toolroll 0.9.104 → 0.9.105

package/dist/server/request-context.js

@@ -1,17 +1,10 @@
-/** What one console request knows about itself, readable anywhere below its handler. */
 import { AsyncLocalStorage } from "node:async_hooks";
+import { provideAdvancedShown } from "../advanced-view.js";
 import { provideFormToken, providePasswordless } from "../html.js";
-/**
- * The request's own session facts, readable from anywhere below the
- * dispatcher without threading them through forty call sites: the csrf
- * token every POST form carries, and the path a switch returns
- * to. AsyncLocalStorage follows the request's own async chain, so two
- * interleaved requests never read each other's token.
- */
 export const requestContext = new AsyncLocalStorage();
 provideFormToken(() => requestContext.getStore()?.csrf);
 providePasswordless(() => requestContext.getStore()?.passwordless === true);
-/** Run a render outside a live request (a test, a background render) as if a browser session with this token asked. */
+provideAdvancedShown(() => requestContext.getStore()?.advanced !== false);
 export function withFormToken(csrf, render) {
     const facts = requestContext.getStore();
     return requestContext.run({ ...(facts ?? { returnTo: "/" }), csrf }, render);

package/dist/server/retired-routes.js

@@ -1,5 +1,4 @@
 import { SAFETY } from "./http.js";
-/** The Tasks page's own address for a view, a project and the other keys it knows. */
 export function tasksHref(over = {}) {
     const q = new URLSearchParams();
     if (over.scope === "all")
@@ -14,35 +13,25 @@ export function tasksHref(over = {}) {
         q.set("cursor", over.cursor);
     return `/tasks${q.size === 0 ? "" : `?${q}`}`;
 }
-/** The one project a link names (one `project` key, never two), or null. */
 const projectOf = (url) => url.searchParams.getAll("project").length === 1 ? url.searchParams.get("project") : null;
-/** The Tasks list views an old link may name, as /tasks names them. */
 const LIST_VIEWS = { all: "all", "needs-you": "needs-you", running: "running", queued: "queued", completed: "completed", done: "completed", archived: "archived", ready: "ready" };
-/** Each retired GET row (route-table.ts `retired`), and where it now lives. */
 export const RETIRED_ROUTES = {
-    // The old Tasks list: its view, project, stored-state filter and page; layout=board is the Board view; all=1 every project.
     work: url => {
         const board = url.searchParams.get("layout") === "board";
         const view = board ? "board" : LIST_VIEWS[url.searchParams.get("view") ?? ""] ?? null;
         const all = url.searchParams.get("all") === "1";
         return tasksHref({ view, scope: all ? "all" : null, project: all ? null : projectOf(url), state: board ? null : url.searchParams.get("state"), cursor: board ? null : url.searchParams.get("cursor") });
     },
-    // The old inbox and its triage flow: Home holds what needs you.
     inbox: url => { const project = projectOf(url); return project === null ? "/" : `/?project=${encodeURIComponent(project)}`; },
     next: url => { const project = projectOf(url); return project === null ? "/" : `/?project=${encodeURIComponent(project)}`; },
-    // The portfolio: Tasks across every project.
     workbench: () => tasksHref({ scope: "all" }),
-    // The old board: the Board view, or its order view.
     board: url => url.searchParams.get("view") === "order" ? tasksHref({ view: "order", project: projectOf(url) })
         : url.searchParams.get("scope") === "all" ? tasksHref({ view: "board", scope: "all" }) : tasksHref({ view: "board", project: projectOf(url) }),
     queue: url => tasksHref({ view: "order", project: projectOf(url) }),
     done: url => tasksHref({ view: "done", project: projectOf(url) }),
-    // The old review list (a result keeps its own page: /review?result=…).
     review: url => tasksHref({ view: "ready", project: projectOf(url) }),
-    // Archive old tasks' preview moved beside Tasks; its POST keeps /work/put-away exactly.
     "work.put-away": url => { const days = url.searchParams.get("days"); return days !== null && /^[0-9]{1,3}$/.test(days) ? `/tasks/archive?days=${days}` : "/tasks/archive"; },
 };
-/** A retired GET's answer: 301 to where it lives now. Permanent: the old address never comes back. */
 export function retiredRedirect(id, url, response) {
     const to = RETIRED_ROUTES[id];
     if (to === undefined)

package/dist/server/route-policy.js

@@ -1,5 +1,4 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
-/** The row supplies the minimum capability and the project resolver. Passwords/nonces are re-proved by the handler. */
 export function evaluateRoutePolicy(route, principal, resolve, operationScope) {
     if (!route.callers.includes(principal.caller))
         return { ok: false, status: 403, reason: 'caller' };
@@ -15,12 +14,10 @@ export function evaluateRoutePolicy(route, principal, resolve, operationScope) {
         return { ok: false, status: 403, reason: 'project' };
     return { ok: true };
 }
-/** The dispatcher matches once; protocol authentication then checks the same row before operation dispatch. */
 const edgePolicy = new AsyncLocalStorage();
 export function withEdgePolicy(route, run) { return edgePolicy.run({ route }, run); }
 export function adapterPolicy(principal, scope, resolve = source => source === 'none' || source === 'adapter') {
     const context = edgePolicy.getStore();
-    // Standalone protocol adapters retain their own authoritative admission checks.
     if (context === undefined)
         return { ok: true };
     const checked = evaluateRoutePolicy(context.route, { ...principal, caller: context.caller ?? principal.caller }, resolve, scope);

package/dist/server/route-table.js

@@ -1,25 +1,6 @@
-/**
- * THE ROUTE TABLE: every address this server answers, in one ordered list.
- *
- * Each row declares its method, its exact pattern, which callers may reach it,
- * the scope it needs, how its project is found, and what a project-limited
- * account may do there. The server matches a request against this table before
- * any handler runs; a request no row declares is refused (fail closed). The
- * scattered allowlists that used to repeat these facts by hand (the limited
- * account's read/write sets, the viewer's POST set, the selected-project
- * exceptions) are projections of this table.
- *
- * A row's `role` says who among its admitted callers may use it (an approver,
- * or an instance operator), with the words a caller without it hears. Every
- * row has exactly one handler (handler-registry.ts); handlers do not re-match
- * paths or restate these checks. They still re-prove what can change after
- * admission: passwords, nonces, webhook signatures, object membership, stale
- * sessions and revoked tokens.
- */
 const CONSOLE = ["cookie", "bearer"];
 const exact = (path) => `^${path.replace(/[.*+?^${}()|[\]\\/]/g, m => (m === "/" ? "\\/" : `\\${m}`))}$`;
 const sampleOf = (pattern) => {
-    // Literal patterns sample themselves; others must name a sample.
     if (!/^\^[^()[\]?*+{}|]*\$$/.test(pattern.replace(/\\[./-]/g, "")))
         throw new Error(`route ${pattern} needs a sample`);
     return pattern.slice(1, -1).replace(/\\(.)/g, "$1");
@@ -49,10 +30,6 @@ function row(stage, domain, id, method, pattern, options = {}) {
         ...localMarkOf(stage, method, id),
     });
 }
-// ---- easy-start C1: the local owner's marks --------------------------------------------------------------------------
-// Decided here for every row, failing the table's load for an edge row nobody decided. A console POST is refused to a
-// local owner unless LOCAL_POSTS names its act; a console GET is a read (`read`) unless LOCAL_GET_DENY names it.
-/** The console POST rows a local owner may use, and the act each is. Everything else is refused. */
 const LOCAL_POSTS = Object.freeze({
     "tasks.add": "file-task",
     "tasks.fast": "build-now",
@@ -63,7 +40,6 @@ const LOCAL_POSTS = Object.freeze({
     "chat.mate-follow": "lead-send",
     "chat.mate-end": "lead-send",
     "chat.mate-stop": "lead-send",
-    // The confirm door narrows the act to the card's own (lead-doors.ts: LOCAL_OWNER_PROPOSALS and the operation's act).
     "chat.proposal.confirm": "lead-send",
     "chat.proposal.dismiss": "lead-send",
     "task.act.steer": "lead-send",
@@ -79,9 +55,7 @@ const LOCAL_POSTS = Object.freeze({
     "task.act.resume-arm": "resume-run",
     "task.act.resume": "resume-run",
     "task.act.complete": "complete-task",
-    // Local-owner slice 2: the plan button, on its own road (tasks.ts localOwnerPlan; the writer checks this exact act).
     "task.act.plan": "request-plan",
-    // Local-owner slice 3: Retry, on its own road (tasks.ts localOwnerRetry; the writer checks this exact act).
     "task.act.requeue": "retry-build",
     "run.act.revise": "request-revision",
     "run.act.note": "request-revision",
@@ -92,30 +66,21 @@ const LOCAL_POSTS = Object.freeze({
     "projects.github-list": "add-project",
     "projects.onboard-preview": "add-project",
     "projects.onboard-confirm": "add-project",
-    // The welcome's sample project, added the way Projects adds a folder (the same admission and its re-check).
     "welcome.sample": "add-project",
-    // The welcome's "Use this one" (and Settings → Lead's turn-on): the lead runs on Claude Code or Codex signed in here.
     "settings.lead-on": "choose-default-agent",
-    // Choosing which open project the pages show: a view filter, never authorization.
     "projects.select": "read",
-    // On or off for one project: it moves no money, permission or approval (code-map-acts.ts re-checks this exact act).
     "settings.code-map": "code-map-switch",
-    // Results routing: lowering only.
     "settings.models-turn-off": "routing-turn-off",
     "settings.models-not-now": "dismiss-suggestion",
     "settings.models-suggest-off": "dismiss-suggestion",
     "settings.models-stop": "trial-stop",
-    // Learning loops (D3): a person at the laptop decides lesson notes and clean-ups of project memory.
     "settings.knowledge-note": "memory-review",
     "settings.knowledge-tidy": "memory-review",
+    "settings.advanced": "view-preference",
     "agents.seen": "mark-seen",
     "agents.watch": "watch-agent",
 });
-/** Console GET rows refused to a local owner (none so far: every GET is a read; adapter-inventory.test.ts proves no GET
- * writes beyond the allowlisted session touch and review nonce). */
 const LOCAL_GET_DENY = new Set([]);
-/** Every edge row, decided: allow where a local owner's cookie may reach it, deny where its adapter refuses one (or no
- * cookie is ever read there). A new edge row fails the table's load until it is listed here. */
 export const EDGE_LOCAL = Object.freeze({
     "edge.healthz": { local: "allow", why: "public read" },
     "edge.instance": { local: "allow", why: "public read (the CLI proves the console)" },
@@ -168,7 +133,6 @@ function localMarkOf(stage, method, id) {
     const act = Object.prototype.hasOwnProperty.call(LOCAL_POSTS, id) ? LOCAL_POSTS[id] : null;
     return act === null ? { local: "deny", localAct: null } : { local: "allow", localAct: act };
 }
-/** The ids the local marks name, for the inventory test (a mark naming no row is stale). */
 export const LOCAL_MARKED_IDS = Object.freeze([...Object.keys(LOCAL_POSTS), ...LOCAL_GET_DENY, ...Object.keys(EDGE_LOCAL)]);
 const edge = (domain, id, method, path, options = {}) => row("edge", domain, id, method, path.startsWith("^") ? path : exact(path), options);
 const get = (domain, id, path, options = {}) => row("console", domain, id, "GET", path.startsWith("^") ? path : exact(path), options);
@@ -176,28 +140,19 @@ const post = (domain, id, path, options = {}) => row("console", domain, id, "POS
 const ID = "[0-9]{1,15}";
 const FLOW = "[1-9][0-9]{0,9}";
 const TASK = "[^/]+";
-/** Free of a project: no opener redirect for a session with nothing open. */
 const free = { needsProject: false };
 const approver = (message, back) => ({ role: "approver", roleBrowser: true, roleRefusal: back === undefined ? { message } : { message, back } });
 const operator = (message, back) => ({ role: "operator", roleBrowser: true, roleRefusal: back === undefined ? { message } : { message, back } });
 const anyApprover = (message, back) => ({ ...approver(message, back), roleBrowser: false });
 const anyOperator = (message, back) => ({ ...operator(message, back), roleBrowser: false });
 const SESSION_JSON = { status: 403, type: "application/json", body: JSON.stringify({ error: "session" }) };
-// URL encoding can triple UTF-8 bytes. Task forms admit their bounded fields (a goal and exclusions of 32,000 bytes
-// each, paths and rubric) before canonical text validation; an imported flow is a file.
 const LARGE_FORM = 1024 * 1024;
-// ---- edge: answered before the console's sign-in ---------------------------------------------------------------
-// Ordered exactly as the server checks them: health and webhooks before the Host check, the rest after it.
 edge("pages", "edge.healthz", "GET,HEAD", "/healthz", { host: "before" });
-// Cockpit B1: the running console proves itself to this installation's CLI (a fresh challenge, answered with the
-// instance secret and the address this connection was received on). It reveals nothing and changes nothing.
 edge("pages", "edge.instance", "GET", "/__instance");
 edge("remote", "edge.telegram-hook", "POST", "/hooks/telegram", { callers: ["service"], host: "before", proof: "adapter" });
 edge("remote", "edge.flow-form", "GET,HEAD", "^\\/hooks\\/form\\/[^/]+$", { project: "flow", sample: "/hooks/form/abc", host: "before", proof: "adapter" });
 edge("remote", "edge.flow-form-send", "POST", "^\\/hooks\\/form\\/[^/]+$", { project: "flow", sample: "/hooks/form/abc", host: "before", proof: "adapter" });
 edge("remote", "edge.flow-hook", "POST", "^\\/hooks\\/flow\\/[^/]+$", { callers: ["service"], project: "flow", sample: "/hooks/flow/abc", host: "before", proof: "adapter" });
-// MCP and CLI multiplex read/act operations in POST bodies. Their minimum is read;
-// the same evaluator receives the operation capability after protocol decoding.
 edge("remote", "edge.mcp", "POST", "/mcp", { callers: ["bearer", "oauth", "coordinator"], scope: "read", project: "adapter", proof: "adapter" });
 edge("remote", "edge.oauth-discovery", "GET,HEAD", "^\\/\\.well-known\\/(oauth-protected-resource(\\/mcp)?|oauth-authorization-server)$", { sample: "/.well-known/oauth-authorization-server" });
 edge("remote", "edge.oauth-register", "POST", "/oauth/register");
@@ -223,26 +178,19 @@ edge("people", "edge.sso-finish", "GET", "/login/sso/finish");
 edge("people", "edge.signup", "POST", "/signup");
 edge("people", "edge.login", "POST", "/login");
 edge("people", "edge.logout", "POST", "/logout", { callers: ["anonymous", "cookie"] });
-// Easy-start C2: a browser session's fresh mutation key after a restart: its own password again (the handler proves both).
 edge("people", "edge.rekey-page", "GET", "/login/rekey", { callers: ["anonymous", "cookie"] });
 edge("people", "edge.rekey", "POST", "/login/rekey", { callers: ["anonymous", "cookie"] });
-// Easy-start C4: the local owner sets a first password (only while none is set); the answer is a fresh full session.
 edge("people", "edge.password-set-page", "GET", "/password/set", { callers: ["anonymous", "cookie"] });
 edge("people", "edge.password-set", "POST", "/password/set", { callers: ["anonymous", "cookie"] });
 edge("people", "edge.join", "GET", "^\\/join\\/[A-Za-z0-9_-]{16,64}$", { sample: "/join/abcdefghijklmnop" });
 edge("people", "edge.join-send", "POST", "^\\/join\\/[A-Za-z0-9_-]{16,64}$", { sample: "/join/abcdefghijklmnop" });
-// ---- console reads ---------------------------------------------------------------------------------------------
-// Coding: the workspace, a session and its reads. The handler answers any other caller in its own format (JSON for the workspace's fetches).
 const CODING = { project: "coding", limited: "self", ...free };
 const SESSION = "[a-f0-9]{32}";
 get("tasks", "code.page", "/code", CODING);
 get("tasks", "code.session", `^\\/code\\/${SESSION}$`, { ...CODING, sample: `/code/${"a".repeat(32)}` });
 for (const one of ["state", "changes", "ship"])
     get("tasks", `code.${one}`, `^\\/code\\/${SESSION}\\/${one}$`, { ...CODING, sample: `/code/${"a".repeat(32)}/${one}` });
-// Any other coding address answers "not found" after the same access check.
 get("tasks", "code.other", "^\\/code\\/.*$", { ...CODING, sample: "/code/unknown" });
-// Live terminals (docs/plans/live-terminal.md): an installation-wide operator's own, from a browser. The handlers prove
-// the operator's generation, the terminal's owner and its project; the socket's upgrade is checked in terminals.ts.
 const TERM = { ...free, callers: ["cookie"], project: "none", limited: "deny", ...operator("Terminals are for installation-wide operators.", "/") };
 const TERMINAL = "[a-f0-9]{32}";
 get("tasks", "term.page", "/term", TERM);
@@ -253,70 +201,49 @@ get("pages", "projects.browse", "/projects/browse", free);
 get("pages", "projects.github", "/projects/github", { ...free, callers: ["cookie"], callerRefusal: { status: 403, type: "text/plain; charset=utf-8", body: "listing repositories feeds a browser session's act" },
     ...anyApprover("your login can watch — adding projects is an approver's act") });
 get("pages", "projects.page", "/projects", { limited: "unscoped", ...free });
-// One project's reading page (/projects/<name>): reads only, like every GET (docs/plans/get-side-effects.md). It shows a
-// project this account can see and never switches the session's project; its Open project button posts to
-// /projects/select. The handler resolves the name among the account's visible projects; anything else is not found.
 get("pages", "projects.project", "^\\/projects\\/[^/]+$", { limited: "unscoped", ...free, sample: "/projects/payments-api" });
-// One project's code map (docs/plans/code-map.md §6): reads only. The handler resolves the name among the account's
-// visible projects, and looks areas and files up exactly in the stored version.
 get("pages", "projects.map", "^\\/projects\\/[^/]+\\/map$", { limited: "unscoped", ...free, sample: "/projects/payments-api/map" });
-// A project's flaky tests list (docs/plans/learning-loops.md): reads only, found as the project's page finds its project.
-// Its one action, "Make a task to fix it", posts the ordinary /tasks/add form.
 get("pages", "projects.flaky", "^\\/projects\\/[^/]+\\/flaky$", { limited: "unscoped", ...free, sample: "/projects/payments-api/flaky" });
 get("pages", "home", "/", { limited: "collection", ...free });
 get("pages", "search", "/search", { limited: "collection", ...free });
-// Retired pages (docs/plans/plain-toolroll.md P1.4): permanent redirects to Home and Tasks, admitted as their target is.
 const RETIRED = { limited: "collection", ...free, retired: true };
 get("tasks", "inbox", "/inbox", RETIRED);
 get("tasks", "work", "/work", RETIRED);
-// Archive old tasks (task-tidy.md): the preview reads only, at /tasks/archive; archiving is an approver's step-up in a
-// browser session, and keeps its POST /work/put-away exactly.
 get("tasks", "work.put-away", "/work/put-away", { ...RETIRED, callers: ["cookie"], ...approver("Only an approver can archive tasks.", "/tasks") });
 get("tasks", "tasks.archive", "/tasks/archive", { limited: "collection", ...free, callers: ["cookie"], ...approver("Only an approver can archive tasks.", "/tasks") });
 post("tasks", "work.put-away.apply", "/work/put-away", { scope: "step-up", limited: "collection", ...approver("Only an approver can archive tasks.", "/tasks") });
 get("tasks", "next", "/next", RETIRED);
-get("pages", "morning", "/morning", { limited: "collection", ...free }); // a redirect to / now
+get("pages", "morning", "/morning", { limited: "collection", ...free });
 get("pages", "workbench", "/workbench", RETIRED);
 get("tasks", "board", "/board", RETIRED);
-// A result keeps its own page here (/review?result=…); the bare list is retired to Tasks' Ready view.
 get("tasks", "review", "/review", { limited: "collection", ...free });
-// A push's task link (P1.4): /n/<the task's stored number>, resolved to its page under the viewer's own access.
 get("tasks", "n.task", "^\\/n\\/[1-9][0-9]{0,14}$", { limited: "unscoped", ...free, project: "none", sample: "/n/1" });
 get("settings", "spend", "/spend", { ...free, ...anyOperator("An instance operator sees spend.", "/") });
 get("settings", "settings.spend", "/settings/spend", { ...free, ...anyOperator("An instance operator sets spending limits.", "/settings") });
 get("pages", "ledger", "/ledger", { limited: "unscoped", ...free });
-get("pages", "activity", "/activity", { limited: "collection", ...free }); // a redirect to / now (Home has the summary)
+get("pages", "activity", "/activity", { limited: "collection", ...free });
 get("tasks", "done", "/done", RETIRED);
 get("settings", "mode", "/mode");
 get("people", "people.page", "/people", { limited: "unscoped", ...free });
 get("pages", "system", "/system", free);
-// Where every "Connect a builder" leads: read-only, open to a project-limited person (the handler shows only a visible project).
 get("pages", "start-builder", "/start-builder", { limited: "unscoped", ...free });
 get("tasks", "tasks", "/tasks", { limited: "collection", ...free });
 get("tasks", "queue", "/queue", RETIRED);
 get("pages", "peek", "/peek", free);
 get("pages", "agents", "/agents", { limited: "unscoped", ...free });
-// The Agents view's Live grid (docs/plans/agents-view.md §3): read-only, every request filtered to what the viewer may see.
-// Browser sessions only, like the transcript and the peek: no token (a lead's, a runner's, a remote one) reads live output.
 get("pages", "agents.live", "/agents/live", { limited: "unscoped", callers: ["cookie"], ...free });
 get("pages", "agents.live.read", `^\\/agents\\/live\\/${ID}$`, { limited: "unscoped", callers: ["cookie"], ...free, sample: "/agents/live/1" });
-// Terminals' address in the Agents area: a 302 to /term, admitted exactly as /term is (an operator's browser session).
 get("pages", "agents.terminals", "/agents/terminals", TERM);
-// Fleet and System are parts of Agents now: GET aliases to /agents#computers and /agents#models.
 get("pages", "fleet", "/fleet", free);
 get("tasks", "tasks.new", "/tasks/new", { limited: "collection", ...free });
-// The first run's own page (Wave E): five guided steps, reads only; it leads Home once the first run is over.
 get("tasks", "welcome", "/welcome", { limited: "collection", ...free });
-// Try a sample project (first-run.ts, sample-project.ts): made in the project folder, then added the way Projects adds a folder.
 post("tasks", "welcome.sample", "/welcome/sample", { callers: ["cookie"], project: "none", ...approver("An approver adds projects.", "/welcome") });
 get("tasks", "task.page", `^\\/t\\/${TASK}$`, { project: "task", limited: "resource", ...free, sample: "/t/one" });
 get("tasks", "task.evidence", `^\\/t\\/${TASK}\\/evidence$`, { project: "task", limited: "resource", ...free, sample: "/t/one/evidence" });
-// One-tap release approval (trusted-release-reports.md A6/A7): the sheet, and the push's opaque locator, which only
-// redirects to it once the plane's own state says the task ref is a release in the person's projects.
 get("tasks", "task.release", `^\\/t\\/${TASK}\\/release$`, { project: "task", limited: "resource", ...free, sample: "/t/one/release" });
 get("tasks", "release.locate", `^\\/approve\\/${ID}$`, { project: "task-ref", limited: "resource", ...free, sample: "/approve/1" });
 get("pages", "ledger.export", "/ledger/export", { limited: "unscoped", ...free });
-get("tasks", "runs", "/runs", { limited: "collection", ...free }); // a redirect to /agents now
+get("tasks", "runs", "/runs", { limited: "collection", ...free });
 get("pages", "menu", "/menu", { limited: "collection", ...free });
 get("tasks", "run.page", `^\\/r\\/${ID}$`, { project: "run", limited: "resource", ...free, sample: "/r/1" });
 get("tasks", "run.evidence", `^\\/r\\/${ID}\\/evidence\\/${ID}$`, { project: "run", limited: "resource", ...free, sample: "/r/1/evidence/2" });
@@ -327,7 +254,6 @@ get("flows", "flows.page", "/flows", { limited: "resource", ...free });
 get("flows", "kits", "/kits");
 get("flows", "kit.page", "^\\/kits\\/[a-z-]{1,40}$", { sample: "/kits/support" });
 get("flows", "subagents", "/settings/lead/subagents", free);
-// D5: subagents were teammates; old links to them land on the same pages under Settings → Lead.
 get("flows", "subagents.legacy", "^\\/teammates(\\/[1-9][0-9]{0,9}(\\/soul\\.md)?)?$", { ...free, sample: "/teammates/1" });
 get("flows", "subagent.page", `^\\/settings\\/lead\\/subagents\\/[1-9][0-9]{0,9}$`, { ...free, sample: "/settings/lead/subagents/1" });
 get("flows", "subagent.soul-file", `^\\/settings\\/lead\\/subagents\\/[1-9][0-9]{0,9}\\/soul\\.md$`, { ...free, sample: "/settings/lead/subagents/1/soul.md" });
@@ -338,11 +264,8 @@ get("flows", "flow.page", `^\\/flows\\/${FLOW}$`, { project: "flow", limited: "r
 get("flows", "recipes", "/recipes", { limited: "collection", ...free });
 for (const one of ["run", "start", "new", "edit", "from-task", "preview", "export"])
     get("flows", `recipes.${one}`, `/recipes/${one}`, { limited: "collection" });
-// Any other recipe screen answers the recipe area's own refusal.
 get("flows", "recipes.other", "^\\/recipes\\/.*$", { sample: "/recipes/unknown" });
-// v115: routines became scheduled flows; old links to them land on the flows page.
 get("tasks", "routines", "/routines", { limited: "collection" });
-// One live stream per page: every room it shows (server/live.ts). Each room admits its own callers; a token reads only the team room.
 edge("live", "live", "GET", "/live", { callers: ["cookie", "bearer"], scope: "read", project: "adapter", proof: "adapter" });
 get("chat", "chat.mate-status", "/chat/mate/status", { ...free, role: "approver", roleBrowser: true, roleRefusal: SESSION_JSON });
 get("chat", "chat.demo-live", "/chat/demo/live", free);
@@ -376,10 +299,7 @@ get("settings", "settings.knowledge", "/settings/knowledge", { limited: "unscope
 get("settings", "settings.learning", "/settings/learning", { limited: "unscoped", ...free });
 get("settings", "settings.telegram", "/settings/telegram", { limited: "self", ...free, ...approver("An approver can pair their own phone.", "/settings") });
 get("settings", "settings.page", "/settings", { limited: "unscoped", ...free });
-// The Settings groups (docs/plans/settings-revamp.md §3): one read-only page each, drawn by the overview's handler.
-// Anyone signed in may open one; the page shows only the sections this person can use, and every form's own route
-// keeps its own role and proof.
-for (const one of ["general", "agents", "alerts", "projects", "access", "system"])
+for (const one of ["general", "agents", "alerts", "projects", "access", "system", "advanced"])
     get("settings", `settings.group-${one}`, `/settings/${one}`, { limited: "unscoped", ...free });
 get("pages", "health", "/health", { ...free, ...anyOperator("An instance operator reads server health.", "/") });
 get("pages", "metrics", "/metrics", { ...free, ...anyOperator("An instance operator reads metrics.", "/") });
@@ -388,17 +308,14 @@ get("tasks", "decision.page", `^\\/d\\/${ID}$`, { project: "decision", limited:
 get("chat", "lead.status", "/lead/status", free);
 get("chat", "chat.task-status", "/chat/task-status", free);
 get("tasks", "decision.evidence", `^\\/d\\/${ID}\\/evidence\\/${ID}$`, { project: "decision", limited: "resource", ...free, sample: "/d/1/evidence/2" });
-// ---- console actions -------------------------------------------------------------------------------------------
-// The scripted demo: the handler answers a non-browser caller "no page here".
 post("chat", "chat.demo.ask", "/chat/demo/ask");
 for (const one of ["approve", "change", "revise", "complete"])
     post("chat", `chat.demo.${one}`, `^\\/chat\\/demo\\/[0-9]{1,9}\\/${one}$`, { sample: `/chat/demo/1/${one}` });
 post("settings", "provider.resume", "^\\/providers\\/[a-z]+\\/resume$", { sample: "/providers/codex/resume" });
 post("settings", "settings.updates-dismiss", "/settings/updates/dismiss");
 post("settings", "settings.updates-checks", "/settings/updates/checks");
-// Cockpit B2: Forget ends this session's remembered password now.
-// Forget is about the caller's own session only: anyone signed in with a browser may use it (a viewer, a project-limited person).
 post("settings", "session.forget-password", "/session/forget-password", { ...free, limited: "self", viewer: true, callers: ["cookie"] });
+post("settings", "settings.advanced", "/settings/advanced", { ...free, limited: "self", viewer: true, callers: ["cookie"] });
 const CODING_ACT = { scope: "step-up", project: "coding", limited: "self" };
 post("tasks", "code.start", "/code/start", CODING_ACT);
 post("tasks", "term.start", "/term/start", { ...TERM, scope: "step-up" });
@@ -406,11 +323,8 @@ for (const one of ["close", "remove"])
     post("tasks", `term.${one}`, `^\\/term\\/${TERMINAL}\\/${one}$`, { ...TERM, sample: `/term/${"a".repeat(32)}/${one}` });
 for (const one of ["send", "stop", "resume", "recover", "continue", "ship", "answer"])
     post("tasks", `code.${one}-send`, `^\\/code\\/${SESSION}\\/${one}$`, { ...CODING_ACT, sample: `/code/${"a".repeat(32)}/${one}` });
-// Reading a coding checkout runs git in a folder an agent writes, so it is a POST with the form token, never a page
-// visit (docs/plans/get-side-effects.md): the session's changes, and the review-for-shipping preview.
 post("tasks", "code.changes-read", `^\\/code\\/${SESSION}\\/changes$`, { project: "coding", limited: "self", callers: ["cookie"], sample: `/code/${"a".repeat(32)}/changes` });
 post("tasks", "code.ship-preview", `^\\/code\\/${SESSION}\\/ship\\/preview$`, { project: "coding", limited: "self", callers: ["cookie"], sample: `/code/${"a".repeat(32)}/ship/preview` });
-// Any other coding action answers "not found" after the same access check.
 post("tasks", "code.act-other", "^\\/code(\\/.*)?$", { ...CODING_ACT, sample: "/code/unknown" });
 post("settings", "settings.skills-revise", "/settings/skills/revise", { project: "form", limited: "unscoped", ...approver("Sign in to revise a test.", "/settings/skills") });
 post("settings", "settings.skills-import", "/settings/skills/import", { project: "form", limited: "unscoped", bodyCap: 2 * 1024 * 1024, ...approver("Sign in as an approver to manage skills.", "/settings/skills") });
@@ -423,7 +337,6 @@ for (const one of ["soul", "state", "note", "settings", "summary", "tools", "mem
     post("flows", `subagent.${one}`, `^\\/settings\\/lead\\/subagents\\/[1-9][0-9]{0,9}\\/${one}$`, { sample: `/settings/lead/subagents/1/${one}`, ...SUBAGENTS });
 post("flows", "subagent.answer", "^\\/settings\\/lead\\/subagents\\/questions\\/[1-9][0-9]{0,9}\\/answer$", { sample: "/settings/lead/subagents/questions/1/answer" });
 post("flows", "flows.gallery-create", "^\\/flows\\/new\\/[a-z-]{1,40}$", { project: "form", limited: "resource", sample: "/flows/new/triage" });
-// Flow editing answers JSON: a caller without approver standing hears it in the editor's own format.
 const CREATE_FLOWS = approver("Sign in as an approver to create flows.", "/flows");
 const EDIT_FLOWS = { role: "approver", roleBrowser: true, roleRefusal: { status: 403, type: "application/json; charset=utf-8", body: JSON.stringify({ ok: false, said: "Sign in as an approver to change flows." }) } };
 post("flows", "flows.create", "/flows/new", { project: "form", limited: "resource", ...CREATE_FLOWS });
@@ -433,12 +346,8 @@ for (const one of ["save", "cards", "archive", "scripts"])
     post("flows", `flow.${one}`, `^\\/flows\\/${FLOW}\\/${one}$`, { project: "flow", limited: "resource", sample: `/flows/1/${one}`, ...EDIT_FLOWS });
 for (const one of ["linear-key", "hooks-address", "secrets"])
     post("flows", `flow.${one}`, `^\\/flows\\/${FLOW}\\/${one}$`, { scope: "step-up", project: "flow", sample: `/flows/1/${one}`, ...EDIT_FLOWS });
-// "Runs on its own": signing raises authority (the owner's password, a step-up); revoking is one click for any approver.
 post("flows", "flow.unattended", `^\\/flows\\/${FLOW}\\/unattended$`, { scope: "step-up", project: "flow", sample: "/flows/1/unattended", ...EDIT_FLOWS });
 post("flows", "flow.unattended-off", `^\\/flows\\/${FLOW}\\/unattended-off$`, { project: "flow", sample: "/flows/1/unattended-off", ...EDIT_FLOWS });
-// Browser use in a flow's script zones (flow-browser.ts): allowing it widens the sandbox, so a person's own step-up from
-// their browser, carrying the approval digest they read; turning it off lowers authority, one click. Browser only: a
-// lead's or remote run's token never reaches either (the CLI says the same).
 post("flows", "flow.browser", `^\\/flows\\/${FLOW}\\/browser$`, { scope: "step-up", project: "flow", sample: "/flows/1/browser", ...EDIT_FLOWS });
 post("flows", "flow.browser-off", `^\\/flows\\/${FLOW}\\/browser-off$`, { callers: ["cookie"], project: "flow", limited: "resource", sample: "/flows/1/browser-off", ...EDIT_FLOWS });
 post("flows", "flow.triggers", `^\\/flows\\/${FLOW}\\/triggers$`, { project: "flow", limited: "resource", sample: "/flows/1/triggers", ...EDIT_FLOWS });
@@ -452,11 +361,8 @@ post("flows", "flow.trigger.check", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/
 post("flows", "flow.trigger.press", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/press$`, { project: "flow", limited: "resource", sample: "/flows/1/triggers/2/press", ...EDIT_FLOWS });
 post("flows", "flow.trigger.renew", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/renew$`, { project: "flow", limited: "resource", sample: "/flows/1/triggers/2/renew", ...EDIT_FLOWS });
 post("flows", "flow.trigger.secret", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/secret$`, { scope: "step-up", project: "flow", limited: "resource", sample: "/flows/1/triggers/2/secret", ...EDIT_FLOWS });
-// v126: a signed webhook's set-up (a new address, and a secret made here shown once) and who signs it: behind the password.
 post("flows", "flow.trigger.setup", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/setup$`, { scope: "step-up", project: "flow", limited: "resource", sample: "/flows/1/triggers/2/setup", ...EDIT_FLOWS });
-// v126: clear a webhook's turned-away count once it has been seen.
 post("flows", "flow.trigger.dropped", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/dropped$`, { project: "flow", limited: "resource", sample: "/flows/1/triggers/2/dropped", ...EDIT_FLOWS });
-// v126: which project a Sentry or Vercel webhook takes deliveries from: behind the password, as its secret is.
 post("flows", "flow.trigger.scope", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/scope$`, { scope: "step-up", project: "flow", limited: "resource", sample: "/flows/1/triggers/2/scope", ...EDIT_FLOWS });
 post("flows", "flow.trigger.sender", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/sender$`, { scope: "step-up", project: "flow", limited: "resource", sample: "/flows/1/triggers/2/sender", ...EDIT_FLOWS });
 post("flows", "flow.trigger.share", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/share$`, { project: "flow", limited: "resource", sample: "/flows/1/triggers/2/share", ...EDIT_FLOWS });
@@ -470,18 +376,11 @@ post("settings", "settings.project-writes", "/settings/project/writes", { scope:
 post("settings", "settings.project-check-access", "/settings/project/check-access", { scope: "step-up", callers: ["cookie"] });
 post("settings", "settings.project-sandbox", "/settings/project/sandbox", { scope: "step-up", callers: ["cookie"] });
 post("settings", "settings.project-delete", "/settings/project/delete", { scope: "step-up", ...operator("An instance operator deletes projects.", "/settings/project") });
-// Lead sweeps (docs/plans/lead-fan-out.md): the table, and cancelling what isn't ready. The handler shows a sweep only in
-// a project the reader can see, and acts only for an approver.
 get("tasks", "sweep.page", "^\\/sweeps\\/[1-9][0-9]{0,9}$", { ...free, limited: "unscoped", sample: "/sweeps/1" });
 post("tasks", "sweep.cancel-rest", "^\\/sweeps\\/[1-9][0-9]{0,9}\\/cancel-rest$", { limited: "unscoped", sample: "/sweeps/1/cancel-rest", ...approver("An approver cancels a sweep's work.", "/chat") });
-// Passwordless (docs/plans/passwordless.md): an operator's installation setting. Turning it on takes a typed password
-// (the handler proves it as a credential act); turning it off is one click, so the row itself is not a step-up.
 get("settings", "settings.passwordless", "/settings/passwordless", { ...free, ...operator("An instance operator sets Passwordless.", "/settings") });
 post("settings", "settings.passwordless-send", "/settings/passwordless", { callers: ["cookie"], ...operator("An instance operator sets Passwordless.", "/settings") });
-// Easy-start C5: turning local mode off: an instance operator's step-up from a full session (a local owner is refused).
 post("settings", "settings.local-mode-off", "/settings/local-mode/off", { callers: ["cookie"], scope: "step-up", ...operator("An instance operator turns off local mode.", "/settings/access") });
-// Release approval (docs/plans/auto-approve-green.md): an approver of the project, from a browser. Approving releases
-// automatically takes a typed password (the handler proves it as a credential act); asking again is one click.
 post("settings", "settings.release-approval-send", "/settings/release-approval", { callers: ["cookie"], ...approver("An approver sets how releases are approved.", "/settings/approval") });
 post("pages", "ledger.checkpoint", "/ledger/checkpoint", operator("An instance operator makes ledger checkpoints.", "/ledger"));
 const SETTINGS_ACT_ROLES = {
@@ -514,18 +413,12 @@ post("settings", "settings.integrations-youiyoux", "/settings/integrations/youiy
 const MODELS = approver("Sign in as an approver to change models.", "/settings/models");
 for (const one of ["check", "watch", "update"])
     post("settings", `settings.models-${one}`, `/settings/models/${one}`, MODELS);
-// Changing which model a role uses: an instance operator's browser step-up (the handler proves the password, or the
-// Passwordless session; model-choices.ts re-proves the session and standing inside its one transaction).
 for (const one of ["agent", "apply"])
     post("settings", `settings.models-${one}`, `/settings/models/${one}`, { scope: "step-up", ...operator("An instance operator changes models.", "/settings/models") });
-// Earned rules (results routing): accepting, keeping a paused rule and switching suggestions on are an instance
-// operator's browser step-up; turning a rule off, Not now and switching suggestions off only take authority away (a
-// signed-in operator, or the local owner in exactly that act: route-store.ts proveRuleDoor re-checks it in the write).
 for (const one of ["accept", "keep", "suggest-on", "try"])
     post("settings", `settings.models-${one}`, `/settings/models/${one}`, { scope: "step-up", ...operator("An instance operator changes which models run.", "/settings/models") });
 for (const one of ["turn-off", "not-now", "suggest-off", "stop"])
     post("settings", `settings.models-${one}`, `/settings/models/${one}`, operator("An instance operator changes which models run.", "/settings/models"));
-// Any other models action answers the models area's own refusal.
 post("settings", "settings.code-map", "/settings/project/code-map", { project: "form", ...approver("An approver turns the code map on or off.", "/settings/project") });
 post("settings", "settings.code-map-holdout", "/settings/project/code-map/holdout", { project: "form", ...approver("A person ends the holdout.", "/settings/project") });
 post("settings", "settings.models-act", "^\\/settings\\/models\\/.*$", { sample: "/settings/models/unknown", ...MODELS });
@@ -536,7 +429,6 @@ post("settings", "settings.knowledge-tidy", "/settings/knowledge/tidy", { projec
 post("settings", "settings.knowledge-decision", "/settings/knowledge/decision", { project: "form", ...approver("Sign in as an approver to change project decisions.", "/settings/knowledge") });
 post("settings", "settings.knowledge-change", "/settings/knowledge/change", { project: "form", limited: "unscoped", ...approver("Sign in as an approver to change project knowledge.", "/settings/knowledge") });
 post("settings", "settings.learning-change", "/settings/learning/change", { project: "form", limited: "unscoped" });
-// A page shows the last check; these ask again (docs/plans/get-side-effects.md).
 post("settings", "control.models-refresh", "/control/models-refresh", anyApprover("Project setup requires an approver."));
 post("settings", "settings.connection-check", "/settings/connection/check", anyApprover("An approver checks a sign-in.", "/settings"));
 for (const one of ["setup-preview", "setup-approve", "instructions-preview", "instructions-approve"])
@@ -559,7 +451,6 @@ post("pages", "projects.map-refresh", "^\\/projects\\/[^/]+\\/map\\/refresh$", {
 post("pages", "projects.remove", "/projects/remove", { project: "form", ...operator("An instance operator removes projects.", "/settings/project") });
 post("pages", "projects.open", "/projects/open", { project: "form-path" });
 post("tasks", "tasks.add", "/tasks/add", { project: "form", limited: "collection", bodyCap: LARGE_FORM });
-// Build (fast-start.ts): a person's own browser session only. No token, chat, agent or webhook reaches it.
 post("tasks", "tasks.fast", "/tasks/fast", { callers: ["cookie"], project: "none", limited: "collection", ...approver("An approver starts builds.", "/tasks/new") });
 post("tasks", "queue.move", "/queue/move");
 post("tasks", "queue.note", "/queue/note");
@@ -572,12 +463,9 @@ post("people", "people.invite", "/people/invite", { scope: "step-up" });
 post("people", "people.invite-revoke", "/people/invite-revoke", { scope: "step-up" });
 post("people", "people.revoke", "/people/revoke", { scope: "step-up" });
 post("pages", "fleet.retire", "/fleet/runner/retire", { scope: "step-up" });
-// Answering a parked decision needs act access and irreversible-choice confirmation, not password step-up.
 post("tasks", "decision.answer", `^\\/d\\/${ID}\\/answer$`, { project: "decision", limited: "resource", scope: "act", sample: "/d/1/answer" });
-// A held automatic release goes on: a person, with their password typed now (release-auto.ts allowAutoPublish).
 post("tasks", "task.release.go-on", `^\\/t\\/${TASK}\\/release\\/go-on$`, { project: "task", limited: "resource", scope: "step-up", sample: "/t/one/release/go-on", ...approver("An approver lets a release go on.", "/tasks") });
 post("tasks", "task.act.keep-grown", `^\\/t\\/${TASK}\\/keep-grown$`, { project: "task", limited: "resource", sample: "/t/one/keep-grown", callers: ["cookie"], ...approver("An approver keeps a change.", "/tasks") });
-// Findings, a failed check's repair, before-and-after evidence: a person's acts from a browser, none of them an approval.
 post("tasks", "task.act.follow-through", `^\\/t\\/${TASK}\\/follow-through$`, { project: "task", limited: "resource", sample: "/t/one/follow-through", callers: ["cookie"], ...approver("An approver acts on a finding.", "/tasks") });
 post("tasks", "task.act.hold", `^\\/t\\/${TASK}\\/hold$`, { project: "task", limited: "resource", sample: "/t/one/hold" });
 post("tasks", "task.act.unhold", `^\\/t\\/${TASK}\\/unhold$`, { project: "task", limited: "resource", sample: "/t/one/unhold" });
@@ -598,12 +486,9 @@ post("tasks", "task.act.route", `^\\/t\\/${TASK}\\/route$`, { project: "task", l
 post("tasks", "task.act.retry-review", `^\\/t\\/${TASK}\\/retry-review$`, { project: "task", limited: "resource", sample: "/t/one/retry-review" });
 post("tasks", "task.act.complete", `^\\/t\\/${TASK}\\/complete$`, { project: "task", limited: "resource", sample: "/t/one/complete", ...approver("Only an approver can mark a result complete.") });
 post("tasks", "task.act.merge", `^\\/t\\/${TASK}\\/merge$`, { project: "task", limited: "resource", sample: "/t/one/merge", ...approver("Only an approver can merge.") });
-// Check again: Toolroll looks at this computer's processes for a finished build once more (stop-proof.ts). Nobody
-// vouches that a build stopped, so no password: it only asks for the look the worker makes on its own anyway.
 post("tasks", "task.act.recheck-stopped", `^\\/t\\/${TASK}\\/recheck-stopped$`, { project: "task", limited: "resource", sample: "/t/one/recheck-stopped", ...approver("Only an approver can have Toolroll check a build again.") });
 post("tasks", "task.act.stop-carrying", `^\\/t\\/${TASK}\\/stop-carrying$`, { project: "task", limited: "resource", sample: "/t/one/stop-carrying", ...approver("Only an approver can stop carrying a release.") });
 post("tasks", "task.act.stop", `^\\/t\\/${TASK}\\/stop$`, { project: "task", limited: "resource", sample: "/t/one/stop" });
-// Putting one task away and bringing it back (task-tidy.md): a person's act, so only a browser session.
 post("tasks", "task.act.archive", `^\\/t\\/${TASK}\\/archive$`, { project: "task", limited: "resource", sample: "/t/one/archive", callers: ["cookie"], ...approver("Only an approver can put a task away.") });
 post("tasks", "task.act.restore", `^\\/t\\/${TASK}\\/restore$`, { project: "task", limited: "resource", sample: "/t/one/restore", callers: ["cookie"], ...approver("Only an approver can restore a task.") });
 post("tasks", "task.act.pause", `^\\/t\\/${TASK}\\/pause$`, { project: "task", limited: "resource", sample: "/t/one/pause" });
@@ -611,27 +496,20 @@ post("tasks", "task.act.resume-arm", `^\\/t\\/${TASK}\\/resume-arm$`, { project:
 post("tasks", "task.act.resume", `^\\/t\\/${TASK}\\/resume$`, { scope: "step-up", project: "task", limited: "resource", sample: "/t/one/resume" });
 for (const one of ["block", "unblock", "repair-dependency", "follow-up"])
     post("tasks", `task.act.${one}`, `^\\/t\\/${TASK}\\/${one}$`, { project: "task", sample: `/t/one/${one}` });
-// Onboarding names a GitHub repository, not a local project. Its root-index/nonce ceremony proves the future destination.
 post("pages", "projects.onboard-preview", "/projects/onboard-preview", { project: "none" });
 post("pages", "projects.onboard-confirm", "/projects/onboard-confirm", { scope: "step-up", project: "none" });
 post("chat", "push.subscribe", "/push/subscribe", { scope: "step-up" });
 post("chat", "push.remove", "/push/remove");
-// Ask this computer's agent CLIs again (docs/plans/get-side-effects.md): Chat's first run and Settings → Lead's Check
-// now. GET /lead/status only reads the last answer.
 post("chat", "lead.check", "/lead/check", { callers: ["cookie"] });
 post("chat", "onboarding.phone-dismiss", "/onboarding/phone/dismiss", approver("An approver puts this away.", "/chat"));
 const LEAD_WORDS = { identity: "An approver names their lead.", about: "An approver edits what their lead knows about them.", "promise/cancel": "An approver manages the lead's promises.", on: "An approver turns the lead on." };
 for (const one of ["identity", "about", "promise/cancel", "on"])
     post("settings", `settings.lead-${one.replaceAll("/", "-")}`, `/settings/lead/${one}`, approver(LEAD_WORDS[one], "/settings/lead"));
-// Quick answers is installation-wide: which model answers everyone's plain questions (responsive-chat.md §8).
 post("settings", "settings.lead-quick", "/settings/lead/quick", { callers: ["cookie"], ...operator("An instance operator chooses how the lead answers.", "/settings/lead") });
 post("chat", "chat.config", "/chat/config", { scope: "step-up" });
 for (const one of ["mint", "follow", "end", "stop"])
     post("chat", `chat.mate-${one}`, `/chat/mate/${one}`, { callers: ["cookie"], ...(one === "mint" ? { scope: "step-up" } : {}) });
-// Remove a message still waiting in the person's lead queue (docs/plans/lead-message-queue.md): their own, while it waits.
 post("chat", "chat.queued-remove", "^\\/chat\\/queued\\/[1-9][0-9]{0,14}\\/remove$", { callers: ["cookie"], sample: "/chat/queued/1/remove" });
-// Confirming a proposal may approve a scope (scope_approve): that one act takes the same standard-approval freshness as
-// /t/:id/approve (chat-actions.ts scopes it); every other operation it confirms still needs a password typed now.
 for (const one of ["confirm", "dismiss"])
     post("chat", `chat.proposal.${one}`, `^\\/chat\\/proposal\\/${ID}\\/${one}$`, { project: "proposal", limited: "proposal", sample: `/chat/proposal/1/${one}`, ...(one === "confirm" ? { freshness: "allowlist" } : {}) });
 for (const one of ["confirm", "dismiss"])
@@ -644,20 +522,14 @@ for (const one of ["prepare", "preview", "import", "save"])
 post("flows", "recipes.launch-send", "/recipes/launch", { limited: "collection" });
 for (const one of ["note", "comment", "revise", "draft-repair", "checks", "add-tests"])
     post("tasks", `run.act.${one}`, `^\\/r\\/${ID}\\/${one}$`, { project: "run", limited: "resource", sample: `/r/1/${one}` });
-// Cockpit E: reveal a running attempt's proved checkout in Finder (nothing is launched in it).
 post("tasks", "run.act.reveal", `^\\/r\\/${ID}\\/reveal$`, { project: "run", limited: "resource", callers: ["cookie"], sample: "/r/1/reveal", ...approver("Only an approver can show an agent's files.") });
 post("tasks", "session.editor-links", "/session/editor-links", { viewer: true });
-// Easy-start C1 (N1): reads never write. The shell says a finished result was opened (it leaves the person's unread
-// Done), and holds or releases the short lease that quiets chat pings while an agent's page is open — keyed POSTs, never
-// a page load or the live stream. A watch-only account keeps its own seen marks and watches too.
 post("tasks", "agents.seen", "/agents/seen", { callers: ["cookie"], project: "none", limited: "unscoped", viewer: true });
 post("tasks", "agents.watch", "/agents/watch", { callers: ["cookie"], project: "none", limited: "unscoped", viewer: true });
 post("tasks", "incident.resolve", `^\\/i\\/${ID}\\/resolve$`, { project: "incident", sample: "/i/1/resolve" });
-/** The sole route table, in match order. */
 export const ROUTES = Object.freeze(rows.map(one => Object.freeze(one)));
 const compiled = ROUTES.map(route => ({ route, test: new RegExp(route.pattern) }));
 const methodMatches = (declared, method) => declared === method || (declared === "GET,HEAD" && (method === "GET" || method === "HEAD"));
-/** The first row that declares this method and path, or null: an undeclared request never reaches a handler. */
 export function matchRoute(method, pathname, stage) {
     for (const { route, test } of compiled) {
         if (stage !== undefined && route.stage !== stage)
@@ -667,7 +539,6 @@ export function matchRoute(method, pathname, stage) {
     }
     return null;
 }
-/** Refuses a malformed table at startup: duplicate ids, duplicate method+pattern rows, or a row shadowed by an earlier one for its own sample. */
 export function assertRouteTable(routes = ROUTES) {
     const ids = new Set(), keys = new Set();
     for (const route of routes) {

package/dist/server/runtime.js

@@ -1,5 +1,4 @@
 import {} from "../project-identity.js";
-/** Captured server state and shared guards. Getters preserve live state across requests. */
 import {} from "node:http";
 import {} from '../assignment.js';
 import {} from '../browser-workspace.js';