toolroll 0.9.104 → 0.9.105

package/dist/model-choices.js

@@ -1,12 +1,3 @@
-/**
- * Settings → Models, the one write path (docs/plans/spend-dashboard.md, slice 3): which model each role uses at the
- * installation or one project, changed in one transaction, ledgered before → after per row (clears included), and
- * never touching sealed work. Presets (D5: "Sized by job", "Opus for everything") and "Switch to it" are changes like
- * any other: their exact diff is shown first and the apply carries its digest.
- *
- * Model choices apply to NEW filings only. Nothing here reads or writes a scope, its approved profile or digest, a run
- * route, an approval, a mode's terms, or a routine's or standing order's pin: those were sealed at filing.
- */
 import { createHash } from "node:crypto";
 import { isAcpProvider } from "./acp-agents.js";
 import { currentLocalOwner, localModeOn, localOwnerInFlight, localOwnerStandsNow } from "./local-owner.js";
@@ -16,14 +7,11 @@ import { passwordlessOn } from "./passwordless.js";
 import { exactModelId, recommendRoute, routeProblems } from "./phase-routing.js";
 import { liveEarnedRules } from "./route-store.js";
 import { isProviderId, validateSpec } from "./provider.js";
-/** Every row the editor owns, in the order the page and the diff show them. Alternates (`--also`) and the strong
- * repair row stay CLI-only; presets clear the strong repair row so repairs follow the builder. */
 export const SLOTS = Object.freeze([
     { phase: "plan", tier: "routine" }, { phase: "plan", tier: "strong" },
     { phase: "build", tier: "light" }, { phase: "build", tier: "routine" }, { phase: "build", tier: "strong" },
     { phase: "repair", tier: "routine" }, { phase: "review", tier: "routine" }, { phase: "review", tier: "strong" },
 ]);
-/** Every row the write path accepts: the editor's, plus the strong repair row the CLI also sets. */
 export const ALL_SLOTS = Object.freeze([
     ...SLOTS.slice(0, 6), { phase: "repair", tier: "strong" }, ...SLOTS.slice(6),
 ]);
@@ -32,7 +20,6 @@ export const slotKey = (slot) => slot.tier === "routine" ? slot.phase : `${slot.
 export function slotOf(key) {
     return SLOTS.find(one => slotKey(one) === key) ?? null;
 }
-/** The role in plain words. */
 export function slotWords(slot) {
     if (slot.phase === "build")
         return slot.tier === "light" ? "Builder for small tasks" : slot.tier === "strong" ? "Builder for large or risky tasks" : "Builder for routine tasks";
@@ -47,8 +34,6 @@ export function rowAt(store, scope, slot) {
 }
 const samePair = (a, b) => a === null || b === null ? a === b : a.provider === b.provider && a.model === b.model;
 const sha = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
-/** Every value the editor shows for a scope: its own rows and, for a project, the installation rows it inherits, and
- * the alternates described in words. A change to any of them makes an open form stale. */
 export function stateDigest(store, scope) {
     const rows = (one) => ({
         slots: ALL_SLOTS.map(slot => [slotKey(slot), rowAt(store, one, slot)]),
@@ -56,18 +41,13 @@ export function stateDigest(store, scope) {
     });
     return sha({ scope, installation: rows(INSTALLATION_SCOPE), project: scope === INSTALLATION_SCOPE ? null : rows(scope) });
 }
-/** The exact change a preview showed: its target and every set and clear, in slot order. */
 export function changeDigest(scope, change) {
     const ordered = [...change].sort((a, b) => order(a.slot) - order(b.slot));
     return sha({ scope, change: ordered.map(one => [slotKey(one.slot), one.to === null ? null : [one.to.provider, one.to.model]]) });
 }
-/** What a preview showed: the scope and every row's before → after. Bound into the apply, so a row that moved in
- * between, or a change the preview never showed, is refused. */
 export function diffDigest(scope, diff) {
     return sha({ scope, diff: diff.map(row => [slotKey(row.slot), row.before, row.after]) });
 }
-/** A preview read from ONE snapshot: the rows it moves, what a cleared project row would inherit, and both digests
- * the apply must match. */
 export function previewModelChange(store, scope, change) {
     return store.transact(() => {
         const diff = diffOf(store, scope, change);
@@ -77,7 +57,6 @@ export function previewModelChange(store, scope, change) {
         };
     });
 }
-/** The rows this change really moves (a set to the value already there is no change). */
 export function diffOf(store, scope, change) {
     return ALL_SLOTS.flatMap(slot => {
         const wanted = change.find(one => slotKey(one.slot) === slotKey(slot));
@@ -88,7 +67,6 @@ export function diffOf(store, scope, change) {
         return samePair(before, after) ? [] : [{ slot, before, after }];
     });
 }
-// ---- presets (owner decision D5, 2026-10-31) -------------------------------
 export const OPUS = "claude-opus-5-5";
 export const SONNET = "claude-sonnet-5-5";
 export const HAIKU = "claude-haiku-5-5";
@@ -106,16 +84,12 @@ export const PRESETS = {
 };
 export const DEFAULT_PRESET = "sized";
 export const isPresetName = (value) => value === "sized" || value === "opus";
-/** A preset as a change: every slot, as exact Claude ids, never an alias. Repair rows are cleared so repairs follow
- * the builder of each size. */
 export function presetChange(name) {
     return ALL_SLOTS.map(slot => {
         const model = PRESETS[name].rows[slotKey(slot)];
         return { slot, to: model === null || model === undefined ? null : { provider: "claude", model } };
     });
 }
-/** The routes a task filed now would get at a scope, for every size and demand that picks a tier (inheritance,
- * review following the planner, and repair following each size's builder included), or the words for why none can. */
 export const ROUTE_CASES = Object.freeze([
     { label: "small", size: "small", risky: false, strict: false }, { label: "routine", size: "medium", risky: false, strict: false },
     { label: "large", size: "large", risky: false, strict: false }, { label: "risky", size: "small", risky: true, strict: false },
@@ -125,24 +99,16 @@ export function effectiveRoutes(store, repo, options = {}) {
     const candidates = resolveRouteCandidates(store, repo);
     if (!candidates.ok)
         return { ok: false, problem: candidates.problem };
-    // A project's live earned rules route its eligible small and routine tasks (the one precedence order,
-    // phase-routing.ts selectBuildLeg); `rules: false` asks for the configured rows alone.
     const rules = options.rules === false ? [] : options.rules ?? liveEarnedRules(store, repo);
     return { ok: true, routes: routesOf(candidates.candidates, rules) };
 }
-/** Every size's and demand's route over these candidates, with a project's earned rules where they apply. (A build
- * moved to another provider for plan headroom takes its repairs with it, so that move can't break a repair; a tier
- * whose only candidate is another provider's is its primary here, and checked.) */
 function routesOf(candidates, rules = []) {
     const routes = ROUTE_CASES.map(one => ({ label: one.label, route: recommendRoute({ qualityMode: one.strict ? "strict" : "default", evidence: [], publication: "none",
             candidates, overrides: [], size: { size: one.size, risky: one.risky, source: "heuristic", reason: "" },
             earned: rules.length === 0 ? null : { rules, release: false, protected: false } }) }));
     return routes;
 }
-/** Which preset a scope's EFFECTIVE configuration matches (what each size would really run, inherited rows
- * included), or null ("a custom set"). */
 export function presetInUse(store, scope) {
-    // The configured rows, not a project's earned rules: a rule never edits the owner's Models rows.
     const effective = effectiveRoutes(store, scope === INSTALLATION_SCOPE ? null : scope, { rules: false });
     if (!effective.ok)
         return null;
@@ -160,7 +126,6 @@ export function presetInUse(store, scope) {
     }
     return null;
 }
-/** "Switch to it": every row at this scope that names `from` names `to` instead. */
 export function switchChange(store, scope, from, to) {
     return SLOTS.flatMap(slot => {
         const row = rowAt(store, scope, slot);
@@ -168,7 +133,6 @@ export function switchChange(store, scope, from, to) {
     });
 }
 const FAMILY = /^claude-(opus|sonnet|haiku|fable)-/;
-/** For each exact Claude id this scope uses, the newest model of its family the watch has seen, when that is newer. */
 export function newerModels(store, scope) {
     const seen = seenModels(store, "claude");
     const used = new Map();
@@ -197,7 +161,6 @@ class Refused extends Error {
         this.refusal = refusal;
     }
 }
-/** Why one row can't be written as asked, or null. */
 function rowProblem(change, strict) {
     const { slot, to } = change;
     if (order(slot) < 0)
@@ -219,17 +182,10 @@ function rowProblem(change, strict) {
         return "Gemini cannot review yet. Choose Claude or Codex.";
     return null;
 }
-/** Projects with rows of their own: an installation change reaches them through inheritance. */
 function projectsWithRows(store) {
     return store.handle.prepare(`SELECT scope FROM phase_config WHERE scope != ? UNION SELECT scope FROM phase_tier_config WHERE scope != ?
     UNION SELECT scope FROM phase_tier_alternate WHERE scope != ? ORDER BY scope`).all(INSTALLATION_SCOPE, INSTALLATION_SCOPE, INSTALLATION_SCOPE).map(one => String(one.scope));
 }
-/**
- * Whether tasks can be filed at a scope with its resulting configuration. INCOMPLETE: a role has no exact model yet
- * (setup in progress; saved, and said). INVALID: something set can't run: an unknown provider, an ineligible reviewer,
- * or a route of any size or demand (small, routine, large, risky, strict) whose repair can't resume its builder,
- * inherited rows included. An invalid result is never saved.
- */
 export function checkScope(store, repo, options = {}) {
     const build = resolvePhaseAgent(store, "build", repo, {});
     if (!build.ok)
@@ -237,24 +193,15 @@ export function checkScope(store, repo, options = {}) {
     const plan = resolvePhaseAgent(store, "plan", repo, {});
     if (!plan.ok)
         return { kind: "invalid", problem: plan.problem };
-    // Every live earned rule's route is checked with the configured ones (results routing): a rule's builder must
-    // share any configured repair row's provider, since repairs resume the builder's session. `rules` is the set to
-    // check (an acceptance adds its candidate rule); by default the project's live rules.
     const rules = options.rules ?? liveEarnedRules(store, repo);
     const repairRow = (repo === null ? null : store.phaseConfig(repo, "repair")) ?? store.phaseConfig(INSTALLATION_SCOPE, "repair");
     for (const rule of rules) {
         if (repairRow !== null && repairRow.provider !== rule.provider)
             return { kind: "invalid", problem: `Repairs must use the builder's provider (${rule.provider}): an earned rule builds ${rule.cohortSize === "small" ? "small" : "routine"} tasks on it.` };
     }
-    // The reviewer is not checked here: an unset reviewer follows the planner, and routing deliberately never lets a
-    // reviewer setting stop a task from planning or building (agentconfig.ts resolveRouteCandidates; that leg never
-    // runs). So a Gemini planner with no reviewer of its own stays a valid configuration. A reviewer row written here is
-    // still refused when an ACP agent, and in the editor when Gemini (rowProblem).
     const repair = (repo === null ? null : store.phaseConfig(repo, "repair")) ?? store.phaseConfig(INSTALLATION_SCOPE, "repair");
     if (repair !== null && repair.provider !== build.spec.provider)
         return { kind: "invalid", problem: `Repairs must use the builder's provider (${build.spec.provider}).` };
-    // What is configured is checked first, with a stand-in for any role that has no model yet, so a missing planner
-    // never hides a repair that can't resume its builder: every size's and demand's route, inherited rows included.
     const standIn = (spec) => isProviderId(spec.provider) ? { provider: spec.provider, model: spec.model ?? "not-chosen-yet" } : null;
     const configured = resolveRouteCandidates(store, repo, { plan: standIn(plan.spec), build: standIn(build.spec) });
     if (!configured.ok)
@@ -269,28 +216,19 @@ export function checkScope(store, repo, options = {}) {
         return { kind: /has no exact model/.test(effective.problem) ? "incomplete" : "invalid", problem: effective.problem };
     return { kind: "ok" };
 }
-/** A resolver's words for a browser: what is wrong, never a terminal command to fix it. */
 export function browserWords(problem) {
     const said = problem.split(" — ")[0].replace(/`[^`]*`/g, "").replace(/\s+([:;,.])/g, "$1").replace(/\s{2,}/g, " ").trim();
     return said.length === 0 ? "This choice can't run." : `${said.charAt(0).toUpperCase()}${said.slice(1)}${/[.!?]$/.test(said) ? "" : "."}`;
 }
-/** The problem alone, or null when tasks can be filed. */
 export function scopeProblem(store, repo) {
     const checked = checkScope(store, repo);
     return checked.kind === "ok" ? null : checked.problem;
 }
 const pairWords = (pair) => pair === null ? "not set" : `${pair.provider} · ${pair.model ?? "its default model"}`;
 const ACTION_OF = (slot) => slot.tier === "routine" ? `agent for ${slot.phase} changed` : `${slot.tier} agent for ${slot.phase} changed`;
-/**
- * Apply one change in ONE transaction: re-prove the actor, check the target and that nothing moved since the person
- * looked, check every row, write every set and clear, check the resulting configuration (no scope it reaches, the
- * target or a project inheriting from it, may stop resolving), and ledger before → after for each row. Any refusal
- * rolls everything back: a preset that fails on its last row writes nothing.
- */
 export function applyModelChoices(store, input, authority, now) {
     try {
         return store.transact(() => {
-            // A savepoint, so a refusal rolls back these writes even inside a caller's transaction (project setup).
             store.handle.exec("SAVEPOINT model_choices");
             try {
                 const result = applyLocked(store, input, authority, now);
@@ -321,9 +259,6 @@ function applyLocked(store, input, authority, now) {
             const scope = input.scope;
             if (scope !== INSTALLATION_SCOPE && !input.knownProject(scope))
                 throw new Refused({ ok: false, reason: "unknown-project", problem: "That isn't a project here." });
-            // A page's form or preview: refused when what it showed moved since. The command line shows nothing first
-            // (`expected: null`): its change applies to the rows as they stand inside this transaction, and the result is
-            // checked below against exactly those rows, so concurrent command-line writers serialize instead of refusing.
             if (input.expected !== null) {
                 if (stateDigest(store, scope) !== input.expected.state)
                     throw new Refused({ ok: false, reason: "stale", problem: "Models changed since this page loaded. Nothing was saved. Review the current choices and try again." });
@@ -345,7 +280,6 @@ function applyLocked(store, input, authority, now) {
             for (const row of diff) {
                 const { slot, after } = row;
                 if (slot.tier === "routine") {
-                    // setPhaseConfig keeps its own before → after entry.
                     if (after !== null) {
                         store.setPhaseConfig(scope, slot.phase, after.provider, after.model, authority.actor, now);
                         continue;
@@ -363,8 +297,6 @@ function applyLocked(store, input, authority, now) {
             let extra = 0;
             for (const op of input.extra ?? [])
                 extra += extraWrite(store, scope, repo, op, authority.actor, now);
-            // INVALID is never saved, for the target or any project inheriting from it. INCOMPLETE (a role with no exact
-            // model yet) is saved and said for the target; another project that could file tasks before must still.
             let unresolved = null;
             for (const target of affected) {
                 const checked = checkScope(store, target);
@@ -381,14 +313,12 @@ function applyLocked(store, input, authority, now) {
         }
     }
 }
-/** The latest runs' floating or exact choice next to the model their provider reported: no verdict. */
 export function recentRuns(store, limit = 8) {
     return store.handle.prepare(`SELECT run.id, task_ref.external_id, run.role, run.model, run.model_reported, run.started_at FROM run
     JOIN task_ref ON task_ref.id = run.task_ref ORDER BY run.started_at DESC, run.id DESC LIMIT ?`).all(Math.max(1, Math.min(limit, 50)))
         .map(row => ({ runId: Number(row["id"]), taskId: String(row["external_id"]), role: String(row["role"]), chosen: row["model"] == null ? null : String(row["model"]),
         ranOn: row["model_reported"] == null ? null : String(row["model_reported"]), at: String(row["started_at"]) }));
 }
-/** One of the command line's other rows, ledgered; how many rows it changed. */
 function extraWrite(store, scope, repo, op, actor, now) {
     const ledger = (action, detail) => store.recordAction({ at: now.toISOString(), actor, repo, taskId: null, runId: null, action, outcome: "changed", source: "policy", detail });
     if (op.kind === "legacy-light-clear") {
@@ -419,13 +349,9 @@ function extraWrite(store, scope, repo, op, actor, now) {
     ledger(`other-provider ${op.tier} agent for ${op.phase} changed`, `${pairWords(before)} → ${pairWords({ provider: op.provider, model: op.model })}`);
     return 1;
 }
-// ---- a first agent's default routing (easy start) -------------------------------
-/** Codex's exact ids for its "Sized by job" preset: the frontier model plans, reviews and builds large or risky
- * work, the workhorse builds routine work, the small model builds small work (the ids Codex lists as of 2026-11). */
 export const CODEX_FRONTIER = "gpt-6-astra";
 export const CODEX_WORKHORSE = "gpt-6-sol";
 export const CODEX_SMALL = "gpt-6-luna";
-/** Each agent's default preset: what a new installation runs on once that agent is chosen and nothing is set yet. */
 export const AGENT_PRESETS = Object.freeze({
     claude: PRESETS[DEFAULT_PRESET],
     codex: {
@@ -434,23 +360,15 @@ export const AGENT_PRESETS = Object.freeze({
         rows: { plan: CODEX_FRONTIER, "plan-strong": CODEX_FRONTIER, "build-light": CODEX_SMALL, build: CODEX_WORKHORSE, "build-strong": CODEX_FRONTIER, repair: null, "repair-strong": null, review: CODEX_FRONTIER, "review-strong": CODEX_FRONTIER },
     },
 });
-/** An agent's default preset as a change: every slot, exact ids, repairs following each size's builder. */
 export function agentPresetChange(agent) {
     return ALL_SLOTS.map(slot => {
         const model = AGENT_PRESETS[agent].rows[slotKey(slot)];
         return { slot, to: model === null || model === undefined ? null : { provider: agent, model } };
     });
 }
-/** The chat provider a lead runs on, as the agent whose preset it brings; null for a direct API. */
 export function defaultAgentOf(provider) {
     return provider === "claude-subscription" ? "claude" : provider === "codex-subscription" ? "codex" : null;
 }
-/**
- * A new installation's first routing: the chosen agent's default preset, written only while NOTHING is set — no role
- * row, tier row or other-provider candidate at the installation or any project — so it never overwrites a choice.
- * Checked and written in one transaction (the caller's, when it has one: the lead's own write rides with it), each row
- * ledgered, the result checked like any apply; a refusal writes nothing.
- */
 export function fillDefaultRouting(store, agent, actor, door, now) {
     const refused = (reason, problem) => ({ filled: false, reason, problem });
     return store.transact(() => {
@@ -461,13 +379,14 @@ export function fillDefaultRouting(store, agent, actor, door, now) {
             }
         }
         else if (!localModeOn(store)) {
-            // The first start's own choice (serve.ts leadByDefault): it may run inside whichever request asked this computer's
-            // agents again, so it reads no principal; local mode on, and nothing set (below), is what admits it.
             return refused("authority", "Only a laptop install's first start chooses its models by itself.");
         }
         const anyRow = store.handle.prepare("SELECT 1 FROM phase_config UNION ALL SELECT 1 FROM phase_tier_config UNION ALL SELECT 1 FROM phase_tier_alternate LIMIT 1").get();
         if (anyRow !== undefined)
             return refused("already-set", "Models are already chosen here.");
+        if (door.kind === "first-start" && store.handle.prepare("SELECT 1 FROM models_generation LIMIT 1").get() !== undefined) {
+            return refused("already-set", "Models were chosen here before.");
+        }
         store.handle.exec("SAVEPOINT default_routing");
         try {
             let rows = 0;
@@ -498,3 +417,9 @@ export function fillDefaultRouting(store, agent, actor, door, now) {
         }
     });
 }
+export function fillRoutingOnSignIn(store, states, now) {
+    const agent = states?.claude === "connected" ? "claude" : states?.codex === "connected" ? "codex" : null;
+    if (agent === null)
+        return null;
+    return fillDefaultRouting(store, agent, "toolroll", { kind: "first-start" }, now);
+}

package/dist/model-names.js

@@ -1,15 +1,8 @@
-/**
- * One name per model, on every screen that names one (Settings revamp S4): the label the Models editor offers for a
- * Claude id (`CLAUDE_EXACT`), the same words for a Claude id that list doesn't carry yet, and the id itself for
- * anything else. Display only: saved rows, approvals, JSON and the CLI keep the exact id.
- */
 import { CLAUDE_EXACT } from "./model-catalog.js";
 import { providerName } from "./provider-auth.js";
 const CLAUDE_PROVIDERS = new Set(["claude", "claude-subscription", "anthropic-api"]);
 const LABELS = new Map(CLAUDE_EXACT.map(one => [one.value, one.label]));
 const FAMILY = /^(?:claude-)?(opus|sonnet|haiku|fable)(?:-(\d+(?:-\d+)*))?$/;
-/** The display name for a model id: "claude-opus-5-5" → "Claude Opus 5.5", "opus" → "Claude Opus"; an id it doesn't
- * know stays the id. `null`, empty or "default": the provider's own default. */
 export function modelName(provider, id) {
     if (id === null || id.trim() === "" || id === "default")
         return "the default model";
@@ -23,8 +16,6 @@ export function modelName(provider, id) {
     }
     return id;
 }
-/** The agent and its model in one phrase: "Claude Opus 5.5", "Codex · gpt-5.5", or the agent alone when no model is
- * pinned. A model name that already says its agent isn't said twice. */
 export function agentModelName(provider, id) {
     const agent = providerName(provider);
     if (id === null || id.trim() === "" || id === "default")

package/dist/models-cli.js

@@ -1,5 +1,3 @@
-/** `toolroll models …`: what each CLI can run, whether the CLIs are
- * current, and the automatic check. The same saved catalog as Settings → Models. */
 import { envelopeJson } from "./envelope.js";
 import { checkModels, isNewModel, modelOptions, priceWords, RUNTIME_TOOLS, runtimeStates, seenModels, setWatch, updateRuntime, watchState } from "./model-catalog.js";
 import { isProviderId } from "./provider.js";
@@ -49,8 +47,6 @@ export async function runModelsCommand(positional, options, context) {
     const ok = (result, lines) => { context.write(context.json ? envelopeJson({ ok: true, command, ...result }) : lines.join("\n")); return 0; };
     if (!MODELS_DESCRIPTORS.some(one => one.action === action))
         return fail("usage", "Use models status | list --provider <p> | check | update <claude|codex|gemini> | watch on|off | results | suggestions | accept <id> | dismiss <id> | turn-off <rule> | keep <rule> | try <id> | stop <trial>.");
-    // This computer's local owner (local mode, through the terminal UI) may turn a rule off and say Not now: the door
-    // re-checks that its in-flight act is exactly that one.
     const local = currentLocalOwner();
     if (context.actor === null && !(local !== null && (action === "turn-off" || action === "dismiss" || action === "suggestions" || action === "stop")))
         return fail("unauthenticated", "Sign in first: the remembered local login drives models commands.");
@@ -101,8 +97,6 @@ export async function runModelsCommand(positional, options, context) {
     setWatch(store, wanted === "on", actor, now);
     return ok({ enabled: wanted === "on" }, [wanted === "on" ? "Automatic checks are on: every 6 hours, with a message for each new model or CLI update." : "Automatic checks are off."]);
 }
-/** `models results [--repo <p>]`: the saved result records of the projects this person can open, newest first — the
- * same records the task page's "Result record" line reads. Read-only. */
 function modelsResults(options, context, ok, fail) {
     const { store } = context;
     for (const key of options.keys())
@@ -122,12 +116,6 @@ function modelsResults(options, context, ok, fail) {
         ? ["No result records yet. A record starts when a task's first build runs."]
         : [summary, ...records.map(one => `${one.task} · ${one.model ?? "unknown model"}${one.size === null ? "" : ` · ${one.size}`} · ${one.words}`)]);
 }
-/**
- * Earned rules on the command line (docs/plans/results-routing.md, slice 2), the same doors Settings → Models uses:
- * `suggestions` reads; `accept` and `keep` take the person's own proof, re-proved inside the write (a lead token or a
- * remote token is refused there); `turn-off` and `dismiss` take the person, or this computer's local owner inside
- * exactly that act.
- */
 function modelsRules(action, positional, options, context, ok, fail, asLocal) {
     const { store, now } = context;
     const allowed = action === "suggestions" ? ["repo", "json", "db", "as", "token", "token-file", "token-env"] : ["repo", "json", "db", "as", "token", "token-file", "token-env"];
@@ -152,7 +140,6 @@ function modelsRules(action, positional, options, context, ok, fail, asLocal) {
                 evidence: one.evidence, configuredEvidence: one.configuredEvidence, prices: one.prices, terms: grantWords(one.grant), words: suggestionWords(one) })),
             rules: rules.map(one => ({ id: one.id, repo: one.repo, size: one.cohortSize, model: one.model, configured: one.configured, state: one.state, acceptedAt: one.acceptedAt,
                 acceptedBy: one.acceptedBy, expires: one.grant?.expires ?? null, endedAt: one.endedAt, endReason: one.endReason, words: ruleWords(store, one) })),
-            // Slice 3: cheaper models to try where results don't yet suggest one, and the trials in use.
             trialOffers: trialOffers.map(one => ({ id: one.id, repo: one.repo, size: one.cohortSize, model: one.model, name: one.name, configured: one.configured,
                 evidence: one.evidence, configuredEvidence: one.configuredEvidence, prices: one.prices, places: one.places, words: trialOfferWords(one) })),
             trials: trials.map(one => ({ id: one.id, repo: one.repo, size: one.cohortSize, model: one.model, configured: one.configured, state: one.state, startedAt: one.acceptedAt,

package/dist/models-ui.js

@@ -1,13 +1,9 @@
-/** Settings → Models, in the kit's Settings frame (a sub-page of "Agents and models"): what is in use and the one
- * choice (a preset, previewed before it applies), then the model for each role behind a disclosure, the CLIs on
- * this computer and the models that just arrived. Saving is an instance operator's step-up. */
 import { html, postForm } from "./html.js";
 import { approvalAsk, termsOf } from "./design/kit.js";
 import { acts, btn, chip, disclose, dock, facts as factList, field, formRow, group, input, note, notice, radios, settingsShell } from "./server/kit.js";
 import { priceWords } from "./model-catalog.js";
 import { whenUtc } from "./when-html.js";
 const when = (iso) => iso === null ? "never" : whenUtc(iso);
-/** The page's own layout on the kit: one-column preset cards, the role pickers in the form rows' control column. */
 export const MODELS_CSS = `.models{display:grid;gap:24px;min-width:0;overflow-wrap:anywhere}.models .k-radios{grid-template-columns:minmax(0,1fr);padding-top:12px}` +
     `.models .k-secthead small{font-weight:400;color:var(--so-muted);font-size:12.5px}.models-presets{display:grid;gap:12px}.models-scope{display:flex;gap:8px;width:100%;max-width:300px;margin:0}.models-scope .k-selw{flex:1;min-width:0}.k-frow-c .models-scope .k-selw{max-width:none}.models-presets .k-acts{padding-top:4px}` +
     `.models .role{display:grid;gap:6px;width:100%;max-width:300px;min-width:0}.models .role .k-input{max-width:none}.models-editor{display:grid;gap:12px;padding-top:4px}` +
@@ -18,8 +14,6 @@ const sec = (id, title, state, body) => html `<section class="k-sec" aria-labell
 const back = (view) => `/settings/models${view.scope.value === "installation" ? "" : `?scope=${encodeURIComponent(view.scope.value)}`}`;
 const scopeQuery = (view) => view.scope.value === "installation" ? "" : `&scope=${encodeURIComponent(view.scope.value)}`;
 const factsOf = (view) => view.facts ?? { passwordless: false, remembered: false };
-/** The step-up's password, only when the rules ask for it (never under Passwordless). Named `password`, as the
- * model posts read it; the server proves it again in the write. */
 function password(view, id) {
     return approvalAsk("step-up", factsOf(view)) === "password"
         ? field({ id, label: "Your password", control: input({ id, name: "password", type: "password", attrs: { autocomplete: "current-password", required: true } }) })
@@ -62,7 +56,6 @@ ${formRow("Automatic checks", `${view.watch.enabled ? "On" : "Off"}. Every 6 hou
     const body = html `<div class="models">${outcome}${preview}${choiceSection(view, manage, previewing)}${suggestedSection(view)}${recentSection(view)}${sec("tools", "AI tools on this computer", "", html `${tools}${checks}`)}${fresh}${chat}</div>`;
     return settingsShell({ group: "agents", sub: true, title: "Models", lead: "Which model plans, builds and reviews each task. Changes apply to tasks filed from now on.", body });
 }
-/** Filters one long picker as you type; the saved choice always stays listed. */
 export function modelsScript() {
     return `(function(){document.querySelectorAll('.models .role').forEach(function(form){
     var search=form.querySelector('[data-model-filter]'),select=form.querySelector('select');
@@ -73,8 +66,6 @@ export function modelsScript() {
       select.value=chosen;});
   })})();`;
 }
-/** What is in use and the one choice (a preset, previewed before it applies); the model for each role behind a
- * disclosure, saved with one step-up; how tasks are sized, on demand. */
 function choiceSection(view, manage, previewing) {
     const inUse = view.inUse === null ? "a custom set" : view.inUse;
     const scopes = view.scope.options.length < 2 ? "" : formRow("Settings for", "A project can follow these or choose its own.", html `<form method="get" action="/settings/models" class="models-scope">\
@@ -96,7 +87,6 @@ ${radios({ name: "preset", legend: "Preset", current, items: presetItems })}${ac
     return html `${sec("choice", "Models for new tasks", `in use: ${inUse}${view.scope.value === "installation" ? "" : ` · ${view.scope.label}`}`, html `${scopes}${unresolved}${presets}${newer}`)}\
 ${disclose("Model for each role", editor)}${sizingSection(view)}${docked}`;
 }
-/** A preset or a switch shows exactly what it changes, and applies only with a second, step-up submit. */
 function previewSection(view, manage) {
     const preview = view.preview;
     if (preview === null || !manage)
@@ -108,7 +98,6 @@ function previewSection(view, manage) {
     const form = postForm("/settings/models/apply", html `${note(`Tasks filed from now on use these. ${termsOf("step-up", factsOf(view))}`)}${password(view, "models-apply-pw")}${acts(btn(label, { variant: "primary", type: "submit", docked: true }), btn("Cancel", { variant: "ghost", href: back(view) }))}`, { hidden: preview.hidden, attrs: { id: "models-apply", class: "models-editor" } });
     return html `<div class="models-diff">${sec("preview", preview.title, "", html `${rows}${form}`)}</div>${dock(btn(label, { variant: "primary", type: "submit", attrs: { form: "models-apply" } }))}`;
 }
-/** How a task's size is decided, in plain words, and what routing does at filing; on demand. */
 function sizingSection(view) {
     const waiting = view.waiting.length === 0 ? "" : html `<p>${view.waiting.length} plan${view.waiting.length === 1 ? "" : "s"} waiting for approval keep the models they were filed with: ${view.waiting.map((one, index) => html `${index === 0 ? "" : ", "}<a class="k-link" href="/t/${encodeURIComponent(one.taskId)}">${one.title}</a>`)}.</p>`;
     return disclose("How tasks are sized", html `<div class="models-sizing"><p>Each task is sized once, when it is filed. ${view.sizing.classifier} If it doesn't answer within 5 seconds, the size comes from the description.</p>${factList([
@@ -117,15 +106,11 @@ function sizingSection(view) {
         ["Large or risky", `Large: ${view.sizing.large}. Risky: ${view.sizing.risky} Planned and built by the large or risky models.`],
     ])}<p>${view.routing}</p><p>Changing a model never re-sizes or re-routes a task that was already filed. One exception: an older build review saved without its own route uses the reviewer set here now.</p>${waiting}</div>`);
 }
-/** The model each recent run was set to, next to the model its provider reported. */
 function recentSection(view) {
     if (view.recent.length === 0)
         return "";
     return sec("recent", "Recent work", "", view.recent.map(one => formRow(one.role, `Chosen ${one.chosen} → ran on ${one.ranOn}`, html `<a class="k-link k-mono" href="/t/${encodeURIComponent(one.taskId)}">${one.taskId}</a>`, "inline")));
 }
-/** Settings → Models → Suggested (docs/plans/results-routing.md slice 2): what a project's own results suggest, each
- * reviewed before it's saved with a step-up; the rules in force with Turn off (Keep or Drop when paused); and the
- * project's "Suggest cheaper models" switch. Turning off and Not now only take authority away: no password. */
 function suggestedSection(view) {
     const s = view.suggested;
     if (s === undefined)
@@ -148,8 +133,6 @@ function suggestedSection(view) {
         : one.state === "paused"
             ? acts(postForm("/settings/models/keep", html `${password(view, `models-keep-${one.id}`)}${btn("Keep", { sm: true, type: "submit" })}`, { hidden: { scope: one.repo, rule: String(one.id) } }), postForm("/settings/models/turn-off", btn("Drop", { sm: true, variant: "ghost", type: "submit" }), { hidden: { scope: one.repo, rule: String(one.id) } }))
             : postForm("/settings/models/turn-off", btn("Turn off", { sm: true, type: "submit" }), { hidden: { scope: one.repo, rule: String(one.id) } }), "top"));
-    // Trials (slice 3): an offer to try a cheaper model on the next few tasks — started with a step-up, each task still
-    // approved by a person — and the trials in use, each with its progress and Stop (stopping only lowers: no password).
     const trialOffers = (s.trialOffers ?? []).map(one => formRow(s.repo === null ? `${one.title} · ${one.project}` : one.title, one.words, manage
         ? acts(postForm("/settings/models/try", html `${password(view, `models-try-${one.id.replace(/[^a-z0-9]/gi, "-")}`)}${btn(one.save, { sm: true, type: "submit" })}`, { hidden: { scope: one.repo, id: one.id } }), postForm("/settings/models/not-now", btn("Not now", { sm: true, variant: "ghost", type: "submit" }), { hidden: { scope: one.repo, id: one.id } }))
         : html ``, "top"));

package/dist/modes.js

@@ -1,26 +1,8 @@
-/**
- * Operating modes (v29, the modes chain v1–v7): a per-repository,
- * password-signed, expiring envelope that pre-authorizes the SIGNER'S OWN
- * future acts. The absence of a mode is 'locked' — every act keeps its
- * own ceremony, today's world, the default forever.
- *
- * The doctrine (v4 ruling): RAISING authority is a password ceremony;
- * LOWERING it is one click for any approver; on revocation or expiry
- * every mode-derived flow falls back to the human ceremony at its next
- * gate, and running work is never fenced.
- *
- * This module owns the terms shape, the digest, and the words. The store
- * owns the transactions; the tick owns the rails; serve owns the
- * ceremony screens.
- */
 import { createHash } from "node:crypto";
 import { CHAT_PROVIDERS, isChatProvider } from "./contracts/chat-tables.js";
 import { canonicalJson } from "./canonical-json.js";
 export const MODE_MAX_DAYS = 7;
-/** Repairs of one failed check's chain: what a person can start, and what the console's choice signs. The CLI signs 1 to 3. */
 export const CHECK_REPAIR_LIMIT = 2;
-/** The presets are STARTING POINTS the ceremony renders in full — the
- * signature always covers the resolved terms, never a label. */
 export function presetTerms(name, absoluteExpiry) {
     return name === "standard"
         ? {
@@ -63,15 +45,12 @@ export function presetTerms(name, absoluteExpiry) {
 export function modeTermsJson(terms) {
     return canonicalJson(terms);
 }
-/** sha256 over a domain-separated canonical encoding, 32 hex like every
- * other safety digest here. */
 export function modeDigestOf(terms) {
     return createHash("sha256")
         .update(`standing-orders:mode:${modeTermsJson(terms)}`, "utf8")
         .digest("hex")
         .slice(0, 32);
 }
-/** Strict rehydration — anything unexpected is null, never a guess. */
 export function modeTermsFromJson(json) {
     if (json === null)
         return null;
@@ -100,19 +79,11 @@ export function modeTermsFromJson(json) {
         measured !== undefined &&
         runs !== undefined &&
         (t["publication"] === "notify" || t["publication"] === "automerge") &&
-        // allowPaidFallback (historical): absent reads as false; a present
-        // value must be a strict boolean, anything else is a bad envelope.
         (t["allowPaidFallback"] === undefined || typeof t["allowPaidFallback"] === "boolean") &&
-        // repairAuto/repairMaxAttempts: the SAME precedent, verbatim (v40). A
-        // legacy mode has NO such fields — that MUST read as false/0, never
-        // inherited. A present repairAuto must be a strict boolean; a present
-        // repairMaxAttempts must be an integer 0..3. Anything else is a bad
-        // envelope, null.
         (t["repairAuto"] === undefined || typeof t["repairAuto"] === "boolean") &&
         (t["repairMaxAttempts"] === undefined ||
             (typeof t["repairMaxAttempts"] === "number" && Number.isInteger(t["repairMaxAttempts"]) && t["repairMaxAttempts"] >= 0 && t["repairMaxAttempts"] <= 3)) &&
         (t["chatApprove"] === undefined || typeof t["chatApprove"] === "boolean") &&
-        // chatApproveChats: absent (a Telegram-only grant, or none), or the apps a chatApprove term names, each once.
         (t["chatApproveChats"] === undefined ||
             (t["chatApprove"] === true && Array.isArray(t["chatApproveChats"]) && t["chatApproveChats"].length > 0 &&
                 t["chatApproveChats"].every(isChatProvider) && new Set(t["chatApproveChats"]).size === t["chatApproveChats"].length)) &&
@@ -140,18 +111,12 @@ export function modeTermsFromJson(json) {
     }
     return null;
 }
-/** The chat apps a mode lets its signer approve from: none without chatApprove; Telegram alone for a grant signed
- * before it named its apps (that is what its words said); otherwise exactly the apps it names. */
 export function chatApproveChatsOf(terms) {
     return !terms.chatApprove ? [] : terms.chatApproveChats ?? ["telegram"];
 }
-/** What a new chatApprove signature names: every chat app, said in its words. */
 export const CHAT_APPROVE_ALL = CHAT_PROVIDERS;
 const CHAT_NAMES = { telegram: "Telegram", slack: "Slack", discord: "Discord", teams: "Teams" };
-/** "Telegram", "Telegram or Slack", "Telegram, Slack, Discord or Teams". */
 export const chatNames = (chats) => chats.length <= 1 ? chats.map(one => CHAT_NAMES[one]).join("") : `${chats.slice(0, -1).map(one => CHAT_NAMES[one]).join(", ")} or ${CHAT_NAMES[chats[chats.length - 1]]}`;
-/** Every term in words — what the ceremony renders and the password
- * signs. The reversal sentence is verbatim from the chain (C1). */
 export function modeWords(terms) {
     return [
         terms.permissionDefault === "escalated"