toolroll 0.9.16 → 0.9.18

package/dist/serve.js

@@ -1,4 +1,5 @@
 import { checkLeadIdentity, leadIdentityOf, leadNameOf, LEAD_NAME_MAX, LEAD_PERSONA_MAX } from "./lead-identity.js";
+import { aboutYouOf, checkAboutYou, saveAboutYou, ABOUT_YOU_LINE_MAX, ABOUT_YOU_MAX_LINES } from "./lead-about.js";
 import { withActor } from "./actor.js";
 import { repositoryContext, repositoryContextRead } from './repository-context.js';
 import { ADD_TESTS_ACTION, followUpChecksOf, requestFollowUpChecks, fileAddTestsTask, resultCheckLevel } from './result-follow-ups.js';
@@ -20,7 +21,7 @@ import { ChatState } from "./chat-delivery-state.js";
 import { slackSettingsHtml } from "./slack-settings.js";
 import { checkSlackCredentials, loadSlackCredentials, saveSlackCredentials, clearSlackCredentials, SLACK_MANIFEST, SlackError } from "./slack-api.js";
 import { SlackState } from "./slack-state.js";
-import { CHAT_ACTIONS, sharedActionPayload, sharedActionNeedsReview, sharedActionReviewPath, mintSharedActionReview } from './chat-actions.js';
+import { CHAT_ACTIONS, OWNER_ACTIONS, sharedActionPayload, sharedActionNeedsReview, sharedActionReviewPath, mintSharedActionReview } from './chat-actions.js';
 import { changeSkills, githubSkill, importSkill, readSkillsSnapshot, reviseSkillTest, skillTestResult, skillsView, testSkill } from "./project-skills.js";
 import { skillsHtml, skillsScript, skillsSnapshotHtml, skillTestFeedbackHtml, SKILLS_CSS } from "./skills-ui.js";
 import { toolsHtml, TOOLS_CSS } from "./tools-ui.js";
@@ -92,6 +93,7 @@ import { DISCLOSURE_CSS } from "./disclosure.js";
 import { styleAsset } from "./style-asset.js";
 import { MOBILE_VIEWPORT_SCRIPT } from "./mobile-viewport.js";
 import { authorizePlanUnderMode, applyModeToNewFiling, planAutoPending } from "./plan-auto.js";
+import { permissionPlainWords } from "./chat-decide.js";
 import { LEDGER_CSV_HEADER, ledgerCsvRows } from "./ledger-csv.js";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
@@ -187,7 +189,8 @@ import { dirname } from "node:path";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { loadOrCreateVapidKeys, validatePushEndpoint } from "./push.js";
 import { parseGithubRepo, previewGithubRepo, cloneGithubRepo, listGithubRepos, isLargeRepo } from "./onboard.js";
-import { verifiedAuthor, LEAD_THREAD, isDigestTime, MATE_ASK_OTHER } from "./store.js";
+import { verifiedAuthor, LEAD_THREAD, isDigestTime, RESULT_SCREENSHOTS, MATE_ASK_OTHER } from "./store.js";
+import { RESULT_SHOT_CHOICES } from "./result-shots.js";
 import { digestTimes } from "./digest-times.js";
 import { updateRepos, addRepos, removeRepos } from "./repos.js";
 import { run as execRun } from "./exec.js";
@@ -212,7 +215,7 @@ import { authorizedProject, canonicalProject, isGitRepo, projectName, sameRepo,
 import { tally, spendLine, runCostWords } from "./summary.js";
 import { classify, holdOwnerWords, attentionCardForUnverifiedDone } from "./board.js";
 import { approveRoutine, describeSchedule, fireRoutine, parseSchedule, refreshRoutineAgents, routineAgentsState, routineDigestOf, validateRoutineTerms, ROUTINE_NAME } from "./routine.js";
-import { effectivePrimary, isMessagingChannel, savePrimary } from "./webhooks.js";
+import { effectivePrimary, isMessagingChannel, loadConsoleUrl, savePrimary } from "./webhooks.js";
 import { resolvePhaseAgent, resolveRoutineAuthority, INSTALLATION_SCOPE, routeOfTask, agentChoicesFor } from "./agentconfig.js";
 import { isRiskLevel, projectRoute, riskTitle, riskConsequence, chosenWords, agentsSummary, postureWords, RISK_CHOICES, RISK_LEVELS, PHASES as ROUTE_PHASES } from "./phase-routing.js";
 import { ALL_CREDENTIAL_ENV, isProviderId, reportsCost, PROVIDER_IDS, validModelId, validateSpec } from "./provider.js";
@@ -260,6 +263,7 @@ import { handleTeamsHttp } from "./teams.js";
 import { checkTeamsCredentials, clearTeamsCredentials, loadTeamsCredentials, saveTeamsCredentials, TeamsError } from "./teams-api.js";
 import { verifyApproverByPassword, verifyApproverStanding } from "./principal.js";
 import { runMateTurn, MATE_MESSAGE_MAX_CHARS } from "./mate.js";
+import { replyHtmlInline, shapeReply } from "./reply-shape.js";
 import { confirmCoordinatorProposal, confirmMateProposal, dismissCoordinatorProposal, dismissMateProposal } from "./mate-doors.js";
 import { envValue } from "./names.js";
 import { cachedRelease, isNewer, runnerVersions, setUpdateChecks, updateChecksOff } from "./releases.js";
@@ -1529,6 +1533,8 @@ export function createDecisionServer(options) {
             actor: who.name,
             csrf: who.via === "cookie" ? who.session.csrf : "",
             returnTo: safeReturn(url.pathname + url.search),
+            // This console's own addresses: a lead reply's links there read as "the task", "the result", "Settings → Lead".
+            appOrigins: [consoleOrigin(request.headers.host), publicOrigin?.origin ?? null, options.configDir === undefined ? null : loadConsoleUrl(process.env, options.configDir)],
             // Every signed-in page shares the workspace shell; pages showing a one-time secret opt out (forceSensitive).
             browser: who.via === 'cookie',
             // v100: signed in with the identity provider: its label, and whether it checked them recently enough to stand in for a password.
@@ -1634,7 +1640,7 @@ export function createDecisionServer(options) {
             }
             if (admitted && proposal) {
                 const taskId = typeof action?.request['task'] === 'string' ? action.request['task'] : typeof proposal.payload['task'] === 'string' ? proposal.payload['task'] : null;
-                const repo = action?.repo ?? (taskId ? store.lookupRef(taskId)?.repo : null) ?? (typeof proposal.payload['repo'] === 'string' ? proposal.payload['repo'] : null);
+                const repo = (action?.repo || null) ?? (taskId ? store.lookupRef(taskId)?.repo : null) ?? (typeof proposal.payload['repo'] === 'string' ? proposal.payload['repo'] : null);
                 return { repo, taskId, runId: typeof action?.request['run'] === 'number' ? action.request['run'] : null, action: action?.operation ?? `chat ${proposal.kind}` };
             }
         }
@@ -1699,6 +1705,9 @@ export function createDecisionServer(options) {
             }
             if (action && proposal && store.getMateThread(proposal.thread)?.approver === who.name && visible(action.repo) && store.accountCanAccess(who.name, action.repo))
                 return true;
+            // A card about the person themselves (what their lead knows about them) is in no project.
+            if (action && proposal && action.repo === '' && OWNER_ACTIONS.has(action.operation) && store.getMateThread(proposal.thread)?.approver === who.name)
+                return true;
             refuse(response, who, 404, 'No such action in your projects.', '/projects');
             return false;
         }
@@ -2641,6 +2650,10 @@ export function createDecisionServer(options) {
                         `<option value="0">wait for my approval</option>` +
                         `<option value="1">auto-approve plans that preserve my filed contract</option>` +
                         `</select><span class="meta">Requires automatic filing approval. File the goal, paths, and acceptance criteria upfront. Changed scope and unanswered questions still pause.</span></label>`,
+                    `<label>From my chat app<select name="chat-approve">` +
+                        `<option value="">approve plans and merges here, with my password (the default)</option>` +
+                        `<option value="1">approve plans and merge ready pull requests from my paired chat, two taps each</option>` +
+                        `</select><span class="meta">Plans that widen permissions, exceed the attempt cap or touch protected paths still open Toolroll.</span></label>`,
                     `<label>If a subscription runs out<select name="allow-paid-fallback">` +
                         `<option value="">never switch to a paid API key on its own (the default, every preset)</option>` +
                         `<option value="1">allow the approved fallback — spend moves to that account</option>` +
@@ -4138,7 +4151,8 @@ export function createDecisionServer(options) {
             const signedIn = localSignIn?.states.claude === "connected" ? "Claude Code" : localSignIn?.states.codex === "connected" ? "Codex" : null;
             const promises = openCommitments(store, who.name, 50).map(one => ({ id: one.id, what: one.what, when: conditionWords(store, one.condition), until: one.expiresAt }));
             return sendScreen(response, 200, screen("Lead", leadSettingsHtml({ config, facts, words: leadWords(), signedIn, command: agentSignInCommand(),
-                said: url.searchParams.get("said"), saved: url.searchParams.get("saved") === "1", identity: leadIdentityOf(store, who.name), promises }), { chrome: chromeFor(project, "settings") }));
+                said: url.searchParams.get("said"), saved: url.searchParams.get("saved") === "1", identity: leadIdentityOf(store, who.name), promises,
+                about: aboutYouOf(store, who.name), aboutSaved: url.searchParams.get("saved") === "about" }), { chrome: chromeFor(project, "settings") }));
         }
         if (url.pathname === "/settings/telegram") {
             // Any approver pairs their OWN phone here; the bot token stays on /settings.
@@ -4223,7 +4237,7 @@ export function createDecisionServer(options) {
                 return at === null || since === null ? null : firstResultWords(since, at);
             })(), (() => {
                 const chosen = store.notificationPreference(who.name);
-                return { mode: chosen.mode, digestAt: chosen.digestAt, projects: notificationProjects(store, who.name) };
+                return { mode: chosen.mode, digestAt: chosen.digestAt, screenshots: chosen.screenshots, projects: notificationProjects(store, who.name) };
             })()));
         }
         if (url.pathname === "/push/key") {
@@ -4818,20 +4832,20 @@ export function createDecisionServer(options) {
             if (result.problem.startsWith("status-")) {
                 // The provider ANSWERED with an error: nothing billed.
                 finish({ state: "failed", failureReason: "provider-error", settledMicrousd: 0 });
-                tell(null, "the provider refused the request — nothing was billed");
+                tell(null, "The chat provider turned the request down. Nothing was kept or charged. Try again in a minute.");
             }
             else if (result.problem === "timeout") {
                 finish({ state: "failed", failureReason: "timeout", settledMicrousd: null, unknownSpend: true });
-                tell(null, "the turn timed out; its cost is unknown and chat is blocked until you acknowledge it");
+                tell(null, "The reply took too long and was stopped, and its cost isn't known yet, so chat is paused. Confirm the cost on this page to turn chat back on.");
             }
             else if (result.problem === "network") {
                 finish({ state: "failed", failureReason: "provider-error", settledMicrousd: null, unknownSpend: true });
-                tell(null, "the provider could not be reached after dispatch; cost unknown — acknowledge to re-enable chat");
+                tell(null, "The chat provider stopped responding partway through, and the cost isn't known, so chat is paused. Confirm the cost on this page to turn chat back on.");
             }
             else {
                 // 200 with an unusable wrapper: billed, amount unproven.
                 finish({ state: "failed", failureReason: "malformed-reply", settledMicrousd: null, unknownSpend: true });
-                tell(null, "the provider's response was malformed and was discarded; cost unknown — acknowledge to re-enable chat");
+                tell(null, "The chat provider sent back an answer that couldn't be read, and its cost isn't known, so chat is paused. Confirm the cost on this page to turn chat back on.");
             }
             return;
         }
@@ -8228,16 +8242,21 @@ export function createDecisionServer(options) {
         }
         if (url.pathname === "/settings/notifications") {
             // Each person's own choice: a closed list of modes and a 24-hour HH:MM, or off.
-            const mode = body.get("mode"), time = (body.get("digest") ?? "").trim();
+            const mode = body.get("mode"), time = (body.get("digest") ?? "").trim(), shots = body.get("screenshots");
             if (mode !== null && mode !== "quiet" && mode !== "all")
                 return refuse(response, who, 400, "choose Only when I'm needed or Every step", "/settings");
             if (time !== "" && time !== "off" && !isDigestTime(time))
                 return refuse(response, who, 400, "the evening digest time is HH:MM, or off", "/settings");
+            if (shots !== null && !RESULT_SCREENSHOTS.includes(shots))
+                return refuse(response, who, 400, "choose Off, First one or Up to 4", "/settings");
             const before = store.notificationPreference(who.name);
-            const after = store.setNotificationPreference(who.name, { ...(mode === null ? {} : { mode }), ...(time === "" ? {} : { digestAt: time === "off" ? null : time }) }, who.name, now);
+            const after = store.setNotificationPreference(who.name, { ...(mode === null ? {} : { mode }), ...(time === "" ? {} : { digestAt: time === "off" ? null : time }),
+                ...(shots === null ? {} : { screenshots: shots }) }, who.name, now);
             const said = after.mode !== before.mode
                 ? after.mode === "quiet" ? "Chats now message you only when you're needed." : "Chats now message you at every step."
-                : after.digestAt === null ? "Evening digest off." : `Evening digest at ${after.digestAt}.`;
+                : after.screenshots !== before.screenshots
+                    ? after.screenshots === "off" ? "Results arrive without screenshots." : `Results arrive with ${after.screenshots === "first" ? "their first screenshot" : "up to 4 screenshots"}.`
+                    : after.digestAt === null ? "Evening digest off." : `Evening digest at ${after.digestAt}.`;
             return redirect(response, `/settings?said=${encodeURIComponent(said)}`);
         }
         if (url.pathname === "/settings/notifications/mute") {
@@ -8704,6 +8723,8 @@ export function createDecisionServer(options) {
                 // attempt cap it carries is meaningless without it.
                 repairAuto: false,
                 repairMaxAttempts: 0,
+                // Approving from the paired chat: only the explicit choice grants it.
+                chatApprove: body.get("chat-approve") === "1",
                 publication: body.get("publication") === "automerge" ? "automerge" : "notify",
             };
             if (["review-auto", "review-retry-auto", "repair-auto"].some(field => body.get(field) === "1")) {
@@ -8725,7 +8746,7 @@ export function createDecisionServer(options) {
                     `<input type="hidden" name="csrf" value="${escape(who.session.csrf)}">` +
                     `<input type="hidden" name="nonce" value="${escape(nonce)}">` +
                     `<input type="hidden" name="digest" value="${escape(digest)}">` +
-                    ["name", "days", "publication", "auto-approve", "plan-auto", "allow-paid-fallback"]
+                    ["name", "days", "publication", "auto-approve", "plan-auto", "chat-approve", "allow-paid-fallback"]
                         .map(field => `<input type="hidden" name="${field}" value="${escape(body.get(field) ?? "")}">`)
                         .join("") +
                     `<input type="hidden" name="expiry" value="${escape(expiry)}">` +
@@ -9231,6 +9252,16 @@ export function createDecisionServer(options) {
             store.setLeadConfig(who.name, checked.identity.name, checked.identity.persona, now);
             return redirect(response, "/settings/lead?saved=1");
         }
+        // Settings → Lead: what this person's lead knows about them, one line each.
+        if (url.pathname === "/settings/lead/about") {
+            if (who.via !== "cookie" || who.role !== "approver")
+                return refuse(response, who, 403, "An approver edits what their lead knows about them.", "/settings/lead");
+            const checked = checkAboutYou(body.get("about") ?? "");
+            if (!checked.ok)
+                return redirect(response, chatReturnWithSaid("/settings/lead", checked.message));
+            saveAboutYou(store, who.name, checked.lines, now);
+            return redirect(response, "/settings/lead?saved=about");
+        }
         // Settings → Lead: stop the lead following up on one of your promises.
         if (url.pathname === "/settings/lead/promise/cancel") {
             if (who.via !== "cookie" || who.role !== "approver")
@@ -12525,7 +12556,7 @@ function approvalSheetHtml(input) {
     // What the yes allows, in plain words, right above it: the agent's
     // permissions, the per-attempt limit, and an earlier version still running.
     const allowing = [];
-    const allowed = permissionPlainWordsOf(scope.profile);
+    const allowed = permissionPlainWords(scope.profile);
     if (allowed !== null)
         allowing.push(allowed);
     if (raceTerms === null)
@@ -12676,20 +12707,6 @@ class PermissionsWouldChange extends Error {
 }
 /** Evidence kinds in plain words, for the signed criteria in Details. */
 const EVIDENCE_PLAIN = { check: "the project check", screenshot: "screenshots", "changed-path": "changed files", "manual-review": "your own check" };
-/** What an agent may do on its own, in a few plain words. */
-function permissionPlainWordsOf(profile) {
-    if (profile === null || profile === undefined)
-        return null;
-    const full = "full access, nothing asks first";
-    if (profile.provider === "claude") {
-        return profile.permissionArgv === "bypassPermissions" ? full
-            : profile.permissionArgv === "auto" ? "file edits and routine commands; anything risky stops"
-                : "file edits only; commands are refused";
-    }
-    if (profile.provider === "gemini")
-        return profile.approvalArgv === "yolo" ? full : "file edits only; other tools are refused";
-    return profile.sandboxMode === "danger-full-access" ? full : "file edits and commands inside the project only";
-}
 /** The permission choice a sealed profile carries, as the scope form names it. */
 function permissionModeOfProfile(profile) {
     if (profile === null || profile === undefined)
@@ -17477,13 +17494,13 @@ function chatHeading(copy, projectCount, showProjectToggle = true) {
                 `${strokeIcon(`<path d="M4 20h16a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-7.9a2 2 0 0 1-1.69-.9L9.6 3.9A2 2 0 0 0 7.93 3H4a2 2 0 0 0-2 2v13c0 1.1.9 2 2 2Z"/>`)}<span>projects</span><span class="badge">${projectCount}</span></button>`
             : "") + `</div></div>`);
 }
-/** A deliberately small rich-text grammar for model copy. Input is escaped
- * before tags are introduced: headings, bullets, numbered steps, bold, and
- * inline code are presentation only—never executable HTML or external links. */
-function renderChatText(text) {
-    const inline = (value) => escape(value)
-        .replace(/`([^`\n]{1,240})`/g, "<code>$1</code>")
-        .replace(/\*\*([^*\n]{1,500})\*\*/g, "<strong>$1</strong>");
+/** A deliberately small rich-text grammar for model copy. The reply is shaped first (the lead's voice, enforced:
+ * no headers, at most three bold anchors, labelled links, no internal ids unless `asked` wanted them); input is
+ * escaped before tags are introduced: bullets, numbered steps, bold, inline code and labelled http(s) links are
+ * presentation only—never executable HTML. */
+function renderChatText(raw, asked) {
+    const inline = replyHtmlInline;
+    const text = shapeReply(raw, { appOrigin: requestContext.getStore()?.appOrigins ?? null, ...(asked === undefined ? {} : { asked }) });
     const lines = text.replace(/\r\n?/g, "\n").split("\n");
     const out = [];
     let paragraph = [];
@@ -17501,15 +17518,9 @@ function renderChatText(text) {
         list = null;
     };
     for (const line of lines) {
-        const heading = /^(?:#{1,3}\s+)(.+)$/.exec(line);
         const bullet = /^\s*[-*]\s+(.+)$/.exec(line);
         const numbered = /^\s*(\d{1,9})[.)]\s+(.+)$/.exec(line);
-        if (heading !== null) {
-            flushParagraph();
-            closeList();
-            out.push(`<h3>${inline(heading[1] ?? "")}</h3>`);
-        }
-        else if (bullet !== null || numbered !== null) {
+        if (bullet !== null || numbered !== null) {
             flushParagraph();
             const wanted = bullet !== null ? "ul" : "ol";
             if (list !== wanted) {
@@ -17598,6 +17609,12 @@ function leadSettingsHtml(data) {
             `<label>Name your lead<input name="name" value="${escape(data.identity.name)}" maxlength="${LEAD_NAME_MAX}" autocomplete="off" required></label>` +
             `<label>Persona<textarea name="persona" rows="4" maxlength="${LEAD_PERSONA_MAX}">${escape(data.identity.persona)}</textarea></label>` +
             `<button type="submit">Save</button>${data.saved === true ? ` <span class="meta" role="status">Saved.</span>` : ""}</form>`,
+        // What the lead knows about this person: lines they confirmed in chat or wrote here. Every project, every chat.
+        data.about === undefined ? "" : `<form method="post" action="/settings/lead/about" class="card lead-about" data-lead-about>` +
+            `<input type="hidden" name="csrf" value="${escape(facts.csrf)}">` +
+            `<label>What your lead knows about you<textarea name="about" rows="${Math.min(10, Math.max(4, data.about.length + 1))}" maxlength="${ABOUT_YOU_MAX_LINES * (ABOUT_YOU_LINE_MAX + 1)}" placeholder="Keep copy terse.&#10;I test changes myself.">${escape(data.about.join("\n"))}</textarea></label>` +
+            `<p class="meta">One per line, up to ${ABOUT_YOU_MAX_LINES}.</p>` +
+            `<button type="submit">Save</button>${data.aboutSaved === true ? ` <span class="meta" role="status">Saved.</span>` : ""}</form>`,
         // What the lead promised to follow up on; it reports each once, here in chat, and drops it after 7 days.
         (data.promises ?? []).length === 0 ? "" : `<section class="card lead-promises" data-lead-promises><h2>Promises</h2><ul class="lead-promise-list">${data.promises.map(one => `<li data-promise="${one.id}"><p>${escape(one.what)}</p><p class="meta">${escape(one.when.charAt(0).toUpperCase() + one.when.slice(1))} · <span class="nowrap">until ${escape(new Date(one.until).toLocaleDateString("en-US", { month: "short", day: "numeric", timeZone: "UTC" }))}</span></p>` +
             `<form method="post" action="/settings/lead/promise/cancel" class="inline">${hidden}<input type="hidden" name="promise" value="${one.id}"><button type="submit" class="secondary">Cancel</button></form></li>`).join("")}</ul></section>`,
@@ -17699,8 +17716,8 @@ function chatPage(chrome, data) {
         parts.push(data.coordinatorProposals);
     parts.push(data.focusTask === null && !data.catchUp ? `<details class="chat-fleet-context">${chatOverviewSummaryHtml(data.projects, data.fleetSnapshot?.attentionCount)}${chatFleetOverview(data.fleetSnapshot, data.projects, data.csrf, false)}</details>` : "", chatLimitsHtml({ provider: config.provider, model: config.model, turnsToday: data.turnsToday, dailyTurns: config.dailyTurns, subscription, weekly: subscription ? null : { spent: data.weeklySpent, ceiling: config.weeklyCeilingMicrousd } }));
     for (const turn of data.latched) {
-        parts.push(`<div class="problem"><strong>Unknown spend blocks chat.</strong> turn #${turn.id} may have cost up to ${chatMoney(turn.reservedMicrousd)} — ` +
-            `<a href="/chat/ack/${turn.id}">read and acknowledge it</a> to re-enable this credential.</div>`);
+        parts.push(`<div class="problem"><strong>Chat is paused.</strong> An earlier reply stopped before its cost was known; it may have cost up to ${chatMoney(turn.reservedMicrousd)}. ` +
+            `<a href="/chat/ack/${turn.id}">Confirm that cost</a> to turn chat back on.</div>`);
     }
     if (data.pending !== null) {
         parts.push(chatWorkingHtml({ details: `Turn #${data.pending.id}${subscription ? " · subscription" : ` · up to ${chatMoney(data.pending.reservedMicrousd)} reserved`}` }));
@@ -18115,9 +18132,14 @@ function mateBrowserMessages(rows, csrf, back, target = { task: null, project: n
         const ask = turn === null ? undefined : rows.asks?.get(turn);
         return ask === undefined ? "" : mateAskHtml(ask, csrf, target, target.task === null ? "lead-message" : "task-message", ask.turn === open);
     };
+    // The owner's message each reply answers: when it asked for ids, the reply keeps them.
+    const askedBy = new Map();
+    rows.messages.reduce((last, message) => { if (message.role === 'operator')
+        return message.text; if (last !== undefined)
+        askedBy.set(message.id, last); return last; }, undefined);
     return rows.messages.map(message => ({
         id: message.id, role: message.role, text: message.text,
-        html: message.role === 'operator' ? `<p>${escape(message.text)}</p>` : renderChatText(message.text) + asked(message.turn),
+        html: message.role === 'operator' ? `<p>${escape(message.text)}</p>` : renderChatText(message.text, askedBy.get(message.id)) + asked(message.turn),
         activity: message.activity, createdAt: message.createdAt,
         ...(() => {
             const parts = message.turn === null ? [] : rows.proposals.filter(one => one.turn === message.turn)
@@ -18188,14 +18210,16 @@ function mateThreadHtml(data) {
         parts.push(`<div class="chat-empty" data-key="empty"><strong>${data.focusTask === null ? "What do you want to get done?" : "What do you want to understand or change?"}</strong>` +
             `<p class="meta">${data.focusTask === null ? "Describe a task or ask about your projects." : "Ask about progress, review results, or adjust the plan."}</p></div>`);
     }
+    let asked;
     for (const message of data.messages) {
         if (message.role === "operator") {
+            asked = message.text;
             parts.push(`<div class="msg op" data-message-role="operator" data-key="m${message.id}"><p style="white-space:pre-wrap">${escape(message.text)}</p></div>`);
             continue;
         }
         const cards = message.turn === null ? [] : (byTurn.get(message.turn) ?? []);
         parts.push(`<div class="msg mate" data-message-role="assistant" data-key="m${message.id}"${message.id === latestReply ? ' id="latest"' : ""}>` +
-            renderChatText(message.text) +
+            renderChatText(message.text, asked) +
             (() => {
                 const ask = message.turn === null ? undefined : data.asks?.get(message.turn);
                 return ask === undefined ? "" : mateAskHtml(ask, data.csrf, { task: data.focusTask?.id ?? null, project: data.chatProject ?? null }, "chat-message", data.pending === null && data.ask?.turn === ask.turn);
@@ -18255,8 +18279,8 @@ function matePage(chrome, data) {
     if (data.problem !== null)
         conversation.push(`<div class="problem">${escape(data.problem)}</div>`);
     for (const turn of data.latched) {
-        conversation.push(`<div class="problem"><strong>Unknown spend blocks chat.</strong> turn #${turn.id} may have cost up to ${chatMoney(turn.reservedMicrousd)} — ` +
-            `<a href="/chat/ack/${turn.id}">read and acknowledge it</a> to re-enable this credential.</div>`);
+        conversation.push(`<div class="problem"><strong>Chat is paused.</strong> An earlier reply stopped before its cost was known; it may have cost up to ${chatMoney(turn.reservedMicrousd)}. ` +
+            `<a href="/chat/ack/${turn.id}">Confirm that cost</a> to turn chat back on.</div>`);
     }
     const lastMessage = data.messages.at(-1);
     const latestReply = data.pending === null && lastMessage?.role === "assistant" ? lastMessage.id : null;
@@ -23916,6 +23940,9 @@ function settingsPage(chrome, existing, hasEnv, csrf, problem, messaging = null,
                 digestTimes(chatNotices.digestAt).map(([value, label]) => `<option value="${value}"${value === (chatNotices.digestAt ?? "off") ? " selected" : ""}>${label}</option>`).join("") +
                 `</select></label>`,
             `<p class="meta">One message: what finished, what waits, what failed.</p>`,
+            `<label>Screenshots with results<select name="screenshots">` +
+                RESULT_SHOT_CHOICES.map(([value, label]) => `<option value="${value}"${value === (chatNotices.screenshots ?? "off") ? " selected" : ""}>${label}</option>`).join("") +
+                `</select></label>`,
             `<button type="submit">Save</button>`,
             `</form>`,
             ...((chatNotices.projects ?? []).length === 0 ? [] : [

package/dist/slack-chat.d.ts

@@ -25,4 +25,6 @@ export declare const applySlackAction: (options: SlackChatOptions, event: SlackE
 export declare const planSlackNotifications: (options: SlackChatOptions) => Promise<void>;
 export declare const planSlackRooms: (options: SlackChatOptions) => Promise<void>;
 export declare function slackBlocks(text: string, buttons?: Record<string, unknown>[]): Record<string, unknown>[];
+/** The lead's reply as mrkdwn sections: no header block, so its first line stays an ordinary line. */
+export declare function slackVoiceBlocks(mrkdwn: string, buttons?: Record<string, unknown>[]): Record<string, unknown>[];
 export declare function deliverSlackPart(options: SlackChatOptions): Promise<boolean>;

package/dist/slack-chat.js

@@ -1,4 +1,5 @@
 import { chatFlowButtons } from "./chat-flow.js";
+import { refuseResultShots, resultShotsPruned } from "./result-shots.js";
 import { chatQuestionButtons } from "./teammate-question.js";
 import { chatAskButtons } from "./chat-ask.js";
 import { channelInbox } from "./chat-inbox.js";
@@ -7,6 +8,7 @@ import { processChatEvent, applyChatAction, planChatNotifications, channelAccess
 /** Slack is a transport for the same saved assistant and confirmation doors. */
 import { proposalPreview, proposalLink, proposalOutcomeText, armedCardText, armedYesLabel, } from "./chat-channel.js";
 import { MATE_MESSAGE_MAX_CHARS } from "./mate.js";
+import { renderReply } from "./reply-shape.js";
 import {} from "./mate-doors.js";
 import { SlackState, slackHash, } from "./slack-state.js";
 import { object, slackId, slackTs, slackMember, SlackError, uploadSlackBytes, } from "./slack-api.js";
@@ -131,6 +133,10 @@ const delivery = (options) => ({
     state: new SlackState(options.store),
     label: "Slack",
     member: (member, channel) => slackMember(options.api, options.identity, member, channel),
+    // A 👍 on the owner's message where the app has reactions:write; Slack shows bots no typing indicator.
+    warm: (event) => ({
+        react: () => options.api("reactions.add", { channel: event.channel, timestamp: event.ts, name: "thumbsup" }),
+    }),
 });
 export const processSlackEvent = (options) => processChatEvent(delivery(options));
 export const applySlackAction = (options, event, binding, repos) => applyChatAction(delivery(options), event, binding, repos);
@@ -156,6 +162,16 @@ export function slackBlocks(text, buttons = []) {
         blocks.push({ type: "actions", elements: buttons });
     return blocks;
 }
+/** The lead's reply as mrkdwn sections: no header block, so its first line stays an ordinary line. */
+export function slackVoiceBlocks(mrkdwn, buttons = []) {
+    const blocks = split(mrkdwn).map((part) => ({
+        type: "section",
+        text: { type: "mrkdwn", text: part },
+    }));
+    if (buttons.length)
+        blocks.push({ type: "actions", elements: buttons });
+    return blocks;
+}
 function linkButton(origin, link) {
     if (!origin ||
         !link ||
@@ -217,6 +233,13 @@ export async function deliverSlackPart(options) {
         if (content.task &&
             !repos.includes(store.lookupRef(content.task)?.repo ?? ""))
             throw new SlackError("Connected projects changed");
+        // A screenshot sent with a result goes in that result's thread once its message is placed.
+        const follows = content.shot?.follows == null ? undefined : state.db.prepare("SELECT message FROM slack_part WHERE id=? AND state='sent'").get(content.shot.follows)?.message;
+        const thread = slackTs(follows) ? String(follows) : event.thread;
+        if (content.image && content.shot && resultShotsPruned(options.evidenceRoot, content.image.run)) {
+            state.db.prepare("UPDATE slack_part SET state='dropped',problem='Removed by retention' WHERE id=?").run(row.id);
+            return true;
+        }
         if (content.image) {
             const verified = verifyResultImage(store, options.evidenceRoot, repos, content.image);
             if (!verified.ok) {
@@ -257,7 +280,7 @@ export async function deliverSlackPart(options) {
                         : [];
                     const found = receipts
                         .map(object)
-                        .find((receipt) => receipt.thread_ts === event.thread && slackTs(receipt.ts));
+                        .find((receipt) => (receipt.thread_ts ?? "") === thread && slackTs(receipt.ts));
                     if (found) {
                         state.db
                             .prepare("UPDATE slack_part SET state='sent',message=?,problem=NULL WHERE id=?")
@@ -273,7 +296,7 @@ export async function deliverSlackPart(options) {
                         },
                     ],
                     channel_id: destination,
-                    thread_ts: event.thread,
+                    thread_ts: thread === "" ? undefined : thread,
                     initial_comment: safeResultImageCaption(content.text, content.image.taskId, content.image.run),
                 });
                 if (!Array.isArray(completed.files) ||
@@ -374,14 +397,16 @@ export async function deliverSlackPart(options) {
                 ...(content.also ?? []).flatMap((one, index) => linkButton(options.origin(), one).map(button => ({ ...button, action_id: `toolroll_link_${index + 2}` }))),
             ];
         const target = content.edit ?? row.message;
+        // The lead's own reply goes out in Slack's mrkdwn (bold anchors, labelled links); everything else stays plain.
+        const voiced = content.voice === true && !content.proposal && !content.image ? renderReply(text, "slack") : null;
         const args = {
             channel: destination,
-            text: text
+            text: voiced ?? text
                 .replaceAll("&", "&")
                 .replaceAll("<", "&lt;")
                 .replaceAll(">", "&gt;"),
-            blocks: slackBlocks(text, buttons),
-            mrkdwn: false,
+            blocks: voiced === null ? slackBlocks(text, buttons) : slackVoiceBlocks(voiced, buttons),
+            mrkdwn: voiced !== null,
             parse: "none",
             unfurl_links: false,
             unfurl_media: false,
@@ -390,9 +415,9 @@ export async function deliverSlackPart(options) {
             ? await options.api("chat.update", { ...args, ts: target })
             : await options.api("chat.postMessage", {
                 ...args,
-                thread_ts: event.kind === "notice" && event.thread === ""
+                thread_ts: event.kind === "notice" && thread === ""
                     ? undefined
-                    : event.thread,
+                    : thread,
             });
         if (!slackTs(answer.ts) || (target && answer.ts !== target))
             throw new SlackError("Slack did not confirm the message identity", 15_000, true);
@@ -405,6 +430,12 @@ export async function deliverSlackPart(options) {
         return true;
     }
     catch (error) {
+        // No permission to upload files here: one plain line instead of the result's screenshots.
+        const content = JSON.parse(row.payload);
+        if (content.image && content.shot && error instanceof SlackError && ["missing_scope", "no_permission"].includes(error.code)) {
+            refuseResultShots(state, store, row, content, "Slack", nowOf(options));
+            return true;
+        }
         const problem = error instanceof SlackError
             ? error
             : new SlackError("Slack delivery is waiting to retry", 15_000, true);

package/dist/store.d.ts

@@ -47,6 +47,9 @@ export type TaskActRow = {
  * "Something else" is implied. The tapped option comes back as the owner's next message, so nothing here is an answer:
  * a question is open while no later message from the owner sits in its thread. */
 export declare const MATE_ASK_SCHEMA = "\nCREATE TABLE IF NOT EXISTS mate_ask (\n  turn         INTEGER PRIMARY KEY REFERENCES mate_turn(id) ON DELETE CASCADE,\n  thread       INTEGER NOT NULL REFERENCES mate_thread(id) ON DELETE CASCADE,\n  question     TEXT NOT NULL,\n  options_json TEXT NOT NULL,\n  created_at   TEXT NOT NULL\n);\nCREATE INDEX IF NOT EXISTS mate_ask_thread ON mate_ask (thread, turn);\n";
+/** Decisions in the chat app (chat-decide.ts; no version bump: additive only). A token names one act on one card (the chat and message it rides); `digest` is
+ * what the card showed — a receipt, a revision source, a task stamp, a plan or a commit. */
+export declare const CHAT_DECIDE_SCHEMA = "\nCREATE TABLE IF NOT EXISTS chat_decide_action (\n  token       TEXT PRIMARY KEY,\n  channel     TEXT NOT NULL,\n  binding     INTEGER NOT NULL,\n  chat        TEXT NOT NULL,\n  message     TEXT,\n  act         TEXT NOT NULL CHECK (act IN ('accept','changes','retry','approve','not-now','merge')),\n  phase       TEXT NOT NULL CHECK (phase IN ('offer','yes','cancel')),\n  task_id     TEXT NOT NULL,\n  run         INTEGER,\n  digest      TEXT NOT NULL,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS chat_decide_action_message ON chat_decide_action (channel, chat, message);\nCREATE TABLE IF NOT EXISTS chat_decide_prompt (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  channel     TEXT NOT NULL,\n  binding     INTEGER NOT NULL,\n  chat        TEXT NOT NULL,\n  task_id     TEXT NOT NULL,\n  run         INTEGER NOT NULL,\n  digest      TEXT NOT NULL,\n  message     TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS chat_decide_prompt_open ON chat_decide_prompt (channel, binding, consumed_at);\n";
 export type MateAsk = {
     turn: number;
     thread: number;
@@ -57,6 +60,8 @@ export type MateAsk = {
 export declare const MATE_ASK_OTHER = "Something else";
 /** How long the question's buttons work, on every channel. */
 export declare const MATE_ASK_TTL_MS: number;
+/** What a turn the lead starts itself for automatic crew updates says in the owner's place (lead-follow.ts): never their answer. */
+export declare const LEAD_FOLLOW_MESSAGE = "Automatic crew update: inspect the saved results or decisions and tell me what needs attention. Do not rerun work.";
 /** Settings → Integrations (no version bump): each integration's last check. `outcome` is ok, failed, or absent (the check found
  * nothing set up, such as no `gh` sign-in). `ok_at` and `error`/`error_at` keep the last success and the last
  * failure across checks, so a row can say both. `account` is a display name only, never a credential. */
@@ -990,12 +995,18 @@ export type TelegramDelivery = Notification & {
 };
 /** How chats reach one person (quiet chat): only when they are needed, or every step. */
 export type NotificationMode = "quiet" | "all";
+/** Screenshots with results: none (the default), the first one, or up to four (result-shots.ts). */
+export type ResultScreenshots = "off" | "first" | "all";
+export declare const RESULT_SCREENSHOTS: readonly ResultScreenshots[];
 export type NotificationPreference = {
     mode: NotificationMode;
     digestAt: string | null;
     digestOn: string | null;
     updatedAt: string | null;
+    screenshots: ResultScreenshots;
 };
+/** One person's saved screenshots following a result message: its own outbox row, addressed to them (result-shots.ts). */
+export declare const RESULT_SHOTS_KIND = "result-screenshots";
 /** Tasks filed this close together share one chat message. */
 export declare const QUIET_GROUP_MS = 60000;
 export declare function isDigestTime(value: string): boolean;
@@ -6702,8 +6713,9 @@ export declare class Store {
     dropMateAsk(turn: number): void;
     /** The question an ANSWERED turn asked; null when it asked none or did not answer. */
     mateAsk(turn: number): MateAsk | null;
-    /** What a tap on the question finds: open; answered (the owner has written in its thread since the reply that asked it);
-     * or expired (older than MATE_ASK_TTL_MS, or the question or the reply that asked it is gone, as after a retention purge). */
+    /** What a tap on the question finds: open; answered (its owner has written in its thread since the reply that asked
+     * it, typed or tapped; a turn the lead started itself, or another person's message, is no answer); or expired (older
+     * than MATE_ASK_TTL_MS, or the question or the reply that asked it is gone, as after a retention purge). */
     mateAskState(turn: number, now: Date): {
         state: "open";
         ask: MateAsk;
@@ -7492,7 +7504,20 @@ export declare class Store {
     setNotificationPreference(account: string, change: {
         mode?: NotificationMode;
         digestAt?: string | null;
+        screenshots?: ResultScreenshots;
     }, by: string, now: Date): NotificationPreference;
+    /** The screenshots of this result already sent (or being sent) to one destination. */
+    resultShotsSent(destination: string, run: number): Set<number>;
+    /** Mark screenshots as sent BEFORE they go: an unconfirmed send is never repeated. */
+    markResultShotsSent(destination: string, run: number, artifacts: readonly number[], now: Date): void;
+    /** Telegram refused them outright, so nothing arrived: they may be tried again. */
+    unmarkResultShotsSent(destination: string, run: number, artifacts: readonly number[]): void;
+    /**
+     * A result message just became a fact: everyone who asked for screenshots with results, can see the project and
+     * would be pinged by it gets one row of their own that follows it — once per result, whatever produced the fact.
+     * Only a result that saved screenshots qualifies; what is sent, and whether at all, is decided again at send time.
+     */
+    private enqueueResultShots;
     /** Everyone who asked for an evening digest, with the local day theirs was last considered. */
     eveningDigestPeople(): {
         account: string;
@@ -7501,13 +7526,19 @@ export declare class Store {
     }[];
     /** Claim one local day's digest for one person: true once, false if it was already considered. */
     claimEveningDigestDay(account: string, day: string): boolean;
-    /** What this person named their lead and its persona, or null when they never saved one. */
+    /** What this person named their lead and its persona, or null when they never saved one. An empty name or persona
+     * (a row saved only for what the lead knows about them) reads as the default. */
     leadConfig(account: string): {
         name: string;
         persona: string;
     } | null;
     /** Save this person's lead name and persona (checked by the caller: lead-identity.ts). */
     setLeadConfig(account: string, name: string, persona: string, now: Date): void;
+    /** What this person's lead knows about them: their confirmed lines, in order (none when they never saved any). */
+    leadAbout(account: string): string[];
+    /** Save what this person's lead knows about them (checked by the caller: lead-about.ts). A person who never named
+     * their lead gets an empty name and persona, so they keep following the defaults. */
+    setLeadAbout(account: string, lines: readonly string[], now: Date): void;
     /** A lead token for one person, shown once. A new one ends their earlier ones; the ledger names it "lead for <owner>". */
     mintLeadCredential(owner: string, by: string, now: Date): {
         id: string;
@@ -7579,6 +7610,8 @@ export declare class Store {
     chatBatchFor(destination: string, taskRef: number, run: number | null, now: Date, windowMs: number, notification?: number | null): ChatBatch;
     chatBatch(id: number): ChatBatch | null;
     setChatBatchMessage(id: number, message: string, digest: string): void;
+    /** The finished-work message that carries this result at one destination, if one was placed: screenshots follow it. */
+    chatBatchMessageFor(destination: string, taskRef: number, run: number): string | null;
     /** The message now showing this card, and what it shows. */
     setChatCardMessage(id: number, message: string, digest: string): void;
     markTelegramDigestSent(now: Date): void;