toolroll 0.9.102 → 0.9.104

package/dist/serve.js

@@ -20,8 +20,6 @@ import { html, htmlString, jsonScript, textHtml } from "./html.js";
 import { browserAssetsAvailable, browserWorkspaceDocument } from './browser-shell.js';
 import { accessKey, countsKey, indexKey, projectSummaryOf, RevisionCache, summaryKey } from './console-chrome.js';
 import { usageChipOf } from './limits-ui.js';
-/** Any header a proxy adds: a request carrying one is never "from this computer" (password freshness, one-time links). */
-const PROXY_HEADER = /^(forwarded|via|x-forwarded-.+|x-real-ip|x-client-ip|x-original-.+|x-cluster-client-ip|true-client-ip|cf-connecting-ip|fastly-client-ip|x-proxyuser-ip)$/i;
 /** How often the background checks look at what is due (docs/plans/get-side-effects.md), and how often this
  * computer's agent sign-ins are asked again. */
 const BACKGROUND_CHECKS_MS = 30_000;
@@ -137,7 +135,7 @@ import { canonicalProject, projectName, resolveCeiling, rowVisible } from "./pro
 import { noteSignInProbe, signInNotices } from "./provider-auth.js";
 import { createConnectionChecker } from "./provider-connection.js";
 import { ALL_CREDENTIAL_ENV } from "./provider.js";
-import { hstsFor, LOOPBACK_PEERS, plainHttpRefusal, transportOf } from "./public-access.js";
+import { hstsFor, LOOPBACK_PEERS, plainHttpRefusal, requestFromThisComputer, transportOf } from "./public-access.js";
 import { attachReadExecutor, defaultReadWorkers, ReadExecutor } from "./read-executor.js";
 import { cachedRelease, isNewer, runnerVersions, updateChecksOff } from "./releases.js";
 import { limitWords, FLUSH_MS as REQUEST_BUDGET_FLUSH_MS, RequestBudget, SOURCE_BUDGET_DEFAULTS, SourceAdmission } from "./request-budget.js";
@@ -158,7 +156,7 @@ import { createPeopleHandlers } from './server/people-tokens.js';
 import { createSettingsHandlers } from './server/settings.js';
 import { readPurpose, requestContext } from "./server/request-context.js";
 import { inPlaceRoute, prefetchRoute } from "./server/in-place.js";
-import { asLocalOwner, localModeOn, localOwnerRefusal, localOwnerStandsNow } from "./local-owner.js";
+import { LOCAL_OWNER_ELSEWHERE, asLocalOwner, localModeOn, localOwnerRefusal, localOwnerStandsNow } from "./local-owner.js";
 import { defaultAgentOf, fillDefaultRouting } from "./model-choices.js";
 import { chromeScript, DEMO_BANNER, DEMO_BANNER_SHORT, focusDocument, KBD_HELP, pinnedTheme, QUEUE_VIEW, refuse, screen, SENSITIVE_INPUT, shell, sidebarScript } from "./server/chrome.js";
 import { BODY_CAP, form, loginHref, passwordSetNext, refusalNext, matchTaskPath, page, projectChatHref, redactedPath, redirect, respond, safeReturn, SHUTDOWN_WAIT_MS, taskChatHref } from "./server/http.js";
@@ -379,16 +377,9 @@ export function createDecisionServer(options) {
     /** v147: this console start's key epoch (easy-start C2): the browser-key wave binds each session's mutation key to it. */
     const keyEpoch = options.keyEpoch ?? randomBytes(16).toString("hex");
     /** This computer, and nothing in front of it: a loopback peer that names a loopback address, with no sign of a proxy —
-     * any forwarding header at all (Forwarded, X-Forwarded-*, X-Real-IP, Via, …) disqualifies the request. */
-    const fromThisComputer = (request) => {
-        const peer = request.socket.remoteAddress ?? "";
-        if (!LOOPBACK_PEERS.has(peer))
-            return false;
-        for (const name of Object.keys(request.headers))
-            if (PROXY_HEADER.test(name))
-                return false;
-        return /^(localhost|127\.0\.0\.1|\[::1\]):[0-9]{1,5}$/.test(request.headers.host ?? "");
-    };
+     * any forwarding header at all (Forwarded, X-Forwarded-*, X-Real-IP, Via, …) disqualifies the request. The one reading
+     * (public-access.ts), which guards.ts also applies to every request a local owner's session makes. */
+    const fromThisComputer = (request) => requestFromThisComputer(request);
     /**
      * Cockpit B2: a request's password-freshness facts — the one place they are made (scope.ts honours them). Every
      * reader looks at the session as it is at the moment of the act, never a snapshot taken before the body arrived:
@@ -911,6 +902,14 @@ export function createDecisionServer(options) {
         const refusedToken = {};
         const who = identify(request, touch, edgeRoute?.domain === 'live', refusedToken);
         timeline.mark("signed in");
+        // Local-owner slice 0: a local owner's session presented from anywhere but this computer (another address, a
+        // proxy, a tailnet or LAN name) signs in no one and changes nothing. Sign-in pages still answer (a password signs
+        // in there); everything else is refused in plain words.
+        if (refusedToken.elsewhere === true && edgeRoute?.domain !== 'people') {
+            request.resume();
+            response.setHeader("x-toolroll-refused", "local-owner-elsewhere");
+            return respond(response, 403, "text/plain; charset=utf-8", LOCAL_OWNER_ELSEWHERE);
+        }
         if (refusedToken.principal !== undefined) {
             if (refuseBudget(requestBudget.admit(refusedToken.principal.tokenId, "api")))
                 return;

package/dist/server/guards.d.ts

@@ -58,6 +58,7 @@ export declare function createSharedGuards(runtime: GuardsRuntime): {
     projectRequestAllowed: (route: RouteDeclaration, source: RouteDeclaration['project'], url: URL, who: Who, request: IncomingMessage, response: ServerResponse, body: URLSearchParams | null) => boolean;
     identify: (request: IncomingMessage, touch?: boolean, limited?: boolean, refusedToken?: {
         principal?: Principal;
+        elsewhere?: boolean;
     }) => Who | null;
     lookupSession: (candidate: string, touch?: boolean) => Session | null;
     restricted: () => boolean;

package/dist/server/guards.js

@@ -15,6 +15,7 @@ import { requestContext } from "./request-context.js";
 import { refuse } from "./chrome.js";
 import { matchTaskPath } from "./http.js";
 import { PersistentSessions, SESSION_COOKIE, sessionWithinLifetime } from "./session.js";
+import { requestFromThisComputer } from "../public-access.js";
 export function createSharedGuards(runtime) {
     const syncIdentities = syncProjectIdentities();
     // v99: wrong passwords. One address guessing across names runs out of tries here; each name
@@ -333,7 +334,16 @@ export function createSharedGuards(runtime) {
         const match = new RegExp(`(?:^|;\\s*)${SESSION_COOKIE}=([0-9a-f]{64})`).exec(cookies);
         if (match === null)
             return null;
-        const session = lookupSession(match[1], touch);
+        // Local-owner slice 0: a local owner's session works only from this computer — a loopback peer naming a loopback
+        // Host, with no forwarding header — on every request, not only when it was made. From anywhere else it signs in
+        // no one, and is not touched (refusedToken.elsewhere says why, for the refusal).
+        const found = lookupSession(match[1], false);
+        if (found !== null && found.authority !== "full" && !requestFromThisComputer(request)) {
+            if (refusedToken !== undefined)
+                refusedToken.elsewhere = true;
+            return null;
+        }
+        const session = touch && found !== null ? lookupSession(match[1], true) : found;
         return session === null ? null : { name: session.name, via: "cookie", session, role: session.role, authority: session.authority };
     }
     /**

package/dist/server/home-asks.d.ts

@@ -0,0 +1,45 @@
+import type { FirstRunStep } from "../first-run.js";
+import type { Store } from "../store.js";
+import type { WorkSummaryAccess } from "../work-summary.js";
+/** One row Home lists that isn't a task's own row. `id` is namespaced so it never meets a task's id; `at` (when it
+ * started waiting) gives its age, or null for a setup step; `repo` its project. */
+export type HomeAskRow = {
+    id: string;
+    title: string;
+    href: string;
+    repo: string | null;
+    at: string | null;
+    line: string | null;
+    action: {
+        label: string;
+        href: string;
+    };
+};
+export type HomeAsks = {
+    /** A release's line for an approver (its version, or why the sheet can't take a yes now); null when it isn't one. */
+    release: (taskId: string) => string | null;
+    /** Releases whose publication waits for a person, one per family, only where that family isn't already a row. */
+    held: HomeAskRow[];
+    /** Flow cards waiting on this person. */
+    flows: HomeAskRow[];
+    /** First-run steps still to do, keyed by step. */
+    setup: (HomeAskRow & {
+        key: FirstRunStep["key"];
+    })[];
+};
+export declare const NO_HOME_ASKS: HomeAsks;
+/** The release sheet: where a release is read and approved, never Home. */
+export declare const releaseSheetHref: (taskId: string) => string;
+/** A release's line (its version, or the sheet's refusal) and every held publication in view. Approvers only: the sheet
+ * mints its approval only for them; anyone else reads a release as an ordinary task row. */
+export declare function releaseAsks(store: Store, now: Date, access: WorkSummaryAccess, project: string | null, approver: boolean): Pick<HomeAsks, "release" | "held">;
+/** Every active card, in a flow of a project this person may see, that waits on them (flows-ui.ts flowCardWaitsOn, the
+ * flow page's own rule). Newest wait first. */
+export declare function flowAsks(store: Store, repos: readonly string[], viewer: {
+    name: string;
+    approver: boolean;
+}, project: string | null): HomeAskRow[];
+/** The first-run steps (first-run.ts, with the builder step) still to do, for an approver. A step that is done, or only
+ * being checked (no answer yet, so no action), is not a row. Null steps (a restricted console, the demo, after the first
+ * success) are none. */
+export declare function setupAsks(steps: readonly FirstRunStep[] | null, approver: boolean): HomeAsks["setup"];

package/dist/server/home-asks.js

@@ -0,0 +1,108 @@
+/**
+ * What else waits on a person at Home (docs/plans/home-other-asks.md): a release's line and a held publication, a flow
+ * card waiting on them, and the first-run steps left to do. Reads only, each through the same admission as the page it
+ * links to; nothing here acts: every row's one link opens its own page, whose own checks decide what this person may do
+ * there. `homeView` (home.ts) assembles these with the work index's rows.
+ */
+import { flowCardHref, flowDefinitionOf } from "../flow-engine.js";
+import { browserViewOf } from "../flow-browser.js";
+import { flowCardWaitsOn } from "../flows-ui.js";
+import { releaseAskOf, releaseTaskOf } from "../release-approval.js";
+import { autoPublishHeld, PUBLISH_ALLOWED_ACTION, PUBLISH_HELD_ACTION } from "../release-auto.js";
+import { taskArchived } from "../task-archive.js";
+import { workStateRows } from "../work-index.js";
+export const NO_HOME_ASKS = { release: () => null, held: [], flows: [], setup: [] };
+/** The release sheet: where a release is read and approved, never Home. */
+export const releaseSheetHref = (taskId) => `/t/${encodeURIComponent(taskId)}/release`;
+const REVIEW_RELEASE = "Review the release";
+/** A release's line (its version, or the sheet's refusal) and every held publication in view. Approvers only: the sheet
+ * mints its approval only for them; anyone else reads a release as an ordinary task row. */
+export function releaseAsks(store, now, access, project, approver) {
+    if (!approver)
+        return { release: () => null, held: [] };
+    const release = (taskId) => {
+        const ask = releaseAskOf(store, taskId);
+        return ask === null ? null : ask.refusal ?? `Version ${ask.version} waits for your approval.`;
+    };
+    const shown = (repo) => (access.repos === null || access.repos.includes(repo)) && (project === null || repo === project);
+    // Only what is still held: the newest held-or-allowed act per task is the held one (release-auto.ts autoPublishHeld's
+    // own rule, read in one statement). Each is then a release this person may see in this scope, before anything heavier.
+    const marked = store.handle.prepare(`SELECT a.task_id, a.at, a.detail FROM action_ledger a WHERE a.action = $held AND a.task_id IS NOT NULL
+    AND a.id = (SELECT MAX(b.id) FROM action_ledger b WHERE b.task_id = a.task_id AND b.action IN ($held, $allowed)) ORDER BY a.at DESC, a.id DESC`)
+        .all({ $held: PUBLISH_HELD_ACTION, $allowed: PUBLISH_ALLOWED_ACTION });
+    const candidates = marked.flatMap(row => {
+        const taskId = String(row["task_id"]);
+        const found = releaseTaskOf(store, taskId);
+        return found === null || !shown(found.ref.repo) || taskArchived(store, taskId) ? []
+            : [{ taskId, ref: found.ref.id, repo: found.ref.repo, at: String(row["at"]), why: autoPublishHeld(store, taskId) ?? String(row["detail"] ?? "") }];
+    });
+    if (candidates.length === 0)
+        return { release, held: [] };
+    // Every family in this person's view, read once (the Tasks list's own projection): a held release's family that is
+    // already a row that needs them (in any group) is not listed twice, and one the view doesn't admit is not listed.
+    const familyOf = new Map();
+    for (const family of workStateRows(store, now, access))
+        for (const member of family.members)
+            familyOf.set(member, { rootId: family.rootId, needs: family.needs });
+    const families = new Set();
+    const held = [];
+    for (const one of candidates) {
+        const family = familyOf.get(one.ref);
+        if (family === undefined || family.needs || families.has(family.rootId))
+            continue;
+        families.add(family.rootId);
+        held.push({ id: `release:${family.rootId}`, title: store.getTask(one.taskId)?.title ?? one.taskId, href: releaseSheetHref(one.taskId), repo: one.repo, at: one.at,
+            line: one.why, action: { label: REVIEW_RELEASE, href: releaseSheetHref(one.taskId) } });
+    }
+    return { release, held };
+}
+/** Every active card, in a flow of a project this person may see, that waits on them (flows-ui.ts flowCardWaitsOn, the
+ * flow page's own rule). Newest wait first. */
+export function flowAsks(store, repos, viewer, project) {
+    if (!viewer.approver)
+        return [];
+    const rows = [];
+    for (const flow of store.listFlows(repos)) {
+        if (flow.state !== "active" || (project !== null && flow.repo !== project) || !store.accountCanAccess(viewer.name, flow.repo))
+            continue;
+        const stages = flowDefinitionOf(flow)?.stages ?? [];
+        // The flow's browser standing, read once and only when a card waits in a zone that starts a browser.
+        let browser;
+        for (const card of store.flowCards(flow.id, false)) {
+            if (card.state !== "active")
+                continue;
+            // A card whose zone was removed still has its subagent's open question (the flow page still takes the answer).
+            const stage = stages.find(one => one.id === card.stage);
+            if (stage?.kind === "check" && stage.browser === true && browser === undefined)
+                browser = browserViewOf(store, flow);
+            const waits = flowCardWaitsOn(store, flow, card, viewer, { stage, ...(browser === undefined ? {} : { browser }) });
+            if (!waits.decide && !waits.choose && !waits.answer && !waits.browser && !waits.reply)
+                continue;
+            const asked = waits.answer ? store.openSubagentQuestionOn(card.id, card.entry)?.question ?? null : null;
+            // The card's own waiting words (a browser wait without the command the page offers as a button).
+            const waiting = card.waiting?.replace(/ Approve it with: toolroll flows browser \d+ on$/, "") ?? null;
+            const said = waiting ?? asked ?? (waits.choose ? "Waits for your choice." : "Waits for your decision.");
+            const href = flowCardHref(flow.id, card.id);
+            rows.push({ id: `flow:${card.id}`, title: card.title, href, repo: flow.repo, at: store.flowCardEnteredAt(card.id) ?? card.updatedAt,
+                line: `${flow.name}: ${said}`, action: { label: "Open the card", href } });
+        }
+    }
+    return rows.sort((a, b) => (b.at ?? "").localeCompare(a.at ?? ""));
+}
+const SETUP_TITLES = {
+    agent: "Sign in to a coding agent", project: "Add a project", builder: "Connect a builder", task: "File your first task",
+};
+/** The first-run steps (first-run.ts, with the builder step) still to do, for an approver. A step that is done, or only
+ * being checked (no answer yet, so no action), is not a row. Null steps (a restricted console, the demo, after the first
+ * success) are none. */
+export function setupAsks(steps, approver) {
+    if (steps === null || !approver)
+        return [];
+    return steps.flatMap(step => {
+        if (step.done || step.checking === true || step.action === null)
+            return [];
+        const action = step.action.kind === "link" ? { label: step.action.label, href: step.action.href } : { label: "Open setup", href: "/welcome" };
+        return [{ key: step.key, id: `setup:${step.key}`, title: SETUP_TITLES[step.key], href: action.href, repo: null, at: null,
+                line: step.action.kind === "command" ? `Run ${step.action.command} in a terminal.` : null, action }];
+    });
+}

package/dist/server/home.d.ts

@@ -1,7 +1,7 @@
 /**
- * Home ("/", docs/plans/live-pages-and-home.md B1): what needs this person, grouped by what is asked (Approve a plan,
- * Answer a question, Something went wrong, Review results, and Needs you for the rest), each group with its exact
- * count; one quiet line for what runs and waits; with nothing waiting, what runs and what finished today. The figures
+ * Home ("/", docs/plans/live-pages-and-home.md B1, home-other-asks.md): what needs this person, grouped by what is asked
+ * (Approve a release, Approve a plan, Answer a question, Flow decisions, Something went wrong, Review results, Finish
+ * setting up, and Needs you for the rest), each group with its exact count; one quiet line for what runs and waits; with nothing waiting, what runs and what finished today. The figures
  * are read from the same work index the Tasks list filters, so a count and the list it opens always agree. Reads
  * only: every act keeps its own route and rules (an agent's question is answered through POST /d/<id>/answer, the
  * same one-click act as its own page).
@@ -9,12 +9,15 @@
 import type { BrowserHomeAsk, BrowserHomeView } from "../browser-workspace.js";
 import type { Store } from "../store.js";
 import type { WorkSummaryAccess } from "../work-summary.js";
+import { type HomeAsks } from "./home-asks.js";
 /** How many waiting rows Home lists; each group says how many more open in Tasks. */
 export declare const HOME_NEEDS_SHOWN = 30;
 /** How many rows finished today Home lists; its figure counts them all. */
 export declare const HOME_DONE_SHOWN = 8;
 /** Each group's heading, in the order Home shows them. */
 export declare const HOME_ASK_LABEL: Readonly<Record<BrowserHomeAsk, string>>;
+/** The groups in Home's one order. */
+export declare const HOME_ASK_ORDER: readonly BrowserHomeAsk[];
 export type HomeFacts = {
     store: Store;
     now: Date;
@@ -31,6 +34,11 @@ export type HomeFacts = {
     chat: boolean;
     /** This person can answer an agent's question (an approver in a browser session). */
     canAnswer: boolean;
+    /** An approver in a browser session (default: `canAnswer`): a release is then read in Approve a release, never
+     * approved here; for anyone else it stays an ordinary task row. */
+    approver?: boolean;
+    /** What else waits on this person (home-asks.ts), already read through each page's own admission. */
+    asks?: HomeAsks;
     /** Why this task's plan can't take a yes right now (render-tasks.ts consentDoorOf), or null when it can. */
     closedDoor: (taskId: string) => {
         title: string;
@@ -44,8 +52,10 @@ export type HomeFacts = {
         at: string;
     } | null;
 };
-/** "19 tasks need you": the heading, said once, from the same total as the rail's count. */
-export declare function homeSentence(needs: number, any: boolean): string;
+/** "19 tasks need you", "3 tasks and 2 other things need you", "2 things need you": the heading, said once. Tasks
+ * are the same total as the rail's count; `others` are the rows that aren't tasks (a held publication, a flow card, a
+ * setup step). */
+export declare function homeSentence(needs: number, any: boolean, others?: number): string;
 /** The lead's words as one plain line: no markdown marks, no line breaks, cut to about one line. */
 export declare function leadLineOf(text: string): string;
 /** Midnight today on this computer's clock: "finished today" starts here. */

package/dist/server/home.js

@@ -1,9 +1,10 @@
 import { browserWorkActionHref } from "../browser-crew.js";
 import { NO_REASON_RECORDED } from "../needs-you.js";
 import { projectName } from "../project.js";
-import { WORK_ASK_GROUPS, workIndexPage } from "../work-index.js";
+import { workIndexPage } from "../work-index.js";
 import { oneLineOf, relativeAge } from "./chrome.js";
 import { taskHref } from "./http.js";
+import { NO_HOME_ASKS, releaseSheetHref } from "./home-asks.js";
 /** How many waiting rows Home lists; each group says how many more open in Tasks. */
 export const HOME_NEEDS_SHOWN = 30;
 const HOME_RUNNING_SHOWN = 8;
@@ -13,15 +14,21 @@ export const HOME_DONE_SHOWN = 8;
 const LEAD_LINE_LIMIT = 160;
 /** Each group's heading, in the order Home shows them. */
 export const HOME_ASK_LABEL = {
-    approve: "Approve a plan", answer: "Answer a question", wrong: "Something went wrong", review: "Review results", other: "Needs you",
+    release: "Approve a release", approve: "Approve a plan", answer: "Answer a question", flow: "Flow decisions", wrong: "Something went wrong",
+    review: "Review results", setup: "Finish setting up", other: "Needs you",
 };
-/** "19 tasks need you": the heading, said once, from the same total as the rail's count. */
-export function homeSentence(needs, any) {
-    if (!any)
-        return "No tasks yet";
+/** The groups in Home's one order. */
+export const HOME_ASK_ORDER = ["release", "approve", "answer", "flow", "wrong", "review", "setup", "other"];
+/** "19 tasks need you", "3 tasks and 2 other things need you", "2 things need you": the heading, said once. Tasks
+ * are the same total as the rail's count; `others` are the rows that aren't tasks (a held publication, a flow card, a
+ * setup step). */
+export function homeSentence(needs, any, others = 0) {
+    const tasks = needs === 1 ? "1 task" : `${needs} tasks`;
+    if (others === 0)
+        return !any ? "No tasks yet" : needs === 0 ? "Nothing needs you" : `${tasks} ${needs === 1 ? "needs" : "need"} you`;
     if (needs === 0)
-        return "Nothing needs you";
-    return needs === 1 ? "1 task needs you" : `${needs} tasks need you`;
+        return others === 1 ? "1 thing needs you" : `${others} things need you`;
+    return `${tasks} and ${others} other ${others === 1 ? "thing" : "things"} need you`;
 }
 /** The lead's words as one plain line: no markdown marks, no line breaks, cut to about one line. */
 export function leadLineOf(text) {
@@ -38,7 +45,15 @@ export function leadLineOf(text) {
 export function startOfToday(now) {
     return new Date(now.getFullYear(), now.getMonth(), now.getDate());
 }
-function rowOf(store, item, now, multi, canAnswer, closedDoor, state) {
+function rowOf(store, item, now, multi, canAnswer, closedDoor, state, release) {
+    // A release (approvers): read on its own sheet, never approved here. Its line is its version, or why the sheet can't
+    // take a yes now; its one link opens the sheet.
+    if (state === "needs" && item.askGroup === "release" && release !== null) {
+        const href = releaseSheetHref(item.activeTaskId);
+        return { id: item.rootId, title: item.title, href, state, ask: "release", reason: null,
+            project: multi || item.repo === null ? (item.repo === null ? "Unplaced" : projectName(item.repo)) : null,
+            age: relativeAge(item.updatedAt, now), line: release(item.activeTaskId), action: { label: "Review the release", href }, question: null };
+    }
     const action = item.primaryAction;
     const href = action?.code === "open-result" && action.target.runId != null
         ? `/review?result=${encodeURIComponent(action.target.taskId)}&run=${action.target.runId}` : browserWorkActionHref(item);
@@ -50,7 +65,8 @@ function rowOf(store, item, now, multi, canAnswer, closedDoor, state) {
         id: decision.id, text: decision.question, recap: decision.recap,
         options: decision.options.map(option => ({ id: option.id, label: option.label, consequence: option.consequence, recommended: option.id === decision.recommendation })),
     } : null;
-    const ask = state === "needs" ? item.askGroup ?? "other" : null;
+    // Anyone else reads a release as the plan it is.
+    const ask = state === "needs" ? (item.askGroup === "release" ? "approve" : item.askGroup ?? "other") : null;
     const said = item.status.detail !== item.status.label ? item.status.detail : null;
     const line = state === "needs" && open ? decision.question : item.progress ?? said;
     // Only a row where something went wrong says why, in one short line.
@@ -101,21 +117,40 @@ export function homeView(facts) {
     const live = take(running.items, "running");
     const queued = take(waiting.items, "queued");
     const done = take(today.items, "completed");
-    const multi = project === null && new Set([...yours, ...live, ...queued, ...done].map(one => one.repo ?? "")).size > 1;
-    const row = (item, state) => rowOf(store, item, now, multi, facts.canAnswer, facts.closedDoor, state);
+    const approver = facts.approver ?? facts.canAnswer;
+    const asks = facts.asks ?? NO_HOME_ASKS;
+    // A held publication, a flow card and a setup step are an approver's alone (home-asks.ts reads them only for one).
+    const held = approver ? asks.held : [], flows = approver ? asks.flows : [];
+    // The builder step waits behind a task row that already asks for a builder: that row says it.
+    const setup = approver ? asks.setup.filter(one => one.key !== "builder" || needs.builderWaits === 0) : [];
+    const extra = [...held, ...flows, ...setup];
+    const multi = project === null && new Set([...yours, ...live, ...queued, ...done].map(one => one.repo ?? "").concat(extra.flatMap(one => one.repo === null ? [] : [one.repo]))).size > 1;
+    const row = (item, state) => rowOf(store, item, now, multi, facts.canAnswer, facts.closedDoor, state, approver ? asks.release : null);
     const rows = yours.map(one => row(one, "needs"));
-    // Each group's count is the work index's exact total for that ask, over every row in view, not only those listed.
-    const groups = WORK_ASK_GROUPS.flatMap(key => {
-        const count = needs.asks[key];
-        const listed = rows.filter(one => one.ask === key);
+    const askRow = (one, ask) => ({ id: one.id, title: one.title, href: one.href, state: "needs", ask, reason: null,
+        project: multi && one.repo !== null ? projectName(one.repo) : null, age: one.at === null ? "" : relativeAge(one.at, now), line: one.line, action: one.action, question: null });
+    // Each group's count is exact over every row in view, not only those listed: the work index's total for a task ask
+    // (a release counted once, in its own group for an approver and as a plan for anyone else), and every other row.
+    const askTotals = {
+        release: (approver ? needs.asks.release : 0) + held.length, approve: needs.asks.approve + (approver ? 0 : needs.asks.release), answer: needs.asks.answer,
+        flow: flows.length, wrong: needs.asks.wrong, review: needs.asks.review, setup: setup.length, other: needs.asks.other,
+    };
+    const listedOf = {
+        release: [...rows.filter(one => one.ask === "release"), ...held.map(one => askRow(one, "release"))], approve: rows.filter(one => one.ask === "approve"),
+        answer: rows.filter(one => one.ask === "answer"), flow: flows.map(one => askRow(one, "flow")), wrong: rows.filter(one => one.ask === "wrong"),
+        review: rows.filter(one => one.ask === "review"), setup: setup.map(one => askRow(one, "setup")), other: rows.filter(one => one.ask === "other"),
+    };
+    const groups = HOME_ASK_ORDER.flatMap(key => {
+        const count = askTotals[key], listed = listedOf[key];
         return count === 0 && listed.length === 0 ? [] : [{ key, label: HOME_ASK_LABEL[key], count: Math.max(count, listed.length), rows: listed }];
     });
+    const others = extra.length;
     const any = totals.all > 0 || totals.completed > 0 || (totals.archived ?? 0) > 0;
     const lead = facts.chat ? facts.leadMessage ?? null : null;
     const leadText = lead === null ? "" : leadLineOf(lead.text);
     return {
         kind: "home",
-        say: homeSentence(totals["needs-you"], any),
+        say: homeSentence(totals["needs-you"], any, others),
         project,
         scopes: facts.projects.length < 2 ? null : [
             { key: "", label: "All projects", href: "/", active: project === null },
@@ -127,6 +162,6 @@ export function homeView(facts) {
         newTask: "/tasks/new",
         ask: facts.chat ? { project, placeholder: "Message the lead" } : null,
         lastLead: lead === null || leadText === "" ? null : { text: leadText, age: relativeAge(lead.at, now), href: "/chat" },
-        empty: any ? null : { title: "No tasks yet", text: "Describe a change in a sentence; an agent writes a plan for you to approve." },
+        empty: any || others > 0 ? null : { title: "No tasks yet", text: "Describe a change in a sentence; an agent writes a plan for you to approve." },
     };
 }

package/dist/server/pages.js

@@ -11,7 +11,8 @@ import { realpathSync } from "node:fs";
 import {} from "node:http";
 import { homedir, hostname } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
-import { buildersFor } from "../dispatch.js";
+import { builderReadyFor, buildersFor, firstRunBuilderRepo } from "../dispatch.js";
+import { withBuilderStep } from "../first-run.js";
 import { listFolder, localOrigins } from "../folder-look.js";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
@@ -70,6 +71,7 @@ import { consentDoorOf, decisionAnswerScript, taskBody } from "./render-tasks.js
 import {} from "./session.js";
 import { rereadBrowser } from "./live.js";
 import { homeView } from "./home.js";
+import { flowAsks, releaseAsks, setupAsks } from "./home-asks.js";
 import { workIndexPage } from "../work-index.js";
 export function createPagesHandlers(runtime) {
     const { identities, clock, lastChecks, store, visible, consoleProjects, restricted, ceiling, options, projectFamilyPeek, sendScreen, chromeFor, unscopedMode, admissionList, taskRepoOf, taskViewData, runVisible, evidenceRoot, workAccess, identify, liveCeiling, sessions, deletedRepos, authenticateApprover, authenticateCredential, projectOf, lookupSession, firstRunStepsNow, chatEnablement, leadPrincipal, leadConversationRows } = runtime;
@@ -204,8 +206,9 @@ export function createPagesHandlers(runtime) {
             return door.open ? null : door;
         };
         const chat = chrome.chat === true;
-        const view = { ...homeView({ store, now, access: workAccess(), evidenceRoot, project, projects, chat, canAnswer: who.role === "approver", closedDoor,
-                leadMessage: chat ? leadLastMessage(who, now) : null }),
+        const access = workAccess(), approver = who.role === "approver";
+        const view = { ...homeView({ store, now, access, evidenceRoot, project, projects, chat, canAnswer: approver, approver, closedDoor,
+                leadMessage: chat ? leadLastMessage(who, now) : null, asks: homeAsksFor(who, access, now, project) }),
             // Until the first result: the welcome's three steps stay one link away.
             setup: firstRunStepsNow(now) !== null ? "/welcome" : null };
         return sendScreen(response, 200, screen("Home", html `<div data-kit-page><h1>Home</h1><p>${view.say}</p><p><a href="/tasks">Tasks</a></p></div>`, { chrome, workspace: { view } }));
@@ -1226,5 +1229,14 @@ export function createPagesHandlers(runtime) {
         const said = leadConversationRows(who, principal, null, now, null).messages.filter(one => one.role === "assistant" && one.pending !== true).at(-1);
         return said === undefined ? null : { text: said.text, at: said.createdAt };
     }
+    /** What else waits on this person at Home (home-asks.ts): releases and held publications in the work index's own
+     * access, flow cards in the projects this person may pick (the Flows list's admission, each flow's project re-checked
+     * against the account), and the first-run steps with the builder step as Chat reads them. Approvers only. */
+    function homeAsksFor(who, access, now, project) {
+        const approver = who.role === "approver";
+        const steps = withBuilderStep(firstRunStepsNow(now), builderReadyFor(store, firstRunBuilderRepo(store, project, visible, runtime.managedRepos()), now));
+        return { ...releaseAsks(store, now, access, project, approver), flows: flowAsks(store, consoleProjects(), { name: who.name, approver }, project),
+            setup: setupAsks(steps, approver) };
+    }
     return { registrations, projectsScreen };
 }

package/dist/server/remote.d.ts

@@ -12,6 +12,7 @@ import { type Who } from "./session.js";
 export interface RemoteRuntime {
     identify: (request: IncomingMessage, touch?: boolean, limited?: boolean, refusedToken?: {
         principal?: Principal;
+        elsewhere?: boolean;
     }) => Who | null;
     store: Store;
     admitPasswordSource: (request: IncomingMessage) => Admission;

package/dist/server/render-results.d.ts

@@ -247,6 +247,10 @@ export type ReviewCockpitView = {
         retry: {
             action: string;
             note: string;
+            pins?: {
+                run: number;
+                digest: string;
+            } | null;
         } | null;
         acceptAnyway?: {
             action: string;

package/dist/server/render-tasks.d.ts

@@ -513,6 +513,15 @@ export declare function taskBodyParts(data: {
         needsTwo: boolean;
     } | null;
     plan: "requested" | "drafted" | null;
+    /** Local-owner slice 2: the planning source this page read (local-owner-acts.ts planSourceOf), which the plan button
+     * posts so a local owner's request binds to exactly it. Null when it can't be read. */
+    planSource?: string | null;
+    /** Local-owner slice 3: the build and approved plan this page read (local-owner-acts.ts retryPinsOf), which Retry posts
+     * so a local owner's retry binds to exactly them. */
+    retryPins?: {
+        run: number;
+        digest: string;
+    } | null;
     planDocument: string | null;
     planAuto?: boolean;
     /** Hash of the verified plan artifact currently shown. */

package/dist/server/render-tasks.js

@@ -2096,9 +2096,9 @@ export function taskBodyParts(data) {
     // A failed task's status card carries Retry itself (the same requeue); here it would be a second ink act.
     const cardRetries = task.state === "failed" && data.assignment != null && data.csrf !== "";
     const primaryAct = stopControlsActive || cardRetries ? null : stalled && !data.claimed
-        ? { html: act("requeue", "Retry, keeping the branch and workspace"), why: "Clears the repeated failures and queues the task again. The branch and workspace are kept.", whyClass: "retry" }
+        ? { html: act("requeue", "Retry, keeping the branch and workspace", data.retryPins == null ? {} : { run: String(data.retryPins.run), digest: data.retryPins.digest }), why: "Clears the repeated failures and queues the task again. The branch and workspace are kept.", whyClass: "retry" }
         : canPlan
-            ? { html: act("plan", "plan first"), why: "plan first sends an agent to read the project, ask you questions and propose a plan. Nothing builds until you approve it.", whyClass: "plan" }
+            ? { html: act("plan", "plan first", data.planSource == null ? {} : { source: data.planSource }), why: "plan first sends an agent to read the project, ask you questions and propose a plan. Nothing builds until you approve it.", whyClass: "plan" }
             : data.plan === "requested"
                 ? null
                 : task.state === "queued" && !data.claimed && (data.position?.position ?? 1) > 1
@@ -2464,9 +2464,9 @@ export function taskBodyParts(data) {
     };
     // Build again, in place, names its form after the card's own act.
     const rebuild = data.csrf !== "" && data.assignment?.primaryAction?.code === "retry-task" && data.assignment.need != null && "key" in data.assignment.need && data.assignment.need.key === "rebuild"
-        ? { action: `${taskHref(data.assignment.rootId)}/requeue` } : null;
+        ? { action: `${taskHref(data.assignment.rootId)}/requeue`, pins: data.retryPins ?? null } : null;
     const retry = failedCard && task.state === "failed" && !data.claimed && !stopControlsActive && data.csrf !== ""
-        ? { action: `${taskHref(task.id)}/requeue`, ...(data.failure == null ? {} : { note: retryNoteOf(data.failure.suggestion) }) } : null;
+        ? { action: `${taskHref(task.id)}/requeue`, pins: data.retryPins ?? null, ...(data.failure == null ? {} : { note: retryNoteOf(data.failure.suggestion) }) } : null;
     // Run checks happens in place: a status row's Run checks posts here and comes back; with nothing to run, the row offers nothing.
     const runChecks = data.runChecks ?? null;
     // A row's link to a result in Chat opens that result's own page instead: Chat would only lead back here.

package/dist/server/route-table.js

@@ -79,6 +79,10 @@ const LOCAL_POSTS = Object.freeze({
     "task.act.resume-arm": "resume-run",
     "task.act.resume": "resume-run",
     "task.act.complete": "complete-task",
+    // Local-owner slice 2: the plan button, on its own road (tasks.ts localOwnerPlan; the writer checks this exact act).
+    "task.act.plan": "request-plan",
+    // Local-owner slice 3: Retry, on its own road (tasks.ts localOwnerRetry; the writer checks this exact act).
+    "task.act.requeue": "retry-build",
     "run.act.revise": "request-revision",
     "run.act.note": "request-revision",
     "run.act.comment": "request-revision",

package/dist/server/runtime.d.ts

@@ -92,6 +92,7 @@ export interface ServerRuntime {
     taskRooms: TaskRooms;
     identify: (request: IncomingMessage, touch?: boolean, limited?: boolean, refusedToken?: {
         principal?: Principal;
+        elsewhere?: boolean;
     }) => Who | null;
     liveCeiling: () => {
         repos: string[];

package/dist/server/task-views.js

@@ -25,6 +25,7 @@ import { assignmentOf } from '../assignment.js';
 import { knowledgeContextHtml } from "../knowledge-ui.js";
 import { failedAttemptSentence, failingCheckSuggestion, GENERAL_SUGGESTION, isInternalErrorReason, latestFinishedAttempt, missedRequirementLine, missedRequirementSuggestion, NO_REASON_RECORDED, stopSuggestionOf } from '../needs-you.js';
 import { planAutoPending } from "../plan-auto.js";
+import { planSourceOf, retryPinsOf } from "../local-owner-acts.js";
 import { readKnowledgeSnapshot } from "../project-knowledge.js";
 import { learningView } from "../project-learning.js";
 import { readSkillsSnapshot, skillTestResult } from "../project-skills.js";
@@ -384,6 +385,8 @@ export function createTaskViews(runtime) {
             })(),
             plan: ref?.plan ?? null,
             planAuto: planAutoPending(runtime.store, taskId, now),
+            planSource: planSourceOf(runtime.store, taskId),
+            retryPins: retryPinsOf(runtime.store, taskId),
             planDocument: planView?.document ?? null,
             planSha: planView?.sha256 ?? null,
             planContract: ref === null || planView === null ? null : planContractViewOf(ref.id, scope),

package/dist/server/tasks.d.ts

@@ -81,3 +81,28 @@ export type ApprovalOutcome = "approved" | "vote" | "approved-not-rebuilt" | "re
 /** The answer to an approval asked in place: its named outcome and the same words the page would show, as JSON. Written
  * only after the approve route's proofs, by the caller that knows the outcome. */
 export declare function answerApprovalInPlace(response: ServerResponse, outcome: ApprovalOutcome, words: string, status: number): void;
+/**
+ * The task page's plan button for the laptop's local owner (local-owner slice 2): bound to the planning source the page
+ * read (the form's hidden `source`), never the task as it is now; the writer (local-owner-acts.ts) proves the rest in one
+ * transaction. No mode pre-authorization and no pins: the full session's road above is never reached from here.
+ */
+export declare function localOwnerPlan(store: Store, taskId: string, source: string | null | undefined, now: Date): {
+    ok: true;
+} | {
+    ok: false;
+    status: number;
+    message: string;
+};
+/**
+ * Retry for the laptop's local owner (local-owner slice 3): bound to the build and the approved plan the page read (the
+ * form's hidden `run` and `digest`), never the task as it is now; the writer proves the rest in one transaction. A form
+ * that carries neither (an older page) is refused, never bound to whatever is current.
+ */
+export declare function localOwnerRetry(store: Store, taskId: string, run: string | null | undefined, digest: string | null | undefined, now: Date): {
+    ok: true;
+    replayed: boolean;
+} | {
+    ok: false;
+    status: number;
+    message: string;
+};