toolroll 0.9.15 → 0.9.17

package/dist/mate.d.ts

@@ -1,8 +1,10 @@
 import { type MateProgress } from "./mate-progress.js";
 import type { ChatConfig, MateSession, MateThread, Store } from "./store.js";
+import type { Integration } from "./integrations.js";
 import type { VerifiedApprover } from "./principal.js";
 import { type MateHistoryMessage } from "./converse.js";
 import { type SubscriptionMateRunner } from "./subscription-chat.js";
+import { type LeadChannel } from './lead-context.js';
 export declare const MATE_MESSAGE_MAX_CHARS = 2000;
 /** The thread's recent history the model sees, most recent first until the cap. */
 export declare const MATE_HISTORY_CAP_BYTES = 16384;
@@ -39,8 +41,14 @@ export type MateTurnInput = {
     clock?: () => Date;
     /** Where evidence lives — get_task reads a scout's report from here. */
     evidenceRoot?: string;
+    /** Where this conversation happens, so the lead fits its replies to it. */
+    channel?: LeadChannel;
+    /** A shared team conversation's own lead name, in place of this person's (Settings → Lead). */
+    leadName?: string;
     /** How this surface delivers the images a turn selects: Telegram sends them as documents after the reply; absent means identity only. */
     mediaDelivery?: "documents";
+    /** The integrations as Settings → Integrations shows them (get_integrations); absent: read from the files beside the database. */
+    integrations?: () => readonly Integration[];
     /**
      * A channel's own standing, re-proved where the approver's is: before
      * admission, before every provider dispatch, after every provider wait,
@@ -54,9 +62,11 @@ export type MateTurnInput = {
         ok: true;
     } | {
         ok: false;
-        reason: string;
+        reason: MateChannelProblem;
     }>;
 };
+/** Why a chat's standing changed under a turn: each has its own plain words (MATE_CHANNEL_COPY). */
+export type MateChannelProblem = "unpaired" | "not-approver" | "projects-changed" | "projects-unreadable" | "member-changed" | "access-changed";
 export type MateRefusal = "empty-message" | "secret-in-message" | "secret-in-context" | "standing" | "unpriced" | "ceiling-changed" | "not-yours" | "thread-closed" | "latched" | "concurrent" | "daily-cap" | "session-exhausted" | "session-ended" | "over-budget" | "monthly-budget" | "policy" | "invalid-request" | "request-changed" | "channel";
 export type MateFailure = "provider-error" | "timeout" | "malformed-reply" | "secret-refused" | "latched" | "revoked" | "superseded";
 export type MateTurnOutcome = {
@@ -84,7 +94,31 @@ export type MateTurnOutcome = {
     message: string;
     unknownSpend: boolean;
 };
+/** What happened, what it means, and one next step: plain words a person can act on, never internal terms. */
 export declare const MATE_REFUSAL_COPY: Record<MateRefusal, string>;
+/** A turn stopped because its chat's standing changed: what happened, what it means, one next step. */
+export declare const MATE_CHANNEL_COPY: Record<MateChannelProblem, string>;
+/** Why a reply did not finish, in the same three parts: what happened, what it means, one next step. */
+export declare const MATE_FAILURE_COPY: {
+    readonly stopped: "This reply was stopped before it finished, from another window or by a newer message. Nothing it proposed was kept. Send your message again if you still need an answer.";
+    readonly ended: "Your sign-in or this conversation ended while the lead was answering. Nothing it proposed was kept. Sign in again or start a new chat, then send your message again.";
+    readonly tooLong: "The reply took too long and was stopped. Nothing it proposed was kept. Send your message again, or ask for less at once.";
+    readonly secretRead: "Something the lead read looked like a password or key, so it stopped before sending it anywhere. Nothing was kept. Remove the password or key from that task or note, then ask again.";
+    readonly secretReply: "The lead's reply contained something that looked like a password or key, so it was thrown away. Nothing was kept. Ask again, without asking for a password or key.";
+    readonly paused: "An earlier reply stopped before its cost was known, so chat is paused. This message wasn't answered. Confirm that earlier reply on the Chat page, then send again.";
+    readonly notStarted: "The reply couldn't be started. Nothing was kept or charged. Send your message again.";
+    readonly notInstalled: "The chat app the lead uses isn't installed on this computer, so it couldn't answer. Nothing was kept. Install it, or choose another provider in Settings → Lead.";
+    readonly unreadable: "The chat provider sent back an answer that couldn't be read, so it was thrown away. Nothing was kept. Send your message again.";
+    readonly signIn: "The chat provider couldn't answer; its sign-in may have expired. Nothing was kept. Sign in to it again on this computer, then send your message again.";
+    readonly refused: "The chat provider turned the request down. Nothing was kept or charged. Try again in a minute; if it keeps happening, check the provider in Settings → Lead.";
+    readonly tooLongUnknownCost: "The reply took too long and was stopped, and its cost isn't known yet, so chat is paused. Nothing it proposed was kept. Confirm the cost on the Chat page to turn chat back on.";
+    readonly lostUnknownCost: "The chat provider stopped responding partway through, and the cost isn't known, so chat is paused. Nothing it proposed was kept. Confirm the cost on the Chat page to turn chat back on.";
+    readonly unreadableUnknownCost: "The chat provider sent back an answer that couldn't be read, and its cost isn't known, so chat is paused. Nothing it proposed was kept. Confirm the cost on the Chat page to turn chat back on.";
+    readonly empty: "The lead sent back an empty answer. Nothing was kept. Send your message again.";
+    readonly unusable: "The lead's answer couldn't be used, so it was thrown away. Nothing was kept. Send your message again.";
+};
+/** A failed turn's saved reason as plain words, for a surface that reads the turn back later (a restart, a delivery retry). */
+export declare function mateFailureText(reason: string | null): string;
 /** The last messages of the thread as provider-neutral history, newest kept first until the byte cap. */
 export declare function historyFor(store: Store, thread: number, queuedMessageId?: number): MateHistoryMessage[];
 /** "read 3 · proposed 1 · 2 steps" — counts only, never results (ruling 11). */

package/dist/mate.js

@@ -1,19 +1,3 @@
-/**
- * The mate's turn engine (mate arc §3): one reservation for the whole
- * loop, one `chat_turn` step per provider request, tools executed
- * in-process under the branded approver, results through `mateView`, and
- * only operator text and assistant text kept (ruling 11). The console
- * and the CLI drive this and render from the rows it writes.
- *
- * Slice-1 review, folded in: the session, thread, and credential are
- * bound to the principal inside the store's admission (finding 2); the
- * principal is re-proved after every network wait and the turn's own
- * row is re-read, so a revocation mid-flight ends the loop before any
- * tool runs (finding 5); a step whose cost is unknown charges the whole
- * reservation (finding 1); the latch is re-checked before every dispatch
- * (finding 11); usage that cannot be true is malformed, never a discount
- * (finding 8); and everything the model sees passed `mateView` (finding 9).
- */
 import { Buffer } from "node:buffer";
 import { mateToolLabel } from "./mate-progress.js";
 import { createHash } from "node:crypto";
@@ -23,35 +7,82 @@ import { MATE_MAX_CALLS_PER_STEP, MATE_MAX_STEPS, MATE_TOOL_RESULT_CAP_BYTES, TU
 import { redactSecretLines, scanForSecrets } from "./evidence.js";
 import { redactSecretAssignments } from "./builder.js";
 import { MATE_CONTRACT } from "./mate-contract.js";
-import { MATE_MAX_PROPOSALS_PER_TURN, MATE_TOOL_SCHEMAS, executeMateTool, isMateTool, mateViewContextFor, redactForMate, toolResultBytes } from "./mate-tools.js";
+import { MATE_MAX_PROPOSALS_PER_TURN, MATE_TOOL_SCHEMAS, executeMateTool, isMateTool, mateViewContextFor, projectLabelForMate, redactForMate, toolResultBytes } from "./mate-tools.js";
 import { composeSubscriptionMatePrompt, performSubscriptionMateRequest } from "./subscription-chat.js";
 import { leadContext } from './lead-context.js';
 import { envValue } from "./names.js";
+import { deliverableClaim, deliverableRepair, dropDeliverableClaims, replyCarriesDeliverable } from "./reply-shape.js";
 export const MATE_MESSAGE_MAX_CHARS = 2_000;
+/** Where a promise made this turn is reported: the chat app it arrived on, or this conversation for the console and terminal. */
+function promiseChannelOfTurn(channel) {
+    return channel === undefined ? undefined : channel === "console" || channel === "terminal" ? "chat" : channel;
+}
 /** The thread's recent history the model sees, most recent first until the cap. */
 export const MATE_HISTORY_CAP_BYTES = 16_384;
 export const MATE_HISTORY_MAX_MESSAGES = 40;
+/** What happened, what it means, and one next step: plain words a person can act on, never internal terms. */
 export const MATE_REFUSAL_COPY = {
-    "empty-message": `a message is 1 to ${MATE_MESSAGE_MAX_CHARS} characters`,
-    "secret-in-message": "that looks like a credential — the mate never forwards or stores those",
-    "secret-in-context": "fleet context contains something credential-shaped — the mate refuses to send it; find and remove it first",
-    standing: "your approver standing changed — sign in again",
-    unpriced: "no pinned price for the chat model — re-save the chat configuration to pin one",
-    "ceiling-changed": "the admitted projects changed since this session was minted — mint a new one",
-    "not-yours": "that mate session is not yours to continue",
-    "thread-closed": "that thread is closed — start a new one",
-    latched: "a turn with unknown cost blocks this credential — acknowledge it first",
-    concurrent: "one turn at a time — the last one is still running",
-    "daily-cap": "the daily turn cap is reached",
-    "session-exhausted": "this mate session's spend ceiling would be exceeded — mint a new one to continue",
-    "session-ended": "this mate session has ended — mint a new one to continue",
-    "over-budget": "the weekly chat spend ceiling would be exceeded",
-    "monthly-budget": "a monthly budget this counts toward holds it: used up, or its cost can't be priced yet (the Spend page says which)",
-    policy: "the organisation policy doesn't allow this chat's provider or model (Settings → Policy says which)",
-    "invalid-request": "This message could not be identified. Reload the conversation before sending it.",
+    "empty-message": `That message was empty or too long, so it wasn't sent. Write 1 to ${MATE_MESSAGE_MAX_CHARS} characters and send it again.`,
+    "secret-in-message": "That message looks like it contains a password or key, so it wasn't sent or saved. Remove it and send the message again.",
+    "secret-in-context": "Something saved in your projects looks like a password or key, so the lead can't read your projects safely. Remove it from the task or note it's in, then try again.",
+    standing: "Your sign-in changed, so the lead can't act for you right now. Sign in again.",
+    unpriced: "The chat model has no saved price, so its cost can't be tracked. Save the chat settings again to fix it.",
+    "ceiling-changed": "Your projects changed since this chat started, so it can't go on. Start a new chat.",
+    "not-yours": "This chat belongs to someone else, so you can't continue it. Start your own chat.",
+    "thread-closed": "This conversation is closed. Start a new one to keep going.",
+    latched: "An earlier reply stopped before its cost was known, so chat is paused. Acknowledge that reply on the Chat page, then send again.",
+    concurrent: "The lead is still answering your last message. Wait for that reply, then send this one.",
+    "daily-cap": "You've reached today's limit on chat replies, so this one wasn't sent. Try again tomorrow.",
+    "session-exhausted": "This chat has used its spending limit. Start a new chat to keep going.",
+    "session-ended": "This chat has ended. Start a new chat to keep going.",
+    "over-budget": "This reply would go over this week's chat spending limit, so it wasn't sent. Raise the weekly limit in chat settings to keep going.",
+    "monthly-budget": "A monthly budget this chat counts toward is used up, or its cost can't be worked out yet. Open the Spend page to see which.",
+    policy: "Your organisation's policy doesn't allow this chat's provider or model. Open Settings → Policy to see what's allowed.",
+    "invalid-request": "This message couldn't be matched to your conversation. Reload the conversation, then send it again.",
     "request-changed": "That send was already received with different text or task context. Reload the conversation before sending a new message.",
-    channel: "this conversation's connection changed — reconnect it before sending again",
+    channel: "This conversation's connection changed, so the message wasn't sent. Reconnect it, then send again.",
+};
+/** A turn stopped because its chat's standing changed: what happened, what it means, one next step. */
+export const MATE_CHANNEL_COPY = {
+    unpaired: "This chat is no longer connected to your account, so the reply was stopped. Nothing it proposed was kept. Connect the chat again in Settings, then send your message again.",
+    "not-approver": "Your account can no longer approve work here, so the reply was stopped. Nothing it proposed was kept. Ask an owner to restore your access, then send your message again.",
+    "projects-changed": "The projects this chat can see changed while the lead was answering, so the reply was stopped. Nothing it proposed was kept. Send your message again.",
+    "projects-unreadable": "Your project list couldn't be read just now, so the reply was stopped. Nothing it proposed was kept. Send your message again in a minute.",
+    "member-changed": "Your account in this chat app no longer has access, so the reply was stopped. Nothing it proposed was kept. Ask the app's admin to add you back, then send your message again.",
+    "access-changed": "This chat's access changed while the lead was answering, so the reply was stopped. Nothing it proposed was kept. Reconnect the chat, then send your message again.",
 };
+/** Why a reply did not finish, in the same three parts: what happened, what it means, one next step. */
+export const MATE_FAILURE_COPY = {
+    stopped: "This reply was stopped before it finished, from another window or by a newer message. Nothing it proposed was kept. Send your message again if you still need an answer.",
+    ended: "Your sign-in or this conversation ended while the lead was answering. Nothing it proposed was kept. Sign in again or start a new chat, then send your message again.",
+    tooLong: "The reply took too long and was stopped. Nothing it proposed was kept. Send your message again, or ask for less at once.",
+    secretRead: "Something the lead read looked like a password or key, so it stopped before sending it anywhere. Nothing was kept. Remove the password or key from that task or note, then ask again.",
+    secretReply: "The lead's reply contained something that looked like a password or key, so it was thrown away. Nothing was kept. Ask again, without asking for a password or key.",
+    paused: "An earlier reply stopped before its cost was known, so chat is paused. This message wasn't answered. Confirm that earlier reply on the Chat page, then send again.",
+    notStarted: "The reply couldn't be started. Nothing was kept or charged. Send your message again.",
+    notInstalled: "The chat app the lead uses isn't installed on this computer, so it couldn't answer. Nothing was kept. Install it, or choose another provider in Settings → Lead.",
+    unreadable: "The chat provider sent back an answer that couldn't be read, so it was thrown away. Nothing was kept. Send your message again.",
+    signIn: "The chat provider couldn't answer; its sign-in may have expired. Nothing was kept. Sign in to it again on this computer, then send your message again.",
+    refused: "The chat provider turned the request down. Nothing was kept or charged. Try again in a minute; if it keeps happening, check the provider in Settings → Lead.",
+    tooLongUnknownCost: "The reply took too long and was stopped, and its cost isn't known yet, so chat is paused. Nothing it proposed was kept. Confirm the cost on the Chat page to turn chat back on.",
+    lostUnknownCost: "The chat provider stopped responding partway through, and the cost isn't known, so chat is paused. Nothing it proposed was kept. Confirm the cost on the Chat page to turn chat back on.",
+    unreadableUnknownCost: "The chat provider sent back an answer that couldn't be read, and its cost isn't known, so chat is paused. Nothing it proposed was kept. Confirm the cost on the Chat page to turn chat back on.",
+    empty: "The lead sent back an empty answer. Nothing was kept. Send your message again.",
+    unusable: "The lead's answer couldn't be used, so it was thrown away. Nothing was kept. Send your message again.",
+};
+/** A failed turn's saved reason as plain words, for a surface that reads the turn back later (a restart, a delivery retry). */
+export function mateFailureText(reason) {
+    switch (reason) {
+        case "timeout": return MATE_FAILURE_COPY.tooLong;
+        case "malformed-reply": return MATE_FAILURE_COPY.unreadable;
+        case "secret-refused": return MATE_FAILURE_COPY.secretReply;
+        case "latched": return MATE_FAILURE_COPY.paused;
+        case "revoked": return MATE_FAILURE_COPY.ended;
+        case "superseded": return MATE_FAILURE_COPY.stopped;
+        case "provider-error": return MATE_FAILURE_COPY.refused;
+        default: return "The lead's reply didn't finish. Nothing it proposed was kept. Send your message again.";
+    }
+}
 const READ_TOOLS = new Set(["get_brief", "get_project_context", "get_actions", "get_action_status", "get_skills", "get_acceptance_evidence", "recap", "list_repos", "list_tasks", "get_task", "get_result", "get_result_images", "get_controls", "get_agents", "get_project_knowledge", "get_task_conversation", "get_diff", "get_check_log", "get_project_tools", "get_flows", "get_flow_insights", "list_decisions", "get_decision", "queue"]);
 /** The last messages of the thread as provider-neutral history, newest kept first until the byte cap. */
 export function historyFor(store, thread, queuedMessageId) {
@@ -149,7 +180,10 @@ export async function runMateTurn(input) {
     let now = clock();
     store.sweepStaleMateTurns(now);
     const view = mateViewContextFor(store, who);
-    const document = redactForMate(leadContext(store, who.repos, now, input.evidenceRoot), view);
+    // Names in the bundle are deliberate (the lead's, the person's first name, project labels); everything else is scrubbed.
+    const document = leadContext(store, who.repos, now, { owner: who.name, thread: thread.id, redact: text => redactForMate(text, view),
+        projectName: (path, index) => projectLabelForMate(path, index, view.names),
+        ...(input.evidenceRoot === undefined ? {} : { evidenceRoot: input.evidenceRoot }), ...(input.channel === undefined ? {} : { channel: input.channel }), ...(input.leadName === undefined ? {} : { leadName: input.leadName }) });
     const authoredMessage = input.queuedMessageId === undefined ? message : `From ${who.name}:\n${message}`;
     const historyMessage = input.context === undefined ? authoredMessage : `${redactForMate(input.context, view)}\n\n${authoredMessage}`;
     const history = [...historyFor(store, thread.id, input.queuedMessageId), { role: "operator", text: historyMessage }];
@@ -229,6 +263,10 @@ export async function runMateTurn(input) {
     let steps = 0;
     const readDecisions = new Map();
     const readResults = new Map();
+    const searchedMemory = new Map();
+    const checkedCapabilities = new Map();
+    /** The turn's one question to its owner: shown with the reply only once the turn answers; a failed turn drops it. */
+    const ask = (question, options) => store.recordMateAsk({ turn: turnId, thread: thread.id, question, options }, clock());
     let tokensIn = 0;
     let tokensOut = 0;
     let settled = 0;
@@ -249,6 +287,7 @@ export async function runMateTurn(input) {
     const fail = (failed, message, unknownSpend) => {
         now = clock();
         store.finalizeMateTurn(turnId, started.generation, { state: "failed", settledMicrousd: settled, unknownSpend, tokensIn, tokensOut, failureReason: failed }, now);
+        store.dropMateAsk(turnId);
         return { ok: false, turn: turnId, failed, message, unknownSpend };
     };
     /** The turn's own row, re-read: still running under our generation, or someone ended it under us. */
@@ -260,20 +299,30 @@ export async function runMateTurn(input) {
     // AFTER it resolves, immediately before sending context or using a tool.
     const guard = (channel) => {
         if (!stillOurs())
-            return { ok: false, turn: turnId, failed: "superseded", message: "this turn was ended before its next action", unknownSpend: false };
+            return { ok: false, turn: turnId, failed: "superseded", message: MATE_FAILURE_COPY.stopped, unknownSpend: false };
         if (!channel.ok)
-            return fail("revoked", `this conversation's connection changed (${channel.reason}) — nothing it proposed was kept`, false);
+            return fail("revoked", MATE_CHANNEL_COPY[channel.reason] ?? MATE_CHANNEL_COPY["access-changed"], false);
         const standing = reproveApprover(store, who);
         const liveSession = store.getMateSession(session.id);
         const liveThread = store.getMateThread(thread.id);
         if (!standing.ok || liveSession === null || liveSession.endedAt !== null || liveThread === null || liveThread.closedAt !== null) {
-            return fail("revoked", "your standing or this conversation ended — nothing it proposed was kept", false);
+            return fail("revoked", MATE_FAILURE_COPY.ended, false);
         }
         return null;
     };
     let reply = null;
     let stoppedAtCap = false;
     let lastText = "";
+    /** A page shown this turn (show_control): a reply may say it links one. */
+    let shownControl = false;
+    /** The turn's one repair step for a reply that claims an attachment it does not carry. */
+    let repaired = false;
+    const unbacked = (text) => {
+        const claim = deliverableClaim(text);
+        if (claim === null || shownControl || replyCarriesDeliverable(text) || store.listMateTurnEvidence(turnId).length > 0)
+            return null;
+        return claim;
+    };
     while (steps < maxSteps) {
         const blocked = guard(input.revalidate === undefined ? { ok: true } : await input.revalidate());
         if (blocked !== null)
@@ -281,22 +330,22 @@ export async function runMateTurn(input) {
         now = clock();
         const remainingMs = TURN_WALL_CLOCK_MS - (now.getTime() - turnStartedAt);
         if (remainingMs <= 0)
-            return fail("timeout", "the turn ran out of time before the model finished", false);
+            return fail("timeout", MATE_FAILURE_COPY.tooLong, false);
         const request = direct ? composeDirect(input.key) : composeSubscription();
         // Tool results join the outbound body: scanned again before every dispatch.
         const outbound = typeof request === "string" ? request : request.body;
         if (scanForSecrets(outbound).length > 0) {
-            return fail("secret-refused", "a tool result contained something credential-shaped — the turn stopped before sending it", false);
+            return fail("secret-refused", MATE_FAILURE_COPY.secretRead, false);
         }
         const step = store.openMateStep({ mateTurn: turnId, generation: started.generation, approver: who.name, credentialKey, provider: config.provider, model: config.model, deadlineMs: remainingMs + 10_000 }, now);
         if (!step.ok) {
             if (step.reason === "latched")
-                return fail("latched", "a turn with unknown cost latched this credential mid-conversation — acknowledge it first", false);
-            return { ok: false, turn: turnId, failed: "superseded", message: "this turn was ended before its next step", unknownSpend: false };
+                return fail("latched", MATE_FAILURE_COPY.paused, false);
+            return { ok: false, turn: turnId, failed: "superseded", message: MATE_FAILURE_COPY.stopped, unknownSpend: false };
         }
         const stepStarted = store.startChatTurn(step.id, now);
         if (!stepStarted.ok)
-            return fail("provider-error", "the step could not be dispatched", false);
+            return fail("provider-error", MATE_FAILURE_COPY.notStarted, false);
         steps++;
         progress({ kind: "step", turn: turnId, step: steps });
         const requestBytes = Buffer.byteLength(outbound, "utf8");
@@ -341,36 +390,36 @@ export async function runMateTurn(input) {
             if (!direct) {
                 finishStep({ state: "failed", failureReason: result.problem === "timeout" ? "timeout" : result.problem === "malformed-reply" ? "malformed-reply" : "provider-error", settledMicrousd: 0 });
                 const message = result.problem === "not-found"
-                    ? "the selected subscription CLI is not installed on this machine"
+                    ? MATE_FAILURE_COPY.notInstalled
                     : result.problem === "timeout"
-                        ? "the subscription turn ran out of time"
+                        ? MATE_FAILURE_COPY.tooLong
                         : result.problem === "malformed-reply"
-                            ? "the subscription provider returned a malformed answer and it was discarded"
-                            : "the subscription provider refused or could not complete the turn — check its login in the terminal";
+                            ? MATE_FAILURE_COPY.unreadable
+                            : MATE_FAILURE_COPY.signIn;
                 return fail(result.problem === "timeout" ? "timeout" : result.problem === "malformed-reply" ? "malformed-reply" : "provider-error", message, false);
             }
             if (result.problem.startsWith("status-")) {
                 // The provider ANSWERED with an error: nothing billed for this step.
                 finishStep({ state: "failed", failureReason: "provider-error", settledMicrousd: 0 });
-                return fail("provider-error", "the provider refused the request — nothing was billed for that step", false);
+                return fail("provider-error", MATE_FAILURE_COPY.refused, false);
             }
             if (result.problem === "timeout") {
                 finishStep({ state: "failed", failureReason: "timeout", settledMicrousd: null, unknownSpend: true });
-                return fail("timeout", "the turn timed out; that step's cost is unknown — the whole reservation is charged and the credential is blocked until you acknowledge it", true);
+                return fail("timeout", MATE_FAILURE_COPY.tooLongUnknownCost, true);
             }
             if (result.problem === "network") {
                 finishStep({ state: "failed", failureReason: "provider-error", settledMicrousd: null, unknownSpend: true });
-                return fail("provider-error", "the provider could not be reached after dispatch; cost unknown — the whole reservation is charged; acknowledge to re-enable chat", true);
+                return fail("provider-error", MATE_FAILURE_COPY.lostUnknownCost, true);
             }
             finishStep({ state: "failed", failureReason: "malformed-reply", settledMicrousd: null, unknownSpend: true });
-            return fail("malformed-reply", "the provider's response was malformed and was discarded; cost unknown — the whole reservation is charged; acknowledge to re-enable chat", true);
+            return fail("malformed-reply", MATE_FAILURE_COPY.unreadableUnknownCost, true);
         }
         const answer = result.answer;
         // Usage that cannot be true — more input tokens than bytes sent — is a
         // malformed reply with unknown cost, never a number to settle by.
         if (direct && answer.tokensIn > requestBytes) {
             finishStep({ state: "failed", failureReason: "malformed-reply", settledMicrousd: null, unknownSpend: true });
-            return fail("malformed-reply", "the provider reported usage that cannot be true; cost unknown — the whole reservation is charged; acknowledge to re-enable chat", true);
+            return fail("malformed-reply", MATE_FAILURE_COPY.unreadableUnknownCost, true);
         }
         // The pinned math, or the provider's own reported charge when HIGHER.
         const stepSettled = direct
@@ -389,15 +438,23 @@ export async function runMateTurn(input) {
             return changed;
         if (answer.calls.length === 0) {
             if (answer.text.trim() === "")
-                return fail("malformed-reply", "the model answered with nothing", false);
-            reply = answer.text;
+                return fail("malformed-reply", MATE_FAILURE_COPY.empty, false);
+            // "Here's the screenshot" with nothing attached or linked: one repair step to attach it or drop the claim; never the claim alone.
+            const claim = unbacked(answer.text);
+            if (claim !== null && !repaired && steps < maxSteps) {
+                repaired = true;
+                history.push({ role: "assistant", text: answer.text, calls: [] });
+                history.push({ role: "operator", text: deliverableRepair(claim) });
+                continue;
+            }
+            reply = claim === null ? answer.text : dropDeliverableClaims(answer.text);
             break;
         }
         if (answer.calls.length > MATE_MAX_CALLS_PER_STEP)
-            return fail("malformed-reply", "the model asked for more tool calls than one step allows", false);
+            return fail("malformed-reply", MATE_FAILURE_COPY.unusable, false);
         for (const call of answer.calls) {
             if (!isMateTool(call.name))
-                return fail("malformed-reply", "the model called a tool that does not exist", false);
+                return fail("malformed-reply", MATE_FAILURE_COPY.unusable, false);
         }
         history.push({ role: "assistant", text: answer.text, calls: answer.calls });
         for (const [index, call] of answer.calls.entries()) {
@@ -407,9 +464,11 @@ export async function runMateTurn(input) {
                     return changed;
             }
             progress({ kind: "tool", turn: turnId, step: steps, label: mateToolLabel(call.name) });
-            const outcome = executeMateTool({ store, who, now: clock(), draft, selectEvidence, step: steps, readDecisions, readResults, ...(input.evidenceRoot === undefined ? {} : { evidenceRoot: input.evidenceRoot }), ...(input.mediaDelivery === undefined ? {} : { mediaDelivery: input.mediaDelivery }) }, call.name, call.args, view);
+            const outcome = executeMateTool({ store, who, now: clock(), draft, selectEvidence, step: steps, readDecisions, readResults, searchedMemory, checkedCapabilities, ask, ...(input.integrations === undefined ? {} : { integrations: input.integrations }), thread: thread.id, turn: turnId, ...(promiseChannelOfTurn(input.channel) === undefined ? {} : { channel: promiseChannelOfTurn(input.channel) }), ...(input.evidenceRoot === undefined ? {} : { evidenceRoot: input.evidenceRoot }), ...(input.mediaDelivery === undefined ? {} : { mediaDelivery: input.mediaDelivery }) }, call.name, call.args, view);
             if (READ_TOOLS.has(call.name))
                 reads++;
+            if (call.name === "show_control" && outcome.ok)
+                shownControl = true;
             // Opt-in, local diagnostics for end-to-end runs: what the lead asked of each tool and what came back (its start), keys
             // blanked. Each line stays whole JSON so a run can assert on what a tool returned rather than on the model's words.
             if (envValue(process.env, "MATE_TRACE") === "1") {
@@ -423,16 +482,17 @@ export async function runMateTurn(input) {
     }
     if (reply === null) {
         stoppedAtCap = true;
-        reply = `${lastText.trim() === "" ? "" : `${lastText.trim()}\n\n`}(stopped after ${maxSteps} steps${maxSteps < MATE_MAX_STEPS ? " within this conversation’s remaining allowance" : ""})`;
+        const last = lastText.trim() === "" || unbacked(lastText) === null ? lastText.trim() : dropDeliverableClaims(lastText);
+        reply = `${last === "" ? "" : `${last}\n\n`}(I stopped here: this answer needed more steps than ${maxSteps < MATE_MAX_STEPS ? "this conversation's remaining spending allows" : "one reply allows"}. Ask me to carry on.)`;
     }
     // Ruling 11: model text is scanned before it becomes durable.
     if (scanForSecrets(reply).length > 0)
-        return fail("secret-refused", "the model's reply contained something credential-shaped and was discarded", false);
+        return fail("secret-refused", MATE_FAILURE_COPY.secretReply, false);
     now = clock();
     const activity = activitySummary(reads, proposals, steps);
     // One write (finding 12): settle, debit, promote the drafts, append the assistant text.
     const finalized = store.finalizeMateTurn(turnId, started.generation, { state: "answered", settledMicrousd: settled, tokensIn, tokensOut, message: { text: reply, activity } }, now);
     if (!finalized)
-        return { ok: false, turn: turnId, failed: "superseded", message: "this turn was ended before it could be kept", unknownSpend: false };
+        return { ok: false, turn: turnId, failed: "superseded", message: MATE_FAILURE_COPY.stopped, unknownSpend: false };
     return { ok: true, turn: turnId, reply, activity, proposals, steps, stoppedAtCap, settledMicrousd: settled };
 }

package/dist/operate.js

@@ -1,4 +1,5 @@
 import { UNSENT_REPLY_MS } from "./telegram-settings.js";
+import { leadNameOf } from "./lead-identity.js";
 import { maybeTriggerRepair } from "./dispose.js";
 import { CHECK_LEVEL_HINTS, CHECK_LEVEL_WORDS, isCheckLevel, liveQuickCommand, projectCheckLevel, quickVerifyKey, setProjectCheckLevel, setTaskCheckLevel, suggestQuickCommand } from "./check-levels.js";
 import { fileAddTestsTask, followUpChecksOf, requestFollowUpChecks, runFollowUpCheck, runWaitingChecks } from "./result-follow-ups.js";
@@ -10698,7 +10699,7 @@ function leadClaimCommand(positional, flags, context) {
     const claimed = leadClaim(store, actor, id, context.clock());
     if (!claimed.ok)
         return fail(write, json, command, claimed.reason, claimed.message, claimed.reason === "usage" ? EXIT.usage : EXIT.refused);
-    return succeed(write, json, command, { task: id, root: claimed.root, lead: claimed.claim }, () => [`${id} is yours: it reads "Your lead is on it" until you complete it, hand it on with task ask, or go two hours without acting on it.`]);
+    return succeed(write, json, command, { task: id, root: claimed.root, lead: claimed.claim }, () => [`${id} is yours: it reads "${leadNameOf(store, actor.account)} is on it" until you complete it, hand it on with task ask, or go two hours without acting on it.`]);
 }
 function blockTask(positional, flags, context) {
     const { store, write, json } = context;
@@ -11642,6 +11643,8 @@ async function chatCommand(flags, context) {
         ceilingUsd: ceilingGiven === undefined ? undefined : Number(ceilingGiven),
         ...(context.mateSeams === undefined ? {} : { seams: { ...context.mateSeams, clock: context.mateSeams.clock ?? context.clock } }),
         ...(context.evidenceRoot === undefined ? {} : { evidenceRoot: context.evidenceRoot }),
+        // The console's own address (and its public one): links there read as "the task", "the result", "Settings → Lead".
+        appOrigin: [loadConsoleUrl(process.env, dirname(context.databaseFile)), phoneOrigin(process.env, dirname(context.databaseFile))],
     });
     return result.code;
 }

package/dist/phase-routing.d.ts

@@ -234,7 +234,7 @@ export declare function parseOverrides(raw: unknown): RouteOverride[] | null;
  * nobody had overridden anything. */
 export declare function overridesFromJson(json: string | null): RouteOverride[] | null;
 export declare function canonicalOverridesJson(overrides: readonly RouteOverride[]): string | null;
-export type ReadinessLookup = (provider: ProviderId) => Pick<ReadinessObservation, "state" | "reason" | "runner" | "observedAt"> | null;
+export type ReadinessLookup = (provider: ProviderId) => (Pick<ReadinessObservation, "state" | "reason" | "runner" | "observedAt"> & Partial<Pick<ReadinessObservation, "probe">>) | null;
 export type RouteLegProjection = RouteLeg & {
     readiness: ReadinessState;
     readinessReason: string | null;

package/dist/project-delete.js

@@ -218,6 +218,7 @@ function deleteRows(store, repo, d, now) {
         del(`${surface}_flow_prompt`, IN("card"), C);
         del(`${surface}_question_action`, IN("question"), questions);
         del(`${surface}_question_prompt`, IN("question"), questions);
+        del(`${surface}_ask_action`, IN("turn"), U);
     }
     del("telegram_action", IN("decision"), decisions);
     del("telegram_decision_message", IN("decision"), decisions);
@@ -242,6 +243,7 @@ function deleteRows(store, repo, d, now) {
     del("team_mate_session", IN("thread"), H);
     del("mate_turn_evidence", `${IN("turn")} OR ${IN("run")} OR ${IN("task_ref")} OR ${IN("artifact")}`, U, R, T, A);
     del("chat_turn", IN("mate_turn"), U);
+    del("mate_ask", IN("turn"), U);
     del("mate_turn", IN("id"), U);
     del("mate_proposal", IN("id"), proposals);
     del("mate_message", IN("thread"), H);
@@ -318,7 +320,7 @@ function deleteRows(store, repo, d, now) {
     for (const [table, column] of SETTINGS)
         del(table, `${column} = ?`, repo);
     del("project_mute", "repo = ?", repo);
-    for (const table of ["knowledge_change", "project_skill_change", "memory_gap", "memory_proposal", "memory_rejection", "memory_session", "memory_search", "mode_rail", "side_spend", "watch_episode", "worktree", "coordinator_proposal"])
+    for (const table of ["knowledge_change", "project_skill_change", "memory_gap", "memory_proposal", "memory_rejection", "memory_session", "memory_search", "mode_rail", "side_spend", "watch_episode", "worktree", "coordinator_proposal", "lead_commitment"])
         del(table, "repo = ?", repo);
     // A builder watching the project keeps its lease until it stops; an ended one goes.
     del("watch_lease", "repo = ? AND expires_at <= ?", repo, now.toISOString());

package/dist/provider-auth.d.ts

@@ -34,6 +34,10 @@ export declare function providerName(provider: string): string;
 export declare function signInReason(pause: Pick<AuthPause, "provider" | "authMode">): string;
 /** What to run, as a command. */
 export declare function signInCommand(pause: Pick<AuthPause, "provider" | "authMode">): string;
+/** The same command for a chat message: the phone scrub hides anything shaped
+ * like a path (`/login` included), so a message names Claude's equivalent
+ * `claude auth login`. */
+export declare function messageCommand(pause: Pick<AuthPause, "provider" | "authMode">): string;
 /** One line for status, ready and the console. */
 export declare function signInWords(pause: AuthPause): string;
 /** The open pause for a provider, or null. */

package/dist/provider-auth.js

@@ -44,7 +44,7 @@ export function signInCommand(pause) {
 /** The same command for a chat message: the phone scrub hides anything shaped
  * like a path (`/login` included), so a message names Claude's equivalent
  * `claude auth login`. */
-function messageCommand(pause) {
+export function messageCommand(pause) {
     const command = signInCommand(pause);
     return command === "claude /login" ? "claude auth login" : command;
 }

package/dist/reply-shape.d.ts

@@ -0,0 +1,96 @@
+/**
+ * The lead's voice, enforced: every chat surface (console, terminal, Telegram, Slack, Discord, Teams) runs a reply
+ * through here before it is sent. The contract asks for plain text; this makes it so, without changing what the reply
+ * says. Shaping is channel-neutral and idempotent — it yields a small canonical form (`**anchor**`, `[label](url)`,
+ * `code`) — and each channel renders that form in its own format.
+ *
+ * - Markdown headers become plain lines.
+ * - Bold stays on at most three short anchors; the rest is plain.
+ * - Bare URLs become labelled links, named from their target: "the task", "the result", "Settings → Lead", else the host.
+ * - Internal ids (run #12, digests, r1-style project ids) are removed unless the owner asked for them. When a reply names
+ *   several of one kind (two runs, two projects), they stay: two items must never read the same.
+ * - Runs of blank lines collapse to one.
+ * Code (inline or fenced) is left exactly as written.
+ */
+export type ReplyChannel = "console" | "terminal" | "telegram" | "slack" | "discord" | "teams";
+export type ShapeOptions = {
+    /** The owner's message this reply answers: when it asks for ids, the ids stay. */
+    asked?: string;
+    /** This app's own origin (or origins: the console's address and its public one). Only a link there is named as the
+     * app's page ("the task"); every other link is named by its real host, whatever label the model wrote, so a reply can
+     * never dress a foreign link up as ours. */
+    appOrigin?: string | readonly (string | null)[] | null;
+};
+export declare const BOLD_ANCHORS = 3;
+/** A bold anchor is a few words, not a sentence. */
+export declare const BOLD_ANCHOR_CHARS = 40;
+/** Did the owner ask for ids (an id, a digest, a hash, a run number or a project's r-number)? */
+export declare function askedForIds(asked: string | undefined): boolean;
+/** What a link is called, from where it goes: the app's own task, result and settings pages by name (only on `appOrigin`); anything else by host. */
+export declare function linkLabel(url: string, appOrigin?: ShapeOptions["appOrigin"]): string;
+/**
+ * The canonical shaped reply: plain lines, at most three bold anchors, labelled links, no internal ids unless asked
+ * (or unless several of a kind would otherwise read the same), single blank lines. Idempotent: shaping a shaped reply
+ * changes nothing.
+ */
+export declare function shapeReply(text: string, options?: ShapeOptions): string;
+/**
+ * A long reply split into parts of at most `size` characters, then each part shaped: the cut is made on the reply as
+ * written, at a paragraph or line where possible and never inside code, a link or a bold anchor, so no part carries
+ * half of one. The parts share one bold budget and one rule for ids, as if the reply were shaped whole. `measure` is
+ * how long a shaped part is once the channel renders it (its own link and escape format): a part that renders past
+ * `size` is cut again, smaller. Only a single link longer than a part can exceed it, and it is never cut.
+ */
+export declare function shapeReplyParts(text: string, size: number, options?: ShapeOptions, measure?: (shaped: string) => number): string[];
+export type ReplyPiece = {
+    kind: "text";
+    text: string;
+} | {
+    kind: "bold";
+    text: string;
+} | {
+    kind: "code";
+    text: string;
+} | {
+    kind: "link";
+    label: string;
+    url: string;
+};
+/** A shaped reply as pieces: plain text, bold anchors, inline code and labelled links. Fenced code stays text. */
+export declare function replyPieces(shaped: string): ReplyPiece[];
+/** Discord's presentation syntax, escaped; mentions are broken so nothing pings. */
+export declare const discordPlain: (text: string) => string;
+/** One line of a shaped reply as console HTML (the console lays out paragraphs and lists itself). */
+export declare function replyHtmlInline(shapedLine: string): string;
+/** A shaped reply in a channel's own text format (Telegram's formatting rides entities: see `telegramReply`). */
+export declare function renderReply(shaped: string, channel: ReplyChannel): string;
+export type TelegramEntity = {
+    type: "bold" | "code";
+    offset: number;
+    length: number;
+} | {
+    type: "text_link";
+    offset: number;
+    length: number;
+    url: string;
+};
+/** A shaped reply for Telegram: plain text plus entities (bold anchors, code, labelled links). Offsets are UTF-16, as JS strings are. */
+export declare function telegramReply(shaped: string): {
+    text: string;
+    entities: TelegramEntity[];
+};
+/** Shape and render in one step, for a surface that sends the reply as text. */
+export declare function voiceReply(text: string, channel: ReplyChannel, options?: ShapeOptions): string;
+/**
+ * The words in a reply that say something is being sent or attached ("I've attached the log", "here's the
+ * screenshot"), or null. A claim needs an attachment noun and a send verb; one whose content the reply lists itself
+ * ("I've included the files I changed: a.ts") is not a claim.
+ */
+export declare function deliverableClaim(text: string): string | null;
+/** Does the reply carry the thing itself: a link, or content quoted in a code block? */
+export declare function replyCarriesDeliverable(text: string): boolean;
+export declare const NOTHING_ATTACHED = "I couldn't attach that to this reply.";
+/** The reply without its claims of an attachment, said plainly once; whatever a claim listed stays; never the claim alone. */
+export declare function dropDeliverableClaims(text: string): string;
+/** The one repair step's words to the lead: attach it, or drop the claim. */
+export declare function deliverableRepair(claim: string): string;