@miadi/connector 0.1.4 → 0.1.6

package/README.md

@@ -23,10 +23,11 @@ Call `get_capabilities` first. It names the signed-in person, their Miadi API ti
 | reads | `get_capabilities` `get_context` `list_circles` `get_circle` `list_sessions` `get_session` `get_evidence` `get_evaluations` `get_narrative_beats` `review_lookup` `review_versions` `handoff_status` `list_records` `get_run_result` `search` `fetch` |
 | contributions | `append_observation` `open_inquiry` `link_records` `propose_narrative_beat` `record_evaluation` `register_source_intent` `record_handoff` `update_handoff` `prepare_calendar_event` `save_research` |
 | requests (approved by a person) | `propose_work` `propose_session_completion` `request_authorized_run` `request_review_operation` `request_deep_diver` `link_review_to_episode` `request_inquiry_episode` |
+| decisions in the conversation | `show_decisions` (cards), `decide_request` (called by the card only) |
 
 - **Reads** stay within the person's Miadi tier. Sessions need the write tier, because a session's name and pane are operator data.
 - **Contributions** need the `miadi:contribute` scope, chosen at sign-in. They append a record to the ledger and change nothing else, except `save_research`: it saves a report on the inquiry shelf as a new folder (the Markdown exactly as given, owner and visibility recorded, private by default), opens the folder's inquiry issue, and commits and pushes the folder in the shelf's repository. A long report is sent in parts (`part`, `parts`, `upload_id`) and saved when the last part arrives; the answer returns its bytes, sha256 and first and last lines.
-- **Requests** append a record that waits for a decision. The answer gives an `approval_url`; Miadi's `/research` page offers the same decisions to a signed-in person with the write tier. The person approves, approves with changes (their instructions are carried into what runs), sends it back for revision with instructions (`revision_requested`, nothing runs, `get_run_result` returns the instructions), or declines. Only the approval door runs a request, once, as that person:
+- **Requests** append a record that waits for a decision. The answer gives an `approval_url`; Miadi's `/research` page offers the same decisions to a signed-in person with the write tier, and `show_decisions` shows them as cards inside the conversation (below). The person approves, approves with changes (their instructions are carried into what runs), sends it back for revision with instructions (`revision_requested`, nothing runs, `get_run_result` returns the instructions), or declines. Only the approval door runs a request, once, as that person:
   - a run becomes a brief in the factory queue, which the intake delivers to a session;
   - a work proposal starts its work the same way, as a brief written from the proposal;
   - a review operation calls the review service;
@@ -37,6 +38,17 @@ Call `get_capabilities` first. It names the signed-in person, their Miadi API ti
 
 The model that asked cannot approve its own request.
 
+### Deciding inside the conversation
+
+In a client that renders MCP Apps (ChatGPT among them), `show_decisions` draws one card per request awaiting a decision: what is asked, by whom, and what approving does. The person decides on the card with their own click: Approve, Approve with my changes, Send back for revision, or Decline. The card then shows the receipt.
+
+The model that asked cannot decide for the person:
+- `decide_request` is declared for the card only (`_meta.ui.visibility: ["app"]`), so the host does not offer it to the model.
+- It requires a decision token that travels only in the `_meta` of the `show_decisions` result. Hosts deliver that metadata to the card and keep it from the model. The token is bound to one request, one person and one OAuth client, and expires after 30 minutes. A decided request no longer awaits a decision, so a token works once.
+- The sign-in must carry `miadi:approve`. A person grants it by ticking "Let me approve requests on cards inside this client" on the sign-in page, and only a person with Miadi's write tier receives it. A person token used directly as Bearer never carries it.
+
+Without that sign-in, or for a person without the write tier, the cards link to each request's approval page instead.
+
 Every record has a claim category: `observed`, `hypothesis`, `desired_future`, `fiction` or `verified_implementation`. Witnessed fact, envisioned features and fiction stay apart.
 
 ## Run it

package/dist/approve.d.ts

@@ -53,4 +53,22 @@ export declare function runBrief(record: ConnectorRecord, approver: MiadiPerson,
     brief: string;
 };
 export declare function executeApproved(record: ConnectorRecord, approver: MiadiPerson, deps: ApprovalDeps, instructions?: string): Promise<Record<string, unknown>>;
+/**
+ * Record a person's decision on a request and, when approved, run it once as
+ * them. The approval page and the in-chat approval card both decide here; the
+ * caller has already checked who the person is, their write tier, and that the
+ * request still awaits approval.
+ */
+export declare function decide(r: ConnectorRecord, person: MiadiPerson, choice: Decision, deps: ApprovalDeps, opts: {
+    instructions?: string;
+    note?: string;
+    via: string;
+}): Promise<{
+    decision: NonNullable<ConnectorRecord["approval_state"]>;
+    state: ConnectorRecord["state"];
+    receipt: Record<string, unknown>;
+}>;
+export declare function isApprovable(r: ConnectorRecord | undefined): r is ConnectorRecord;
+/** What approving a request does, in one sentence, for the card a person decides on. */
+export declare function consequenceOf(r: ConnectorRecord): string;
 export declare function registerApprovalRoutes(app: Express, deps: ApprovalDeps): void;

package/dist/approve.js

@@ -261,6 +261,79 @@ ${r.refs.length ? `<dt>References</dt><dd>${r.refs.map(escapeHtml).join("<br>")}
 </dl>
 <pre>${escapeHtml(JSON.stringify(shown, null, 2))}</pre>`;
 }
+/**
+ * Record a person's decision on a request and, when approved, run it once as
+ * them. The approval page and the in-chat approval card both decide here; the
+ * caller has already checked who the person is, their write tier, and that the
+ * request still awaits approval.
+ */
+export async function decide(r, person, choice, deps, opts) {
+    const { instructions } = opts;
+    const decision = choice === "approve" || choice === "approve_with_changes" ? "approved" : choice === "request_revision" ? "revision_requested" : "declined";
+    let receipt = {
+        decided_by: { person_id: person.id, name: person.name },
+        decided_at: new Date().toISOString(),
+        decision: choice,
+        via: opts.via,
+        ...(instructions ? { instructions } : {}),
+        note: opts.note,
+    };
+    let state = decision === "approved" ? "completed" : decision === "revision_requested" ? "pending" : "withdrawn";
+    if (decision === "approved") {
+        try {
+            const outcome = await executeApproved(r, person, deps, instructions);
+            receipt = { ...receipt, ...outcome };
+            if (outcome.outcome === "failed")
+                state = "blocked";
+            if (outcome.outcome === "queued")
+                state = "in_progress";
+        }
+        catch (error) {
+            receipt = { ...receipt, outcome: "failed", message: error instanceof Error ? error.message : String(error) };
+            state = "blocked";
+        }
+    }
+    deps.ledger.append({
+        id: newRecordId(r.kind),
+        kind: r.kind,
+        created_at: new Date().toISOString(),
+        actor: { person_id: person.id, name: person.name, client_id: opts.via },
+        refs: r.refs,
+        evidence_refs: [],
+        supersedes: r.id,
+        approval_state: decision,
+        state,
+        ...(decision === "revision_requested" ? { next_action: `Revise and submit a new request that cites ${r.id} in refs.` } : {}),
+        completion_receipt: receipt,
+        body: { decision: choice, ...(instructions ? { instructions } : {}) },
+    });
+    return { decision, state, receipt };
+}
+export function isApprovable(r) {
+    return Boolean(r && APPROVABLE.has(r.kind));
+}
+/** What approving a request does, in one sentence, for the card a person decides on. */
+export function consequenceOf(r) {
+    const b = r.body;
+    switch (r.kind) {
+        case "run_request":
+            return "Approving queues a brief for the factory intake, which opens or reaches an agent session within minutes.";
+        case "work_proposal":
+            return "Approving starts the work: a brief written from the proposal and your instructions is queued for an agent session.";
+        case "review_operation_request":
+            return `Approving calls the review service once: ${String(b.operation ?? "operation").replace(/_/g, " ")}.`;
+        case "deep_diver_request":
+            return `Approving marks review version ${b.version ?? "?"} ready for Deep Diver, which queues its pass.`;
+        case "review_episode_link_request":
+            return `Approving has episode ${b.episode ?? "?"} hold the review through the episode door.`;
+        case "inquiry_episode_request":
+            return b.new_episode ? "Approving mints a new episode with the inquiry woven in." : `Approving weaves the inquiry into episode ${b.episode ?? "?"}.`;
+        case "session_completion_proposal":
+            return `Approving records the ending (${b.ending ?? "?"}) for the session. No pane is closed.`;
+        default:
+            return "Approving runs the request once, as you.";
+    }
+}
 export function registerApprovalRoutes(app, deps) {
     const find = (id) => current(deps.ledger.all()).find((r) => r.id === id);
     const form = express.urlencoded({ extended: false, limit: "128kb" });
@@ -298,42 +371,10 @@ export function registerApprovalRoutes(app, deps) {
             res.status(400).type("html").send(approvePage(r, choice === "request_revision" ? "Say what to revise." : "Write the changes to apply."));
             return;
         }
-        const decision = choice === "approve" || choice === "approve_with_changes" ? "approved" : choice === "request_revision" ? "revision_requested" : "declined";
-        let receipt = {
-            decided_by: { person_id: person.id, name: person.name },
-            decided_at: new Date().toISOString(),
-            decision: choice,
-            ...(instructions ? { instructions } : {}),
+        const { decision, receipt } = await decide(r, person, choice, deps, {
+            instructions,
             note: body.note || undefined,
-        };
-        let state = decision === "approved" ? "completed" : decision === "revision_requested" ? "pending" : "withdrawn";
-        if (decision === "approved") {
-            try {
-                const outcome = await executeApproved(r, person, deps, instructions);
-                receipt = { ...receipt, ...outcome };
-                if (outcome.outcome === "failed")
-                    state = "blocked";
-                if (outcome.outcome === "queued")
-                    state = "in_progress";
-            }
-            catch (error) {
-                receipt = { ...receipt, outcome: "failed", message: error instanceof Error ? error.message : String(error) };
-                state = "blocked";
-            }
-        }
-        deps.ledger.append({
-            id: newRecordId(r.kind),
-            kind: r.kind,
-            created_at: new Date().toISOString(),
-            actor: { person_id: person.id, name: person.name, client_id: String(body.via ?? "approval-page").slice(0, 60) },
-            refs: r.refs,
-            evidence_refs: [],
-            supersedes: r.id,
-            approval_state: decision,
-            state,
-            ...(decision === "revision_requested" ? { next_action: `Revise and submit a new request that cites ${r.id} in refs.` } : {}),
-            completion_receipt: receipt,
-            body: { decision: choice, ...(instructions ? { instructions } : {}) },
+            via: String(body.via ?? "approval-page").slice(0, 60),
         });
         res.type("html").send(page("Recorded", `<h1>${decision === "approved" ? "Approved" : decision === "revision_requested" ? "Sent back for revision" : "Declined"}</h1>${summary(find(r.id))}<pre>${escapeHtml(JSON.stringify(receipt, null, 2))}</pre>`));
     });

package/dist/decisions.d.ts

@@ -0,0 +1,18 @@
+export declare const DECISIONS_CARD_URI = "ui://miadi/decisions-v1.html";
+export declare const DECISION_TOKEN_TTL: number;
+/** Where the tokens travel in a result's `_meta`, keyed by record id. */
+export declare const DECISION_TOKENS_META = "miadi/decisionTokens";
+export declare class DecisionTokens {
+    private readonly secret;
+    constructor(stateDir: string);
+    private sign;
+    issue(recordId: string, personId: string, clientId: string, now?: number): string;
+    verify(token: string, recordId: string, personId: string, clientId: string, now?: number): "ok" | "expired" | "invalid";
+}
+/**
+ * The card. Self-contained: no network, no external script. It reads the
+ * request list from the tool output and the tokens from the tool's metadata,
+ * and calls `decide_request` through the host. In a host without that bridge it
+ * shows each request's approval page instead.
+ */
+export declare const DECISIONS_CARD_HTML = "<!doctype html>\n<html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<style>\n:root{color-scheme:light dark;--fg:#1d1b18;--muted:#5b5650;--line:#d9d4cc;--accent:#7a4a00;--ok:#1d6b3a;--err:#b00020;--chip:#f1ede6}\n@media (prefers-color-scheme:dark){:root{--fg:#ece8e1;--muted:#b3ada4;--line:#3a3631;--accent:#ffd700;--ok:#7fd49b;--err:#ff8a80;--chip:#24211d}}\n*{box-sizing:border-box}\nbody{margin:0;color:var(--fg);font:15px/1.45 system-ui,sans-serif;background:transparent}\nmain{padding:12px;display:grid;gap:12px}\n.empty,.note{color:var(--muted)}\narticle{border:1px solid var(--line);border-radius:10px;padding:12px}\nh2{font-size:15px;margin:0 0 4px}\n.kind{display:inline-block;font-size:12px;padding:1px 8px;border-radius:999px;background:var(--chip);color:var(--muted);margin-bottom:6px}\n.meta{font-size:13px;color:var(--muted);margin:0 0 6px}\n.does{margin:6px 0;font-weight:600}\ndetails{margin:6px 0}\nsummary{cursor:pointer;color:var(--muted);font-size:13px}\npre{white-space:pre-wrap;overflow-wrap:anywhere;font-size:12px;margin:6px 0 0;max-height:240px;overflow:auto}\ntextarea{width:100%;min-height:64px;padding:8px;border:1px solid var(--line);border-radius:8px;background:transparent;color:var(--fg);font:inherit;margin-top:8px}\n.row{display:flex;flex-wrap:wrap;gap:8px;margin-top:8px}\nbutton{padding:8px 12px;border-radius:8px;border:1px solid var(--line);background:transparent;color:var(--fg);font:inherit;cursor:pointer;min-height:40px}\nbutton.primary{border-color:var(--accent);outline:1px solid var(--accent)}\nbutton:focus-visible,a:focus-visible,textarea:focus-visible{outline:2px solid var(--accent);outline-offset:2px}\nbutton[disabled]{opacity:.55;cursor:default}\na{color:inherit}\n.done{color:var(--ok);font-weight:600}\n.fail{color:var(--err);font-weight:600}\n</style></head><body><main id=\"root\" aria-live=\"polite\"><p class=\"note\">Loading requests\u2026</p></main>\n<script>\n(function(){\n  var root=document.getElementById(\"root\");\n  var decided={};\n  function el(tag,attrs,text){var e=document.createElement(tag);if(attrs)for(var k in attrs){if(k===\"class\")e.className=attrs[k];else e.setAttribute(k,attrs[k]);}if(text!=null)e.textContent=text;return e;}\n  function host(){return window.openai||null;}\n  function data(){var h=host();return h&&h.toolOutput?h.toolOutput:null;}\n  function tokens(){var h=host();var m=h&&h.toolResponseMetadata;return (m&&m[\"miadi/decisionTokens\"])||{};}\n  function render(){\n    var d=data();root.textContent=\"\";\n    if(!d){root.appendChild(el(\"p\",{class:\"note\"},\"Waiting for the request list.\"));return;}\n    var list=d.decisions||[];\n    if(!list.length){root.appendChild(el(\"p\",{class:\"empty\"},d.message||\"No request is waiting for a decision.\"));return;}\n    if(!d.can_decide_here&&d.reason){root.appendChild(el(\"p\",{class:\"note\"},d.reason));}\n    var t=tokens();\n    list.forEach(function(r){root.appendChild(card(r,t[r.id]));});\n  }\n  function card(r,token){\n    var a=el(\"article\",{\"aria-label\":r.title});\n    a.appendChild(el(\"span\",{class:\"kind\"},r.kind_label||r.kind));\n    a.appendChild(el(\"h2\",null,r.title));\n    a.appendChild(el(\"p\",{class:\"meta\"},\"Asked by \"+r.by+(r.via?\" through \"+r.via:\"\")+\" \u00B7 \"+new Date(r.created_at).toLocaleString()+(r.circle?\" \u00B7 \"+r.circle+\" circle\":\"\")));\n    a.appendChild(el(\"p\",{class:\"does\"},r.consequence));\n    if(r.intention)a.appendChild(el(\"p\",null,r.intention));\n    var det=el(\"details\");det.appendChild(el(\"summary\",null,\"What exactly is asked\"));det.appendChild(el(\"pre\",null,r.detail||\"\"));a.appendChild(det);\n    var status=el(\"p\",{role:\"status\"});\n    if(decided[r.id]){status.className=decided[r.id].ok?\"done\":\"fail\";status.textContent=decided[r.id].text;a.appendChild(status);return a;}\n    if(!token||!host()||!host().callTool){\n      var p=el(\"p\",{class:\"note\"});p.appendChild(document.createTextNode(\"Decide on its approval page: \"));\n      var link=el(\"a\",{href:r.approval_url,target:\"_blank\",rel:\"noopener\"},\"open the approval page\");p.appendChild(link);a.appendChild(p);return a;\n    }\n    var ta=el(\"textarea\",{\"aria-label\":\"Instructions or changes (needed to approve with changes or send back)\",placeholder:\"Instructions or changes (needed to approve with changes or send back)\"});\n    a.appendChild(ta);\n    var row=el(\"div\",{class:\"row\"});\n    var buttons=[[\"approve\",\"Approve\",\"primary\"],[\"approve_with_changes\",\"Approve with my changes\",\"\"],[\"request_revision\",\"Send back for revision\",\"\"],[\"decline\",\"Decline\",\"\"]];\n    var btns=[];\n    buttons.forEach(function(b){var x=el(\"button\",{type:\"button\",class:b[2]},b[1]);x.addEventListener(\"click\",function(){go(b[0]);});btns.push(x);row.appendChild(x);});\n    a.appendChild(row);a.appendChild(status);\n    function go(choice){\n      var text=ta.value.trim();\n      if((choice===\"approve_with_changes\"||choice===\"request_revision\")&&!text){status.className=\"fail\";status.textContent=choice===\"request_revision\"?\"Say what to revise.\":\"Write the changes to apply.\";ta.focus();return;}\n      btns.forEach(function(x){x.disabled=true;});status.className=\"note\";status.textContent=\"Recording your decision\u2026\";\n      host().callTool(\"decide_request\",{record_id:r.id,decision:choice,instructions:text||undefined,decision_token:token}).then(function(res){\n        var out=(res&&(res.structuredContent||res.structured_content))||null;\n        if(!out&&res&&res.content&&res.content[0]&&res.content[0].text){try{out=JSON.parse(res.content[0].text);}catch(e){out={message:res.content[0].text};}}\n        var ok=out&&!out.error;\n        decided[r.id]={ok:ok,text:ok?(out.summary||\"Recorded.\"):((out&&out.message)||\"Not recorded.\")};render();\n      },function(err){btns.forEach(function(x){x.disabled=false;});status.className=\"fail\";status.textContent=\"Not recorded: \"+(err&&err.message?err.message:String(err));});\n    }\n    return a;\n  }\n  window.addEventListener(\"openai:set_globals\",render);\n  render();\n})();\n</script></body></html>";

package/dist/decisions.js

@@ -0,0 +1,139 @@
+/**
+ * In-chat approval: a request is decided on a card rendered inside the client
+ * (ChatGPT and other MCP Apps hosts), by the person's own click.
+ *
+ * Two locks keep the model that asked from approving:
+ * - `decide_request` is declared for the card only (`_meta.ui.visibility: ["app"]`),
+ *   so the host does not offer it to the model;
+ * - it requires a decision token that travels only in the `_meta` of the
+ *   `show_decisions` result, which hosts deliver to the card and keep from the
+ *   model. The token is bound to one request, one person and one OAuth client,
+ *   and expires. A request decided once is no longer awaiting approval, so a
+ *   token cannot be used twice.
+ *
+ * The sign-in must also carry `miadi:approve`, which a person grants by ticking
+ * it, and Miadi must give them the write tier.
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { newSecret } from "./store.js";
+export const DECISIONS_CARD_URI = "ui://miadi/decisions-v1.html";
+export const DECISION_TOKEN_TTL = 30 * 60;
+/** Where the tokens travel in a result's `_meta`, keyed by record id. */
+export const DECISION_TOKENS_META = "miadi/decisionTokens";
+export class DecisionTokens {
+    secret;
+    constructor(stateDir) {
+        const file = join(stateDir, "decision-secret");
+        if (!existsSync(file))
+            writeFileSync(file, newSecret(32), { mode: 0o600, flag: "wx" });
+        this.secret = readFileSync(file, "utf8").trim();
+    }
+    sign(recordId, personId, clientId, exp) {
+        return createHmac("sha256", this.secret).update(`${recordId}\n${personId}\n${clientId}\n${exp}`).digest("base64url");
+    }
+    issue(recordId, personId, clientId, now = Math.floor(Date.now() / 1000)) {
+        const exp = now + DECISION_TOKEN_TTL;
+        return `${exp}.${this.sign(recordId, personId, clientId, exp)}`;
+    }
+    verify(token, recordId, personId, clientId, now = Math.floor(Date.now() / 1000)) {
+        const [expRaw, mac] = String(token ?? "").split(".");
+        const exp = Number(expRaw);
+        if (!Number.isInteger(exp) || !mac)
+            return "invalid";
+        const expected = Buffer.from(this.sign(recordId, personId, clientId, exp));
+        const given = Buffer.from(mac);
+        if (expected.length !== given.length || !timingSafeEqual(expected, given))
+            return "invalid";
+        return exp < now ? "expired" : "ok";
+    }
+}
+/**
+ * The card. Self-contained: no network, no external script. It reads the
+ * request list from the tool output and the tokens from the tool's metadata,
+ * and calls `decide_request` through the host. In a host without that bridge it
+ * shows each request's approval page instead.
+ */
+export const DECISIONS_CARD_HTML = `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<style>
+:root{color-scheme:light dark;--fg:#1d1b18;--muted:#5b5650;--line:#d9d4cc;--accent:#7a4a00;--ok:#1d6b3a;--err:#b00020;--chip:#f1ede6}
+@media (prefers-color-scheme:dark){:root{--fg:#ece8e1;--muted:#b3ada4;--line:#3a3631;--accent:#ffd700;--ok:#7fd49b;--err:#ff8a80;--chip:#24211d}}
+*{box-sizing:border-box}
+body{margin:0;color:var(--fg);font:15px/1.45 system-ui,sans-serif;background:transparent}
+main{padding:12px;display:grid;gap:12px}
+.empty,.note{color:var(--muted)}
+article{border:1px solid var(--line);border-radius:10px;padding:12px}
+h2{font-size:15px;margin:0 0 4px}
+.kind{display:inline-block;font-size:12px;padding:1px 8px;border-radius:999px;background:var(--chip);color:var(--muted);margin-bottom:6px}
+.meta{font-size:13px;color:var(--muted);margin:0 0 6px}
+.does{margin:6px 0;font-weight:600}
+details{margin:6px 0}
+summary{cursor:pointer;color:var(--muted);font-size:13px}
+pre{white-space:pre-wrap;overflow-wrap:anywhere;font-size:12px;margin:6px 0 0;max-height:240px;overflow:auto}
+textarea{width:100%;min-height:64px;padding:8px;border:1px solid var(--line);border-radius:8px;background:transparent;color:var(--fg);font:inherit;margin-top:8px}
+.row{display:flex;flex-wrap:wrap;gap:8px;margin-top:8px}
+button{padding:8px 12px;border-radius:8px;border:1px solid var(--line);background:transparent;color:var(--fg);font:inherit;cursor:pointer;min-height:40px}
+button.primary{border-color:var(--accent);outline:1px solid var(--accent)}
+button:focus-visible,a:focus-visible,textarea:focus-visible{outline:2px solid var(--accent);outline-offset:2px}
+button[disabled]{opacity:.55;cursor:default}
+a{color:inherit}
+.done{color:var(--ok);font-weight:600}
+.fail{color:var(--err);font-weight:600}
+</style></head><body><main id="root" aria-live="polite"><p class="note">Loading requests…</p></main>
+<script>
+(function(){
+  var root=document.getElementById("root");
+  var decided={};
+  function el(tag,attrs,text){var e=document.createElement(tag);if(attrs)for(var k in attrs){if(k==="class")e.className=attrs[k];else e.setAttribute(k,attrs[k]);}if(text!=null)e.textContent=text;return e;}
+  function host(){return window.openai||null;}
+  function data(){var h=host();return h&&h.toolOutput?h.toolOutput:null;}
+  function tokens(){var h=host();var m=h&&h.toolResponseMetadata;return (m&&m["${DECISION_TOKENS_META}"])||{};}
+  function render(){
+    var d=data();root.textContent="";
+    if(!d){root.appendChild(el("p",{class:"note"},"Waiting for the request list."));return;}
+    var list=d.decisions||[];
+    if(!list.length){root.appendChild(el("p",{class:"empty"},d.message||"No request is waiting for a decision."));return;}
+    if(!d.can_decide_here&&d.reason){root.appendChild(el("p",{class:"note"},d.reason));}
+    var t=tokens();
+    list.forEach(function(r){root.appendChild(card(r,t[r.id]));});
+  }
+  function card(r,token){
+    var a=el("article",{"aria-label":r.title});
+    a.appendChild(el("span",{class:"kind"},r.kind_label||r.kind));
+    a.appendChild(el("h2",null,r.title));
+    a.appendChild(el("p",{class:"meta"},"Asked by "+r.by+(r.via?" through "+r.via:"")+" · "+new Date(r.created_at).toLocaleString()+(r.circle?" · "+r.circle+" circle":"")));
+    a.appendChild(el("p",{class:"does"},r.consequence));
+    if(r.intention)a.appendChild(el("p",null,r.intention));
+    var det=el("details");det.appendChild(el("summary",null,"What exactly is asked"));det.appendChild(el("pre",null,r.detail||""));a.appendChild(det);
+    var status=el("p",{role:"status"});
+    if(decided[r.id]){status.className=decided[r.id].ok?"done":"fail";status.textContent=decided[r.id].text;a.appendChild(status);return a;}
+    if(!token||!host()||!host().callTool){
+      var p=el("p",{class:"note"});p.appendChild(document.createTextNode("Decide on its approval page: "));
+      var link=el("a",{href:r.approval_url,target:"_blank",rel:"noopener"},"open the approval page");p.appendChild(link);a.appendChild(p);return a;
+    }
+    var ta=el("textarea",{"aria-label":"Instructions or changes (needed to approve with changes or send back)",placeholder:"Instructions or changes (needed to approve with changes or send back)"});
+    a.appendChild(ta);
+    var row=el("div",{class:"row"});
+    var buttons=[["approve","Approve","primary"],["approve_with_changes","Approve with my changes",""],["request_revision","Send back for revision",""],["decline","Decline",""]];
+    var btns=[];
+    buttons.forEach(function(b){var x=el("button",{type:"button",class:b[2]},b[1]);x.addEventListener("click",function(){go(b[0]);});btns.push(x);row.appendChild(x);});
+    a.appendChild(row);a.appendChild(status);
+    function go(choice){
+      var text=ta.value.trim();
+      if((choice==="approve_with_changes"||choice==="request_revision")&&!text){status.className="fail";status.textContent=choice==="request_revision"?"Say what to revise.":"Write the changes to apply.";ta.focus();return;}
+      btns.forEach(function(x){x.disabled=true;});status.className="note";status.textContent="Recording your decision…";
+      host().callTool("decide_request",{record_id:r.id,decision:choice,instructions:text||undefined,decision_token:token}).then(function(res){
+        var out=(res&&(res.structuredContent||res.structured_content))||null;
+        if(!out&&res&&res.content&&res.content[0]&&res.content[0].text){try{out=JSON.parse(res.content[0].text);}catch(e){out={message:res.content[0].text};}}
+        var ok=out&&!out.error;
+        decided[r.id]={ok:ok,text:ok?(out.summary||"Recorded."):((out&&out.message)||"Not recorded.")};render();
+      },function(err){btns.forEach(function(x){x.disabled=false;});status.className="fail";status.textContent="Not recorded: "+(err&&err.message?err.message:String(err));});
+    }
+    return a;
+  }
+  window.addEventListener("openai:set_globals",render);
+  render();
+})();
+</script></body></html>`;

package/dist/oauth.d.ts

@@ -16,6 +16,12 @@ import type { OAuthClientInformationFull, OAuthTokens, OAuthTokenRevocationReque
 import { JsonFile } from "./store.js";
 export declare const SCOPE_READ = "miadi:read";
 export declare const SCOPE_CONTRIBUTE = "miadi:contribute";
+/**
+ * Decide requests on in-chat approval cards. Granted only when the person ticks
+ * it at sign-in and Miadi gives them the write tier; never to a person token
+ * used directly as Bearer.
+ */
+export declare const SCOPE_APPROVE = "miadi:approve";
 export declare const SCOPES: string[];
 /** Who a Miadi person token belongs to, as Miadi itself answers. */
 export interface Person {
@@ -23,6 +29,8 @@ export interface Person {
     name: string;
     /** The Miadi person token, so calls to Miadi are made as this person. */
     token: string;
+    /** Miadi's API tier for this person, when the identify function knows it. */
+    api_tier?: string | null;
 }
 export type Identify = (token: string) => Promise<Person | null>;
 interface Pending {

package/dist/oauth.js

@@ -3,7 +3,15 @@ import { escapeHtml } from "@miadi/node-service-kit/format";
 import { digest, newSecret } from "./store.js";
 export const SCOPE_READ = "miadi:read";
 export const SCOPE_CONTRIBUTE = "miadi:contribute";
-export const SCOPES = [SCOPE_READ, SCOPE_CONTRIBUTE];
+/**
+ * Decide requests on in-chat approval cards. Granted only when the person ticks
+ * it at sign-in and Miadi gives them the write tier; never to a person token
+ * used directly as Bearer.
+ */
+export const SCOPE_APPROVE = "miadi:approve";
+export const SCOPES = [SCOPE_READ, SCOPE_CONTRIBUTE, SCOPE_APPROVE];
+/** What a person token used directly as Bearer carries: no in-chat approval. */
+const DIRECT_SCOPES = [SCOPE_READ, SCOPE_CONTRIBUTE];
 export const emptyOAuthState = () => ({ clients: {}, pending: {}, codes: {}, tokens: {} });
 const ACCESS_TTL = 8 * 3600;
 const REFRESH_TTL = 90 * 24 * 3600;
@@ -98,9 +106,14 @@ export class MiadiOAuthProvider {
             }));
             return;
         }
-        let scopes = wanted(pending.params.scopes);
+        let scopes = wanted(pending.params.scopes).filter((x) => x !== SCOPE_APPROVE);
         if (body.contribute !== "on")
             scopes = scopes.filter((x) => x !== SCOPE_CONTRIBUTE);
+        // In-chat approval is opt-in, whatever the client asked for, and only for Miadi's write tier.
+        if (body.approve === "on" && person.api_tier === "write")
+            scopes.push(SCOPE_APPROVE);
+        if (!scopes.includes(SCOPE_READ))
+            scopes.unshift(SCOPE_READ);
         const code = newSecret(24);
         this.state.update((st) => {
             delete st.pending[body.request_id];
@@ -158,14 +171,14 @@ export class MiadiOAuthProvider {
         // A Miadi person token used directly (terminal clients).
         const cached = this.direct.get(digest(token));
         if (cached && cached.until > now()) {
-            return info(token, "direct", SCOPES, cached.until, cached.person);
+            return info(token, "direct", DIRECT_SCOPES, cached.until, cached.person);
         }
         const person = await this.identify(token);
         if (!person)
             throw new InvalidTokenError("Unknown token");
         const until = now() + DIRECT_TTL;
         this.direct.set(digest(token), { person, until });
-        return info(token, "direct", SCOPES, until, person);
+        return info(token, "direct", DIRECT_SCOPES, until, person);
     }
     async revokeToken(_client, request) {
         this.state.update((s) => {
@@ -250,6 +263,8 @@ ${o.error ? `<p class="err" role="alert">${escapeHtml(o.error)}</p>` : ""}
 <label for="person_token">Your Miadi person token</label>
 <input id="person_token" name="person_token" type="password" autocomplete="off" required>
 ${contribute ? '<label><input type="checkbox" name="contribute" checked> Allow contributions in my name</label>' : ""}
+<label><input type="checkbox" name="approve"> Let me approve requests on cards inside this client</label>
+<p>Only for people with Miadi's write tier. Each approval is your own click on a card; the assistant cannot approve for you.</p>
 <div class="row">
 <button class="primary" type="submit" name="decision" value="allow">Sign in</button>
 <button type="submit" name="decision" value="deny" formnovalidate>Refuse</button>

package/dist/server.d.ts

@@ -15,4 +15,4 @@ export declare function createConnectorApp(config: ConnectorConfig, deps: Connec
     provider: MiadiOAuthProvider;
     ledger: Ledger<ConnectorRecord>;
 };
-export declare const INSTRUCTIONS = "Miadi is a relational software factory: agent sessions, Miadi reviews of screenwalks, Chronicle episodes, talking circles and the five accountable circles (Story, Stewardship, Engineering, Evaluation, Continuity) across three domains (Creative, Ceremonial, Engineering).\n\nStart with get_capabilities: it says who you are signed in as, which tools are live, and which return not_implemented.\n\nRules every tool keeps:\n- Every record names the person who made it, with a claim category: observed, hypothesis, desired_future, fiction or verified_implementation. Keep fiction and desired futures apart from what was observed.\n- Requests (runs, work proposals, review operations, Deep Diver, review-to-episode links, inquiry-to-episode weaves, session completion) are recorded as awaiting_approval. Nothing runs, publishes or closes until a person decides in Miadi. The person may approve, approve with changes (their instructions are carried into what runs), send it back for revision with instructions (approval_state revision_requested; read the instructions with get_run_result and submit a revised request citing the old id in refs), or decline.\n- A research report (a Deep Research report) is delivered with save_research exactly as written, never summarised or shortened, with its sources; a long report goes in parts. Check the bytes and first and last lines the answer returns against what you sent.\n- An unknown id is answered as not found, never invented. A missing backing service is answered as unavailable.\n- Use the miadi-review:<uuid>, miadi-chronicle://<n>, owner/repo#n and session:<uuid> reference forms.";
+export declare const INSTRUCTIONS = "Miadi is a relational software factory: agent sessions, Miadi reviews of screenwalks, Chronicle episodes, talking circles and the five accountable circles (Story, Stewardship, Engineering, Evaluation, Continuity) across three domains (Creative, Ceremonial, Engineering).\n\nStart with get_capabilities: it says who you are signed in as, which tools are live, and which return not_implemented.\n\nRules every tool keeps:\n- Every record names the person who made it, with a claim category: observed, hypothesis, desired_future, fiction or verified_implementation. Keep fiction and desired futures apart from what was observed.\n- Requests (runs, work proposals, review operations, Deep Diver, review-to-episode links, inquiry-to-episode weaves, session completion) are recorded as awaiting_approval. Nothing runs, publishes or closes until a person decides. After making a request, call show_decisions: it shows the request as a card in the conversation, where the person decides with their own click (or follows its approval page). Never claim a decision the card has not reported. The person may approve, approve with changes (their instructions are carried into what runs), send it back for revision with instructions (approval_state revision_requested; read the instructions with get_run_result and submit a revised request citing the old id in refs), or decline.\n- A research report (a Deep Research report) is delivered with save_research exactly as written, never summarised or shortened, with its sources; a long report goes in parts. Check the bytes and first and last lines the answer returns against what you sent.\n- An unknown id is answered as not found, never invented. A missing backing service is answered as unavailable.\n- Use the miadi-review:<uuid>, miadi-chronicle://<n>, owner/repo#n and session:<uuid> reference forms.";

package/dist/server.js

@@ -16,6 +16,7 @@ import { mcpAuthRouter, createOAuthMetadata, getOAuthProtectedResourceMetadataUr
 import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
 import { MiadiOAuthProvider, SCOPES, emptyOAuthState } from "./oauth.js";
 import { registerApprovalRoutes } from "./approve.js";
+import { DecisionTokens } from "./decisions.js";
 import { JsonFile, Ledger, ensureStateDir, statePaths } from "./store.js";
 import { registerTools } from "./tools.js";
 import { MiadiClient } from "./miadi.js";
@@ -67,7 +68,7 @@ export function createConnectorApp(config, deps) {
     app.post("/authorize/confirm", express.urlencoded({ extended: false, limit: "16kb" }), (req, res, next) => {
         provider.confirm(req, res).catch(next);
     });
-    registerApprovalRoutes(app, {
+    const approvalDeps = {
         config,
         ledger,
         miadi,
@@ -75,14 +76,16 @@ export function createConnectorApp(config, deps) {
         fetchImpl: deps.fetchImpl,
         factoryDir: deps.factoryDir,
         tmuxSessions: deps.tmuxSessions,
-    });
+    };
+    registerApprovalRoutes(app, approvalDeps);
+    const decisionTokens = new DecisionTokens(config.stateDir);
     const auth = requireBearerAuth({
         verifier: provider,
         requiredScopes: ["miadi:read"],
         resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(mcpUrl),
     });
     const handle = async (req, res) => {
-        const ctx = { config, miadi, reviews, ledger, oauthState, factoryDir: deps.factoryDir };
+        const ctx = { config, miadi, reviews, ledger, oauthState, factoryDir: deps.factoryDir, approval: approvalDeps, decisionTokens };
         const server = new McpServer({ name: "miadi", version: VERSION }, { instructions: INSTRUCTIONS });
         registerTools(server, ctx);
         const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
@@ -116,7 +119,7 @@ Start with get_capabilities: it says who you are signed in as, which tools are l
 
 Rules every tool keeps:
 - Every record names the person who made it, with a claim category: observed, hypothesis, desired_future, fiction or verified_implementation. Keep fiction and desired futures apart from what was observed.
-- Requests (runs, work proposals, review operations, Deep Diver, review-to-episode links, inquiry-to-episode weaves, session completion) are recorded as awaiting_approval. Nothing runs, publishes or closes until a person decides in Miadi. The person may approve, approve with changes (their instructions are carried into what runs), send it back for revision with instructions (approval_state revision_requested; read the instructions with get_run_result and submit a revised request citing the old id in refs), or decline.
+- Requests (runs, work proposals, review operations, Deep Diver, review-to-episode links, inquiry-to-episode weaves, session completion) are recorded as awaiting_approval. Nothing runs, publishes or closes until a person decides. After making a request, call show_decisions: it shows the request as a card in the conversation, where the person decides with their own click (or follows its approval page). Never claim a decision the card has not reported. The person may approve, approve with changes (their instructions are carried into what runs), send it back for revision with instructions (approval_state revision_requested; read the instructions with get_run_result and submit a revised request citing the old id in refs), or decline.
 - A research report (a Deep Research report) is delivered with save_research exactly as written, never summarised or shortened, with its sources; a long report goes in parts. Check the bytes and first and last lines the answer returns against what you sent.
 - An unknown id is answered as not found, never invented. A missing backing service is answered as unavailable.
 - Use the miadi-review:<uuid>, miadi-chronicle://<n>, owner/repo#n and session:<uuid> reference forms.`;

package/dist/tools.d.ts

@@ -5,6 +5,8 @@ import type { ReviewClient } from "./reviews.js";
 import type { JsonFile, Ledger } from "./store.js";
 import type { OAuthState } from "./oauth.js";
 import { type ConnectorRecord } from "./records.js";
+import { type ApprovalDeps } from "./approve.js";
+import { type DecisionTokens } from "./decisions.js";
 export interface ToolContext {
     config: ConnectorConfig;
     miadi: MiadiClient;
@@ -13,6 +15,9 @@ export interface ToolContext {
     oauthState: JsonFile<OAuthState>;
     /** The factory directory holding queue/ (default ~/.miadi/factory). */
     factoryDir?: string;
+    /** What the in-chat approval card needs to run a decided request. */
+    approval?: ApprovalDeps;
+    decisionTokens?: DecisionTokens;
 }
 export declare function registerTools(server: McpServer, ctx: ToolContext): void;
 /** What get_capabilities reports for each tool. */

package/dist/tools.js

@@ -13,10 +13,11 @@
 import { z } from "zod";
 import { MiadiError } from "./miadi.js";
 import { reviewIdOf, videoIdOf } from "./reviews.js";
-import { SCOPE_CONTRIBUTE } from "./oauth.js";
+import { SCOPE_APPROVE, SCOPE_CONTRIBUTE } from "./oauth.js";
 import { CIRCLES, CIRCLE_IDS, CLAIM_CATEGORIES, DOMAINS, HANDOFF_STATES, current, newRecordId, } from "./records.js";
 import { VERSION } from "./version.js";
-import { readQueueState } from "./approve.js";
+import { DECISIONS, consequenceOf, decide, isApprovable, readQueueState } from "./approve.js";
+import { DECISIONS_CARD_HTML, DECISIONS_CARD_URI, DECISION_TOKENS_META } from "./decisions.js";
 import { join } from "node:path";
 import { artefactVisibility, readArtefactWeave, saveResearchArtefact } from "@miadi/inquiry-weave";
 import { ResearchUploads, UploadRefusal } from "./uploads.js";
@@ -1001,6 +1002,147 @@ export function registerTools(server, ctx) {
         });
         return { ...r, approval_url: approvalUrl(r.id) };
     }));
+    // ── decisions inside the conversation ─────────────────────────────────
+    const KIND_LABEL = {
+        run_request: "Agent run",
+        work_proposal: "Work proposal",
+        review_operation_request: "Review operation",
+        deep_diver_request: "Deep Diver",
+        review_episode_link_request: "Review into an episode",
+        inquiry_episode_request: "Inquiry into an episode",
+        session_completion_proposal: "Session ending",
+    };
+    const titleOf = (r) => {
+        const b = r.body;
+        const t = b.title ?? b.task ?? b.desired_outcome ?? b.reason ?? b.operation ?? b.artefact ?? r.intention ?? r.kind;
+        const line = String(t).split("\n")[0].trim();
+        return line.length > 120 ? `${line.slice(0, 117)}…` : line;
+    };
+    const detailOf = (r) => {
+        const shown = { ...r.body };
+        for (const k of ["markdown", "transcript"])
+            if (typeof shown[k] === "string")
+                shown[k] = `${shown[k].length} chars`;
+        return JSON.stringify({ ...shown, refs: r.refs.length ? r.refs : undefined }, null, 2);
+    };
+    server.registerResource("miadi-decisions-card", DECISIONS_CARD_URI, { title: "Miadi decisions", description: "Requests awaiting a person's decision, decided by the person's own click.", mimeType: "text/html;profile=mcp-app" }, async () => ({
+        contents: [
+            {
+                uri: DECISIONS_CARD_URI,
+                mimeType: "text/html;profile=mcp-app",
+                text: DECISIONS_CARD_HTML,
+                _meta: { ui: { prefersBorder: true, csp: { connectDomains: [], resourceDomains: [] } }, "openai/widgetDescription": "Cards for the requests awaiting the person's decision." },
+            },
+        ],
+    }));
+    server.registerTool("show_decisions", {
+        title: "Show the requests awaiting a decision",
+        description: "Show the requests that await a person's decision (runs, work proposals, review operations, Deep Diver, episode links, session endings) as cards in the conversation. The person approves, approves with changes, sends back or declines each one with their own click; you cannot decide for them. Call it after making a request, or when the person asks what waits for them. Optionally pass record_id to show one request.",
+        inputSchema: { record_id: z.string().optional() },
+        annotations: READ,
+        _meta: { ui: { resourceUri: DECISIONS_CARD_URI }, "openai/outputTemplate": DECISIONS_CARD_URI, "openai/toolInvocation/invoking": "Gathering requests", "openai/toolInvocation/invoked": "Requests shown" },
+    }, async ({ record_id }, extra) => {
+        try {
+            const { person, auth } = personOf(extra);
+            const writer = person.api_tier === "write";
+            const waiting = records()
+                .filter((r) => r.approval_state === "awaiting_approval" && isApprovable(r))
+                .filter((r) => writer || r.actor.person_id === person.id)
+                .filter((r) => !record_id || r.id === record_id)
+                .slice(-20)
+                .reverse();
+            const canDecide = writer && auth.scopes.includes(SCOPE_APPROVE) && Boolean(ctx.decisionTokens);
+            const reason = canDecide
+                ? undefined
+                : !writer
+                    ? `Deciding needs Miadi's write tier; ${person.name} has ${person.api_tier ?? "no API tier"}. The requests are listed with their approval pages.`
+                    : "This sign-in does not allow approving inside this client. Reconnect and tick \"Let me approve requests on cards inside this client\", or use each request's approval page.";
+            const decisions = waiting.map((r) => ({
+                id: r.id,
+                kind: r.kind,
+                kind_label: KIND_LABEL[r.kind] ?? r.kind,
+                title: titleOf(r),
+                by: r.actor.name,
+                via: r.actor.client_name,
+                created_at: r.created_at,
+                circle: r.circle,
+                intention: r.intention,
+                consequence: consequenceOf(r),
+                detail: detailOf(r),
+                approval_url: approvalUrl(r.id),
+            }));
+            const tokens = canDecide ? Object.fromEntries(waiting.map((r) => [r.id, ctx.decisionTokens.issue(r.id, person.id, auth.clientId)])) : {};
+            const structured = {
+                decisions,
+                count: decisions.length,
+                can_decide_here: canDecide,
+                ...(reason ? { reason } : {}),
+                ...(decisions.length ? {} : { message: record_id ? "That request is not awaiting a decision." : "No request is waiting for a decision." }),
+            };
+            const text = decisions.length
+                ? `${decisions.length} request(s) await a decision and are shown as cards. ${canDecide ? "The person decides each one on its card; do not decide or claim a decision for them." : reason}`
+                : structured.message;
+            return { structuredContent: structured, content: [{ type: "text", text }], _meta: { [DECISION_TOKENS_META]: tokens } };
+        }
+        catch (error) {
+            if (error instanceof ToolRefusal)
+                return fail({ error: error.code, message: error.message });
+            return fail({ error: "failed", message: error instanceof Error ? error.message : String(error) });
+        }
+    });
+    server.registerTool("decide_request", {
+        title: "Record the person's decision from a card",
+        description: "Called by the decisions card when the person clicks Approve, Approve with my changes, Send back or Decline. Requires the card's decision token, which the assistant does not receive.",
+        inputSchema: {
+            record_id: z.string().min(1),
+            decision: z.enum(DECISIONS),
+            instructions: z.string().max(20000).optional(),
+            decision_token: z.string().min(10).max(200),
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+        // A card-only tool renders nothing itself: ChatGPT refuses a widget on a private tool.
+        _meta: { ui: { visibility: ["app"] }, "openai/widgetAccessible": true },
+    }, async (a, extra) => {
+        try {
+            const { person, auth } = personOf(extra);
+            if (!auth.scopes.includes(SCOPE_APPROVE))
+                throw new ToolRefusal("insufficient_scope", "This sign-in does not allow approving inside this client.");
+            requireTier(person, "write");
+            if (!ctx.decisionTokens || !ctx.approval)
+                throw new ToolRefusal("unavailable", "In-chat decisions are not configured on this connector.");
+            const r = records().find((x) => x.id === a.record_id);
+            if (!isApprovable(r))
+                throw new ToolRefusal("not_found", "No request with that id.");
+            const check = ctx.decisionTokens.verify(a.decision_token, r.id, person.id, auth.clientId);
+            if (check !== "ok")
+                throw new ToolRefusal(check === "expired" ? "token_expired" : "invalid_token", check === "expired" ? "This card is too old; show the requests again." : "This decision did not come from the person's card.");
+            if (r.approval_state !== "awaiting_approval")
+                throw new ToolRefusal("already_decided", `This request is already ${r.approval_state}.`);
+            const instructions = a.instructions?.trim() || undefined;
+            if ((a.decision === "approve_with_changes" || a.decision === "request_revision") && !instructions) {
+                throw new ToolRefusal("instructions_required", a.decision === "request_revision" ? "Say what to revise." : "Write the changes to apply.");
+            }
+            const client = ctx.oauthState.read().clients[auth.clientId];
+            const { decision, state, receipt } = await decide(r, person, a.decision, ctx.approval, {
+                instructions,
+                via: `card:${String(client?.client_name ?? auth.clientId).slice(0, 50)}`,
+            });
+            const summary = decision === "approved"
+                ? `Approved by ${person.name}. ${receipt.outcome === "failed" ? "Running it failed; see the receipt." : `Outcome: ${String(receipt.outcome ?? "recorded").replace(/_/g, " ")}.`}`
+                : decision === "revision_requested"
+                    ? `Sent back for revision by ${person.name}.`
+                    : `Declined by ${person.name}.`;
+            const out = { record_id: r.id, decision, state, summary, receipt };
+            return { structuredContent: out, content: [{ type: "text", text: JSON.stringify(out, null, 2) }] };
+        }
+        catch (error) {
+            if (error instanceof ToolRefusal) {
+                const out = { error: error.code, message: error.message };
+                return { isError: true, structuredContent: out, content: [{ type: "text", text: JSON.stringify(out, null, 2) }] };
+            }
+            return fail({ error: "failed", message: error instanceof Error ? error.message : String(error) });
+        }
+    });
 }
 function asState(e) {
     if (e instanceof MiadiError)
@@ -1082,4 +1224,6 @@ export const TOOL_STATUS = {
     link_review_to_episode: "live, contribute, needs_approval",
     save_research: "live, contribute (the whole report, in parts when long; saved on the inquiry shelf with its issue, pushed; private by default)",
     request_inquiry_episode: "live, contribute, needs_approval (weaves a shelf folder into an episode or starts one)",
+    show_decisions: "live (cards in the conversation; deciding on them needs the write tier and the miadi:approve sign-in)",
+    decide_request: "card only: the person's click on a decisions card; not offered to the assistant",
 };

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.1.4";
+export declare const VERSION = "0.1.6";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.1.4";
+export const VERSION = "0.1.6";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miadi/connector",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "The Miadi connector: one remote MCP service through which a person signed in with their Miadi person token, from ChatGPT or any MCP client, reads sessions, reviews, episodes and circles and records observations, inquiries, handoffs and proposals with their name on each record.",
   "license": "MIT",
   "author": "Miadi",