toolroll 0.9.103 → 0.9.105

package/dist/server/pages.js

@@ -1,3 +1,4 @@
+import { advancedShownNow } from "../advanced-view.js";
 import { projectOutcomes } from '../project-outcomes.js';
 import { steerControlsFor } from "../steer-controls.js";
 import { canReveal, cdCommandOf, localCheckoutOf } from "../checkout-proof.js";
@@ -5,7 +6,6 @@ import { instanceHttpAnswer } from "../console-instance.js";
 import { handlersOf } from './handler-registry.js';
 import { html, joinHtml, postForm, reauth } from "../html.js";
 import * as kit from "./kit.js";
-/** pages handlers, moved without changing their route bodies. */
 import { createHmac, randomBytes } from "node:crypto";
 import { realpathSync } from "node:fs";
 import {} from "node:http";
@@ -75,13 +75,6 @@ import { flowAsks, releaseAsks, setupAsks } from "./home-asks.js";
 import { workIndexPage } from "../work-index.js";
 export function createPagesHandlers(runtime) {
     const { identities, clock, lastChecks, store, visible, consoleProjects, restricted, ceiling, options, projectFamilyPeek, sendScreen, chromeFor, unscopedMode, admissionList, taskRepoOf, taskViewData, runVisible, evidenceRoot, workAccess, identify, liveCeiling, sessions, deletedRepos, authenticateApprover, authenticateCredential, projectOf, lookupSession, firstRunStepsNow, chatEnablement, leadPrincipal, leadConversationRows } = runtime;
-    // The filesystem browser (operator request): pick a project folder by
-    // looking, not typing. CONFINED to exactly what opening allows —
-    // explicit --repo mode has an enumerable list and gets no browser at
-    // all; --project-root mode browses its roots; unscoped mode (trust-
-    // everything, named as such) browses from the home directory.
-    // Directory NAMES only, never file contents; symlinks are resolved
-    // and re-checked so a link cannot walk out of the fence.
     async function projectsBrowse(ctx) {
         const { url, who, response } = ctx;
         if (who.via !== "cookie")
@@ -92,11 +85,9 @@ export function createPagesHandlers(runtime) {
         }
         const asked = url.searchParams.get("at") ?? browseRoots[0];
         const within = (path) => browseRoots.some(root => path === root || path.startsWith(`${root}/`));
-        // Spelled outside every root: refused before anything is read. Inside, the look resolves links and checks again.
         if (!within(resolve(asked))) {
             return refuse(response, who, 403, "that path is outside what this server may browse", "/projects/browse");
         }
-        // Read off the console's thread (folder-look.ts): a folder that doesn't answer never freezes the console.
         const looked = await listFolder(asked, browseRoots, { ...(options.folderLook === undefined ? {} : { runner: options.folderLook }), ...(options.folderLookMs === undefined ? {} : { deadlineMs: options.folderLookMs }) });
         if (!looked.ok) {
             return looked.why === "no-answer"
@@ -107,7 +98,6 @@ export function createPagesHandlers(runtime) {
         if (canonical === null || !within(canonical)) {
             return refuse(response, who, 403, "that path is outside what this server may browse", "/projects/browse");
         }
-        // The look kept only folders inside a root; checked here again, as before.
         const entries = looked.value.entries
             .filter(one => within(one.path))
             .sort((a, b) => Number(b.git) - Number(a.git) || a.name.localeCompare(b.name))
@@ -124,33 +114,16 @@ export function createPagesHandlers(runtime) {
             registered,
         }));
     }
-    // The signed-in gh account's repositories, OFFERED instead of typed
-    // (operator request): read-only listing through the same hardened gh
-    // runner onboarding uses, every identity re-parsed strictly, and each
-    // row carries exactly ONE honest action — open (already a project
-    // here), add (a clone under a root this server may serve, never yet
-    // opened), or the EXISTING preview-and-password clone ceremony.
-    // Approver only: a viewer has no business enumerating private
-    // repository names.
     async function projectsGithub(ctx) {
         const { who, response } = ctx;
         if (store.isDemo())
             return refuse(response, who, 403, "the sandbox never talks to GitHub");
-        // The last listing (docs/plans/get-side-effects.md): List repositories posts; opening the page asks GitHub nothing.
         const listed = lastChecks.known("github-repos")?.value ?? null;
-        // What this machine already has, matched by the clone's own recorded
-        // origin — registered projects first, then the immediate children of
-        // the configured roots. Identities are compared case-insensitively
-        // (GitHub's rule); the FIRST match wins.
         const localByIdentity = new Map();
         const registered = new Set();
         for (const project of store.listProjects())
             if (visible(project.path))
                 registered.add(project.path);
-        // Roots are walked ONLY when there are listed repos to match against
-        // (finding 1), at most 400 folders a root. Every read runs off the
-        // console's thread (folder-look.ts): a folder that doesn't answer
-        // leaves its copies unmatched and the page says so.
         const roots = listed !== null && listed.ok && listed.repos.length > 0 ? [...ceiling.roots] : [];
         let localUnanswered = false;
         if (registered.size > 0 || roots.length > 0) {
@@ -177,7 +150,6 @@ export function createPagesHandlers(runtime) {
             now: clock(),
         }));
     }
-    // List repositories / Refresh list: ask the GitHub CLI signed in on this machine, then show the page.
     async function projectsGithubList(ctx) {
         const { who, response } = ctx;
         if (store.isDemo())
@@ -189,15 +161,12 @@ export function createPagesHandlers(runtime) {
         const { url, who, response } = ctx;
         return void projectsScreen(response, who, url.searchParams.get("said"), 200, safeReturn(url.searchParams.get("return")), "said");
     }
-    // Home (UI revamp wave B): what needs this person, four counts that agree with the Tasks filters, and the lead's box.
-    // A token or a restricted session keeps landing on Tasks; a first run with nothing filed yet keeps its checklist in the chat.
     async function homeRedirect(ctx) {
         const { who, response, now, project } = ctx;
         if (who.via !== "cookie" || restricted())
             return redirect(response, "/tasks");
         if (firstRunStepsNow(now) !== null && !store.hasAnyWork())
             return redirect(response, "/chat");
-        // One scope for the page and the chrome around it: the project its address names (proved by the router), else all.
         const chrome = chromeFor(project, "none");
         const projects = chrome.projects ?? [];
         const closedDoor = (taskId) => {
@@ -209,12 +178,9 @@ export function createPagesHandlers(runtime) {
         const access = workAccess(), approver = who.role === "approver";
         const view = { ...homeView({ store, now, access, evidenceRoot, project, projects, chat, canAnswer: approver, approver, closedDoor,
                 leadMessage: chat ? leadLastMessage(who, now) : null, asks: homeAsksFor(who, access, now, project) }),
-            // Until the first result: the welcome's three steps stay one link away.
             setup: firstRunStepsNow(now) !== null ? "/welcome" : null };
         return sendScreen(response, 200, screen("Home", html `<div data-kit-page><h1>Home</h1><p>${view.say}</p><p><a href="/tasks">Tasks</a></p></div>`, { chrome, workspace: { view } }));
     }
-    // Search (UI revamp wave B): the ⌘K menu's "See all results". The places come from the page; the tasks here are the
-    // most recent ones in view (live and archived), matched on their title and id. Reads only.
     async function searchPage(ctx) {
         const { url, response, now } = ctx;
         const q = (url.searchParams.get("q") ?? "").replace(/[\p{Cc}\p{Cf}]/gu, " ").trim().slice(0, 200);
@@ -236,8 +202,6 @@ export function createPagesHandlers(runtime) {
         const view = { kind: "search", q, tasks, truncated: live.nextCursor !== null || archived.nextCursor !== null };
         return sendScreen(response, 200, screen("Search", html `<div data-kit-page><h1>Search</h1><form action="/search"><input type="search" name="q" value="${q}" aria-label="Search"></form></div>`, { chrome: chromeFor(null, "none"), workspace: { view } }));
     }
-    // The board's old name; bookmarks keep working. A GET-only alias, so a
-    // plain 302 — never the shared 303 helper, which belongs to POST landings.
     async function morningAlias(ctx) {
         const { response } = ctx;
         response.writeHead(302, { ...SAFETY, Location: "/" });
@@ -254,15 +218,11 @@ export function createPagesHandlers(runtime) {
         const before = url.searchParams.get("before");
         if (before !== null && (!/^[1-9][0-9]{0,14}$/.test(before) || !Number.isSafeInteger(Number(before))))
             return refuse(response, who, 400, "Invalid ledger cursor.", "/ledger");
-        // Events that belong to no project (sign-ins, accounts, installation policy) are an instance operator's to read.
         const query = { repos: chosen === "" ? admitted : [chosen], instance: chosen === "" && store.isInstanceOperator(who.name),
             actor: (url.searchParams.get("actor") ?? "").slice(0, 200), outcome: (url.searchParams.get("outcome") ?? "").slice(0, 100),
             source: url.searchParams.get("source") ?? "", taskId: (url.searchParams.get("task") ?? "").slice(0, 200) };
         if (url.searchParams.get("format") === "csv") {
             const generation = store.accountOf(who.name)?.generation;
-            // Descending immutable IDs pin the export at its first read; later
-            // arrivals cannot duplicate or extend it. Yield between bounded pages
-            // and honor backpressure/disconnects, so exports cannot fill memory.
             const first = store.actionLedger({ ...query, limit: 100 });
             async function* chunks() {
                 yield LEDGER_CSV_HEADER;
@@ -276,11 +236,10 @@ export function createPagesHandlers(runtime) {
                     const cursor = page.at(-1).id;
                     await yieldEventLoop();
                     const next = store.actionLedger({ ...query, before: cursor, limit: 100 });
-                    // Pages only ever move to older entries; one that doesn't is the end.
                     page = next.length > 0 && next[0].id < cursor ? next : [];
                 }
             }
-            response.writeHead(200, { "content-type": "text/csv; charset=utf-8", "content-disposition": 'attachment; filename="standing-orders-actions.csv"', "cache-control": "no-store", "x-content-type-options": "nosniff" });
+            response.writeHead(200, { "content-type": "text/csv; charset=utf-8", "content-disposition": 'attachment; filename="toolroll-actions.csv"', "cache-control": "no-store", "x-content-type-options": "nosniff" });
             try {
                 await pipeline(Readable.from(chunks()), response);
             }
@@ -289,7 +248,6 @@ export function createPagesHandlers(runtime) {
             }
             return;
         }
-        // v103: the chain is sealed and checked before it's shown; an operator sees the checkpoint to copy off the machine.
         const report = store.ledgerChain();
         const operator = who.via === "cookie" && store.isInstanceOperator(who.name);
         const latest = store.ledgerCheckpoints(1)[0] ?? null;
@@ -300,27 +258,21 @@ export function createPagesHandlers(runtime) {
             return respond(response, 200, "application/json; charset=utf-8", JSON.stringify(checkResponse("ledgerPage", { chain: { ok: report.ok, entries: report.entries, through: report.through, head: report.head, problem: report.problem }, entries: rows.slice(0, 50), nextBefore: rows.length > 50 ? rows[49].id : null })));
         return sendScreen(response, 200, screen("Audit log", ledgerBody(rows, projects, url.searchParams, chainView), { chrome: chromeFor(chosen === "" ? null : chosen, "ledger", undefined, chosen === "" ? "all" : "project") }));
     }
-    // The activity summary lives on Home now (UI revamp wave B); the old address keeps answering, as a GET alias.
     async function activityPage(ctx) {
         const { response } = ctx;
         response.writeHead(302, { ...SAFETY, Location: "/" });
         response.end();
         return;
     }
-    // A GET-only alias, a plain 302 (like morningAlias): an old address lands on the part of Agents that took it over.
     const aliasTo = (location) => async (ctx) => {
         ctx.response.writeHead(302, { ...SAFETY, Location: location });
         ctx.response.end();
     };
-    // System became part of Agents (UI revamp wave B): the model per phase and the computers that build.
     const systemScreen = aliasTo("/agents#models");
-    // Terminals live on their own page (/term, its own bundle); the Agents area's address for them leads there.
     const agentsTerminals = aliasTo("/term");
-    // Peek became the Agents board: one place to check on every running agent (agents-board.ts).
     async function peekPage(ctx) {
         return redirect(ctx.response, "/agents");
     }
-    /** What the board says after a Reply or a steer, in fixed words (never text from the address). */
     const AGENT_SAID = {
         replied: { tone: "info", text: "Reply sent. The agent reads it at its next check." },
         steered: { tone: "info", text: "Note sent. It shows in the conversation with whether the agent has read it." },
@@ -343,12 +295,6 @@ export function createPagesHandlers(runtime) {
         "reveal-mac-only": { tone: "error", text: "Show in Finder works on a Mac. Copy the command instead." },
         "reveal-failed": { tone: "error", text: "Finder didn't show it. The path is above; copy the command instead." },
     };
-    /**
-     * The opened agent's head (docs/plans/one-page-task-and-agent.md): its task's status in the task page's own words and
-     * that status's one action as a link to the task page tab holding its form, and where this run opens there — a
-     * result (the shared predicate: a finished builder or scout run) on the Result tab at this run, a plan on the Plan
-     * tab, anything else on its record.
-     */
     function agentTaskHeadOf(taskId, runId, live, access, now) {
         const family = store.taskFamilyOf(taskId, access.repos, access.includeUnplaced);
         const root = family?.root.id ?? taskId;
@@ -364,7 +310,6 @@ export function createPagesHandlers(runtime) {
             if (assignment !== null) {
                 const words = assignmentTaskStatusOf(assignment);
                 const wants = words.primaryAction?.href ?? "";
-                // A result to review is on the Result tab; everything else the task page heads with (the approval, a retry…).
                 const href = /^\/review\?result=|[?&]result=/.test(wants) ? `${taskHref(root)}?tab=result` : taskHref(root);
                 task = { headline: words.headline, sentence: words.sentence, tone: words.tone, action: { label: words.primaryAction?.label ?? "Open task", href } };
             }
@@ -374,23 +319,18 @@ export function createPagesHandlers(runtime) {
         }
         return { task, open };
     }
-    /** After a retire: fixed words naming a computer the store knows as retired (never text from the address). */
     function retiredSaid(name) {
         if (name === null)
             return null;
         const known = store.listRunners().find(one => one.name === name && one.retiredAt !== null);
         return known === undefined ? null : { tone: "info", text: `${known.name} is retired. It takes no more work; tasks reserved for it wait until you move them.` };
     }
-    // The Agents board (one place to check on running agents): rows by state, and the opened agent's live view.
     async function agentsPage(ctx) {
         const { url, who, response, project } = ctx;
         const now = clock();
         const access = workAccess();
         const asked = url.searchParams.get("run");
-        // The Live grid only watches (docs/plans/agents-view.md §3): it branches off before an opened agent is built, so
-        // viewing it never marks a run seen, takes a watch or offers a composer — a reload of ?view=live&run=… included.
         const watching = url.searchParams.get("view") === "live";
-        // Live is a browser session's only, like its reads (no token sees the grid).
         if (watching && who.via !== "cookie")
             return respond(response, 403, "text/plain; charset=utf-8", "The Live view is for a signed-in browser.");
         let selected = null;
@@ -398,49 +338,38 @@ export function createPagesHandlers(runtime) {
             const run = store.getRun(Number(asked));
             const facts = run === null || !runVisible(run) ? null : agentFactsFor(store, run.id, access, who.name);
             if (facts !== null) {
-                // Opening a finished agent is viewing it: the shell says so with a keyed POST /agents/seen (easy-start N1: a page
-                // load never writes), which leaves this person's unread Done.
                 const live = facts.outcome === null;
                 const composer = live ? steerControlsFor(store, facts.taskId, facts.runId, now, who.role === "approver") : null;
                 const sealed = live ? null : sealedDiffOf(store, evidenceRoot, facts.runId);
-                // A reply's own word first; otherwise the note that the agent asked past the questions cap.
                 const said = AGENT_SAID[url.searchParams.get("said") ?? ""] ?? (facts.questionNote === null ? null : { tone: "info", text: facts.questionNote });
                 selected = {
                     ...agentRowOf(store, facts, now, evidenceRoot), live,
                     question: live && facts.question !== null ? { ...facts.question, action: `${taskHref(facts.taskId)}/reply` } : null,
-                    // The conversation's window: its notes answer anywhere; its transcript only from the machine that runs it (the window says so).
                     transcript: `/r/${facts.runId}?fragment=transcript&shape=records`,
-                    // The live look at its checkout needs this machine's runner — the one running it — and pool, as the run page's does.
                     peek: live && options.localRunner !== undefined && run.runner === options.localRunner && options.poolRoot !== undefined ? `/r/${facts.runId}?fragment=peek` : null,
                     files: (sealed?.files ?? []).slice(0, 30).map(one => ({ path: one.path, added: one.additions, removed: one.deletions })),
                     filesMore: Math.max(0, (sealed?.fileCount ?? 0) - 30),
-                    // A note goes only to an attempt that reads notes (steer-controls.ts); the composer says what it takes.
                     steer: composer?.steer ?? null,
                     controls: composer?.controls ?? null,
                     checkout: (() => {
                         if (!live || who.role !== "approver" || store.isDemo())
                             return null;
                         const proof = localCheckoutOf(store, facts.runId, { runner: options.localRunner, poolRoot: options.poolRoot }, now);
-                        // Show in Finder only where it can work (a Mac); elsewhere the path and the command stand alone.
                         return proof.ok ? { path: proof.path, cd: cdCommandOf(proof.path), reveal: canReveal(options.revealPath !== undefined) ? `/r/${facts.runId}/reveal` : null } : null;
                     })(),
                     canAct: who.role === "approver" && !store.isDemo(),
                     taskHref: taskHref(facts.taskId),
-                    // The run's own address: a finished result opens on its result page, anything else on its record.
                     resultHref: live ? null : `/r/${facts.runId}`,
                     ...agentTaskHeadOf(facts.taskId, facts.runId, live, access, now),
                     room: `agent:${facts.runId}`, said,
                 };
             }
         }
-        // The Live grid is drawn in the browser from its own read-only reads (agents-live-view.tsx): no board facts here.
         if (watching) {
             const view = { kind: "agents", groups: [], selected: null, lanes: null, empty: null, live: true };
             return sendScreen(response, 200, screen("Agents", html `<h1>Agents</h1><p class="meta">Live needs JavaScript.</p>`, { chrome: chromeFor(project, "runs"), workspace: { view } }));
         }
         const groups = agentsListOf(store, now, access, who.name, evidenceRoot);
-        // The installation's parts (what /fleet and /system showed) are for a person with access to all of it, as those
-        // pages were; a project-limited person sees their own agents only.
         const installation = !restricted();
         const windowAsked = url.searchParams.get("window");
         const view = { kind: "agents", groups, selected, lanes: null,
@@ -460,12 +389,9 @@ export function createPagesHandlers(runtime) {
                 ...group.rows.map(row => html `<p class="row"><a href="${row.href}"><strong>${row.title}</strong></a> <span class="meta">${[row.label, row.line].filter(Boolean).join(" \u00b7 ")}</span></p>`),
             ], "\n")), "\n"),
         ], "\n");
-        // The list reads itself while something builds, as /system did (forms being edited are kept); an opened agent
-        // follows its own room instead.
         const refreshSeconds = selected !== null ? undefined : store.liveClaims(null, now).length > 0 ? 10 : installation ? 60 : undefined;
         return sendScreen(response, 200, screen("Agents", fallback, { chrome: chromeFor(project, "runs"), workspace: { view }, ...(refreshSeconds === undefined ? {} : { refreshSeconds }) }));
     }
-    // Fleet became the computers on Agents (UI revamp wave B): register, retire, reserved work and notes are there.
     const fleetPage = aliasTo("/agents#computers");
     async function ledgerExport(ctx) {
         const { url, who, request, response, now } = ctx;
@@ -478,8 +404,6 @@ export function createPagesHandlers(runtime) {
         const access = workAccess();
         store.recordAction({ at: now.toISOString(), actor: who.name, repo: null, taskId: null, runId: null, action: "ledger exported", outcome: "exported", source: "access",
             detail: `${from.slice(0, 10)} to ${last.slice(0, 10)}` });
-        // A piece at a time (a page of entries, or one pack), yielding between them, and stopping if the reader's access
-        // changes: their account, and the session or API token they came with (read without writing anything).
         const generation = store.accountOf(who.name)?.generation;
         const tokenId = who.via === "bearer" && who.token !== undefined ? parseApiToken(/^Bearer (so_\S+)$/.exec(request.headers.authorization ?? "")?.[1] ?? "")?.id ?? null : null;
         const stillLive = () => {
@@ -493,7 +417,6 @@ export function createPagesHandlers(runtime) {
             const token = store.apiTokenSecret(tokenId)?.row;
             return token !== undefined && tokenLive(token, Date.now());
         };
-        // The whole walk it starts from is shared by exports in the same minute; a reader who stops reading for a minute is let go.
         const pieces = ledgerExportChunks(store, { from, to }, { repos: access.repos, instance: store.isInstanceOperator(who.name) }, access, who.name, now, evidenceRoot);
         async function* chunks() {
             for (const piece of pieces) {
@@ -504,7 +427,7 @@ export function createPagesHandlers(runtime) {
             }
         }
         response.setTimeout(60_000, () => response.destroy());
-        response.writeHead(200, { "content-type": "application/json; charset=utf-8", "content-disposition": `attachment; filename="standing-orders-audit-${from.slice(0, 10)}-to-${last.slice(0, 10)}.json"`,
+        response.writeHead(200, { "content-type": "application/json; charset=utf-8", "content-disposition": `attachment; filename="toolroll-audit-${from.slice(0, 10)}-to-${last.slice(0, 10)}.json"`,
             "cache-control": "no-store", "x-content-type-options": "nosniff" });
         try {
             await pipeline(Readable.from(chunks()), response);
@@ -516,15 +439,11 @@ export function createPagesHandlers(runtime) {
     }
     async function menuPage(ctx) {
         const { response, project } = ctx;
-        // The phone's overflow drawer as an honest page: every destination
-        // the tab bar does not carry, one tap away, no JavaScript — grouped
-        // under the same workflows/admin headings as the rail's accordion,
-        // with settings last, outside both.
         const chrome = chromeFor(project, "menu");
         const section = (label, rows) => html `<h2 class="menu-group-label">${label}</h2><div class="menu-list">${joinHtml(rows.map(row => html `<a class="menu-row" href="${row.href}"><strong>${row.label}</strong><span class="meta">${row.hint}</span></a>`), "\n")}</div>`;
         return sendScreen(response, 200, screen("Workspace tools", joinHtml([
-            section("Work tools", workToolRows(chrome.projectScoped, chrome.chat, chrome.code)),
-            section("Settings", settingsRows(chrome.projectScoped, chrome.settings)),
+            section("Work tools", workToolRows(chrome.projectScoped, chrome.chat, chrome.code, advancedShownNow())),
+            section("Settings", settingsRows(chrome.projectScoped, chrome.settings, advancedShownNow())),
         ], "\n"), { chrome }));
     }
     async function capsScreen(ctx) {
@@ -537,14 +456,11 @@ export function createPagesHandlers(runtime) {
     async function health(ctx) {
         const { request, response } = ctx;
         const health = store.telemetry.snapshot();
-        // Beside /healthz, for an instance operator: where the slowest recent console answers spent their time (route ids
-        // and milestones only).
         const slow = slowRequestLines(store);
         return request.headers.accept?.includes('application/json')
             ? respond(response, 200, 'application/json; charset=utf-8', JSON.stringify({ ...health, slowRequests: slow }))
             : respond(response, 200, 'text/plain; charset=utf-8', `${healthWords(health)}\n${slow.length === 0 ? "" : `\nSlow console requests (over ${SLOW_REQUEST_MS} ms), newest first:\n${slow.join("\n")}\n`}`);
     }
-    // v104: Prometheus metrics, for an instance operator (a scraper sends one's API token).
     async function metrics(ctx) {
         const { response, now } = ctx;
         response.writeHead(200, { "content-type": "text/plain; version=0.0.4; charset=utf-8", "cache-control": "no-store", "x-content-type-options": "nosniff" });
@@ -566,15 +482,10 @@ export function createPagesHandlers(runtime) {
     async function projectsSelect(ctx) {
         const { who, response, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.projectsSelect);
-        // Session-only project switching (E2): reads the registry, writes
-        // ONLY session.project — the durable upsert lives in /projects/open,
-        // which stays an approver's act. This is the one project verb a
-        // viewer may use.
         if (who.via !== "cookie") {
             return refuse(response, who, 403, "selecting a project is a browser session's act");
         }
         const askedPath = (body.get("path") ?? "").trim();
-        // Resolved off the console's thread (project-identity.ts): a folder that doesn't answer is said, never waited on.
         const decidedOn = identities.generation();
         const picked = askedPath === "" ? null : await identities.resolveNow(askedPath);
         if (picked === "no-answer")
@@ -583,7 +494,6 @@ export function createPagesHandlers(runtime) {
         if ((askedPath !== "" && canonicalPick === null) || (canonicalPick !== null && (!visible(canonicalPick) || !(await authorizedProject(liveCeiling(), canonicalPick))))) {
             return refuse(response, who, 403, "that project is outside this console's reach");
         }
-        // An identity that changed during the awaits above undoes what they proved.
         if (identities.generation() !== decidedOn)
             return refuse(response, who, 409, "a project folder changed while this was being checked — try again");
         who.session.project = canonicalPick;
@@ -594,8 +504,6 @@ export function createPagesHandlers(runtime) {
     async function projectsRemove(ctx) {
         const { who, response, posted, now } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.projectsRemove);
-        // The reversible remove: off every list and the builder; tasks, results and settings stay. Deleting is
-        // Settings → Project → Delete project. The same admission code as `repos remove` (project-admission.ts).
         const repo = body.get("repo") ?? "";
         if (!consoleProjects().includes(repo))
             return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
@@ -613,8 +521,6 @@ export function createPagesHandlers(runtime) {
     async function projectsOpen(ctx) {
         const { who, response, posted, now } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.projectsOpen);
-        // Sessions only: a bearer caller names its project per request and has
-        // no session to mutate — refusing here keeps that boundary legible.
         if (who.via !== "cookie") {
             return refuse(response, who, 403, "opening a project is a browser session's act");
         }
@@ -628,54 +534,35 @@ export function createPagesHandlers(runtime) {
         if (canonical === null) {
             return void projectsScreen(response, who, "that path does not exist on this server", 400, safeReturn(body.get("return")), "open");
         }
-        // Authorization is the ceiling, then the path must actually be a git
-        // repository — validation with direct argv and a bound, never a shell.
-        // Both checks apply even to configured repos: naming a directory in
-        // config authorizes it; only being a repository makes it openable.
         if (!(await authorizedProject(liveCeiling(), canonical))) {
             return void projectsScreen(response, who, "that path is outside what this server was configured to serve", 403, safeReturn(body.get("return")), "open");
         }
         if (!(await isGitRepo(canonical))) {
             return void projectsScreen(response, who, "that path is not a git repository", 400, safeReturn(body.get("return")), "open");
         }
-        // An account limited to listed projects never widens its own list.
         if (!visible(canonical)) {
             return void projectsScreen(response, who, "That project is outside your access.", 403, safeReturn(body.get("return")), "open");
         }
-        // An identity that changed during the awaits above undoes what they proved.
         if (identities.generation() !== decidedOn)
             return void projectsScreen(response, who, "a project folder changed while this was being checked — try again", 409, safeReturn(body.get("return")), "open");
-        // Opening an allowed repository admits it the same way `repos add` does
-        // (project-admission.ts). A co-located `up` notices the durable list and
-        // connects its builder; there is no separate restart or binding step.
-        // The admission asks again, inside its registry lock and its transaction, about the repo it proves.
         const stillAllowed = (repo) => identities.generation() === decidedOn && visible(repo);
         const admitted = await admitProject(store, { registryFile: options.registryPath ?? null, path: canonical, actor: { label: who.name, origin: "console" }, now, stillAllowed, resolveFolder: identities.resolveNow });
         if (!admitted.ok) {
             return void projectsScreen(response, who, admitted.reason === "not-git" ? "that path is not a git repository" : `that project is valid, but it could not be added — ${admitted.message}`, admitted.reason === "moved" ? 409 : 400, safeReturn(body.get("return")), "open");
         }
-        // And once more before the session follows it.
         if (!stillAllowed(admitted.repo))
             return void projectsScreen(response, who, "a project folder changed while this was being checked — try again", 409, safeReturn(body.get("return")), "open");
         deletedRepos.delete(admitted.repo);
         who.session.project = admitted.repo;
         who.session.projectRevision++;
-        // The switcher (board pass) opens a project from any screen and
-        // returns there — a same-site path only, never an off-site road.
         return redirect(response, safeReturn(body.get("return")));
     }
-    // Runner lifecycle, brought in from the terminal behind the same
-    // password step-up the console uses for every other credential-grade
-    // act. Register mints a token that is shown ONCE and stored only as a
-    // hash — the page that shows it renders no self-refreshing script, so
-    // the token is never re-rendered.
     async function fleetRegister(ctx) {
         const { who, request, response, posted, now } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.runnerRegister);
         if (who.via !== "cookie")
             return refuse(response, who, 403, "runner registration is a browser surface");
         const token = body.get("token") ?? "";
-        // A worker credential is minted here: a credential act, a password typed now even with Passwordless on.
         if (!authenticateCredential(who, token).ok) {
             return refuse(response, who, 403, "registering a worker takes your password, typed again", "/agents#computers");
         }
@@ -688,16 +575,12 @@ export function createPagesHandlers(runtime) {
             return refuse(response, who, 400, "capacity is a whole number of tasks, 1 to 64", "/agents#computers");
         }
         const { token: minted } = registerRunner(store, { name, host: hostname(), capacity, now });
-        // A kit reading page (UI revamp wave B), back to the computers on Agents. The token is text to select: a Copy
-        // button would need a script, and this page carries none.
         const tokenScreen = screen("fleet", html `<div data-kit-page>${kit.phoneHeader("Computer registered", { back: "/agents#computers" })}${kit.doc(kit.docHeader({ title: `${name} is registered`, back: ["/agents#computers", "Agents"], same: true, meta: html `Takes up to ${capacity} ${capacity === 1 ? "task" : "tasks"} at a time` }), kit.slots({
             status: html `<h2>Its token, shown once</h2>`,
             text: "Only a hash is kept, so copy it now.",
             acts: html `<code class="k-code" data-runner-token>${minted}</code>`,
             terms: "Keep it beside the computer, in a file only you can read (0600) or a secrets manager. If it's lost, register the name again; its old claims are taken back.",
-        }), kit.acts(kit.btn("Back to Agents", { href: "/agents#computers" })))}</div>`, 
-        // A one-time secret on screen: no script of any kind rides along.
-        { chrome: chromeFor(projectOf(who, request) ?? null, "fleet"), forceSensitive: true });
+        }), kit.acts(kit.btn("Back to Agents", { href: "/agents#computers" })))}</div>`, { chrome: chromeFor(projectOf(who, request) ?? null, "fleet"), forceSensitive: true });
         return sendScreen(response, 200, tokenScreen);
     }
     async function fleetRetire(ctx) {
@@ -713,14 +596,11 @@ export function createPagesHandlers(runtime) {
         const retired = store.retireRunner(name, now);
         if (!retired)
             return refuse(response, who, 404, `no worker \`${name}\``, "/agents#computers");
-        // Agents says it in fixed words, naming the computer only once the store knows it as retired (retiredSaid).
         return redirect(response, `/agents?retired=${encodeURIComponent(name)}#computers`);
     }
     async function onboardPreview(ctx) {
         const { who, response, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.onboard);
-        // Repo onboarding (findings 1-39): bearer and demo refuse BEFORE any
-        // gh call; the console flow exists only on root-configured serves.
         if (who.via !== "cookie")
             return refuse(response, who, 403, "adding repositories is a browser session's act");
         if (store.isDemo())
@@ -732,7 +612,6 @@ export function createPagesHandlers(runtime) {
         const shape = parseGithubRepo(body.get("repo") ?? "");
         if (!shape.ok)
             return projectsScreen(response, who, shape.problem, 400, "/", "link");
-        // Roots by INDEX (finding 13) — a posted path is never accepted.
         const rootIndex = Number(body.get("root") ?? "0");
         const rootRaw = Number.isInteger(rootIndex) ? ceiling.roots[rootIndex] : undefined;
         if (rootRaw === undefined)
@@ -746,16 +625,12 @@ export function createPagesHandlers(runtime) {
         const reparsed = parseGithubRepo(previewed.preview.nameWithOwner);
         if (!reparsed.ok)
             return projectsScreen(response, who, "GitHub named a repository shape this console refuses", 400, "/", "link");
-        // The hook boundary is NORMALIZED like the real preview would be
-        // (verification finding 2): a size that is not a nonnegative finite
-        // number is unknown, and unknown is LARGE.
         const diskUsageKib = typeof previewed.preview.diskUsageKib === "number" && Number.isFinite(previewed.preview.diskUsageKib) && previewed.preview.diskUsageKib >= 0
             ? previewed.preview.diskUsageKib
             : null;
         const target = join(root, reparsed.name);
         if (dirname(target) !== root)
             return projectsScreen(response, who, "the target escaped its root — refused", 400, "/", "link");
-        // The session-held record (finding 14): swept at mint, capped 3.
         const session = who.session;
         session.onboard ??= new Map();
         const cutoff = Date.now() - 10 * 60_000;
@@ -778,8 +653,6 @@ export function createPagesHandlers(runtime) {
     async function onboardConfirm(ctx) {
         const { who, request, response, posted, now } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.onboard);
-        // Repo onboarding (findings 1-39): bearer and demo refuse BEFORE any
-        // gh call; the console flow exists only on root-configured serves.
         if (who.via !== "cookie")
             return refuse(response, who, 403, "adding repositories is a browser session's act");
         if (store.isDemo())
@@ -788,12 +661,6 @@ export function createPagesHandlers(runtime) {
             return refuse(response, who, 403, "adding from GitHub is not supported on Windows yet");
         if (ceiling.roots.length === 0)
             return projectsScreen(response, who, "naming where repositories live takes --project-root", 400, "/", "clone");
-        // CONFIRM: password, then session liveness AGAIN via lookupSession
-        // (finding 22/33) — the record is consumed from the RETURNED live
-        // session, synchronously, before the first await. A full session types
-        // its password (or Passwordless stands in); a laptop's local owner has
-        // none: inside this row's add-project admission the prover's local-owner
-        // branch proves it (scope.ts proveAccountNow), whatever the field holds.
         const password = body.get("token") ?? "";
         if (!authenticateApprover(who, password).ok) {
             return projectsScreen(response, who, "cloning takes your password, typed again", 403, "/", "clone");
@@ -808,8 +675,7 @@ export function createPagesHandlers(runtime) {
             live.onboard?.delete(nonce);
             return projectsScreen(response, who, "that preview expired or was already used — preview again", 400, "/", "clone");
         }
-        live.onboard?.delete(nonce); // consumed BEFORE the first await
-        // Identities as this confirmation found them: the admission below re-checks against them (project-identity.ts).
+        live.onboard?.delete(nonce);
         const decidedOn = identities.generation();
         if (record.large && body.get("big-ok") !== "1") {
             return projectsScreen(response, who, "that repository is large (or its size is unknown) — tick the box to clone it anyway", 400, "/", "clone");
@@ -828,13 +694,9 @@ export function createPagesHandlers(runtime) {
         });
         if (!cloned.ok)
             return projectsScreen(response, who, cloned.message, 400, "/", "clone");
-        // The clone answer is BOUND to the record's exact target (verification
-        // finding 2): whatever produced it — the real primitive or a test
-        // hook — an answer naming any other path never enrolls or opens.
         if (cloned.target !== record.target) {
             return projectsScreen(response, who, "the clone answered with a different path than the preview promised — refused; nothing was enrolled", 400, "/", "clone");
         }
-        // authorizedProject AFTER the repository exists (finding 20).
         const clonedAt = await identities.resolveNow(cloned.target);
         const admitted = typeof clonedAt === "string" && clonedAt !== "no-answer" && (await authorizedProject(liveCeiling(), clonedAt)) ? clonedAt : null;
         if (admitted === null) {
@@ -854,15 +716,6 @@ export function createPagesHandlers(runtime) {
             ? `${projectName(admitted)} is ready — the builder is connecting automatically`
             : `${admitted} is ready and open`, 200, "/", "said");
     }
-    /**
-     * The opener: every project inside the ceiling, most recently opened
-     * first, plus repos the queue has seen — shown only when the ceiling
-     * admits them — and an open-by-path field validated server-side. A
-     * registry row never confers access; this page only offers what the
-     * server was configured to allow.
-     */
-    /** The projects this person may open: the registered ones they can see, most recently opened first, then the
-     * configured ones the queue has seen. A registry row never confers access. */
     function visibleProjects() {
         const recent = store.listProjects().filter(one => visible(one.path));
         const recentPaths = new Set(recent.map(one => one.path));
@@ -874,7 +727,6 @@ export function createPagesHandlers(runtime) {
         }
         return { recent, candidates: [...candidates] };
     }
-    /** A cheap peek per project: one small set of COUNTs, scoped to the exact repo. */
     function peekOf(path, now) {
         try {
             return projectFamilyPeek(path, now);
@@ -887,9 +739,6 @@ export function createPagesHandlers(runtime) {
         const now = clock();
         const { recent, candidates } = visibleProjects();
         const open = who.via === "cookie" ? who.session.project : null;
-        // Onboarding availability (findings 2/28/32/39): a cookie session on a
-        // root-configured, non-demo, POSIX serve gets the live card; everybody
-        // else gets the card DISABLED with the reason in words.
         const onboardState = restricted() || who.via !== "cookie"
             ? { enabled: false, why: "An instance operator adds projects." }
             : store.isDemo()
@@ -914,10 +763,6 @@ export function createPagesHandlers(runtime) {
             browsable: !restricted() && (ceiling.roots.length > 0 || unscopedMode),
         }));
     }
-    /** One project's reading page (/projects/<name>). A GET only reads (docs/plans/get-side-effects.md): it never
-     * switches the session's project; its Open project button posts to /projects/select, which proves it again. The
-     * name is found among the projects this person may open (projectsSelect's rule: visible here and inside the
-     * ceiling); a name it can't see answers exactly like one that doesn't exist. */
     async function projectFound(ctx, page) {
         const { url, who, response } = ctx;
         let name = "";
@@ -941,7 +786,6 @@ export function createPagesHandlers(runtime) {
         }
         return { ...found, ambiguous: named.length > 1 };
     }
-    /** A project's flaky tests list and one row's history. Reads only; found exactly as the project's page is. */
     async function projectFlakyHandler(ctx) {
         const { url, who, response, now } = ctx;
         const found = await projectFound(ctx, "flaky");
@@ -968,7 +812,6 @@ export function createPagesHandlers(runtime) {
             return;
         const open = who.via === "cookie" ? who.session.project : null;
         const path = found.path;
-        // The tasks that wait on this person or run, from the board's own classification, scoped to this one project.
         const snapshot = store.boardScoped(path, now, 200, null);
         const cards = snapshot.tasks
             .filter(facts => facts.repo === path)
@@ -996,7 +839,6 @@ export function createPagesHandlers(runtime) {
             activity, now,
         }));
     }
-    /** The named project's code map address, for this account; null when it isn't one they can see. */
     async function mapProject(ctx, suffix) {
         let name = "";
         try {
@@ -1046,7 +888,6 @@ export function createPagesHandlers(runtime) {
         const secret = options.instanceSecret?.() ?? null;
         if (secret === null)
             return respond(response, 404, "application/json; charset=utf-8", JSON.stringify({ error: "not-up" }));
-        // Bound to what THIS console saw as the receiving end of this very connection — never the Host header.
         const answer = instanceHttpAnswer(secret, url.searchParams.getAll("c").length === 1 ? url.searchParams.get("c") : null, { address: request.socket.localAddress, port: request.socket.localPort });
         response.setHeader("Cache-Control", "no-store");
         return respond(response, answer.status, "application/json; charset=utf-8", answer.body);
@@ -1061,7 +902,6 @@ export function createPagesHandlers(runtime) {
     }
     async function workspaceStyle(ctx) {
         const { request, response, url } = ctx;
-        // Only the current build's hash is served; any other hash is no asset.
         if (url.pathname !== WORKSPACE_STYLE.path)
             return respond(response, 404, 'text/plain; charset=utf-8', 'No such address.');
         return WORKSPACE_STYLE.serve(request, response);
@@ -1085,41 +925,27 @@ export function createPagesHandlers(runtime) {
         response.setHeader("cache-control", "no-store");
         return respond(response, 200, "application/json", JSON.stringify({ proof: createHmac("sha256", Buffer.from(identity, "hex")).update(challenge).digest("hex") }));
     }
-    // The Live grid (docs/plans/agents-view.md §3), kept after every other handler.
-    /** The Live grid's tiles (JSON, read-only): every role's running agents and those that just ended, that this viewer
-     * may see — the console's ceiling and the account's own access, proved per run, on every request. */
     async function agentsLive(ctx) {
         const { who, request, response } = ctx;
         response.setHeader("cache-control", "no-store");
-        // A browser session only (the route says so too): live output is never a token's to read.
         if (who.via !== "cookie")
             return respond(response, 403, "application/json", JSON.stringify({ error: "session" }));
         const browser = who;
         const canSee = (run) => { const repo = taskRepoOf(run.taskRef); return repo !== null && visible(repo) && store.accountCanAccess(who.name, repo); };
         const tiles = agentsLiveOf(store, clock(), { canSee, localRunner: options.localRunner });
-        // The viewer's own lead turns, admitted as their chat is, from the session as it is saved now.
         const current = rereadBrowser(runtime, request, browser);
         const leads = current === null ? [] : leadTilesFor(runtime, current);
-        // Re-proved right before delivery: the session still held, each tile's run still in view from its current row, and
-        // each lead turn still admitted, from the session as it is saved now.
         const again = current === null ? null : rereadBrowser(runtime, request, browser);
         if (again === null)
             return respond(response, 401, "application/json", JSON.stringify({ error: "session" }));
         const shown = tiles.filter(tile => { const run = store.getRun(tile.runId); return run !== null && canSee(run); });
-        // Work the viewer's own lead filed nests under it (docs/plans/lead-dispatched-tiles.md): proved from the store now,
-        // for the tiles already shown, and only ever for their owner.
         const filed = again.role === "approver" ? leadFiledLinks(store, again.name, shown.map(tile => tile.runId)) : new Map();
         return respond(response, 200, "application/json", JSON.stringify({ tiles: shown.map(tile => ({ ...tile, filedBy: filed.get(tile.runId) ?? null })), leads: leadsStillAdmitted(runtime, again, leads) }));
     }
-    /** This console's key for the Live grid's read cursors: random, in memory only (never where a build can reach), so a
-     * restart makes old cursors start over visibly. A cursor is state, never permission. */
     const liveCursorKey = randomBytes(32);
-    /** One window of a run's live output for the Live grid (JSON, read-only): its own records or its subagents'. Access
-     * is proved before the read (ceiling, account, this computer's run) and again after it, before a byte is sent. */
     async function agentsLiveRead(ctx) {
         const { url, who, response } = ctx;
         response.setHeader("cache-control", "no-store");
-        // A browser session only (the route says so too): live output is never a token's to read.
         if (who.via !== "cookie")
             return respond(response, 403, "application/json", JSON.stringify({ error: "session" }));
         const runId = Number(url.pathname.slice("/agents/live/".length));
@@ -1129,7 +955,6 @@ export function createPagesHandlers(runtime) {
             return respond(response, 400, "application/json", JSON.stringify({ error: "request" }));
         }
         const browser = who;
-        // The saved session still held (not just the cookie), and the run still in view from its current row.
         const allowed = () => {
             if (rereadBrowser(runtime, ctx.request, browser) === null)
                 return false;
@@ -1144,17 +969,12 @@ export function createPagesHandlers(runtime) {
         }
         const read = { key: liveCursorKey, commands: runLiveCommands(store, runId) };
         const window = file === "sub" ? readChildWindow(evidenceRoot, runId, cursor, read) : readMainWindow(evidenceRoot, runId, cursor, read);
-        // Re-proved after the read: a narrowed account or a run gone from view gets nothing it read.
         if (!allowed() || store.getRun(runId)?.runner !== options.localRunner)
             return respond(response, 404, "application/json", JSON.stringify({ error: "run" }));
         return respond(response, 200, "application/json", JSON.stringify(window.ok ? window : { error: window.reason }));
     }
-    /** Start a builder (Settings revamp S4): the command, and whether a builder that may build the open project is
-     * checking in, as dispatch decides. Read-only; a project-limited person sees only a project they may see. */
     async function startBuilderPage(ctx) {
         const { response, now, project, url, who } = ctx;
-        // ?task=<id>: that task's own saved project (a builder there, as dispatch decides for it), never the open one; the
-        // session's selection is left alone. Unknown, unplaced or not visible to this person: 404, the same answer.
         const taskId = url.searchParams.get("task");
         const ref = taskId === null ? null : store.lookupRef(taskId.slice(0, 200));
         if (taskId !== null && (ref === null || ref.repo === null || !visible(ref.repo)))
@@ -1210,11 +1030,6 @@ export function createPagesHandlers(runtime) {
         "edge.font": fontAsset,
         "edge.desktop-health": desktopHealth,
     });
-    /** The lead's last message in this person's main thread, for Home's one line above the message box. The thread is
-     * read only through the gate a docked conversation uses (serve.ts dockedConversation): an approver in a browser
-     * session, chat enabled, the approver's standing re-proved now (leadPrincipal), their lead session under the current
-     * ceiling and generation; and then through leadConversationRows, the very rows /chat renders, which keep only a thread
-     * under this person's current ceiling. Null at any refusal, and when the lead has said nothing yet. */
     function leadLastMessage(who, now) {
         if (who.role !== "approver")
             return null;
@@ -1229,9 +1044,6 @@ export function createPagesHandlers(runtime) {
         const said = leadConversationRows(who, principal, null, now, null).messages.filter(one => one.role === "assistant" && one.pending !== true).at(-1);
         return said === undefined ? null : { text: said.text, at: said.createdAt };
     }
-    /** What else waits on this person at Home (home-asks.ts): releases and held publications in the work index's own
-     * access, flow cards in the projects this person may pick (the Flows list's admission, each flow's project re-checked
-     * against the account), and the first-run steps with the builder step as Chat reads them. Approvers only. */
     function homeAsksFor(who, access, now, project) {
         const approver = who.role === "approver";
         const steps = withBuilderStep(firstRunStepsNow(now), builderReadyFor(store, firstRunBuilderRepo(store, project, visible, runtime.managedRepos()), now));