@miadi/connector 0.1.18 → 0.1.20

package/dist/approve.js

@@ -12,8 +12,10 @@
 import express from "express";
 import { mkdirSync, writeFileSync } from "node:fs";
 import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
 import { join } from "node:path";
 import { escapeHtml } from "@miadi/node-service-kit/format";
+import { DEFAULT_DECISION_WAIT_MS } from "./config.js";
 import { MiadiError } from "./miadi.js";
 import { MiadiUnavailable } from "./people.js";
 import { current, newRecordId } from "./records.js";
@@ -22,7 +24,45 @@ import { factoryDir, runBriefFile, readQueueState } from "./queue-state.js";
 import { factoryLedgerPath, readFactoryReceipts, receiptsForRecord } from "./factory-receipt.js";
 import { steerAttempts, steerSession, tmuxAdapter } from "./steer.js";
 import { contentHash, versionOf } from "./revisions.js";
+import { canReadReading } from "./reading/privacy.js";
+import { authorizationReceipt, authorizeProvider, briefAttributes, CHOICE_TTL_MS, CODEX_POLICIES, isPersonId, needsPersonChoice, providerPolicyOf, } from "./provider-policy.js";
 export { factoryDir, runBriefFile, readQueueState } from "./queue-state.js";
+/**
+ * One line per step of a decision, for the journal: the request, a correlation id,
+ * the door it came through, timings, the outcome and the HTTP status the run met.
+ * Never a token, never instructions (jgwill/Miadi#924).
+ */
+export function logDecision(deps, event) {
+    const line = { evt: "connector.decision", at: new Date().toISOString(), ...event };
+    try {
+        (deps.log ?? ((e) => console.log(JSON.stringify(e))))(line);
+    }
+    catch {
+        /* a log that fails never fails a decision */
+    }
+}
+/** How long a decision answer waits for its run before saying it is recorded and still running. */
+export function decisionWaitOf(deps) {
+    return deps.config.decisionWaitMs ?? DEFAULT_DECISION_WAIT_MS;
+}
+/** What `settleWithin` answers when the promise has not settled in time; the promise goes on. */
+export const STILL_RUNNING = Symbol("still_running");
+/** The promise's value if it settles within `ms`, else STILL_RUNNING. A rejection after the bound is caught, never unhandled. */
+export async function settleWithin(p, ms) {
+    let timer;
+    const bound = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(STILL_RUNNING), ms);
+    });
+    try {
+        const out = await Promise.race([p, bound]);
+        if (out === STILL_RUNNING)
+            p.catch(() => { });
+        return out;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /**
  * What a person may decide on a request. Approving with changes runs it with the
  * approver's instructions carried into what runs; a revision sends it back to
@@ -65,8 +105,10 @@ export function proposalTask(record) {
     }
     return lines.join("\n");
 }
-export function runBrief(record, approver, sessions, instructions) {
+export function runBrief(record, approver, sessions, instructions, providerAttrs = {}) {
     const body = (record.kind === "work_proposal" ? { task: proposalTask(record) } : record.body);
+    // A request recorded before providers were resolved (jgwill/Miadi#893) names only what was asked (#926 review RR7).
+    const provider = body.resolved_provider ?? body.provider;
     const short = record.id.split(":")[1]?.slice(0, 8) ?? "run";
     const to = body.session && sessions.includes(body.session) ? body.session : `new:${body.session ?? `connector-${yymmdd()}-${short}`}`;
     // A new session opens where the request says, else where the factory runner's config says (defaultCwd): no host path here (#911).
@@ -78,7 +120,9 @@ export function runBrief(record, approver, sessions, instructions) {
         `record="${attr(record.id)}"`,
         `version="${versionOf(record)}"`,
         // The provider the connector verified at request time (jgwill/Miadi#893); the intake may honour it or record why not.
-        ...(body.resolved_provider ? [`provider="${attr(body.resolved_provider)}"`] : []),
+        ...(provider ? [`provider="${attr(provider)}"`] : []),
+        // What authorizes a provider that needs the requester's own choice; the runner refuses Codex without it (jgwill/Miadi#926).
+        ...Object.entries(providerAttrs).map(([k, v]) => `${k}="${attr(v)}"`),
         ...(to.startsWith("new:") && cwd ? [`cwd="${attr(cwd)}"`] : []),
     ];
     const lines = [
@@ -151,6 +195,11 @@ export async function executeApproved(record, approver, deps, instructions) {
         return { status: res.status, ok: res.ok, response: parsed };
     };
     const queueBrief = () => {
+        // Checked again where the brief is written: an approval, and every rerun of it (jgwill/Miadi#926).
+        const authorization = record.kind === "run_request" ? authorizeProvider(record, deps.ledger.all()) : undefined;
+        if (authorization && !authorization.authorized) {
+            return { outcome: "failed", provider_authorization: authorizationReceipt(authorization), message: `No brief was written. ${authorization.explanation}` };
+        }
         const queue = join(deps.factoryDir ?? factoryDir(), "queue");
         mkdirSync(queue, { recursive: true });
         // A lister that cannot answer means no session is known live: the brief opens a new one (#922 R16).
@@ -161,10 +210,16 @@ export async function executeApproved(record, approver, deps, instructions) {
         catch {
             sessions = [];
         }
-        const { to, brief } = runBrief(record, approver, sessions, instructions);
+        const { to, brief } = runBrief(record, approver, sessions, instructions, authorization ? briefAttributes(authorization) : {});
         const file = runBriefFile(record);
         writeFileSync(join(queue, file), brief, { flag: "wx", mode: 0o640 });
-        return { outcome: "queued", to, file, note: "The factory intake delivers queued briefs every 5 minutes." };
+        return {
+            outcome: "queued",
+            to,
+            file,
+            ...(authorization ? { provider_authorization: authorizationReceipt(authorization) } : {}),
+            note: "The factory intake delivers queued briefs every 5 minutes.",
+        };
     };
     switch (record.kind) {
         case "run_request":
@@ -300,9 +355,15 @@ ${versionOf(r) > 1 ? `<dt>Version</dt><dd>${versionOf(r)}, the one a decision he
  * caller has already checked who the person is, their write tier, and that the
  * request still awaits approval.
  */
-/** A request is decided once: a second decision while one runs, or after it, is refused. */
+/** A request is decided once: a second, different decision while one runs, or after it, is refused. */
 export class AlreadyDecided extends Error {
 }
+/**
+ * A decision that differs from the one recorded or being recorded (another choice, or other
+ * instructions). The same decision sent again is not refused: it answers with the first one's receipt (#924).
+ */
+export class DecisionConflict extends AlreadyDecided {
+}
 /** A decision on a version the request no longer holds: it was revised after the page or card was read (#919). */
 export class StaleVersion extends AlreadyDecided {
     currentVersion;
@@ -313,32 +374,129 @@ export class StaleVersion extends AlreadyDecided {
         this.decidedVersion = decidedVersion;
     }
 }
-const deciding = new Set();
+/**
+ * An approval of a run whose provider needs the requester's own choice for this mission,
+ * and has none (jgwill/Miadi#926). Declining or sending it back stays possible.
+ */
+export class ProviderChoiceRequired extends Error {
+    authorization;
+    constructor(authorization) {
+        super(authorization.explanation);
+        this.authorization = authorization;
+    }
+}
+/** The decisions being recorded now, by request id: one at a time per request, in this process. */
+const deciding = new Map();
 /** Whether a decision on this request is being recorded now, its run may still be going. */
 export function isBeingDecided(recordId) {
     return deciding.has(recordId);
 }
+const APPROVAL_OF = {
+    approve: "approved",
+    approve_with_changes: "approved",
+    request_revision: "revision_requested",
+    decline: "declined",
+};
+/** The approval state a choice leaves a request in. */
+export function approvalStateOf(choice) {
+    return APPROVAL_OF[choice];
+}
+const sameDecision = (a, b) => a.choice === b.choice && String(a.instructions ?? "").trim() === String(b.instructions ?? "").trim();
+/**
+ * Record a person's decision once. The page and the card (or two cards, or a host
+ * that retries a call it gave up waiting on) may send it more than once:
+ * - the same decision while the first is being recorded waits for that one and
+ *   answers with its receipt, marked `replayed`; nothing runs twice;
+ * - the same decision after it was recorded answers with the recorded receipt;
+ * - a different decision is refused as a DecisionConflict (jgwill/Miadi#924).
+ */
 export async function decide(r, person, choice, deps, opts) {
     // Checked again here, with no await between the check and the claim: the
     // page and the card (or two cards) may decide the same request at once, and
     // a revision may land between reading a version and deciding it (#919).
-    const live = current(deps.ledger.all()).find((x) => x.id === r.id);
-    if (!live || live.approval_state !== "awaiting_approval" || deciding.has(r.id)) {
-        throw new AlreadyDecided(deciding.has(r.id) ? "A decision on this request is being recorded." : `This request is already ${live?.approval_state ?? "gone"}.`);
+    const asked = { choice, instructions: opts.instructions };
+    const inflight = deciding.get(r.id);
+    if (inflight) {
+        if (inflight.promise && inflight.choice !== "rerun" && sameDecision({ choice: inflight.choice, instructions: inflight.instructions }, asked)) {
+            logDecision(deps, { phase: "replay", record: r.id, correlation: inflight.correlation, via: opts.via, choice, while: "recording" });
+            return { ...(await inflight.promise), replayed: true };
+        }
+        logDecision(deps, { phase: "conflict", record: r.id, correlation: inflight.correlation, via: opts.via, choice, while: "recording" });
+        throw new DecisionConflict(inflight.choice === "rerun" ? "This request is being run again." : "A different decision on this request is being recorded.");
     }
+    const live = current(deps.ledger.all()).find((x) => x.id === r.id);
+    if (!live)
+        throw new AlreadyDecided("This request is gone.");
     // A decision that names no version (a page opened before versions, a surface that sends none) decides version 1:
     // a request revised since is refused, never decided blind (#919 review F1).
     const decidedVersion = opts.expectedVersion ?? 1;
+    if (live.approval_state !== "awaiting_approval") {
+        const prior = (live.completion_receipt ?? {});
+        const priorVersion = typeof prior.version === "number" ? prior.version : 1;
+        if (typeof prior.decision === "string" && sameDecision({ choice: prior.decision, instructions: prior.instructions }, asked) && priorVersion === decidedVersion) {
+            logDecision(deps, { phase: "replay", record: r.id, via: opts.via, choice, while: "recorded", state: live.state });
+            return { decision: live.approval_state, state: live.state, receipt: prior, replayed: true };
+        }
+        logDecision(deps, { phase: "conflict", record: r.id, via: opts.via, choice, while: "recorded", recorded: prior.decision });
+        throw new DecisionConflict(`This request is already ${live.approval_state ?? "gone"}.`);
+    }
     if (versionOf(live) !== decidedVersion)
         throw new StaleVersion(versionOf(live), decidedVersion);
-    deciding.add(r.id);
+    // A generic approval never chooses Codex: the requester's own fresh choice or policy must already stand (jgwill/Miadi#926).
+    if (live.kind === "run_request" && approvalStateOf(choice) === "approved") {
+        const authorization = authorizeProvider(live, deps.ledger.all(), { requireFresh: true });
+        if (!authorization.authorized) {
+            logDecision(deps, { phase: "provider_choice_required", record: r.id, via: opts.via, choice, provider: authorization.provider });
+            throw new ProviderChoiceRequired(authorization);
+        }
+    }
+    const entry = { ...asked, correlation: randomUUID(), started: Date.now() };
+    deciding.set(r.id, entry);
+    entry.promise = decideOnce(live, person, choice, deps, { ...opts, correlation: entry.correlation, started: entry.started });
     try {
-        return await decideOnce(live, person, choice, deps, opts);
+        return await entry.promise;
     }
     finally {
         deciding.delete(r.id);
     }
 }
+/**
+ * The kinds whose run is done at once on this host (a brief written to the
+ * factory queue, an ending recorded): nothing outside is called, so nothing is
+ * written ahead of it. Every other approved run is recorded as running first.
+ */
+const RUNS_AT_ONCE = new Set(["run_request", "work_proposal", "session_completion_proposal"]);
+/** What the receipt of a run the connector lost to a restart says (jgwill/Miadi#924). */
+export const INTERRUPTED_MESSAGE = "The connector stopped while this ran, so whether it finished is not known. Read what it was to change before running it again. A review create is safe to run again: the review service answers with the review it already holds for that video.";
+/**
+ * A run recorded as running whose process is gone (the connector restarted mid-run)
+ * becomes a failed run that a person may run again. Called once when the connector
+ * starts; a run this process is still recording is left alone.
+ */
+export function reconcileInterrupted(deps) {
+    const out = [];
+    for (const r of current(deps.ledger.all())) {
+        const receipt = (r.completion_receipt ?? {});
+        if (r.approval_state !== "approved" || r.state !== "in_progress" || receipt.outcome !== "running" || deciding.has(r.id))
+            continue;
+        deps.ledger.append({
+            id: newRecordId(r.kind),
+            kind: r.kind,
+            created_at: new Date().toISOString(),
+            actor: { person_id: "system:miadi-connector", name: "Miadi connector", client_id: "restart" },
+            refs: r.refs,
+            evidence_refs: [],
+            supersedes: r.id,
+            approval_state: "approved",
+            state: "blocked",
+            completion_receipt: { ...receipt, outcome: "failed", interrupted: true, message: INTERRUPTED_MESSAGE, interrupted_at: new Date().toISOString() },
+            body: { decision: "interrupted" },
+        });
+        logDecision(deps, { phase: "interrupted", record: r.id, correlation: receipt.correlation, started_at: receipt.started_at });
+        out.push(r.id);
+    }
+    return out;
+}
 /** Whether a request was approved and its run failed, so a person may run it again. */
 export function isRerunnable(r) {
     return !!r && r.approval_state === "approved" && r.state === "blocked";
@@ -355,7 +513,7 @@ export async function rerun(r, person, deps, opts) {
     if (!isRerunnable(live) || deciding.has(r.id)) {
         throw new AlreadyDecided(deciding.has(r.id) ? "This request is being run." : `This request is ${live?.approval_state ?? "gone"} and ${live?.state ?? "unknown"}; only an approved request whose run failed is run again.`);
     }
-    deciding.add(r.id);
+    deciding.set(r.id, { choice: "rerun", correlation: randomUUID(), started: Date.now() });
     try {
         const prior = (live.completion_receipt ?? {});
         const instructions = typeof prior.instructions === "string" ? prior.instructions : undefined;
@@ -403,7 +561,8 @@ export async function rerun(r, person, deps, opts) {
 }
 async function decideOnce(r, person, choice, deps, opts) {
     const { instructions } = opts;
-    const decision = choice === "approve" || choice === "approve_with_changes" ? "approved" : choice === "request_revision" ? "revision_requested" : "declined";
+    const decision = approvalStateOf(choice);
+    logDecision(deps, { phase: "start", record: r.id, kind: r.kind, correlation: opts.correlation, via: opts.via, choice, version: versionOf(r) });
     let receipt = {
         decided_by: { person_id: person.id, name: person.name },
         decided_at: new Date().toISOString(),
@@ -414,9 +573,28 @@ async function decideOnce(r, person, choice, deps, opts) {
         via: opts.via,
         ...(instructions ? { instructions } : {}),
         note: opts.note,
+        correlation: opts.correlation,
     };
     let state = decision === "approved" ? "completed" : decision === "revision_requested" ? "pending" : "withdrawn";
     if (decision === "approved") {
+        if (!RUNS_AT_ONCE.has(r.kind)) {
+            // Written ahead of the run: the decision is in the ledger before anything is called, so a restart
+            // mid-run can never offer the request for a second approval, and every surface reads it as running (#924).
+            deps.ledger.append({
+                id: newRecordId(r.kind),
+                kind: r.kind,
+                created_at: new Date().toISOString(),
+                actor: { person_id: person.id, name: person.name, client_id: opts.via },
+                refs: r.refs,
+                evidence_refs: [],
+                supersedes: r.id,
+                approval_state: decision,
+                state: "in_progress",
+                completion_receipt: { ...receipt, outcome: "running", started_at: new Date(opts.started).toISOString() },
+                body: { decision: choice, ...(instructions ? { instructions } : {}) },
+            });
+            logDecision(deps, { phase: "running", record: r.id, correlation: opts.correlation, ms: Date.now() - opts.started });
+        }
         try {
             const outcome = await executeApproved(r, person, deps, instructions);
             receipt = { ...receipt, ...outcome };
@@ -444,17 +622,29 @@ async function decideOnce(r, person, choice, deps, opts) {
         completion_receipt: receipt,
         body: { decision: choice, ...(instructions ? { instructions } : {}) },
     });
+    logDecision(deps, {
+        phase: "done",
+        record: r.id,
+        correlation: opts.correlation,
+        decision,
+        state,
+        outcome: receipt.outcome,
+        ...(typeof receipt.status === "number" ? { status: receipt.status } : {}),
+        ms: Date.now() - opts.started,
+    });
     return { decision, state, receipt };
 }
 export function isApprovable(r) {
     return Boolean(r && APPROVABLE.has(r.kind));
 }
 /** What approving a request does, in one sentence, for the card a person decides on. */
-export function consequenceOf(r) {
+export function consequenceOf(r, authorization) {
     const b = r.body;
     switch (r.kind) {
         case "run_request":
-            return "Approving queues a brief for the factory intake, which opens or reaches an agent session within minutes.";
+            return authorization && !authorization.authorized
+                ? `Approving is refused until ${r.actor.name} chooses ${authorization.provider} for this mission on its approval page; approving does not choose it. Declining or sending it back stays possible.`
+                : `Approving queues a brief for the factory intake, which opens or reaches an agent session within minutes${authorization?.provider ? ` with ${authorization.provider}` : ""}.`;
         case "work_proposal":
             return "Approving starts the work: a brief written from the proposal and your instructions is queued for an agent session.";
         case "review_operation_request":
@@ -506,8 +696,43 @@ export function registerApprovalRoutes(app, deps) {
         if (!writer && r.actor.person_id !== person.id) {
             return void res.status(403).type("html").send(signInToRead(r, `Reading and deciding this request needs Miadi's write tier; ${person.name} has ${person.api_tier ?? "no API tier"}.`));
         }
+        const requester = r.actor.person_id === person.id && isPersonId(person.id);
         if (!body.decision)
-            return void res.type("html").send(approvePage(deps, r, { token: writer ? token : undefined }));
+            return void res.type("html").send(approvePage(deps, r, { token: writer ? token : undefined, chooserToken: requester ? token : undefined }));
+        if (body.decision === "choose_provider") {
+            // The requester's own, separate choice of a provider that needs one, for this version only (jgwill/Miadi#926).
+            const live = find(r.id);
+            const again = (status, error) => void res.status(status).type("html").send(approvePage(deps, live, { token: writer ? token : undefined, chooserToken: requester ? token : undefined, error }));
+            if (!requester) {
+                return again(403, isPersonId(r.actor.person_id)
+                    ? `Only ${r.actor.name}, who asked, can choose a provider for their own mission.`
+                    : `${r.actor.name} is a service token: only a person chooses a provider, for a request of their own. Name another provider for this request.`);
+            }
+            if (live.approval_state !== "awaiting_approval" || isBeingDecided(live.id))
+                return again(409, "A provider is chosen only while the request awaits a decision.");
+            const provider = String(body.provider ?? "");
+            const named = authorizeProvider(live, deps.ledger.all(), { requireFresh: true });
+            if (!needsPersonChoice(provider) || provider !== named.provider)
+                return again(400, `This request names ${named.provider ?? "no provider"}; only that provider can be chosen here.`);
+            if (Number(body.version) !== versionOf(live))
+                return again(409, `This request is now at version ${versionOf(live)}. Read it and choose again.`);
+            if (body.confirm !== "yes")
+                return again(400, `Tick the box to choose ${provider} for this mission.`);
+            if (!named.authorized || named.state !== "person_choice") {
+                deps.ledger.append({
+                    id: newRecordId("provider_choice"),
+                    kind: "provider_choice",
+                    created_at: new Date().toISOString(),
+                    actor: { person_id: person.id, name: person.name, client_id: "approval-page" },
+                    refs: [live.id],
+                    evidence_refs: [],
+                    claim_category: "observed",
+                    body: { request_id: live.id, provider, version: versionOf(live), content_hash: contentHash(live) },
+                });
+                logDecision(deps, { phase: "provider_chosen", record: live.id, provider, version: versionOf(live) });
+            }
+            return void res.type("html").send(approvePage(deps, find(r.id), { token: writer ? token : undefined, chooserToken: token }));
+        }
         if (!writer)
             return void res.status(403).type("html").send(approvePage(deps, r, { error: `Deciding needs Miadi's write tier; ${person.name} has ${person.api_tier ?? "no API tier"}.` }));
         if (body.decision === "rerun") {
@@ -523,12 +748,11 @@ export function registerApprovalRoutes(app, deps) {
             const failedAgain = ran.receipt.outcome === "failed";
             return void res.type("html").send(page("Recorded", `<h1>${failedAgain ? "Run again, and it failed again" : "Run again"}</h1>${summary(find(r.id))}<pre>${escapeHtml(JSON.stringify(ran.receipt, null, 2))}</pre>`));
         }
-        if (r.approval_state !== "awaiting_approval") {
-            return void res.status(409).type("html").send(approvePage(deps, r, { error: `This request is already ${r.approval_state}.` }));
-        }
         const choice = DECISIONS.includes(String(body.decision)) ? body.decision : "decline";
         const instructions = String(body.instructions ?? "").trim().slice(0, 20000) || undefined;
-        if ((choice === "approve_with_changes" || choice === "request_revision") && !instructions) {
+        const via = String(body.via ?? "approval-page").slice(0, 60);
+        // Only a decision that would be recorded now needs its instructions; a form sent again after it was recorded is answered below (#924).
+        if (r.approval_state === "awaiting_approval" && !isBeingDecided(r.id) && (choice === "approve_with_changes" || choice === "request_revision") && !instructions) {
             return void res
                 .status(400)
                 .type("html")
@@ -537,32 +761,47 @@ export function registerApprovalRoutes(app, deps) {
         let decided;
         try {
             const shown = Number(body.version);
-            decided = await decide(r, person, choice, deps, {
+            const running = decide(r, person, choice, deps, {
                 instructions,
                 note: body.note || undefined,
-                via: String(body.via ?? "approval-page").slice(0, 60),
+                via,
                 ...(Number.isInteger(shown) && shown >= 1 ? { expectedVersion: shown } : {}),
             });
+            // A run that takes longer than a proxy waits (the review service may take minutes) is answered as
+            // recorded and running; the run goes on, and signing in again shows how it ended (#924).
+            const settled = await settleWithin(running, decisionWaitOf(deps));
+            if (settled === STILL_RUNNING) {
+                logDecision(deps, { phase: "answered_running", record: r.id, via, choice });
+                const now = find(r.id);
+                return void res.status(202).type("html").send(page("Recorded", `<h1>${escapeHtml(projectionOf(now, deps)?.label ?? "Being recorded")}</h1>${summary(now)}${projectionBlock(projectionOf(now, deps), undefined)}${refreshForm(token)}`));
+            }
+            decided = settled;
         }
         catch (error) {
+            if (error instanceof ProviderChoiceRequired) {
+                return void res.status(409).type("html").send(approvePage(deps, find(r.id), { token, chooserToken: requester ? token : undefined, error: error.message }));
+            }
             if (error instanceof StaleVersion)
                 return void res.status(409).type("html").send(approvePage(deps, find(r.id), { token, error: error.message }));
             if (error instanceof AlreadyDecided)
                 return void res.status(409).type("html").send(approvePage(deps, find(r.id), { error: error.message }));
             throw error;
         }
-        const { decision, receipt } = decided;
+        const { decision, receipt, replayed } = decided;
         const p = projectionOf(find(r.id), deps);
         const heading = decision === "approved"
             ? p?.stage === "failed"
                 ? "Approved, but running it failed"
-                : p?.outstanding.length
-                    ? "Approved, changes still to do"
-                    : "Approved"
+                : p?.stage === "recording"
+                    ? "Approved, running"
+                    : p?.outstanding.length
+                        ? "Approved, changes still to do"
+                        : "Approved"
             : decision === "revision_requested"
                 ? "Sent back for revision"
                 : "Declined";
-        res.type("html").send(page("Recorded", `<h1>${heading}</h1>${summary(find(r.id))}${projectionBlock(p, receipt)}`));
+        const again = replayed ? "<p>This decision was already recorded. Nothing ran again; here is where it stands.</p>" : "";
+        res.type("html").send(page("Recorded", `<h1>${heading}</h1>${again}${summary(find(r.id))}${projectionBlock(p, receipt)}${p?.stage === "recording" ? refreshForm(token) : ""}`));
     });
     // A record's own page, for citations in ChatGPT: its author and anyone with Miadi's read tier may read it.
     app.get("/records/:id", (req, res) => {
@@ -583,12 +822,19 @@ export function registerApprovalRoutes(app, deps) {
         const r = find(String(req.params.id));
         if (!r)
             return void res.status(404).type("html").send(page("Not found", "<h1>No record with that id</h1>"));
+        if (!canReadReading(r, current(deps.ledger.all()), person)) {
+            return void res.status(403).type("html").send(page("Miadi record", recordForm(String(req.params.id), "This source and its reading are private to the source owner and factory operators.")));
+        }
         if (!person.api_tier && r.actor.person_id !== person.id) {
             return void res.status(403).type("html").send(page("Miadi record", recordForm(String(req.params.id), `Reading records needs Miadi's read tier; ${person.name} has none.`)));
         }
         res.type("html").send(page("Miadi record", `<h1>${escapeHtml(r.kind)}</h1>${summary(r)}`));
     });
 }
+/** A button that shows where a running request stands now, signed in with the token the person just used. */
+function refreshForm(token) {
+    return `<form method="post"><input type="hidden" name="person_token" value="${escapeHtml(token)}"><div class="row"><button class="primary" type="submit">Show where it stands now</button></div></form>`;
+}
 function recordForm(id, error) {
     return `<h1>Miadi record</h1><p>${escapeHtml(id)}</p>
 ${error ? `<p class="err" role="alert">${escapeHtml(error)}</p>` : ""}
@@ -639,8 +885,12 @@ function approvePage(deps, r, o = {}) {
     const open = r.approval_state === "awaiting_approval";
     // A decision being recorded offers no buttons: a second click would decide the same request again.
     const actionable = open && !isBeingDecided(r.id);
+    // Freshness binds a decision still to come; a decided run shows the authorization it holds (#926 review R1).
+    const authorization = r.kind === "run_request" ? authorizeProvider(r, deps.ledger.all(), { requireFresh: open }) : undefined;
+    const blocked = Boolean(authorization && !authorization.authorized);
     return page("Approve a Miadi request", `<h1>${open ? "Approve a request" : "A decided request"}</h1>
-${actionable ? `<p>${escapeHtml(consequenceOf(r))} Declining records your refusal. Either is kept in the ledger with your name.</p>` : ""}
+${actionable ? `<p>${escapeHtml(consequenceOf(r, authorization))} Declining records your refusal. Either is kept in the ledger with your name.</p>` : ""}
+${authorization ? providerSection(r, authorization, actionable ? o.chooserToken : undefined) : ""}
 ${summary(r)}
 ${projectionBlock(projectionOf(r, deps), open ? undefined : r.completion_receipt)}
 ${o.error ? `<p class="err" role="alert">${escapeHtml(o.error)}</p>` : ""}
@@ -651,19 +901,104 @@ ${actionable && o.token
 <label for="i">Instructions (needed to approve with changes or to send back)</label>
 <textarea id="i" name="instructions" rows="4"></textarea>
 <div class="row">
-<button class="primary" type="submit" name="decision" value="approve">Approve and run</button>
-<button type="submit" name="decision" value="approve_with_changes">Approve with my changes</button>
+${blocked
+            ? ""
+            : `<button class="primary" type="submit" name="decision" value="approve">Approve and run</button>
+<button type="submit" name="decision" value="approve_with_changes">Approve with my changes</button>`}
 <button type="submit" name="decision" value="request_revision">Send back for revision</button>
 <button type="submit" name="decision" value="decline">Decline</button>
 </div></form>`
         : actionable
             ? "<p>A person with Miadi's write tier decides this request.</p>"
-            : isRerunnable(r) && o.token
-                ? `<p>It was approved, and running it failed. When what it calls has been fixed, it can be run again with the same approval and instructions; the ledger records who ran it again.</p>
+            : o.token && projectionOf(r, deps)?.stage === "recording"
+                ? refreshForm(o.token)
+                : isRerunnable(r) && o.token
+                    ? `<p>It was approved, and running it failed. When what it calls has been fixed, it can be run again with the same approval and instructions; the ledger records who ran it again.</p>
 <form method="post">
 <input type="hidden" name="person_token" value="${escapeHtml(o.token)}">
 <div class="row"><button class="primary" type="submit" name="decision" value="rerun">Run it again</button></div></form>`
-                : ""}`);
+                    : ""}`);
+}
+/**
+ * Which provider a run launches with, who chose it, and, when the requester's own choice is
+ * missing, the separate control only the requester sees (jgwill/Miadi#926).
+ */
+function providerSection(r, a, chooserToken) {
+    const lines = [
+        `<dt>Provider</dt><dd>${escapeHtml(a.provider ?? "the factory runner's default")}</dd>`,
+        `<dt>Asked for</dt><dd>${escapeHtml(a.requested ?? "none named")}${a.requester.client ? ` (through ${escapeHtml(a.requester.client)})` : ""}</dd>`,
+        `<dt>Authorized by</dt><dd>${escapeHtml(a.state.replace(/_/g, " "))}</dd>`,
+    ].join("");
+    const choose = a.state === "needs_person_choice" && chooserToken && a.provider
+        ? `<form method="post">
+<input type="hidden" name="person_token" value="${escapeHtml(chooserToken)}">
+<input type="hidden" name="version" value="${versionOf(r)}">
+<input type="hidden" name="provider" value="${escapeHtml(a.provider)}">
+<label><input type="checkbox" name="confirm" value="yes" required> I choose ${escapeHtml(a.provider)} for this mission (version ${versionOf(r)}) myself. It does not cover any other mission.</label>
+<div class="row"><button type="submit" name="decision" value="choose_provider">Choose ${escapeHtml(a.provider)} for this mission</button></div>
+</form>`
+        : a.state === "needs_person_choice" && !isPersonId(r.actor.person_id)
+            ? ""
+            : a.state === "needs_person_choice"
+                ? `<p>Only ${escapeHtml(r.actor.name)}, who asked, can choose ${escapeHtml(a.provider ?? "")} for this mission, signed in here. Within ${CHOICE_TTL_MS / 3_600_000} hours of that choice it can be approved.</p>`
+                : "";
+    return `<section aria-label="Provider"><dl>${lines}</dl><p>${escapeHtml(a.explanation)}</p>${choose}</section>`;
+}
+/** The person's own provider policy page: read and change it, signed in with their person token (jgwill/Miadi#926). */
+export function registerProviderPolicyRoutes(app, deps) {
+    const form = express.urlencoded({ extended: false, limit: "16kb" });
+    const signIn = (error) => page("Your provider policy", `<h1>Your provider policy</h1><p>Which agent providers a request made in your name may name. Sign in to read or change yours; it applies to your requests only.</p>
+${error ? `<p class="err" role="alert">${escapeHtml(error)}</p>` : ""}
+<form method="post"><label for="t">Your Miadi person token</label><input id="t" name="person_token" type="password" autocomplete="off" required>
+<div class="row"><button class="primary" type="submit">Read my policy</button></div></form>`);
+    app.get("/providers", (_req, res) => void res.type("html").send(signIn()));
+    app.post("/providers", form, async (req, res) => {
+        const body = (req.body ?? {});
+        const token = String(body.person_token ?? "").trim();
+        let person;
+        try {
+            person = await deps.identify(token);
+        }
+        catch (error) {
+            if (!(error instanceof MiadiUnavailable))
+                throw error;
+            return void res.status(503).type("html").send(signIn("Miadi could not be reached. Try again in a minute."));
+        }
+        if (!person)
+            return void res.status(401).type("html").send(signIn("Miadi did not recognise that person token."));
+        if (!isPersonId(person.id))
+            return void res.status(403).type("html").send(signIn("A service token has no provider policy; a person sets their own."));
+        let saved = "";
+        if (body.codex !== undefined) {
+            if (!CODEX_POLICIES.includes(body.codex))
+                return void res.status(400).type("html").send(signIn("Unknown Codex policy."));
+            if (providerPolicyOf(deps.ledger.all(), person.id).codex !== body.codex) {
+                deps.ledger.append({
+                    id: newRecordId("provider_policy"),
+                    kind: "provider_policy",
+                    created_at: new Date().toISOString(),
+                    actor: { person_id: person.id, name: person.name, client_id: "providers-page" },
+                    refs: [],
+                    evidence_refs: [],
+                    claim_category: "observed",
+                    body: { codex: body.codex },
+                });
+                logDecision(deps, { phase: "provider_policy_set", person: person.id, codex: body.codex });
+            }
+            saved = "<p>Saved. It applies to your requests from now on, including a failed run of yours that is run again. A per-mission choice you already made still covers its mission.</p>";
+        }
+        const policy = providerPolicyOf(deps.ledger.all(), person.id);
+        const option = (value, label) => `<label><input type="radio" name="codex" value="${value}"${policy.codex === value ? " checked" : ""}> ${escapeHtml(label)}</label>`;
+        res.type("html").send(page("Your provider policy", `<h1>${escapeHtml(person.name)}'s provider policy</h1>${saved}
+<dl><dt>Codex</dt><dd>${escapeHtml(policy.codex.replace(/_/g, " "))}${policy.source === "default" ? " (the default)" : `, set ${escapeHtml(policy.set_at ?? "")}`}</dd>
+<dt>Other providers</dt><dd>Pi, Copilot and Claude Code run when a request names them and they are installed; Pi and Copilot may also be picked by the host's order.</dd></dl>
+<form method="post"><input type="hidden" name="person_token" value="${escapeHtml(token)}">
+<fieldset><legend>When a request in my name names Codex</legend>
+${option("per_mission_choice", "Codex runs only when I choose it for that mission on its approval page (default).")}
+${option("selectable", "Codex may be named for my requests without a per-mission choice.")}
+</fieldset>
+<div class="row"><button class="primary" type="submit">Save my policy</button></div></form>`));
+    });
 }
 /** How a request is named to a person. */
 export const KIND_LABELS = {

package/dist/config.d.ts

@@ -14,5 +14,17 @@ export interface ConnectorConfig {
     inquiryRoot?: string;
     /** owner/repo a saved report's inquiry issue is opened in (MIADI_INQUIRY_GITHUB_REPO). */
     inquiryRepo?: string;
+    /**
+     * How long a card's decision token stays usable, in seconds (MIADI_CONNECTOR_DECISION_TOKEN_TTL).
+     * Default 7 days, held between 5 minutes and 30 days. The request itself does not expire (jgwill/Miadi#924).
+     */
+    decisionTokenTtl?: number;
+    /**
+     * How long a decision answer waits for the run it starts, in milliseconds (MIADI_CONNECTOR_DECISION_WAIT_MS).
+     * Past it the answer says the decision is recorded and still running, and the run goes on. Default 20 s, at most 50 s.
+     */
+    decisionWaitMs?: number;
 }
+export declare const DEFAULT_DECISION_TOKEN_TTL: number;
+export declare const DEFAULT_DECISION_WAIT_MS = 20000;
 export declare function configFromEnv(env?: NodeJS.ProcessEnv): ConnectorConfig;

package/dist/config.js

@@ -1,5 +1,14 @@
 import { resolveEnv } from "@miadi/inquiry-weave";
 import { reviewToken } from "./reviews.js";
+export const DEFAULT_DECISION_TOKEN_TTL = 7 * 24 * 3600;
+export const DEFAULT_DECISION_WAIT_MS = 20_000;
+/** A number from the environment held between two bounds; anything unreadable is the default. */
+function bounded(raw, fallback, min, max) {
+    const n = Number(raw);
+    if (raw === undefined || raw.trim() === "" || !Number.isFinite(n))
+        return fallback;
+    return Math.min(max, Math.max(min, Math.round(n)));
+}
 export function configFromEnv(env = process.env) {
     const port = Number(env.MIADI_CONNECTOR_PORT || 3337);
     const shelf = resolveEnv({}, env);
@@ -14,5 +23,7 @@ export function configFromEnv(env = process.env) {
         stateDir: env.MIADI_CONNECTOR_STATE_DIR || "/srv/miadi/connector",
         inquiryRoot: shelf.inquiryRoot,
         inquiryRepo: shelf.repo,
+        decisionTokenTtl: bounded(env.MIADI_CONNECTOR_DECISION_TOKEN_TTL, DEFAULT_DECISION_TOKEN_TTL, 300, 30 * 24 * 3600),
+        decisionWaitMs: bounded(env.MIADI_CONNECTOR_DECISION_WAIT_MS, DEFAULT_DECISION_WAIT_MS, 0, 50_000),
     };
 }