toolroll 0.9.15 → 0.9.17

package/dist/serve.js

@@ -1,3 +1,5 @@
+import { checkLeadIdentity, leadIdentityOf, leadNameOf, LEAD_NAME_MAX, LEAD_PERSONA_MAX } from "./lead-identity.js";
+import { aboutYouOf, checkAboutYou, saveAboutYou, ABOUT_YOU_LINE_MAX, ABOUT_YOU_MAX_LINES } from "./lead-about.js";
 import { withActor } from "./actor.js";
 import { repositoryContext, repositoryContextRead } from './repository-context.js';
 import { ADD_TESTS_ACTION, followUpChecksOf, requestFollowUpChecks, fileAddTestsTask, resultCheckLevel } from './result-follow-ups.js';
@@ -6,6 +8,7 @@ import { repositoryContextHtml } from './repository-context-ui.js';
 import { browserAssetsAvailable, browserWorkspaceDocument, serveBrowserAsset } from './browser-shell.js';
 import { browserCrewOf, browserCrewFromIndex, browserWorkActionHref, browserProjectsOf, browserNavigationOf } from './browser-workspace.js';
 import { configureLeadFollow, leadFollowStatus, runLeadFollowPass } from './lead-follow.js';
+import { cancelCommitment, conditionWords, openCommitments } from './lead-commitments.js';
 import { startMaintenance } from './maintenance.js';
 import { codingHandoffPreview, createCodingHandoff } from './coding-handoff.js';
 import { codingShippingHtml, CODING_SHIPPING_CSS } from './coding-shipping-ui.js';
@@ -18,7 +21,7 @@ import { ChatState } from "./chat-delivery-state.js";
 import { slackSettingsHtml } from "./slack-settings.js";
 import { checkSlackCredentials, loadSlackCredentials, saveSlackCredentials, clearSlackCredentials, SLACK_MANIFEST, SlackError } from "./slack-api.js";
 import { SlackState } from "./slack-state.js";
-import { CHAT_ACTIONS, sharedActionPayload, sharedActionNeedsReview, sharedActionReviewPath, mintSharedActionReview } from './chat-actions.js';
+import { CHAT_ACTIONS, OWNER_ACTIONS, sharedActionPayload, sharedActionNeedsReview, sharedActionReviewPath, mintSharedActionReview } from './chat-actions.js';
 import { changeSkills, githubSkill, importSkill, readSkillsSnapshot, reviseSkillTest, skillTestResult, skillsView, testSkill } from "./project-skills.js";
 import { skillsHtml, skillsScript, skillsSnapshotHtml, skillTestFeedbackHtml, SKILLS_CSS } from "./skills-ui.js";
 import { toolsHtml, TOOLS_CSS } from "./tools-ui.js";
@@ -65,7 +68,7 @@ import { prepareWorkspaceRevision, WorkspaceValidatorCache } from "./workspace-r
 import { workIndexPage, workCountsByProject, WorkIndexCursorError, WORK_INDEX_MAX_LIMIT } from "./work-index.js";
 import { leadActivity } from "./lead-voice.js";
 import { openWorkDecisionOf } from "./work-summary.js";
-import { acceptAndCompleteAsOperator, assignmentOf, checkAssignmentAsOperator, personCheckPending } from './assignment.js';
+import { acceptAndCompleteAsOperator, assignmentOf, checkAssignmentAsOperator, owedAcceptance } from './assignment.js';
 import { demoChatHtml, demoThreadHtml, DEMO_CHAT_SCRIPT } from "./demo-chat.js";
 import { pullRequestSettingsHtml, PULL_REQUEST_SETTINGS_CSS } from './pull-request-ui.js';
 import { checkSettingsHtml, CHECK_SETTINGS_CSS } from './check-levels-ui.js';
@@ -185,7 +188,7 @@ import { dirname } from "node:path";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { loadOrCreateVapidKeys, validatePushEndpoint } from "./push.js";
 import { parseGithubRepo, previewGithubRepo, cloneGithubRepo, listGithubRepos, isLargeRepo } from "./onboard.js";
-import { verifiedAuthor, LEAD_THREAD, isDigestTime } from "./store.js";
+import { verifiedAuthor, LEAD_THREAD, isDigestTime, MATE_ASK_OTHER } from "./store.js";
 import { digestTimes } from "./digest-times.js";
 import { updateRepos, addRepos, removeRepos } from "./repos.js";
 import { run as execRun } from "./exec.js";
@@ -210,7 +213,7 @@ import { authorizedProject, canonicalProject, isGitRepo, projectName, sameRepo,
 import { tally, spendLine, runCostWords } from "./summary.js";
 import { classify, holdOwnerWords, attentionCardForUnverifiedDone } from "./board.js";
 import { approveRoutine, describeSchedule, fireRoutine, parseSchedule, refreshRoutineAgents, routineAgentsState, routineDigestOf, validateRoutineTerms, ROUTINE_NAME } from "./routine.js";
-import { effectivePrimary, isMessagingChannel, savePrimary } from "./webhooks.js";
+import { effectivePrimary, isMessagingChannel, loadConsoleUrl, savePrimary } from "./webhooks.js";
 import { resolvePhaseAgent, resolveRoutineAuthority, INSTALLATION_SCOPE, routeOfTask, agentChoicesFor } from "./agentconfig.js";
 import { isRiskLevel, projectRoute, riskTitle, riskConsequence, chosenWords, agentsSummary, postureWords, RISK_CHOICES, RISK_LEVELS, PHASES as ROUTE_PHASES } from "./phase-routing.js";
 import { ALL_CREDENTIAL_ENV, isProviderId, reportsCost, PROVIDER_IDS, validModelId, validateSpec } from "./provider.js";
@@ -258,6 +261,7 @@ import { handleTeamsHttp } from "./teams.js";
 import { checkTeamsCredentials, clearTeamsCredentials, loadTeamsCredentials, saveTeamsCredentials, TeamsError } from "./teams-api.js";
 import { verifyApproverByPassword, verifyApproverStanding } from "./principal.js";
 import { runMateTurn, MATE_MESSAGE_MAX_CHARS } from "./mate.js";
+import { replyHtmlInline, shapeReply } from "./reply-shape.js";
 import { confirmCoordinatorProposal, confirmMateProposal, dismissCoordinatorProposal, dismissMateProposal } from "./mate-doors.js";
 import { envValue } from "./names.js";
 import { cachedRelease, isNewer, runnerVersions, setUpdateChecks, updateChecksOff } from "./releases.js";
@@ -1527,6 +1531,8 @@ export function createDecisionServer(options) {
             actor: who.name,
             csrf: who.via === "cookie" ? who.session.csrf : "",
             returnTo: safeReturn(url.pathname + url.search),
+            // This console's own addresses: a lead reply's links there read as "the task", "the result", "Settings → Lead".
+            appOrigins: [consoleOrigin(request.headers.host), publicOrigin?.origin ?? null, options.configDir === undefined ? null : loadConsoleUrl(process.env, options.configDir)],
             // Every signed-in page shares the workspace shell; pages showing a one-time secret opt out (forceSensitive).
             browser: who.via === 'cookie',
             // v100: signed in with the identity provider: its label, and whether it checked them recently enough to stand in for a password.
@@ -1632,7 +1638,7 @@ export function createDecisionServer(options) {
             }
             if (admitted && proposal) {
                 const taskId = typeof action?.request['task'] === 'string' ? action.request['task'] : typeof proposal.payload['task'] === 'string' ? proposal.payload['task'] : null;
-                const repo = action?.repo ?? (taskId ? store.lookupRef(taskId)?.repo : null) ?? (typeof proposal.payload['repo'] === 'string' ? proposal.payload['repo'] : null);
+                const repo = (action?.repo || null) ?? (taskId ? store.lookupRef(taskId)?.repo : null) ?? (typeof proposal.payload['repo'] === 'string' ? proposal.payload['repo'] : null);
                 return { repo, taskId, runId: typeof action?.request['run'] === 'number' ? action.request['run'] : null, action: action?.operation ?? `chat ${proposal.kind}` };
             }
         }
@@ -1697,6 +1703,9 @@ export function createDecisionServer(options) {
             }
             if (action && proposal && store.getMateThread(proposal.thread)?.approver === who.name && visible(action.repo) && store.accountCanAccess(who.name, action.repo))
                 return true;
+            // A card about the person themselves (what their lead knows about them) is in no project.
+            if (action && proposal && action.repo === '' && OWNER_ACTIONS.has(action.operation) && store.getMateThread(proposal.thread)?.approver === who.name)
+                return true;
             refuse(response, who, 404, 'No such action in your projects.', '/projects');
             return false;
         }
@@ -2465,6 +2474,7 @@ export function createDecisionServer(options) {
                 csrf,
                 canRetryReview: who.via === "cookie" && who.role === "approver",
                 noted: url.searchParams.get("noted") !== null,
+                refusal: Object.hasOwn(RESULT_REFUSALS, url.searchParams.get("refused") ?? "") ? RESULT_REFUSALS[url.searchParams.get("refused")] : null,
                 tab: parseResultTab(url.searchParams.get("tab")),
                 user: who.name,
                 now,
@@ -2914,8 +2924,9 @@ export function createDecisionServer(options) {
             const version = url.searchParams.get("version");
             if (version !== null && !family.versions.some(one => one.id === version))
                 return refuse(response, who, 404, "That version is not available for this task.", taskHref(family.root.id));
+            // A version's own address lands on its family's page, still asking for the plan editor when it did (Chat's Edit plan).
             if (task.taskId !== family.root.id)
-                return redirect(response, `${taskHref(family.root.id)}?version=${encodeURIComponent(task.taskId)}`);
+                return redirect(response, `${taskHref(family.root.id)}?version=${encodeURIComponent(task.taskId)}${url.searchParams.get("edit") === "plan" ? "&edit=plan" : ""}`);
             return taskScreen(response, who, version ?? family.current.id, null, 200, undefined, undefined, url.searchParams.get("edit") === "plan");
         }
         // v103: a task's evidence pack, as a printable page or JSON (the whole family, sealed ledger entries included).
@@ -3482,7 +3493,7 @@ export function createDecisionServer(options) {
             const fragments = known === version
                 ? null
                 : {
-                    thread: mateThreadHtml({ ...rows, focusTask, csrf, now, problem: takeMateNote(csrf, session.id) }),
+                    thread: mateThreadHtml({ ...rows, focusTask, csrf, now, problem: takeMateNote(csrf, session.id), chatProject }),
                     after: mateAfterComposerHtml({ messages: rows.messages, pending: rows.pending, focusTask, csrf }),
                     live: focusTask === null ? null : taskChatLiveRegion(focusTask, csrf, true, rows.pending !== null),
                 };
@@ -4132,8 +4143,10 @@ export function createDecisionServer(options) {
                 returnTo: "/settings/lead",
             };
             const signedIn = localSignIn?.states.claude === "connected" ? "Claude Code" : localSignIn?.states.codex === "connected" ? "Codex" : null;
+            const promises = openCommitments(store, who.name, 50).map(one => ({ id: one.id, what: one.what, when: conditionWords(store, one.condition), until: one.expiresAt }));
             return sendScreen(response, 200, screen("Lead", leadSettingsHtml({ config, facts, words: leadWords(), signedIn, command: agentSignInCommand(),
-                said: url.searchParams.get("said") }), { chrome: chromeFor(project, "settings") }));
+                said: url.searchParams.get("said"), saved: url.searchParams.get("saved") === "1", identity: leadIdentityOf(store, who.name), promises,
+                about: aboutYouOf(store, who.name), aboutSaved: url.searchParams.get("saved") === "about" }), { chrome: chromeFor(project, "settings") }));
         }
         if (url.pathname === "/settings/telegram") {
             // Any approver pairs their OWN phone here; the bot token stays on /settings.
@@ -4432,8 +4445,16 @@ export function createDecisionServer(options) {
         // One reply runs at a time per person; this thread shows it only when
         // the reply is its own.
         const live = store.liveMateTurnFor(who.name);
+        const messages = store.listMateMessages(opened.thread.id, 40);
+        // The lead's question with buttons, while its reply is the last word in the thread.
+        const last = messages.at(-1);
+        const ask = last?.role === "assistant" && last.turn !== null && store.getMateTurn(last.turn)?.approver === who.name ? store.mateAskOpen(last.turn, now) : null;
+        // Answered questions stay readable above the answer; only their buttons go.
+        const asks = new Map(messages.flatMap(one => { const asked = one.role === "assistant" && one.turn !== null ? store.mateAsk(one.turn) : null; return asked === null ? [] : [[asked.turn, asked]]; }));
         return {
-            messages: store.listMateMessages(opened.thread.id, 40),
+            messages,
+            ask,
+            asks,
             proposals,
             decisions: decisionsFor(store, [...proposals, ...coordinatorProposals]),
             coordinatorProposals,
@@ -4508,7 +4529,7 @@ export function createDecisionServer(options) {
         const rows = mateConversationRows(who, principal, focusTask, now, chatProject);
         return {
             sessionId: session.id, user: session.approver, version: mateChatVersion({ ...rows, focusTask }),
-            messages: mateBrowserMessages(rows, who.session.csrf, back),
+            messages: mateBrowserMessages(rows, who.session.csrf, back, { task: focusTask?.id ?? null, project: chatProject }),
             pendingTurnId: rows.pending?.id ?? null, requestId: randomBytes(16).toString("hex"), maxChars: MATE_MESSAGE_MAX_CHARS,
             taskId: focusTask?.id ?? null, resultRunId, project: focusTask === null ? chatProject : null,
         };
@@ -4805,20 +4826,20 @@ export function createDecisionServer(options) {
             if (result.problem.startsWith("status-")) {
                 // The provider ANSWERED with an error: nothing billed.
                 finish({ state: "failed", failureReason: "provider-error", settledMicrousd: 0 });
-                tell(null, "the provider refused the request — nothing was billed");
+                tell(null, "The chat provider turned the request down. Nothing was kept or charged. Try again in a minute.");
             }
             else if (result.problem === "timeout") {
                 finish({ state: "failed", failureReason: "timeout", settledMicrousd: null, unknownSpend: true });
-                tell(null, "the turn timed out; its cost is unknown and chat is blocked until you acknowledge it");
+                tell(null, "The reply took too long and was stopped, and its cost isn't known yet, so chat is paused. Confirm the cost on this page to turn chat back on.");
             }
             else if (result.problem === "network") {
                 finish({ state: "failed", failureReason: "provider-error", settledMicrousd: null, unknownSpend: true });
-                tell(null, "the provider could not be reached after dispatch; cost unknown — acknowledge to re-enable chat");
+                tell(null, "The chat provider stopped responding partway through, and the cost isn't known, so chat is paused. Confirm the cost on this page to turn chat back on.");
             }
             else {
                 // 200 with an unusable wrapper: billed, amount unproven.
                 finish({ state: "failed", failureReason: "malformed-reply", settledMicrousd: null, unknownSpend: true });
-                tell(null, "the provider's response was malformed and was discarded; cost unknown — acknowledge to re-enable chat");
+                tell(null, "The chat provider sent back an answer that couldn't be read, and its cost isn't known, so chat is paused. Confirm the cost on this page to turn chat back on.");
             }
             return;
         }
@@ -4976,7 +4997,8 @@ export function createDecisionServer(options) {
             try {
                 const project = s.chrome.active === 'chat' ? null : s.chrome.project;
                 crew = extras.team?.tasks ? browserCrewFromIndex(extras.team.tasks, extras.team.selected?.id) : requestFacts.workCrew?.project === project ? browserCrewFromIndex(requestFacts.workCrew.page)
-                    : browserCrewOf(store, clock(), { principal: 'operator', repos: managedRepos(), includeUnplaced: false }, { evidenceRoot, project });
+                    // The reader's own lead's claims read "<name> is on it" here too.
+                    : browserCrewOf(store, clock(), { principal: 'operator', repos: managedRepos(), includeUnplaced: false, viewer: requestFacts.actor ?? null }, { evidenceRoot, project });
             }
             catch {
                 notices.push('Crew updates are unavailable. Open Tasks to inspect saved work.');
@@ -5018,6 +5040,7 @@ export function createDecisionServer(options) {
             const request = requestFacts.workspaceRequest;
             const workspace = {
                 version: 1, path: currentPath, title: s.title, user: requestFacts.actor ?? '', csrf: requestFacts.csrf, sensitive,
+                ...(requestFacts.actor ? { leadName: leadNameOf(store, requestFacts.actor) } : {}),
                 refreshUrl: path.pathname + path.search,
                 receipt: conversation !== null && request && REQUEST_TOKEN.test(request)
                     ? { request, received: store.mateRequestReceipt(conversation.sessionId, request) !== null } : null,
@@ -5123,7 +5146,7 @@ export function createDecisionServer(options) {
         // One line: what this person's lead is doing now and when it last acted.
         const activity = leadActivity(store, who.name);
         const leadTask = activity?.taskId == null ? null : store.lookupRef(activity.taskId);
-        const lead = activity === null ? null : { doing: activity.doing, at: activity.at,
+        const lead = activity === null ? null : { name: activity.name, doing: activity.doing, at: activity.at,
             href: leadTask == null || !admitted(leadTask.repo) ? null : taskHref(familyOf(activity.taskId)?.root.id ?? activity.taskId) };
         return {
             agents, counts, catchUp, allHref: "/work", ...(lead === null ? {} : { lead }),
@@ -5224,7 +5247,7 @@ export function createDecisionServer(options) {
         };
     }
     function workAccess() {
-        // The reader's own lead's claims read "Your lead is on it" (lead-voice.ts); nobody else's.
+        // The reader's own lead's claims read "<name> is on it" (lead-voice.ts); nobody else's.
         return { principal: 'operator', repos: admissionList(), includeUnplaced: visible(null), viewer: requestContext.getStore()?.actor ?? null };
     }
     // All project counts are read together. No task artifacts or processes are
@@ -9206,6 +9229,35 @@ export function createDecisionServer(options) {
         }
         // Turn the lead on with the agent signed in on this computer: its membership spends no dollars, so like starting a
         // conversation it needs no second password; the full form (Advanced) still asks for one.
+        // Settings → Lead: the name and persona this person's lead speaks with.
+        if (url.pathname === "/settings/lead/identity") {
+            if (who.via !== "cookie" || who.role !== "approver")
+                return refuse(response, who, 403, "An approver names their lead.", "/settings/lead");
+            const checked = checkLeadIdentity(body.get("name") ?? "", body.get("persona") ?? "");
+            if (!checked.ok)
+                return redirect(response, chatReturnWithSaid("/settings/lead", checked.message));
+            store.setLeadConfig(who.name, checked.identity.name, checked.identity.persona, now);
+            return redirect(response, "/settings/lead?saved=1");
+        }
+        // Settings → Lead: what this person's lead knows about them, one line each.
+        if (url.pathname === "/settings/lead/about") {
+            if (who.via !== "cookie" || who.role !== "approver")
+                return refuse(response, who, 403, "An approver edits what their lead knows about them.", "/settings/lead");
+            const checked = checkAboutYou(body.get("about") ?? "");
+            if (!checked.ok)
+                return redirect(response, chatReturnWithSaid("/settings/lead", checked.message));
+            saveAboutYou(store, who.name, checked.lines, now);
+            return redirect(response, "/settings/lead?saved=about");
+        }
+        // Settings → Lead: stop the lead following up on one of your promises.
+        if (url.pathname === "/settings/lead/promise/cancel") {
+            if (who.via !== "cookie" || who.role !== "approver")
+                return refuse(response, who, 403, "An approver manages the lead's promises.", "/settings/lead");
+            const id = Number(body.get("promise"));
+            const done = Number.isSafeInteger(id) && cancelCommitment(store, who.name, id, who.name, "Cancelled in Settings.", now);
+            // The promise leaving the list says it was cancelled; only a refusal needs words.
+            return redirect(response, done ? "/settings/lead" : chatReturnWithSaid("/settings/lead", "That promise was already closed."));
+        }
         if (url.pathname === "/settings/lead/on") {
             if (who.via !== "cookie" || who.role !== "approver")
                 return refuse(response, who, 403, "An approver turns the lead on.", "/settings/lead");
@@ -9519,7 +9571,7 @@ export function createDecisionServer(options) {
                 }
                 const opened = store.openMateThread(who.name, principal.ceilingDigest, now, chatScopeOf(focusTask, chatProject));
                 const onProgress = beginLiveTurn(opened.thread.id);
-                void runMateTurn({ store, who: principal, session: mateSession, thread: opened.thread, config: enabled.config, key: enabled.key, message, onProgress, ...(requestId === null ? {} : { requestId }), ...(focusTask === null && chatProject !== null ? { context: `Current project: ${projectName(chatProject)} (${chatProject}). Keep this conversation about that project unless the operator explicitly asks to broaden it; use it as the repo for project tools.` } : {}), ...(focusTask === null ? {} : { context: `Current task: ${focusTask.id}. Read it with get_task before answering or proposing changes. Read its currentExecution next and bind new actions to that exact execution. Never replace the target of a prior proposal with a newer revision. Keep this turn about that task unless the operator explicitly asks to broaden it.${resultContext}${modeContext}` }), fetcher: chatFetcher, ...(options.subscriptionChatRunner === undefined ? {} : { subscriptionRunner: options.subscriptionChatRunner }), clock, evidenceRoot })
+                void runMateTurn({ store, who: principal, session: mateSession, thread: opened.thread, config: enabled.config, key: enabled.key, message, onProgress, channel: "console", ...(requestId === null ? {} : { requestId }), ...(focusTask === null && chatProject !== null ? { context: `Current project: ${projectName(chatProject)} (${chatProject}). Keep this conversation about that project unless the operator explicitly asks to broaden it; use it as the repo for project tools.` } : {}), ...(focusTask === null ? {} : { context: `Current task: ${focusTask.id}. Read it with get_task before answering or proposing changes. Read its currentExecution next and bind new actions to that exact execution. Never replace the target of a prior proposal with a newer revision. Keep this turn about that task unless the operator explicitly asks to broaden it.${resultContext}${modeContext}` }), fetcher: chatFetcher, ...(options.subscriptionChatRunner === undefined ? {} : { subscriptionRunner: options.subscriptionChatRunner }), clock, evidenceRoot })
                     .then(outcome => {
                     if (!outcome.ok)
                         noteMate(who.session.csrf, "turn" in outcome ? outcome.turn : null, outcome.message);
@@ -11019,8 +11071,14 @@ export function createDecisionServer(options) {
                         throw error;
                     saved = { ok: false, status: 409, message: "Not saved: this would change what the agent may do. Change permissions in Details, under edit the scope." };
                 }
-                if (!saved.ok)
-                    return taskScreen(response, who, taskId, saved.message, saved.status, body);
+                if (!saved.ok) {
+                    // Refused because the plan moved on: the draft comes back with the version now on file, so saving it
+                    // again (having read the reason) can succeed instead of being refused the same way.
+                    const draft = new URLSearchParams(body);
+                    if (saved.status === 409)
+                        draft.set("sawDigest", store.getScope(taskId)?.digest ?? "");
+                    return taskScreen(response, who, taskId, saved.message, saved.status, draft);
+                }
                 return redirect(response, taskHref(taskId));
             }
             case "approve": {
@@ -11135,8 +11193,13 @@ export function createDecisionServer(options) {
                     note = validated.note;
                 }
                 // A failed task's result is accepted only anyway, on purpose: with a reason.
-                if (note === null && store.getTask(taskId)?.state === "failed")
-                    return taskScreen(response, who, taskId, "Accepting anyway needs a reason.", 400);
+                if (note === null && store.getTask(taskId)?.state === "failed") {
+                    // Posted from the result page: back there, where the reason field is, with the refusal said on it.
+                    const back = body.get("return") === null ? null : safeReturn(body.get("return"));
+                    if (back !== null && back.startsWith("/review?"))
+                        return redirect(response, withRefusal(back, "reason"));
+                    return taskScreen(response, who, taskId, ACCEPT_ANYWAY_NEEDS_REASON, 400);
+                }
                 store.acceptProof(latest.id, verifiedAuthor(who.name), note, now);
                 return redirect(response, body.get("return") === null ? taskHref(taskId) : safeReturn(body.get("return")));
             }
@@ -11166,7 +11229,7 @@ export function createDecisionServer(options) {
                     const publish = body.get("publish") === "1";
                     const finished = acceptAndCompleteAsOperator(store, taskId, { runId: Number(namedRun), receiptDigest: digest, note }, principal, now, evidenceRoot, publish ? accepted => completeAndOpenPullRequest(store, { taskId, digest: accepted, runId: Number(namedRun), who: principal, root: evidenceRoot }, now) : undefined);
                     if (!finished.ok)
-                        return taskScreen(response, who, taskId, finished.message, 409);
+                        return taskScreen(response, who, taskId, finished.message, finished.reason === "needs-reason" ? 400 : 409);
                     return redirect(response, publish ? `${taskHref(familyOf(taskId)?.root.id ?? taskId)}#merge` : body.get("return") === null ? reviewHref(taskId, Number(namedRun)) : safeReturn(body.get("return")));
                 }
                 if (body.get("publish") === "1") {
@@ -17432,13 +17495,13 @@ function chatHeading(copy, projectCount, showProjectToggle = true) {
                 `${strokeIcon(`<path d="M4 20h16a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-7.9a2 2 0 0 1-1.69-.9L9.6 3.9A2 2 0 0 0 7.93 3H4a2 2 0 0 0-2 2v13c0 1.1.9 2 2 2Z"/>`)}<span>projects</span><span class="badge">${projectCount}</span></button>`
             : "") + `</div></div>`);
 }
-/** A deliberately small rich-text grammar for model copy. Input is escaped
- * before tags are introduced: headings, bullets, numbered steps, bold, and
- * inline code are presentation only—never executable HTML or external links. */
-function renderChatText(text) {
-    const inline = (value) => escape(value)
-        .replace(/`([^`\n]{1,240})`/g, "<code>$1</code>")
-        .replace(/\*\*([^*\n]{1,500})\*\*/g, "<strong>$1</strong>");
+/** A deliberately small rich-text grammar for model copy. The reply is shaped first (the lead's voice, enforced:
+ * no headers, at most three bold anchors, labelled links, no internal ids unless `asked` wanted them); input is
+ * escaped before tags are introduced: bullets, numbered steps, bold, inline code and labelled http(s) links are
+ * presentation only—never executable HTML. */
+function renderChatText(raw, asked) {
+    const inline = replyHtmlInline;
+    const text = shapeReply(raw, { appOrigin: requestContext.getStore()?.appOrigins ?? null, ...(asked === undefined ? {} : { asked }) });
     const lines = text.replace(/\r\n?/g, "\n").split("\n");
     const out = [];
     let paragraph = [];
@@ -17456,15 +17519,9 @@ function renderChatText(text) {
         list = null;
     };
     for (const line of lines) {
-        const heading = /^(?:#{1,3}\s+)(.+)$/.exec(line);
         const bullet = /^\s*[-*]\s+(.+)$/.exec(line);
         const numbered = /^\s*(\d{1,9})[.)]\s+(.+)$/.exec(line);
-        if (heading !== null) {
-            flushParagraph();
-            closeList();
-            out.push(`<h3>${inline(heading[1] ?? "")}</h3>`);
-        }
-        else if (bullet !== null || numbered !== null) {
+        if (bullet !== null || numbered !== null) {
             flushParagraph();
             const wanted = bullet !== null ? "ul" : "ol";
             if (list !== wanted) {
@@ -17548,6 +17605,20 @@ function leadSettingsHtml(data) {
         `<p><a href="/settings">Settings</a></p><h1>Lead</h1>`,
         data.said === null ? "" : `<p class="problem" role="status">${escape(data.said)}</p>`,
         `<section class="card lead-settings" data-lead-settings>${summary}</section>`,
+        data.identity === undefined ? "" : `<form method="post" action="/settings/lead/identity" class="card lead-identity" data-lead-identity>` +
+            `<input type="hidden" name="csrf" value="${escape(facts.csrf)}">` +
+            `<label>Name your lead<input name="name" value="${escape(data.identity.name)}" maxlength="${LEAD_NAME_MAX}" autocomplete="off" required></label>` +
+            `<label>Persona<textarea name="persona" rows="4" maxlength="${LEAD_PERSONA_MAX}">${escape(data.identity.persona)}</textarea></label>` +
+            `<button type="submit">Save</button>${data.saved === true ? ` <span class="meta" role="status">Saved.</span>` : ""}</form>`,
+        // What the lead knows about this person: lines they confirmed in chat or wrote here. Every project, every chat.
+        data.about === undefined ? "" : `<form method="post" action="/settings/lead/about" class="card lead-about" data-lead-about>` +
+            `<input type="hidden" name="csrf" value="${escape(facts.csrf)}">` +
+            `<label>What your lead knows about you<textarea name="about" rows="${Math.min(10, Math.max(4, data.about.length + 1))}" maxlength="${ABOUT_YOU_MAX_LINES * (ABOUT_YOU_LINE_MAX + 1)}" placeholder="Keep copy terse.&#10;I test changes myself.">${escape(data.about.join("\n"))}</textarea></label>` +
+            `<p class="meta">One per line, up to ${ABOUT_YOU_MAX_LINES}.</p>` +
+            `<button type="submit">Save</button>${data.aboutSaved === true ? ` <span class="meta" role="status">Saved.</span>` : ""}</form>`,
+        // What the lead promised to follow up on; it reports each once, here in chat, and drops it after 7 days.
+        (data.promises ?? []).length === 0 ? "" : `<section class="card lead-promises" data-lead-promises><h2>Promises</h2><ul class="lead-promise-list">${data.promises.map(one => `<li data-promise="${one.id}"><p>${escape(one.what)}</p><p class="meta">${escape(one.when.charAt(0).toUpperCase() + one.when.slice(1))} · <span class="nowrap">until ${escape(new Date(one.until).toLocaleDateString("en-US", { month: "short", day: "numeric", timeZone: "UTC" }))}</span></p>` +
+            `<form method="post" action="/settings/lead/promise/cancel" class="inline">${hidden}<input type="hidden" name="promise" value="${one.id}"><button type="submit" class="secondary">Cancel</button></form></li>`).join("")}</ul></section>`,
         `<details class="lead-advanced" data-lead-advanced><summary>Advanced</summary>`,
         leadConfigForm(config, facts),
         config === null ? "" : `<form method="post" action="/chat/config" class="inline">${hidden}<input type="hidden" name="off" value="1">` +
@@ -17646,8 +17717,8 @@ function chatPage(chrome, data) {
         parts.push(data.coordinatorProposals);
     parts.push(data.focusTask === null && !data.catchUp ? `<details class="chat-fleet-context">${chatOverviewSummaryHtml(data.projects, data.fleetSnapshot?.attentionCount)}${chatFleetOverview(data.fleetSnapshot, data.projects, data.csrf, false)}</details>` : "", chatLimitsHtml({ provider: config.provider, model: config.model, turnsToday: data.turnsToday, dailyTurns: config.dailyTurns, subscription, weekly: subscription ? null : { spent: data.weeklySpent, ceiling: config.weeklyCeilingMicrousd } }));
     for (const turn of data.latched) {
-        parts.push(`<div class="problem"><strong>Unknown spend blocks chat.</strong> turn #${turn.id} may have cost up to ${chatMoney(turn.reservedMicrousd)} — ` +
-            `<a href="/chat/ack/${turn.id}">read and acknowledge it</a> to re-enable this credential.</div>`);
+        parts.push(`<div class="problem"><strong>Chat is paused.</strong> An earlier reply stopped before its cost was known; it may have cost up to ${chatMoney(turn.reservedMicrousd)}. ` +
+            `<a href="/chat/ack/${turn.id}">Confirm that cost</a> to turn chat back on.</div>`);
     }
     if (data.pending !== null) {
         parts.push(chatWorkingHtml({ details: `Turn #${data.pending.id}${subscription ? " · subscription" : ` · up to ${chatMoney(data.pending.reservedMicrousd)} reserved`}` }));
@@ -18041,13 +18112,35 @@ function coordinatorProposalsSection(proposals, decisions, csrf, now, heading =
         proposals.map(one => coordinatorProposalCard(one, csrf, now, decisions.get(typeof one.payload["decision"] === "number" ? one.payload["decision"] : -1) ?? null, returnTo)).join("") +
         `</div>`);
 }
+/** The lead's question as buttons: each option sends itself as the next message (the same POST as a typed one);
+ * "Something else" moves to the composer. Nothing shows while a reply is running. */
+function mateAskHtml(ask, csrf, target, composer, open = true) {
+    if (!open)
+        return `<div class="so-owner-ask" data-ask="${ask.turn}"><p class="so-owner-ask-question"><strong>${escape(ask.question)}</strong></p></div>`;
+    const hidden = `<input type="hidden" name="csrf" value="${escape(csrf)}">` +
+        (target.task !== null ? `<input type="hidden" name="task" value="${escape(target.task)}">` : target.project !== null ? `<input type="hidden" name="project" value="${escape(target.project)}">` : "");
+    return `<div class="so-owner-ask" data-ask="${ask.turn}"><p class="so-owner-ask-question"><strong>${escape(ask.question)}</strong></p>` +
+        `<div class="so-owner-ask-options" role="group" aria-label="Answer options">` +
+        ask.options.map(option => `<form method="post" action="/chat" class="inline">${hidden}<button type="submit" name="message" value="${escape(option)}" class="so-suggestion quiet">${escape(option)}</button></form>`).join("") +
+        `<label for="${escape(composer)}" class="so-suggestion so-owner-ask-other">${escape(MATE_ASK_OTHER)}</label></div></div>`;
+}
 /** The thread's messages as the React conversation renders them, each
  * with the proposal cards its turn produced; `back` is where a card's
  * confirm or dismiss returns. */
-function mateBrowserMessages(rows, csrf, back) {
+function mateBrowserMessages(rows, csrf, back, target = { task: null, project: null }) {
+    const open = rows.pending === null ? rows.ask?.turn ?? null : null;
+    const asked = (turn) => {
+        const ask = turn === null ? undefined : rows.asks?.get(turn);
+        return ask === undefined ? "" : mateAskHtml(ask, csrf, target, target.task === null ? "lead-message" : "task-message", ask.turn === open);
+    };
+    // The owner's message each reply answers: when it asked for ids, the reply keeps them.
+    const askedBy = new Map();
+    rows.messages.reduce((last, message) => { if (message.role === 'operator')
+        return message.text; if (last !== undefined)
+        askedBy.set(message.id, last); return last; }, undefined);
     return rows.messages.map(message => ({
         id: message.id, role: message.role, text: message.text,
-        html: message.role === 'operator' ? `<p>${escape(message.text)}</p>` : renderChatText(message.text),
+        html: message.role === 'operator' ? `<p>${escape(message.text)}</p>` : renderChatText(message.text, askedBy.get(message.id)) + asked(message.turn),
         activity: message.activity, createdAt: message.createdAt,
         ...(() => {
             const parts = message.turn === null ? [] : rows.proposals.filter(one => one.turn === message.turn)
@@ -18070,6 +18163,7 @@ function mateChatVersion(rows) {
         rows.coordinatorProposals.map(one => [one.id, one.state, one.outcome === null ? null : JSON.stringify(one.outcome)]),
         [...rows.decisions.values()].map(one => [one.id, one.state, one.choice ?? null]),
         rows.pending === null ? null : [rows.pending.id, rows.pending.steps],
+        rows.ask?.turn ?? null,
         rows.recent[0] === undefined ? null : [rows.recent[0].id, rows.recent[0].state, rows.recent[0].failureReason],
         focus === null
             ? null
@@ -18117,14 +18211,20 @@ function mateThreadHtml(data) {
         parts.push(`<div class="chat-empty" data-key="empty"><strong>${data.focusTask === null ? "What do you want to get done?" : "What do you want to understand or change?"}</strong>` +
             `<p class="meta">${data.focusTask === null ? "Describe a task or ask about your projects." : "Ask about progress, review results, or adjust the plan."}</p></div>`);
     }
+    let asked;
     for (const message of data.messages) {
         if (message.role === "operator") {
+            asked = message.text;
             parts.push(`<div class="msg op" data-message-role="operator" data-key="m${message.id}"><p style="white-space:pre-wrap">${escape(message.text)}</p></div>`);
             continue;
         }
         const cards = message.turn === null ? [] : (byTurn.get(message.turn) ?? []);
         parts.push(`<div class="msg mate" data-message-role="assistant" data-key="m${message.id}"${message.id === latestReply ? ' id="latest"' : ""}>` +
-            renderChatText(message.text) +
+            renderChatText(message.text, asked) +
+            (() => {
+                const ask = message.turn === null ? undefined : data.asks?.get(message.turn);
+                return ask === undefined ? "" : mateAskHtml(ask, data.csrf, { task: data.focusTask?.id ?? null, project: data.chatProject ?? null }, "chat-message", data.pending === null && data.ask?.turn === ask.turn);
+            })() +
             cards.map(one => mateProposalCard(one, data.csrf, inert, data.decisions.get(typeof one.payload["decision"] === "number" ? one.payload["decision"] : -1) ?? null, data.focusTask === null ? null : returnTo)).join("") +
             `<div class="chat-message-foot">${chatActivity(message.activity)}<time datetime="${escape(message.createdAt)}">${escape(relativeAge(message.createdAt, data.now))}</time></div>` +
             `</div>`);
@@ -18180,17 +18280,17 @@ function matePage(chrome, data) {
     if (data.problem !== null)
         conversation.push(`<div class="problem">${escape(data.problem)}</div>`);
     for (const turn of data.latched) {
-        conversation.push(`<div class="problem"><strong>Unknown spend blocks chat.</strong> turn #${turn.id} may have cost up to ${chatMoney(turn.reservedMicrousd)} — ` +
-            `<a href="/chat/ack/${turn.id}">read and acknowledge it</a> to re-enable this credential.</div>`);
+        conversation.push(`<div class="problem"><strong>Chat is paused.</strong> An earlier reply stopped before its cost was known; it may have cost up to ${chatMoney(turn.reservedMicrousd)}. ` +
+            `<a href="/chat/ack/${turn.id}">Confirm that cost</a> to turn chat back on.</div>`);
     }
     const lastMessage = data.messages.at(-1);
     const latestReply = data.pending === null && lastMessage?.role === "assistant" ? lastMessage.id : null;
-    conversation.push(mateThreadHtml({ ...data, problem: null }));
+    conversation.push(mateThreadHtml({ ...data, problem: null, chatProject }));
     conversation.push(
     // The New update action (package 2): hidden until a live update lands
     // while the reader is above the latest message; a real button, so the
     // keyboard reaches it. Only this act moves the reader.
-    `<div class="chat-new-update-holder"><button type="button" class="chat-new-update" id="chat-new-update" hidden>New update ↓</button></div>`, `<form method="post" action="/chat" class="card composer" id="${latestReply === null && data.pending === null ? "latest" : "chat-composer"}" aria-label="message the mate" data-chat-session="${data.session.id}" data-chat-task="${escape(data.focusTask?.id ?? "")}" data-chat-user="${escape(data.session.approver)}" data-chat-busy="${data.pending === null ? "0" : "1"}" data-chat-version="${mateChatVersion(data)}" data-chat-approval="${escape(data.focusTask?.approval?.digest ?? "")}">`, `<input type="hidden" name="csrf" value="${escape(data.csrf)}">`, `<input type="hidden" name="request" value="${randomBytes(16).toString("hex")}"><input type="hidden" name="request-session" value="${data.session.id}">`, data.focusTask === null ? "" : `<input type="hidden" name="task" value="${escape(data.focusTask.id)}">`, chatProject === null ? "" : `<input type="hidden" name="project" value="${escape(chatProject)}">`, data.resultRunId == null ? "" : `<input type="hidden" name="result" value="${data.resultRunId}">`, `<label>Message<textarea name="message" rows="1" maxlength="${MATE_MESSAGE_MAX_CHARS}" placeholder="${data.focusTask !== null ? "Ask about this task…" : chatProject !== null ? `Ask about ${escape(projectName(chatProject))}…` : "Describe what you want done…"}"></textarea></label>`, `<button type="submit" aria-label="${data.pending === null ? "send message" : "wait for the current reply before sending"}"${data.pending === null ? "" : " disabled"}>Send</button>`, `</form>`, 
+    `<div class="chat-new-update-holder"><button type="button" class="chat-new-update" id="chat-new-update" hidden>New update ↓</button></div>`, `<form method="post" action="/chat" class="card composer" id="${latestReply === null && data.pending === null ? "latest" : "chat-composer"}" aria-label="message the mate" data-chat-session="${data.session.id}" data-chat-task="${escape(data.focusTask?.id ?? "")}" data-chat-user="${escape(data.session.approver)}" data-chat-busy="${data.pending === null ? "0" : "1"}" data-chat-version="${mateChatVersion(data)}" data-chat-approval="${escape(data.focusTask?.approval?.digest ?? "")}">`, `<input type="hidden" name="csrf" value="${escape(data.csrf)}">`, `<input type="hidden" name="request" value="${randomBytes(16).toString("hex")}"><input type="hidden" name="request-session" value="${data.session.id}">`, data.focusTask === null ? "" : `<input type="hidden" name="task" value="${escape(data.focusTask.id)}">`, chatProject === null ? "" : `<input type="hidden" name="project" value="${escape(chatProject)}">`, data.resultRunId == null ? "" : `<input type="hidden" name="result" value="${data.resultRunId}">`, `<label>Message<textarea id="chat-message" name="message" rows="1" maxlength="${MATE_MESSAGE_MAX_CHARS}" placeholder="${data.focusTask !== null ? "Ask about this task…" : chatProject !== null ? `Ask about ${escape(projectName(chatProject))}…` : "Describe what you want done…"}"></textarea></label>`, `<button type="submit" aria-label="${data.pending === null ? "send message" : "wait for the current reply before sending"}"${data.pending === null ? "" : " disabled"}>Send</button>`, `</form>`, 
     // Concise pass (2026-09-13): the status line speaks only when there is
     // a state to report — a reply in progress here, the connection from
     // the continuity script — and the composer carries no second intro.
@@ -18202,7 +18302,7 @@ function matePage(chrome, data) {
         workspace: {
             conversation: {
                 sessionId: data.session.id, user: data.session.approver, version: mateChatVersion(data),
-                messages: mateBrowserMessages(data, data.csrf, data.focusTask === null && chatProject === null ? null : returnTo),
+                messages: mateBrowserMessages(data, data.csrf, data.focusTask === null && chatProject === null ? null : returnTo, { task: data.focusTask?.id ?? null, project: chatProject }),
                 pendingTurnId: data.pending?.id ?? null, requestId: randomBytes(16).toString('hex'), maxChars: MATE_MESSAGE_MAX_CHARS,
                 taskId: data.focusTask?.id ?? null, resultRunId: data.resultRunId ?? null, project: chatProject,
             },
@@ -19529,6 +19629,15 @@ function accentHead() {
 }
 const requestContext = new AsyncLocalStorage();
 /** A same-site path or "/": never a scheme, a host, or a protocol-relative road. */
+/** The words a result page shows for a refusal its own form led to, by the fixed code a redirect carries. */
+const ACCEPT_ANYWAY_NEEDS_REASON = "Accepting anyway needs a reason.";
+const RESULT_REFUSALS = { reason: ACCEPT_ANYWAY_NEEDS_REASON };
+/** A same-site page address with a refusal code added, before any fragment. */
+function withRefusal(href, code) {
+    const at = href.indexOf("#");
+    const [path, hash] = at === -1 ? [href, ""] : [href.slice(0, at), href.slice(at)];
+    return `${path}${path.includes("?") ? "&" : "?"}refused=${code}${hash}`;
+}
 function safeReturn(raw) {
     if (raw === null || raw === undefined)
         return "/";
@@ -21779,12 +21888,13 @@ function reviewCockpitPage(chrome, data) {
         capped: queue.length >= data.queueCap ? data.queueCap : null,
         missing: data.missing === null ? null : `No completed task ${data.missing} is in view here — it may not be finished, or it is outside this console's projects.`,
         beyond: data.beyondQueue && selected !== null,
-        selected: detailParts === null ? null : detailParts.selected,
+        selected: detailParts === null ? null : data.refusal == null ? detailParts.selected : { ...detailParts.selected, problem: data.refusal },
     };
     return screen("review", [
         selected === null ? `<h1>Results</h1>` : "",
         missingNote,
         beyondNote,
+        data.refusal == null || selected === null ? "" : `<p class="problem" data-result-refusal>${escape(data.refusal)}</p>`,
         `<div class="cockpit">${queuePane}${detail}</div>`,
     ].join("\n"), {
         chrome,
@@ -22011,14 +22121,11 @@ function reviewCockpitDetailParts(view, csrf, noted, canRetryReview, tab, user)
         },
     };
 }
-/** What Accept and finish owes before it completes, as the form asks for it: the person's own check (no
- * reason), an exception a report that doesn't match its changes needs a reason for, or nothing. */
+/** What Accept and finish owes before it completes, as the form asks for it: the server's own rule
+ * (owedAcceptance), so the form asks for exactly what the completion requires. */
 function owedAcceptanceOf(receipt) {
-    if (receipt === null || receipt.proofAcceptance !== null)
-        return null;
-    if (personCheckPending(receipt))
-        return { note: null };
-    return cantAcceptYetOf(receipt.proof?.verdict ?? null, receipt.proof?.reasons ?? [], false) === ACCEPT_NEEDS_REASON ? { note: "Why is this safe to accept?" } : null;
+    const owed = owedAcceptance(receipt);
+    return owed === null ? null : owed === "person-check" ? { note: null } : { note: "Why is this safe to accept?" };
 }
 function completionForm(taskId, runId, digest, csrf, pullRequestTo = null, accept = null) {
     // Accept and finish, in one request: with an acceptance owed (the person's own checks, or an exception and

package/dist/slack-chat.d.ts

@@ -25,4 +25,6 @@ export declare const applySlackAction: (options: SlackChatOptions, event: SlackE
 export declare const planSlackNotifications: (options: SlackChatOptions) => Promise<void>;
 export declare const planSlackRooms: (options: SlackChatOptions) => Promise<void>;
 export declare function slackBlocks(text: string, buttons?: Record<string, unknown>[]): Record<string, unknown>[];
+/** The lead's reply as mrkdwn sections: no header block, so its first line stays an ordinary line. */
+export declare function slackVoiceBlocks(mrkdwn: string, buttons?: Record<string, unknown>[]): Record<string, unknown>[];
 export declare function deliverSlackPart(options: SlackChatOptions): Promise<boolean>;