toolroll 0.9.103 → 0.9.105

package/dist/server/guards.js

@@ -15,17 +15,9 @@ import { requestContext } from "./request-context.js";
 import { refuse } from "./chrome.js";
 import { matchTaskPath } from "./http.js";
 import { PersistentSessions, SESSION_COOKIE, sessionWithinLifetime } from "./session.js";
+import { requestFromThisComputer } from "../public-access.js";
 export function createSharedGuards(runtime) {
     const syncIdentities = syncProjectIdentities();
-    // v99: wrong passwords. One address guessing across names runs out of tries here; each name
-    // locks on its own (sign-in-guard.ts), and every lock, whatever road it came by, is kept.
-    /**
-     * Every step-up in the console: a password typed now, or (an empty field) an explicit identity-provider re-check
-     * made on request and not yet spent, or — inside an allowlisted act only — a remembered password (cockpit B2,
-     * scope.ts proveAccountNow / freshnessFor, reading the request's live facts). Standing (an approver, with access to
-     * the project) is checked either way.
-     */
-    /** A credential act (docs/plans/passwordless.md): only a password typed now (or a one-use provider re-check) proves it. */
     function authenticateCredential(who, token, repo) {
         if (who.via !== "cookie")
             return { ok: false, reason: "not-an-approver" };
@@ -33,13 +25,10 @@ export function createSharedGuards(runtime) {
         return !proved.ok || credentialProof(proved.method) ? proved : { ok: false, reason: "not-an-approver" };
     }
     function authenticateApprover(who, token, repo) {
-        // Re-entering a password never upgrades a machine credential into a browser ceremony.
         if (who.via !== "cookie")
             return { ok: false, reason: "not-an-approver" };
         return checkApproverPassword(runtime.store, who.name, token, repo);
     }
-    // Native tools share the installation's login and can read beyond a project.
-    // Account project membership cannot provide an OS read boundary.
     function codingActorAllowed(actor) {
         return runtime.store.isInstanceOperator(actor.name) && runtime.store.accountOf(actor.name)?.generation === actor.generation;
     }
@@ -52,22 +41,11 @@ export function createSharedGuards(runtime) {
         return rowVisible(runtime.liveCeiling(), repo) && (actor === undefined || runtime.store.accountCanAccess(actor, repo));
     };
     function codingProjectAllowed(repo) { return runtime.codingProjects().includes(repo); }
-    /** The enumerable admission list for roll-up SQL: repos-only ceilings
-     * enumerate themselves; root ceilings enumerate the STORED repos that
-     * pass the ceiling (Codex roll-up review, finding 11); unscoped = null. */
     const admissionList = () => restricted() ? [...(runtime.store.accountOf(requestContext.getStore().actor)?.projects ?? [])].filter(visible) : runtime.unscopedMode
         ? null
         : [...new Set([...runtime.managedRepos(), ...(runtime.ceiling.roots.length === 0 ? [] : runtime.store.knownRepos().filter(visible))])];
-    /** The task behind a resource, for the ceiling check; null = no ref (visible). */
     const taskRepoOf = (taskRef) => runtime.store.refForId(taskRef)?.repo ?? null;
-    /**
-     * The one gate every POST passes — parse elsewhere, authorize here. A
-     * refusal names its status; null means proceed. Duplicated security fields
-     * are refused outright: two `csrf` values in one body is not a preference,
-     * it is a smuggling attempt.
-     */
     function authorizeMutation(request, who, body) {
-        // A read token never mutates, whatever its person's role (operate-remote.ts says the same to the remote CLI).
         if (who.via === "bearer") {
             if (who.principal !== undefined) {
                 const live = reproveRemote(runtime.store, who.principal, new Date());
@@ -91,12 +69,6 @@ export function createSharedGuards(runtime) {
             }
         }
         if (who.via === "cookie") {
-            // A PRESENT Origin must name this server. An ABSENT one is not a
-            // forgery: iOS Safari and some in-app browsers omit Origin on
-            // same-origin form posts, and refusing them locked the console on
-            // the operator's own phone. The per-session CSRF token below is the
-            // primary proof either way — a cross-site attacker can post, but
-            // cannot read the token to include it.
             const origin = request.headers.origin;
             const referer = request.headers.referer;
             const named = typeof origin === "string" && origin !== "null" ? origin : typeof referer === "string" ? referer : null;
@@ -106,14 +78,9 @@ export function createSharedGuards(runtime) {
             if (body.get("csrf") !== who.session.csrf) {
                 return { status: 403, message: "stale form — reload and try again" };
             }
-            // Easy-start C2: on a protected loopback install the CSRF token is rendered into pages any cookie holder can read,
-            // so a mutation also presents the session's key, which only this console's own origin holds.
             const keyed = runtime.browserKeys.check(who, request, body.sent);
             if (keyed !== null)
                 return keyed;
-            // Easy-start C1 (after the CSRF and key proofs, so a forged post learns nothing more): a local owner's session
-            // mutates only inside the console's admission of a row marked for it (which set the local owner this chain acts
-            // as), and only while that still stands; anywhere else it is refused.
             if (who.authority !== "full") {
                 const local = currentLocalOwner();
                 if (local === null || local.account !== who.name || !localOwnerStandsNow(runtime.store, local))
@@ -122,12 +89,6 @@ export function createSharedGuards(runtime) {
         }
         return null;
     }
-    /**
-     * The project a request views through — cookie sessions carry their open
-     * project; bearer callers may name one per request, constrained by the
-     * ceiling. Returns undefined when a named project is outside the ceiling:
-     * that is a refusal, not a fallback.
-     */
     function projectOf(who, request) {
         const fallback = () => restricted() ? admissionList()?.[0] ?? null : runtime.defaultProject;
         if (who.via === "cookie") {
@@ -135,7 +96,6 @@ export function createSharedGuards(runtime) {
             if (!restricted()) {
                 if (selected === null || visible(selected))
                     return selected;
-                // A saved selection can outlive the live ceiling, including its startup default.
                 const project = fallback();
                 return visible(project) ? project : null;
             }
@@ -146,16 +106,11 @@ export function createSharedGuards(runtime) {
             return fallback();
         if (Array.isArray(header))
             return undefined;
-        // A request's path, never resolved on this thread (project-identity.ts): a known identity or exactly a saved one.
         const canonical = identities().vouched(header, savedIdentities);
         if (canonical === undefined || !visible(canonical))
             return undefined;
         return canonical;
     }
-    /**
-     * What a project-limited account may do at this address: a projection of the route table's `limited` column
-     * (server/route-table.ts), never a hand-kept list. An address the table does not declare is instance-only.
-     */
     function resolveRouteProject(source, url, who, request, body) {
         const id = Number(url.pathname.split('/')[2]);
         const runRepo = (runId) => {
@@ -168,8 +123,6 @@ export function createSharedGuards(runtime) {
             case 'form': return body?.get('repo')?.trim() || projectOf(who, request) || null;
             case 'form-path': {
                 const path = body?.get('path')?.trim() ?? '';
-                // Invalid/missing paths keep the opener's existing 400 response and recoverable form.
-                // Never resolved here: an unknown path passes on to the opener, which resolves it off the thread and checks again.
                 return path === '' ? null : identities().vouched(path, savedIdentities) ?? null;
             }
             case 'task': {
@@ -213,8 +166,6 @@ export function createSharedGuards(runtime) {
             refuse(response, who, 403, "that project is outside this console's reach", "/projects");
             return false;
         }
-        // Shared coordination has its own complete audience/project admission.
-        // A person's open-project filter does not deny an explicitly scoped room.
         if (route?.limited === 'conversation' && request.method === 'GET' && who.via === 'cookie' && url.searchParams.get('private') !== '1' && ((!url.searchParams.has('task') && !url.searchParams.has('result')) || url.searchParams.has('conversation'))) {
             try {
                 const snapshot = runtime.team.domain.snapshot({ name: who.name, generation: who.session.generation }, url.searchParams.get('conversation') ?? undefined, url.searchParams.get('lead') ?? undefined);
@@ -226,8 +177,6 @@ export function createSharedGuards(runtime) {
                 return false;
             }
         }
-        // The person's own settings and saved objects (personal pairing, their chat-approval setting, their coding
-        // sessions): each route separately proves cookie, standing, password and every project it names.
         if (route?.limited === "self")
             return true;
         if (route?.limited === "proposal") {
@@ -239,17 +188,15 @@ export function createSharedGuards(runtime) {
                     if (access.conversation.projects.every(visible))
                         return true;
                 }
-                catch { /* The same scoped refusal below also covers revoked membership. */ }
+                catch { }
             }
             if (action && proposal && runtime.store.getLeadThread(proposal.thread)?.approver === who.name && visible(action.repo) && runtime.store.accountCanAccess(who.name, action.repo))
                 return true;
-            // A card about the person themselves (what their lead knows about them) is in no project.
             if (action && proposal && action.repo === '' && OWNER_ACTIONS.has(action.operation) && runtime.store.getLeadThread(proposal.thread)?.approver === who.name)
                 return true;
             refuse(response, who, 404, 'No such action in your projects.', '/projects');
             return false;
         }
-        // A task address whose id does not decode names no task.
         const undecodable = route?.project === "task" && matchTaskPath(path, "(?:/[a-z-]+)?$") === null;
         if (route === null || route.limited === "deny" || route.limited === "conversation" || undecodable) {
             refuse(response, who, 403, "This area requires instance access. Your account operates within its assigned projects.", "/projects");
@@ -261,8 +208,6 @@ export function createSharedGuards(runtime) {
                 return false;
             }
         }
-        // Every collection except the unscoped ones must have a concrete project;
-        // NULL otherwise means all rows in legacy store APIs.
         if (route.limited !== "unscoped" && !visible(projectOf(who, request) ?? null)) {
             refuse(response, who, 403, "No assigned project is available. Ask an instance operator for access.", "/projects");
             return false;
@@ -272,27 +217,22 @@ export function createSharedGuards(runtime) {
             if (url.searchParams.get("view") === "order")
                 url.searchParams.delete("view");
         }
-        // Tasks (P1.4) keeps the board's rule: the queue's order view stays an instance view, never a limited person's.
         if (route.id === "tasks" && url.searchParams.get("view") === "order")
             url.searchParams.set("view", "board");
         return true;
     }
     function workAccess() {
-        // The reader's own lead's claims read "<name> is on it" (lead-voice.ts); nobody else's.
         return { principal: 'operator', repos: admissionList(), includeUnplaced: visible(null), viewer: requestContext.getStore()?.actor ?? null };
     }
     function familyOf(taskId) {
         return runtime.store.taskFamilyOf(taskId, admissionList(), visible(null));
     }
-    // ---- identity ------------------------------------------------------------
     function identify(request, touch = true, limited = false, refusedToken) {
-        // v101: an API token. Wrong ones spend the address's tries like a wrong password; expired or revoked ones, and a removed account's, name no one.
         const presented = /^Bearer (so_\S+)$/.exec(request.headers.authorization ?? "")?.[1];
         if (presented !== undefined) {
             const source = runtime.joinSourceOf(request), at = Date.now();
             if (runtime.signInBudget.waitFor(source, at) > 0)
                 return null;
-            // The one credential check (api-tokens.ts): only a person's API token signs in here.
             const found = runtime.store.presentedCredential(presented);
             const kept = found?.kind === "person" ? runtime.store.apiTokenSecret(found.id) : null;
             if (kept === null) {
@@ -301,14 +241,11 @@ export function createSharedGuards(runtime) {
             }
             if (!tokenLive(kept.row, at))
                 return null;
-            // v111: a token limited to some projects signs in only where its limit travels with it (the remote CLI and MCP,
-            // through Principal.projects); the console's own pages and APIs check the account's access alone, so it is refused there.
             const account = runtime.store.accountOf(kept.row.account);
             if (account === null || account.revokedAt !== null)
                 return null;
             const principal = { kind: "person", account: kept.row.account, generation: account.generation, scope: kept.row.access, tokenId: kept.row.id,
                 projects: tokenProjects(tokenProjects(account.projects, kept.row.projects), oauthProjects(runtime.store, kept.row.id)) };
-            // Preserve proof only for a refusal and its admission charge. This never makes an OAuth token a console login.
             if (!oauthTokenAllowed(runtime.store, kept.row.id, new URL(request.url ?? "/", "http://placeholder").pathname, new Date(at)) ||
                 (kept.row.projects !== null && !limited)) {
                 if (refusedToken !== undefined)
@@ -320,7 +257,6 @@ export function createSharedGuards(runtime) {
         }
         const bearer = /^Bearer (.+):(.+)$/.exec(request.headers.authorization ?? "");
         if (bearer !== null) {
-            // A password on a request is a sign-in too: the same per-address tries and per-name lock.
             const source = runtime.joinSourceOf(request), at = Date.now();
             if (runtime.signInBudget.waitFor(source, at) > 0)
                 return null;
@@ -333,15 +269,15 @@ export function createSharedGuards(runtime) {
         const match = new RegExp(`(?:^|;\\s*)${SESSION_COOKIE}=([0-9a-f]{64})`).exec(cookies);
         if (match === null)
             return null;
-        const session = lookupSession(match[1], touch);
+        const found = lookupSession(match[1], false);
+        if (found !== null && found.authority !== "full" && !requestFromThisComputer(request)) {
+            if (refusedToken !== undefined)
+                refusedToken.elsewhere = true;
+            return null;
+        }
+        const session = touch && found !== null ? lookupSession(match[1], true) : found;
         return session === null ? null : { name: session.name, via: "cookie", session, role: session.role, authority: session.authority };
     }
-    /**
-     * Constant-time against the session table, small as it is — and every hit
-     * is re-proved against time and the approver's credential generation. A
-     * rotated credential kills its cookies the same way it kills its Telegram
-     * bindings: authority derived from the old secret does not outlive it.
-     */
     function lookupSession(candidate, touch = true) {
         const bytes = Buffer.from(candidate, "utf8");
         let found = null;
@@ -352,7 +288,6 @@ export function createSharedGuards(runtime) {
                 break;
             }
         }
-        // v101: not in memory, maybe from before a restart.
         if (found === null) {
             const loaded = runtime.sessions.load(candidate);
             if (loaded !== null)
@@ -368,13 +303,10 @@ export function createSharedGuards(runtime) {
                 runtime.sessions.delete(id);
                 return null;
             }
-            // v147: a local owner's session stands only while local mode is on, at the generation it was made under, for its
-            // owner. Off, moved or changed hands: the session is ended, never read as full.
             if (session.authority !== "full" && !localBindingStands(localModeOf(runtime.store), { account: session.name, localGeneration: session.localGeneration })) {
                 runtime.sessions.delete(id);
                 return null;
             }
-            // Ended in another process (or from Sessions): the cached copy is dropped, never used.
             if (!runtime.sessions.stillSaved(id)) {
                 Map.prototype.delete.call(runtime.sessions, id);
                 return null;
@@ -383,25 +315,16 @@ export function createSharedGuards(runtime) {
                 session.lastSeen = now;
                 runtime.sessions.persist(session, true);
             }
-            // A touch that found the session ended elsewhere dropped it: this request is not signed in by it.
             if (touch && !runtime.sessions.holds(session))
                 return null;
             return session;
         }
         return null;
     }
-    /**
-     * When this server is scoped to a repo, a run whose task belongs to a
-     * different repo does not exist here — its evidence may hold that other
-     * repo's diffs, and one console instance is one trust domain.
-     */
     function runVisible(run) {
         return visible(taskRepoOf(run.taskRef));
     }
-    // Defined last, so the reviewed functions above keep their places (password-freshness.test.ts).
-    /** Project identities read without touching a folder (project-identity.ts); absent: the synchronous reads. */
     function identities() { return runtime.identities ?? syncIdentities; }
-    /** The projects `up` proved and admitted (each its own identity): what a request may name without a read. */
     function savedIdentities() { return runtime.managedRepos(); }
     return { authenticateApprover, authenticateCredential, authorizeMutation, projectOf, resolveRouteProject, projectRequestAllowed, identify, lookupSession, restricted, visible, admissionList, codingActorAllowed, codingProjectAllowed, workAccess, familyOf, taskRepoOf, runVisible };
 }

package/dist/server/handler-registry.js

@@ -1,12 +1,10 @@
 import { ROUTES } from './route-table.js';
-/** One domain's handlers by route id: one function per row. */
 export function handlersOf(domain, console, edge = {}) {
     return [
         ...Object.entries(console).map(([id, handle]) => ({ id, domain, stage: 'console', handle })),
         ...Object.entries(edge).map(([id, handle]) => ({ id, domain, stage: 'edge', handle })),
     ];
 }
-/** Registrations are independent of policy. Missing, extra, incompatible or shared handlers fail at startup. */
 export function assertHandlerRegistry(registrations, routes = ROUTES) {
     const seen = new Set();
     const callbacks = new Map();

package/dist/server/home-asks.js

@@ -1,9 +1,3 @@
-/**
- * What else waits on a person at Home (docs/plans/home-other-asks.md): a release's line and a held publication, a flow
- * card waiting on them, and the first-run steps left to do. Reads only, each through the same admission as the page it
- * links to; nothing here acts: every row's one link opens its own page, whose own checks decide what this person may do
- * there. `homeView` (home.ts) assembles these with the work index's rows.
- */
 import { flowCardHref, flowDefinitionOf } from "../flow-engine.js";
 import { browserViewOf } from "../flow-browser.js";
 import { flowCardWaitsOn } from "../flows-ui.js";
@@ -12,11 +6,8 @@ import { autoPublishHeld, PUBLISH_ALLOWED_ACTION, PUBLISH_HELD_ACTION } from "..
 import { taskArchived } from "../task-archive.js";
 import { workStateRows } from "../work-index.js";
 export const NO_HOME_ASKS = { release: () => null, held: [], flows: [], setup: [] };
-/** The release sheet: where a release is read and approved, never Home. */
 export const releaseSheetHref = (taskId) => `/t/${encodeURIComponent(taskId)}/release`;
 const REVIEW_RELEASE = "Review the release";
-/** A release's line (its version, or the sheet's refusal) and every held publication in view. Approvers only: the sheet
- * mints its approval only for them; anyone else reads a release as an ordinary task row. */
 export function releaseAsks(store, now, access, project, approver) {
     if (!approver)
         return { release: () => null, held: [] };
@@ -25,8 +16,6 @@ export function releaseAsks(store, now, access, project, approver) {
         return ask === null ? null : ask.refusal ?? `Version ${ask.version} waits for your approval.`;
     };
     const shown = (repo) => (access.repos === null || access.repos.includes(repo)) && (project === null || repo === project);
-    // Only what is still held: the newest held-or-allowed act per task is the held one (release-auto.ts autoPublishHeld's
-    // own rule, read in one statement). Each is then a release this person may see in this scope, before anything heavier.
     const marked = store.handle.prepare(`SELECT a.task_id, a.at, a.detail FROM action_ledger a WHERE a.action = $held AND a.task_id IS NOT NULL
     AND a.id = (SELECT MAX(b.id) FROM action_ledger b WHERE b.task_id = a.task_id AND b.action IN ($held, $allowed)) ORDER BY a.at DESC, a.id DESC`)
         .all({ $held: PUBLISH_HELD_ACTION, $allowed: PUBLISH_ALLOWED_ACTION });
@@ -38,8 +27,6 @@ export function releaseAsks(store, now, access, project, approver) {
     });
     if (candidates.length === 0)
         return { release, held: [] };
-    // Every family in this person's view, read once (the Tasks list's own projection): a held release's family that is
-    // already a row that needs them (in any group) is not listed twice, and one the view doesn't admit is not listed.
     const familyOf = new Map();
     for (const family of workStateRows(store, now, access))
         for (const member of family.members)
@@ -56,8 +43,6 @@ export function releaseAsks(store, now, access, project, approver) {
     }
     return { release, held };
 }
-/** Every active card, in a flow of a project this person may see, that waits on them (flows-ui.ts flowCardWaitsOn, the
- * flow page's own rule). Newest wait first. */
 export function flowAsks(store, repos, viewer, project) {
     if (!viewer.approver)
         return [];
@@ -66,12 +51,10 @@ export function flowAsks(store, repos, viewer, project) {
         if (flow.state !== "active" || (project !== null && flow.repo !== project) || !store.accountCanAccess(viewer.name, flow.repo))
             continue;
         const stages = flowDefinitionOf(flow)?.stages ?? [];
-        // The flow's browser standing, read once and only when a card waits in a zone that starts a browser.
         let browser;
         for (const card of store.flowCards(flow.id, false)) {
             if (card.state !== "active")
                 continue;
-            // A card whose zone was removed still has its subagent's open question (the flow page still takes the answer).
             const stage = stages.find(one => one.id === card.stage);
             if (stage?.kind === "check" && stage.browser === true && browser === undefined)
                 browser = browserViewOf(store, flow);
@@ -79,7 +62,6 @@ export function flowAsks(store, repos, viewer, project) {
             if (!waits.decide && !waits.choose && !waits.answer && !waits.browser && !waits.reply)
                 continue;
             const asked = waits.answer ? store.openSubagentQuestionOn(card.id, card.entry)?.question ?? null : null;
-            // The card's own waiting words (a browser wait without the command the page offers as a button).
             const waiting = card.waiting?.replace(/ Approve it with: toolroll flows browser \d+ on$/, "") ?? null;
             const said = waiting ?? asked ?? (waits.choose ? "Waits for your choice." : "Waits for your decision.");
             const href = flowCardHref(flow.id, card.id);
@@ -90,11 +72,8 @@ export function flowAsks(store, repos, viewer, project) {
     return rows.sort((a, b) => (b.at ?? "").localeCompare(a.at ?? ""));
 }
 const SETUP_TITLES = {
-    agent: "Sign in to a coding agent", project: "Add a project", builder: "Connect a builder", task: "File your first task",
+    agent: "Sign in to a coding agent", project: "Add a project", builder: "Start taking work", task: "File your first task",
 };
-/** The first-run steps (first-run.ts, with the builder step) still to do, for an approver. A step that is done, or only
- * being checked (no answer yet, so no action), is not a row. Null steps (a restricted console, the demo, after the first
- * success) are none. */
 export function setupAsks(steps, approver) {
     if (steps === null || !approver)
         return [];

package/dist/server/home.js

@@ -5,23 +5,15 @@ import { workIndexPage } from "../work-index.js";
 import { oneLineOf, relativeAge } from "./chrome.js";
 import { taskHref } from "./http.js";
 import { NO_HOME_ASKS, releaseSheetHref } from "./home-asks.js";
-/** How many waiting rows Home lists; each group says how many more open in Tasks. */
 export const HOME_NEEDS_SHOWN = 30;
 const HOME_RUNNING_SHOWN = 8;
-/** How many rows finished today Home lists; its figure counts them all. */
 export const HOME_DONE_SHOWN = 8;
-/** About one line of the lead's last message. */
 const LEAD_LINE_LIMIT = 160;
-/** Each group's heading, in the order Home shows them. */
 export const HOME_ASK_LABEL = {
     release: "Approve a release", approve: "Approve a plan", answer: "Answer a question", flow: "Flow decisions", wrong: "Something went wrong",
     review: "Review results", setup: "Finish setting up", other: "Needs you",
 };
-/** The groups in Home's one order. */
 export const HOME_ASK_ORDER = ["release", "approve", "answer", "flow", "wrong", "review", "setup", "other"];
-/** "19 tasks need you", "3 tasks and 2 other things need you", "2 things need you": the heading, said once. Tasks
- * are the same total as the rail's count; `others` are the rows that aren't tasks (a held publication, a flow card, a
- * setup step). */
 export function homeSentence(needs, any, others = 0) {
     const tasks = needs === 1 ? "1 task" : `${needs} tasks`;
     if (others === 0)
@@ -30,7 +22,6 @@ export function homeSentence(needs, any, others = 0) {
         return others === 1 ? "1 thing needs you" : `${others} things need you`;
     return `${tasks} and ${others} other ${others === 1 ? "thing" : "things"} need you`;
 }
-/** The lead's words as one plain line: no markdown marks, no line breaks, cut to about one line. */
 export function leadLineOf(text) {
     const plain = text
         .replace(/```[\s\S]*?```/g, " ")
@@ -41,13 +32,10 @@ export function leadLineOf(text) {
         .replace(/(^|[\s(])[*_]([^*_\n]+)[*_](?=[\s).,!?:;]|$)/g, "$1$2");
     return oneLineOf(plain, LEAD_LINE_LIMIT);
 }
-/** Midnight today on this computer's clock: "finished today" starts here. */
 export function startOfToday(now) {
     return new Date(now.getFullYear(), now.getMonth(), now.getDate());
 }
 function rowOf(store, item, now, multi, canAnswer, closedDoor, state, release) {
-    // A release (approvers): read on its own sheet, never approved here. Its line is its version, or why the sheet can't
-    // take a yes now; its one link opens the sheet.
     if (state === "needs" && item.askGroup === "release" && release !== null) {
         const href = releaseSheetHref(item.activeTaskId);
         return { id: item.rootId, title: item.title, href, state, ask: "release", reason: null,
@@ -60,19 +48,14 @@ function rowOf(store, item, now, multi, canAnswer, closedDoor, state, release) {
     const decisionId = action?.target.decisionId ?? null;
     const decision = decisionId === null ? null : store.getDecision(decisionId);
     const open = decision !== null && decision.state === "open" && decision.supersededReason === null;
-    // An irreversible option is armed behind a confirmation on its own page; Home answers only what one click may.
     const question = state === "needs" && open && canAnswer && decision.options.every(option => option.reversible) ? {
         id: decision.id, text: decision.question, recap: decision.recap,
         options: decision.options.map(option => ({ id: option.id, label: option.label, consequence: option.consequence, recommended: option.id === decision.recommendation })),
     } : null;
-    // Anyone else reads a release as the plan it is.
     const ask = state === "needs" ? (item.askGroup === "release" ? "approve" : item.askGroup ?? "other") : null;
     const said = item.status.detail !== item.status.label ? item.status.detail : null;
     const line = state === "needs" && open ? decision.question : item.progress ?? said;
-    // Only a row where something went wrong says why, in one short line.
-    // With no reason on record, the row says what happened (its status) instead of a sentence about the missing reason.
     const reason = ask === "wrong" ? oneLineOf((said !== null && said !== NO_REASON_RECORDED ? said : item.status.label).replace(/[.\s]+$/, ""), 120) : null;
-    // A plan that can't take a yes never offers one: the reason, and the one act that opens it, as the task page says.
     const door = state === "needs" && action?.code === "approve-scope" ? closedDoor(action.target.taskId) : null;
     return {
         id: item.rootId, title: item.title, href: taskHref(item.rootId), state, ask, reason,
@@ -82,30 +65,22 @@ function rowOf(store, item, now, multi, canAnswer, closedDoor, state, release) {
             : href === null || action === null ? null : { label: action.label, href }, question,
     };
 }
-/** Home's view for one person and scope, from four reads of the work index: what waits on you (with exact per-ask
- * totals), what runs, what waits its turn, and what was completed today (filtered before its limit). */
 export function homeView(facts) {
     const { store, now, access, project } = facts;
     const read = (view, limit, completedSince) => workIndexPage(store, now, access, { view, limit, project, ...(completedSince === undefined ? {} : { completedSince }),
         ...(facts.evidenceRoot === undefined ? {} : { root: facts.evidenceRoot }) });
     const needs = read("needs-you", HOME_NEEDS_SHOWN);
     const running = read("running", HOME_RUNNING_SHOWN);
-    // Queued: what waits its turn, or what Toolroll or another task moves on, with no person asked.
     const waiting = read("queued", HOME_RUNNING_SHOWN);
-    // Done today: the Completed list from midnight on, filtered in the read itself, so the figure and the rows are
-    // what finished today however many there are.
     const today = read("completed", HOME_DONE_SHOWN, startOfToday(now).toISOString());
     const totals = needs.totals;
-    // Every project is said by name (scope=all): /tasks alone would narrow to the session's open project.
     const scopeQuery = project === null ? "scope=all&" : `project=${encodeURIComponent(project)}&`;
-    // Each figure keeps the list it opens.
     const counts = [
         { key: "needs", label: "Needs you", value: totals["needs-you"], href: `/tasks?${scopeQuery}view=needs-you` },
         { key: "running", label: "Running", value: totals.running, href: `/tasks?${scopeQuery}view=running` },
         { key: "queued", label: "Queued", value: totals.queued, href: `/tasks?${scopeQuery}view=queued` },
         { key: "finished", label: "Finished", value: totals.completed, href: `/tasks?${scopeQuery}view=completed` },
     ];
-    // One row per family, in the first list that claims it.
     const seen = new Set();
     const take = (items, view) => items.filter(one => {
         if (!one.status.views.includes(view) || seen.has(one.rootId))
@@ -119,9 +94,7 @@ export function homeView(facts) {
     const done = take(today.items, "completed");
     const approver = facts.approver ?? facts.canAnswer;
     const asks = facts.asks ?? NO_HOME_ASKS;
-    // A held publication, a flow card and a setup step are an approver's alone (home-asks.ts reads them only for one).
     const held = approver ? asks.held : [], flows = approver ? asks.flows : [];
-    // The builder step waits behind a task row that already asks for a builder: that row says it.
     const setup = approver ? asks.setup.filter(one => one.key !== "builder" || needs.builderWaits === 0) : [];
     const extra = [...held, ...flows, ...setup];
     const multi = project === null && new Set([...yours, ...live, ...queued, ...done].map(one => one.repo ?? "").concat(extra.flatMap(one => one.repo === null ? [] : [one.repo]))).size > 1;
@@ -129,8 +102,6 @@ export function homeView(facts) {
     const rows = yours.map(one => row(one, "needs"));
     const askRow = (one, ask) => ({ id: one.id, title: one.title, href: one.href, state: "needs", ask, reason: null,
         project: multi && one.repo !== null ? projectName(one.repo) : null, age: one.at === null ? "" : relativeAge(one.at, now), line: one.line, action: one.action, question: null });
-    // Each group's count is exact over every row in view, not only those listed: the work index's total for a task ask
-    // (a release counted once, in its own group for an approver and as a plan for anyone else), and every other row.
     const askTotals = {
         release: (approver ? needs.asks.release : 0) + held.length, approve: needs.asks.approve + (approver ? 0 : needs.asks.release), answer: needs.asks.answer,
         flow: flows.length, wrong: needs.asks.wrong, review: needs.asks.review, setup: setup.length, other: needs.asks.other,
@@ -160,7 +131,7 @@ export function homeView(facts) {
         working: [...live.map(one => row(one, "running")), ...queued.map(one => row(one, "queued"))],
         finishedToday: { count: Math.max(today.completedSince, done.length), rows: done.map(one => row(one, "done")), href: counts[3].href },
         newTask: "/tasks/new",
-        ask: facts.chat ? { project, placeholder: "Message the lead" } : null,
+        ask: facts.chat ? { project, placeholder: "Ask Toolroll" } : null,
         lastLead: lead === null || leadText === "" ? null : { text: leadText, age: relativeAge(lead.at, now), href: "/chat" },
         empty: any || others > 0 ? null : { title: "No tasks yet", text: "Describe a change in a sentence; an agent writes a plan for you to approve." },
     };