed\"?\"fail\":[\"recording\",\"dispatching\"].indexOf(p.stage)!==-1?\"note\":\"done\",stage:p.stage,label:p.label,lines:p.lines||[],url:p.receipt_url||null,note:note||null};}\n  // Read where a request stands. Still running: read again later. Never decided (the call was lost on the way): offer the decision again.\n  function follow(r,lost){\n    if(!host()||!host().callTool)return;\n    polls[r.id]=(polls[r.id]||0)+1;\n    host().callTool(\"get_run_result\",{record_id:r.id}).then(function(res){\n      var out=toolResult(res);var p=out&&(out.projection||(out.data&&out.data.projection));\n      if(!p){if(lost){delete decided[r.id];errors[r.id]=lost;}render();return;}\n      if(p.stage===\"awaiting_decision\"){delete decided[r.id];if(lost)errors[r.id]=lost+\" Nothing was decided; decide again.\";render();return;}\n      var note=decided[r.id]&&decided[r.id].note;\n      decided[r.id]=projectionView(p,note);delete errors[r.id];render();\n      if(p.stage===\"recording\"&&polls[r.id]<POLL_MAX)setTimeout(function(){follow(r);},POLL_MS);\n    },function(err){\n      if(lost){decided[r.id]={cls:\"note\",stage:\"recording\",label:\"Your decision may be recorded. Checking again\u2026\",lines:[],url:null,note:null};render();}\n      if(polls[r.id]<POLL_MAX)setTimeout(function(){follow(r,lost);},POLL_MS);\n    });\n  }\n  function card(r,token){\n    var a=el(\"article\",{\"aria-label\":r.title});\n    a.appendChild(el(\"span\",{class:\"kind\"},r.kind_label||r.kind));\n    a.appendChild(el(\"h2\",null,r.title));\n    a.appendChild(el(\"p\",{class:\"meta\"},\"Asked by \"+r.by+(r.via?\" through \"+r.via:\"\")+\" \u00B7 \"+new Date(r.created_at).toLocaleString()+(r.circle?\" \u00B7 \"+r.circle+\" circle\":\"\")));\n    a.appendChild(el(\"p\",{class:\"does\"},r.consequence));\n    if(r.intention)a.appendChild(el(\"p\",null,r.intention));\n    var det=el(\"details\");det.appendChild(el(\"summary\",null,\"What exactly is asked\"));det.appendChild(el(\"pre\",null,r.detail||\"\"));a.appendChild(det);\n    var status=el(\"p\",{role:\"status\"});\n    if(r.projection&&r.projection.stage!==\"awaiting_decision\"&&(!decided[r.id]||[\"recording\",\"dispatching\"].indexOf(r.projection.stage)===-1)){decided[r.id]=projectionView(r.projection);}\n    if(decided[r.id]){\n      var shown=decided[r.id];a.appendChild(decidedBlock(shown));\n      if(shown.stage===\"recording\"&&polls[r.id]===undefined&&host()&&host().callTool){polls[r.id]=0;setTimeout(function(){follow(r);},POLL_MS);}\n      if([\"recording\",\"dispatching\"].indexOf(shown.stage)!==-1&&host()&&host().callTool){\n        var refresh=el(\"button\",{type:\"button\"},\"Refresh status\");\n        refresh.addEventListener(\"click\",function(){\n          refresh.disabled=true;\n          host().callTool(\"get_run_result\",{record_id:r.id}).then(function(res){\n            var out=toolResult(res);var p=out&&(out.projection||(out.data&&out.data.projection));\n            if(p){decided[r.id]=projectionView(p);delete errors[r.id];}\n            else{errors[r.id]=(out&&out.message)||\"Status could not be refreshed.\";}\n            render();\n          },function(err){errors[r.id]=\"Status could not be refreshed: \"+String(err&&err.message||err);render();});\n        });\n        a.appendChild(refresh);\n      }\n      if(errors[r.id])a.appendChild(el(\"p\",{class:\"fail\",role:\"status\"},errors[r.id]));\n      return a;\n    }\n    function approvalLink(){var p=el(\"p\",{class:\"note\"});p.appendChild(document.createTextNode(\"Decide on its approval page: \"));p.appendChild(el(\"a\",{href:r.approval_url,target:\"_blank\",rel:\"noopener\"},\"open the approval page\"));return p;}\n    if(pending[r.id]){status.className=\"note\";status.textContent=\"Recording your decision\u2026\";a.appendChild(status);return a;}\n    if(!token||!host()||!host().callTool){a.appendChild(approvalLink());return a;}\n    var ta=el(\"textarea\",{\"aria-label\":\"Instructions or changes (needed to approve with changes or send back)\",placeholder:\"Instructions or changes (needed to approve with changes or send back)\"});\n    a.appendChild(ta);\n    var row=el(\"div\",{class:\"row\"});\n    var buttons=[[\"approve\",\"Approve\",\"primary\"],[\"approve_with_changes\",\"Approve with my changes\",\"\"],[\"request_revision\",\"Send back for revision\",\"\"],[\"decline\",\"Decline\",\"\"]];\n    var btns=[];\n    buttons.forEach(function(b){var x=el(\"button\",{type:\"button\",class:b[2]},b[1]);x.addEventListener(\"click\",function(){go(b[0]);});btns.push(x);row.appendChild(x);});\n    a.appendChild(row);a.appendChild(status);\n    if(errors[r.id]){status.className=\"fail\";status.textContent=errors[r.id];if(relink[r.id])a.appendChild(approvalLink());}\n    function go(choice){\n      var text=ta.value.trim();\n      if((choice===\"approve_with_changes\"||choice===\"request_revision\")&&!text){status.className=\"fail\";status.textContent=choice===\"request_revision\"?\"Say what to revise.\":\"Write the changes to apply.\";ta.focus();return;}\n      btns.forEach(function(x){x.disabled=true;});status.className=\"note\";status.textContent=\"Recording your decision\u2026\";pending[r.id]=true;delete errors[r.id];\n      host().callTool(\"decide_request\",{record_id:r.id,decision:choice,instructions:text||undefined,decision_token:token}).then(function(res){\n        var out=toolResult(res);\n        // The connector answers with the request's projection, also when a click finds it decided already.\n        var proj=out&&(out.projection||(out.detail&&out.detail.projection));\n        var code=out&&out.error;\n        delete pending[r.id];\n        // The token expired or the request was revised, and it still awaits a decision: say so and keep it open.\n        if(code&&(!proj||proj.stage===\"awaiting_decision\")){errors[r.id]=(out&&out.message)||\"Not recorded.\";relink[r.id]=true;render();return;}\n        var note=out&&out.replayed?\"This decision was already recorded. Nothing ran again.\":code===\"decision_conflict\"?\"A different decision was recorded first. Here is where it stands.\":code===\"already_decided\"?\"This request was already decided. Here is where it stands.\":null;\n        if(proj){decided[r.id]=projectionView(proj,note);}\n        else{decided[r.id]={cls:code?\"fail\":\"done\",label:code?((out&&out.message)||\"Not recorded.\"):((out&&out.summary)||\"Recorded.\"),lines:[],url:null,note:null};}\n        render();\n      },function(err){\n        // The host gave up waiting; the connector may still have recorded it. Read before offering the buttons again (#924).\n        delete pending[r.id];\n        decided[r.id]={cls:\"note\",stage:\"recording\",label:\"Checking whether your decision was recorded\u2026\",lines:[],url:null,note:null};\n        polls[r.id]=0;render();\n        follow(r,\"Not recorded: \"+(err&&err.message?err.message:String(err))+\".\");\n      });\n    }\n    return a;\n  }\n  window.addEventListener(\"openai:set_globals\",render);\n  render();\n})();\n</script></body></html>";

package/dist/decisions.js

@@ -7,9 +7,14 @@
  *   so the host does not offer it to the model;
  * - it requires a decision token that travels only in the `_meta` of the
  *   `show_decisions` result, which hosts deliver to the card and keep from the
- *   model. The token is bound to one request, one person and one OAuth client,
- *   and expires. A request decided once is no longer awaiting approval, so a
- *   token cannot be used twice.
+ *   model. The token is bound to one request, its version, one person and one
+ *   OAuth client, and expires (7 days by default). A request decided once is no
+ *   longer awaiting approval, so a token cannot decide twice.
+ *
+ * The token's lifetime is not what keeps a request safe: using it needs the same
+ * person's bearer for the same client with `miadi:approve`, and that bearer can
+ * already ask show_decisions for a fresh token. A short lifetime only made cards
+ * left open for a few hours refuse their person (jgwill/Miadi#924).
  *
  * The sign-in must also carry `miadi:approve`, which a person grants by ticking
  * it, and Miadi must give them the write tier.
@@ -18,13 +23,17 @@ import { createHmac, timingSafeEqual } from "node:crypto";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { newSecret } from "./store.js";
+import { DEFAULT_DECISION_TOKEN_TTL } from "./config.js";
 export const DECISIONS_CARD_URI = "ui://miadi/decisions-v1.html";
-export const DECISION_TOKEN_TTL = 30 * 60;
+/** The default lifetime of a card's decision token, in seconds; MIADI_CONNECTOR_DECISION_TOKEN_TTL changes it. */
+export const DECISION_TOKEN_TTL = DEFAULT_DECISION_TOKEN_TTL;
 /** Where the tokens travel in a result's `_meta`, keyed by record id. */
 export const DECISION_TOKENS_META = "miadi/decisionTokens";
 export class DecisionTokens {
+    ttl;
     secret;
-    constructor(stateDir) {
+    constructor(stateDir, ttl = DECISION_TOKEN_TTL) {
+        this.ttl = ttl;
         const file = join(stateDir, "decision-secret");
         if (!existsSync(file))
             writeFileSync(file, newSecret(32), { mode: 0o600, flag: "wx" });
@@ -37,7 +46,7 @@ export class DecisionTokens {
     }
     /** A token for one card: one request, at the version the card shows, for one person in one client. */
     issue(recordId, personId, clientId, now = Math.floor(Date.now() / 1000), version = 1) {
-        const exp = now + DECISION_TOKEN_TTL;
+        const exp = now + this.ttl;
         return `${exp}.v${version}.${this.sign(recordId, personId, clientId, exp, version)}`;
     }
     /** `stale`: the token is genuine but was minted for a version the request no longer holds. */
@@ -98,6 +107,10 @@ a{color:inherit}
   // A redraw while a decision is being recorded must not offer the buttons again.
   var pending={};
   var errors={};
+  // A decision still running is followed to its outcome (jgwill/Miadi#924): one read every POLL_MS, at most POLL_MAX.
+  var POLL_MS=3000,POLL_MAX=100,polls={};
+  // An error that leaves the request open offers its approval page under it.
+  var relink={};
   function el(tag,attrs,text){var e=document.createElement(tag);if(attrs)for(var k in attrs){if(k==="class")e.className=attrs[k];else e.setAttribute(k,attrs[k]);}if(text!=null)e.textContent=text;return e;}
   function host(){return window.openai||null;}
   function data(){var h=host();return h&&h.toolOutput?h.toolOutput:null;}
@@ -125,7 +138,23 @@ a{color:inherit}
     if(!out&&res&&res.content&&res.content[0]&&res.content[0].text){try{out=JSON.parse(res.content[0].text);}catch(e){out={message:res.content[0].text};}}
     return out;
   }
-  function projectionView(p,note){return {cls:p.stage==="failed"?"fail":"done",stage:p.stage,label:p.label,lines:p.lines||[],url:p.receipt_url||null,note:note||null};}
+  function projectionView(p,note){return {cls:p.stage==="failed"?"fail":["recording","dispatching"].indexOf(p.stage)!==-1?"note":"done",stage:p.stage,label:p.label,lines:p.lines||[],url:p.receipt_url||null,note:note||null};}
+  // Read where a request stands. Still running: read again later. Never decided (the call was lost on the way): offer the decision again.
+  function follow(r,lost){
+    if(!host()||!host().callTool)return;
+    polls[r.id]=(polls[r.id]||0)+1;
+    host().callTool("get_run_result",{record_id:r.id}).then(function(res){
+      var out=toolResult(res);var p=out&&(out.projection||(out.data&&out.data.projection));
+      if(!p){if(lost){delete decided[r.id];errors[r.id]=lost;}render();return;}
+      if(p.stage==="awaiting_decision"){delete decided[r.id];if(lost)errors[r.id]=lost+" Nothing was decided; decide again.";render();return;}
+      var note=decided[r.id]&&decided[r.id].note;
+      decided[r.id]=projectionView(p,note);delete errors[r.id];render();
+      if(p.stage==="recording"&&polls[r.id]<POLL_MAX)setTimeout(function(){follow(r);},POLL_MS);
+    },function(err){
+      if(lost){decided[r.id]={cls:"note",stage:"recording",label:"Your decision may be recorded. Checking again…",lines:[],url:null,note:null};render();}
+      if(polls[r.id]<POLL_MAX)setTimeout(function(){follow(r,lost);},POLL_MS);
+    });
+  }
   function card(r,token){
     var a=el("article",{"aria-label":r.title});
     a.appendChild(el("span",{class:"kind"},r.kind_label||r.kind));
@@ -138,6 +167,7 @@ a{color:inherit}
     if(r.projection&&r.projection.stage!=="awaiting_decision"&&(!decided[r.id]||["recording","dispatching"].indexOf(r.projection.stage)===-1)){decided[r.id]=projectionView(r.projection);}
     if(decided[r.id]){
       var shown=decided[r.id];a.appendChild(decidedBlock(shown));
+      if(shown.stage==="recording"&&polls[r.id]===undefined&&host()&&host().callTool){polls[r.id]=0;setTimeout(function(){follow(r);},POLL_MS);}
       if(["recording","dispatching"].indexOf(shown.stage)!==-1&&host()&&host().callTool){
         var refresh=el("button",{type:"button"},"Refresh status");
         refresh.addEventListener("click",function(){
@@ -154,11 +184,9 @@ a{color:inherit}
       if(errors[r.id])a.appendChild(el("p",{class:"fail",role:"status"},errors[r.id]));
       return a;
     }
+    function approvalLink(){var p=el("p",{class:"note"});p.appendChild(document.createTextNode("Decide on its approval page: "));p.appendChild(el("a",{href:r.approval_url,target:"_blank",rel:"noopener"},"open the approval page"));return p;}
     if(pending[r.id]){status.className="note";status.textContent="Recording your decision…";a.appendChild(status);return a;}
-    if(!token||!host()||!host().callTool){
-      var p=el("p",{class:"note"});p.appendChild(document.createTextNode("Decide on its approval page: "));
-      var link=el("a",{href:r.approval_url,target:"_blank",rel:"noopener"},"open the approval page");p.appendChild(link);a.appendChild(p);return a;
-    }
+    if(!token||!host()||!host().callTool){a.appendChild(approvalLink());return a;}
     var ta=el("textarea",{"aria-label":"Instructions or changes (needed to approve with changes or send back)",placeholder:"Instructions or changes (needed to approve with changes or send back)"});
     a.appendChild(ta);
     var row=el("div",{class:"row"});
@@ -166,7 +194,7 @@ a{color:inherit}
     var btns=[];
     buttons.forEach(function(b){var x=el("button",{type:"button",class:b[2]},b[1]);x.addEventListener("click",function(){go(b[0]);});btns.push(x);row.appendChild(x);});
     a.appendChild(row);a.appendChild(status);
-    if(errors[r.id]){status.className="fail";status.textContent=errors[r.id];}
+    if(errors[r.id]){status.className="fail";status.textContent=errors[r.id];if(relink[r.id])a.appendChild(approvalLink());}
     function go(choice){
       var text=ta.value.trim();
       if((choice==="approve_with_changes"||choice==="request_revision")&&!text){status.className="fail";status.textContent=choice==="request_revision"?"Say what to revise.":"Write the changes to apply.";ta.focus();return;}
@@ -174,14 +202,22 @@ a{color:inherit}
       host().callTool("decide_request",{record_id:r.id,decision:choice,instructions:text||undefined,decision_token:token}).then(function(res){
         var out=toolResult(res);
         // The connector answers with the request's projection, also when a click finds it decided already.
-        var proj=out&&out.projection;
-        var already=!!(out&&out.error==="already_decided");
-        var ok=out&&!out.error;
+        var proj=out&&(out.projection||(out.detail&&out.detail.projection));
+        var code=out&&out.error;
         delete pending[r.id];
-        if(proj){decided[r.id]=projectionView(proj,already?"This request was already decided. Here is where it stands.":null);}
-        else{decided[r.id]={cls:ok?"done":"fail",label:ok?(out.summary||"Recorded."):((out&&out.message)||"Not recorded."),lines:[],url:null,note:null};}
+        // The token expired or the request was revised, and it still awaits a decision: say so and keep it open.
+        if(code&&(!proj||proj.stage==="awaiting_decision")){errors[r.id]=(out&&out.message)||"Not recorded.";relink[r.id]=true;render();return;}
+        var note=out&&out.replayed?"This decision was already recorded. Nothing ran again.":code==="decision_conflict"?"A different decision was recorded first. Here is where it stands.":code==="already_decided"?"This request was already decided. Here is where it stands.":null;
+        if(proj){decided[r.id]=projectionView(proj,note);}
+        else{decided[r.id]={cls:code?"fail":"done",label:code?((out&&out.message)||"Not recorded."):((out&&out.summary)||"Recorded."),lines:[],url:null,note:null};}
         render();
-      },function(err){delete pending[r.id];errors[r.id]="Not recorded: "+(err&&err.message?err.message:String(err));render();});
+      },function(err){
+        // The host gave up waiting; the connector may still have recorded it. Read before offering the buttons again (#924).
+        delete pending[r.id];
+        decided[r.id]={cls:"note",stage:"recording",label:"Checking whether your decision was recorded…",lines:[],url:null,note:null};
+        polls[r.id]=0;render();
+        follow(r,"Not recorded: "+(err&&err.message?err.message:String(err))+".");
+      });
     }
     return a;
   }

package/dist/request-state.d.ts

@@ -7,6 +7,8 @@
  *
  * Stages, from the ledger's folded record (see `current()`):
  * - awaiting_decision: awaiting_approval, nothing decided
+ * - recording: a decision is being recorded, or it was approved and its run is
+ *   going (written ahead as outcome `running`, jgwill/Miadi#924)
  * - declined, sent_back: decided, nothing ran
  * - dispatching: approved, and its brief is queued or running (state in_progress)
  * - completed: approved, and its run finished (state completed)
@@ -19,7 +21,7 @@
 import type { ConnectorRecord } from "./records.js";
 export declare const APPROVABLE_KINDS: readonly ["run_request", "review_operation_request", "deep_diver_request", "review_episode_link_request", "work_proposal", "session_completion_proposal", "inquiry_episode_request", "session_steer_request"];
 export declare const APPROVABLE: ReadonlySet<string>;
-/** `recording`: a decision was taken a moment ago and its run may still be going; it is not the ledger's state. */
+/** `recording`: a decision was taken a moment ago and its run is still going (in memory, or written ahead as outcome `running`). */
 export type RequestStage = "awaiting_decision" | "recording" | "declined" | "sent_back" | "dispatching" | "completed" | "failed";
 export type RequestStanding = "waiting" | "open" | "done" | "stopped";
 export interface RequestDecision {

package/dist/request-state.js

@@ -20,6 +20,7 @@ const CHOICE_WORDS = {
     superseded: "Superseded by a later version",
 };
 const OUTCOME_WORDS = {
+    running: "running",
     queued: "queued for the factory intake",
     done: "done",
     linked: "filed in the episode",
@@ -141,6 +142,10 @@ function projectCore(record, ctx = {}) {
             outstanding,
         }, lines);
     }
+    // Approved and written ahead of its run, which is still going (#924): a transient stage every surface refreshes.
+    if (record.state === "in_progress" && outcome === "running") {
+        return finish({ ...base, stage: "recording", standing: "open", decision, label: `${changes ? "Approved with changes" : "Approved"}, running`, outcome }, [...decisionLines(decision), "Running it now. The outcome shows here when it finishes."]);
+    }
     if (record.state === "in_progress") {
         const delivered = ctx.queue?.state === "delivered";
         const outstanding = [];

package/dist/server.d.ts

@@ -23,10 +23,12 @@ export interface ConnectorDeps {
     steerSettleMs?: number;
     /** Person-token attempts allowed per address in 15 minutes on each sign-in form (default 30). */
     tokenAttemptsPerWindow?: number;
+    /** Where decision events go (default: one JSON line on stdout, the service journal); tests collect them (jgwill/Miadi#924). */
+    log?: (event: Record<string, unknown>) => void;
 }
 export declare function createConnectorApp(config: ConnectorConfig, deps: ConnectorDeps): {
     app: import("express-serve-static-core").Express;
     provider: MiadiOAuthProvider;
     ledger: Ledger<ConnectorRecord>;
 };
-export declare const INSTRUCTIONS = "Miadi is a relational software factory: agent sessions, Miadi reviews of screenwalks, Chronicle episodes, talking circles and the five accountable circles (Story, Stewardship, Engineering, Evaluation, Continuity) across three domains (Creative, Ceremonial, Engineering).\n\nStart with get_capabilities: it says who you are signed in as, which tools are live, and which return not_implemented.\n\nRules every tool keeps:\n- Every record names the person who made it, with a claim category: observed, hypothesis, desired_future, fiction or verified_implementation. Keep fiction and desired futures apart from what was observed.\n- Requests (runs, work proposals, review operations, Deep Diver, review-to-episode links, inquiry-to-episode weaves, session completion) are recorded as awaiting_approval. Nothing runs, publishes or closes until a person decides. After making a request, call show_decisions: it shows the request as a card in the conversation, where the person decides with their own click (or follows its approval page). Never claim a decision the card has not reported. The person may approve, approve with changes (their instructions are carried into what runs), send it back for revision with instructions (approval_state revision_requested; read the instructions with get_run_result and revise it in place with revise_pending_request), or decline.\n- A mission is revised, never re-requested: to change a run or work proposal that still awaits a decision, call revise_pending_request with its id and the version you read (expected_version). It keeps one id, one approval page and one card; get_request_history shows every version. A new request_authorized_run or propose_work is for a new mission only. Requests made earlier as separate versions are joined with supersede_pending_requests, naming their exact ids, only when the person names or confirms them.\n- A research report (a Deep Research report) is delivered with save_research exactly as written, never summarised or shortened, with its sources; a long report goes in parts. Check the bytes and first and last lines the answer returns against what you sent.\n- An unknown id is answered as not found, never invented. A missing backing service is answered as unavailable.\n- Use the miadi-review:<uuid>, miadi-chronicle://<n>, owner/repo#n and session:<uuid> reference forms.";
+export declare const INSTRUCTIONS = "Miadi is a relational software factory: agent sessions, Miadi reviews of screenwalks, Chronicle episodes, talking circles and the five accountable circles (Story, Stewardship, Engineering, Evaluation, Continuity) across three domains (Creative, Ceremonial, Engineering).\n\nStart with get_capabilities: it says who you are signed in as, which tools are live, and which return not_implemented.\n\nEvery tool is offered on every connection. A client that loads tools on demand shows only those its last tool search matched: a tool you do not see is not missing. Search for it by its exact name, get_capabilities first, before telling the person a tool is absent. The main reads are get_capabilities, get_context, search, fetch, list_records, list_sessions, get_session, review_lookup, read_episode_file and show_decisions.\n\nRules every tool keeps:\n- Every record names the person who made it, with a claim category: observed, hypothesis, desired_future, fiction or verified_implementation. Keep fiction and desired futures apart from what was observed.\n- Requests (runs, work proposals, review operations, Deep Diver, review-to-episode links, inquiry-to-episode weaves, session completion) are recorded as awaiting_approval. Nothing runs, publishes or closes until a person decides. After making a request, call show_decisions: it shows the request as a card in the conversation, where the person decides with their own click (or follows its approval page). Never claim a decision the card has not reported. The person may approve, approve with changes (their instructions are carried into what runs), send it back for revision with instructions (approval_state revision_requested; read the instructions with get_run_result and revise it in place with revise_pending_request), or decline.\n- A mission is revised, never re-requested: to change a run or work proposal that still awaits a decision, call revise_pending_request with its id and the version you read (expected_version). It keeps one id, one approval page and one card; get_request_history shows every version. A new request_authorized_run or propose_work is for a new mission only. Requests made earlier as separate versions are joined with supersede_pending_requests, naming their exact ids, only when the person names or confirms them.\n- A research report (a Deep Research report) is delivered with save_research exactly as written, never summarised or shortened, with its sources; a long report goes in parts. Check the bytes and first and last lines the answer returns against what you sent.\n- An unknown id is answered as not found, never invented. A missing backing service is answered as unavailable.\n- Use the miadi-review:<uuid>, miadi-chronicle://<n>, owner/repo#n and session:<uuid> reference forms.";

package/dist/server.js

@@ -15,8 +15,8 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { mcpAuthRouter, createOAuthMetadata, getOAuthProtectedResourceMetadataUrl } from "@modelcontextprotocol/sdk/server/auth/router.js";
 import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
-import { MiadiOAuthProvider, SCOPES, emptyOAuthState } from "./oauth.js";
-import { registerApprovalRoutes } from "./approve.js";
+import { MiadiOAuthProvider, SCOPES, SCOPE_CONTRIBUTE, SCOPE_READ, emptyOAuthState } from "./oauth.js";
+import { reconcileInterrupted, registerApprovalRoutes } from "./approve.js";
 import { DecisionTokens } from "./decisions.js";
 import { JsonFile, Ledger, ensureStateDir, statePaths } from "./store.js";
 import { registerTools } from "./tools.js";
@@ -87,14 +87,29 @@ export function createConnectorApp(config, deps) {
         tmuxSessions: deps.tmuxSessions,
         tmux: deps.tmux,
         steerSettleMs: deps.steerSettleMs,
+        log: deps.log,
     };
+    // A run the connector was recording when it last stopped is failed now, so a person may run it again (#924).
+    reconcileInterrupted(approvalDeps);
     registerApprovalRoutes(app, approvalDeps);
-    const decisionTokens = new DecisionTokens(config.stateDir);
-    const auth = requireBearerAuth({
+    const decisionTokens = new DecisionTokens(config.stateDir, config.decisionTokenTtl);
+    const bearer = requireBearerAuth({
         verifier: provider,
-        requiredScopes: ["miadi:read"],
+        requiredScopes: [SCOPE_READ],
         resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(mcpUrl),
     });
+    // A 401's scope is the list a client asks for at sign-in (MCP scope selection,
+    // step 1). Claude asks for exactly that list, so naming only miadi:read gave
+    // every Claude sign-in read alone. /mcp still requires only miadi:read; the
+    // sign-in page lets the person leave contributions off.
+    const asked = `scope="${[SCOPE_READ, SCOPE_CONTRIBUTE].join(" ")}"`;
+    const auth = (req, res, next) => {
+        const set = res.set.bind(res);
+        res.set = ((field, value) => field === "WWW-Authenticate" && typeof value === "string"
+            ? set(field, value.replace(/scope="[^"]*"/, asked))
+            : set(field, value));
+        bearer(req, res, next);
+    };
     const handle = async (req, res) => {
         const ctx = {
             config,
@@ -143,6 +158,8 @@ export const INSTRUCTIONS = `Miadi is a relational software factory: agent sessi
 
 Start with get_capabilities: it says who you are signed in as, which tools are live, and which return not_implemented.
 
+Every tool is offered on every connection. A client that loads tools on demand shows only those its last tool search matched: a tool you do not see is not missing. Search for it by its exact name, get_capabilities first, before telling the person a tool is absent. The main reads are get_capabilities, get_context, search, fetch, list_records, list_sessions, get_session, review_lookup, read_episode_file and show_decisions.
+
 Rules every tool keeps:
 - Every record names the person who made it, with a claim category: observed, hypothesis, desired_future, fiction or verified_implementation. Keep fiction and desired futures apart from what was observed.
 - Requests (runs, work proposals, review operations, Deep Diver, review-to-episode links, inquiry-to-episode weaves, session completion) are recorded as awaiting_approval. Nothing runs, publishes or closes until a person decides. After making a request, call show_decisions: it shows the request as a card in the conversation, where the person decides with their own click (or follows its approval page). Never claim a decision the card has not reported. The person may approve, approve with changes (their instructions are carried into what runs), send it back for revision with instructions (approval_state revision_requested; read the instructions with get_run_result and revise it in place with revise_pending_request), or decline.

package/dist/tools.js

@@ -16,7 +16,7 @@ import { reviewIdOf, videoIdOf } from "./reviews.js";
 import { SCOPE_APPROVE, SCOPE_CONTRIBUTE } from "./oauth.js";
 import { CIRCLES, CIRCLE_IDS, CLAIM_CATEGORIES, DOMAINS, HANDOFF_STATES, current, newRecordId, } from "./records.js";
 import { VERSION } from "./version.js";
-import { AlreadyDecided, DECISIONS, KIND_LABELS, StaleVersion, consequenceOf, decide, isApprovable, isBeingDecided, readQueueState, requestProjection } from "./approve.js";
+import { AlreadyDecided, DECISIONS, DecisionConflict, KIND_LABELS, STILL_RUNNING, StaleVersion, approvalStateOf, consequenceOf, decide, decisionWaitOf, isApprovable, isBeingDecided, logDecision, readQueueState, requestProjection, settleWithin, } from "./approve.js";
 import { RevisionRefused, requestHistory, revisionRecord, supersedeRecords, versionOf } from "./revisions.js";
 import { DECISIONS_CARD_HTML, DECISIONS_CARD_URI, DECISION_TOKENS_META } from "./decisions.js";
 import { discoverProviders, jevConfigOf, resolveProvider, routerPreflight, PROVIDERS } from "./providers.js";
@@ -231,7 +231,7 @@ export function registerTools(server, ctx) {
     // ── reads ──────────────────────────────────────────────────────────────
     server.registerTool("get_capabilities", {
         title: "What this connector can do for you",
-        description: "The capability handshake: who you are signed in as, your Miadi tier and scopes, every tool with its status (live, needs_approval, write_tier), the services reached and the five circles. Call this first.",
+        description: "Start here with the Miadi connector. The capability handshake: who you are signed in as (who am I), your Miadi tier and scopes, the full list of Miadi tools with each one's status (live, needs_approval, write_tier), the services reached and the five circles. Call this first.",
         inputSchema: {},
         annotations: READ,
     }, wrap(async (_args, extra) => {
@@ -1932,42 +1932,64 @@ export function registerTools(server, ctx) {
             const projectionNow = () => requestProjection(all().find((x) => x.id === r.id) ?? r, { reviewBase: ctx.approval?.config.reviewUrl, factoryDir: ctx.factoryDir });
             const check = ctx.decisionTokens.verify(a.decision_token, r.id, person.id, auth.clientId, undefined, versionOf(r));
             if (check === "stale") {
-                throw new ToolRefusal("stale_version", `This card showed an earlier version; the request is now at version ${versionOf(r)}. Show the requests again and decide version ${versionOf(r)}.`, { projection: projectionNow() });
+                throw new ToolRefusal("stale_version", `This card showed an earlier version; the request is now at version ${versionOf(r)}. Show the requests again and decide version ${versionOf(r)}.`, { projection: projectionNow(), approval_url: approvalUrl(r.id) });
             }
-            if (check !== "ok")
-                throw new ToolRefusal(check === "expired" ? "token_expired" : "invalid_token", check === "expired" ? "This card is too old; show the requests again." : "This decision did not come from the person's card.");
-            if (r.approval_state !== "awaiting_approval") {
-                throw new ToolRefusal("already_decided", `This request is already ${r.approval_state}.`, { projection: projectionNow() });
+            if (check === "expired") {
+                // The request does not expire: the card's token did. Its approval page still decides it, and a fresh card does too (#924).
+                throw new ToolRefusal("token_expired", "This card's decision token has expired; the request has not. Show the requests again for a fresh card, or decide on its approval page.", {
+                    projection: projectionNow(),
+                    approval_url: approvalUrl(r.id),
+                });
             }
+            if (check !== "ok")
+                throw new ToolRefusal("invalid_token", "This decision did not come from the person's card.");
             const instructions = a.instructions?.trim() || undefined;
-            if ((a.decision === "approve_with_changes" || a.decision === "request_revision") && !instructions) {
+            if (r.approval_state === "awaiting_approval" && !isBeingDecided(r.id) && (a.decision === "approve_with_changes" || a.decision === "request_revision") && !instructions) {
                 throw new ToolRefusal("instructions_required", a.decision === "request_revision" ? "Say what to revise." : "Write the changes to apply.");
             }
             const client = ctx.oauthState.read().clients[auth.clientId];
+            const via = `card:${String(client?.client_name ?? auth.clientId).slice(0, 50)}`;
             let decided;
             try {
-                decided = await decide(r, person, a.decision, ctx.approval, {
-                    instructions,
-                    via: `card:${String(client?.client_name ?? auth.clientId).slice(0, 50)}`,
-                    expectedVersion: versionOf(r),
-                });
+                const running = decide(r, person, a.decision, ctx.approval, { instructions, via, expectedVersion: versionOf(r) });
+                // A host gives up on a call after about a minute and may send it again; a review create can take longer.
+                // Past the bound the answer is the decision, recorded and running, and the card follows it to its outcome (#924).
+                const settled = await settleWithin(running, decisionWaitOf(ctx.approval));
+                if (settled === STILL_RUNNING) {
+                    logDecision(ctx.approval, { phase: "answered_running", record: r.id, via, choice: a.decision });
+                    const decision = approvalStateOf(a.decision);
+                    const out = {
+                        record_id: r.id,
+                        version: versionOf(r),
+                        decision,
+                        state: "in_progress",
+                        recording: true,
+                        summary: `${decision === "approved" ? "Approved" : "Decided"} by ${person.name}, and still running. The card shows the outcome when it finishes; get_run_result reads it.`,
+                        projection: projectionNow(),
+                    };
+                    return { structuredContent: out, content: [{ type: "text", text: JSON.stringify(out, null, 2) }] };
+                }
+                decided = settled;
             }
             catch (error) {
                 if (error instanceof StaleVersion)
-                    throw new ToolRefusal("stale_version", error.message, { projection: projectionNow() });
-                // A decision recorded a moment earlier, by another client, is reported with where it stands.
+                    throw new ToolRefusal("stale_version", error.message, { projection: projectionNow(), approval_url: approvalUrl(r.id) });
+                // A different decision recorded a moment earlier, by another click or client, is reported with where it stands.
+                if (error instanceof DecisionConflict)
+                    throw new ToolRefusal("decision_conflict", error.message, { projection: projectionNow() });
                 if (error instanceof AlreadyDecided)
                     throw new ToolRefusal("already_decided", error.message, { projection: projectionNow() });
                 throw error;
             }
-            const { decision, state, receipt } = decided;
+            const { decision, state, receipt, replayed } = decided;
             const projection = projectionNow();
-            const summary = decision === "approved"
-                ? `Approved by ${person.name}. ${receipt.outcome === "failed" ? "Running it failed; see the receipt." : `Outcome: ${String(receipt.outcome ?? "recorded").replace(/_/g, " ")}.`}`
-                : decision === "revision_requested"
-                    ? `Sent back for revision by ${person.name}.`
-                    : `Declined by ${person.name}.`;
-            const out = { record_id: r.id, version: versionOf(r), decision, state, summary, receipt, projection };
+            const summary = (replayed ? "Already recorded; nothing ran again. " : "") +
+                (decision === "approved"
+                    ? `Approved by ${receipt.decided_by?.name ?? person.name}. ${receipt.outcome === "failed" ? "Running it failed; see the receipt." : `Outcome: ${String(receipt.outcome ?? "recorded").replace(/_/g, " ")}.`}`
+                    : decision === "revision_requested"
+                        ? `Sent back for revision by ${receipt.decided_by?.name ?? person.name}.`
+                        : `Declined by ${receipt.decided_by?.name ?? person.name}.`);
+            const out = { record_id: r.id, version: versionOf(r), decision, state, summary, receipt, projection, ...(replayed ? { replayed: true } : {}) };
             return { structuredContent: out, content: [{ type: "text", text: JSON.stringify(out, null, 2) }] };
         }
         catch (error) {

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.1.17";
+export declare const VERSION = "0.1.19";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.1.17";
+export const VERSION = "0.1.19";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miadi/connector",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "The Miadi connector: one remote MCP service through which a person signed in with their Miadi person token, from ChatGPT or any MCP client, reads sessions, reviews, episodes and circles and records observations, inquiries, handoffs and proposals with their name on each record.",
   "license": "MIT",
   "author": "Miadi",