toolroll 0.9.33 → 0.9.36

package/dist/serve.js

@@ -1,3 +1,4 @@
+import { SCREENSHOT_CAPTURE, structuredHandoffView, terminalDiffView } from "./result-evidence-readers.js";
 import { checkLeadIdentity, leadIdentityOf, leadNameOf, LEAD_NAME_MAX, LEAD_PERSONA_MAX } from "./lead-identity.js";
 import { aboutYouOf, checkAboutYou, saveAboutYou, ABOUT_YOU_LINE_MAX, ABOUT_YOU_MAX_LINES } from "./lead-about.js";
 import { withActor } from "./actor.js";
@@ -53,7 +54,7 @@ import { FORM_PATH, flowFormPage, receiveFlowForm, shareFlowButton, stopSharingF
 import { addFlowTriggerTo, checkFlowTriggerNow, HOOK_PATH, pressFlowButton, receiveFlowHook, removeFlowTrigger, renewFlowHook, removeLinearKey, saveHooksBase, saveLinearKey, saveLinearSigningSecret } from "./flow-triggers.js";
 import { addCardToFlow, advanceFlows, cancelFlowCard, crossProjectProblem, decideFlowCard, FLOW_HREF, flowDefinitionOf, moveCardInFlow } from "./flow-engine.js";
 import { chooseFlowCard } from "./flow-send.js";
-import { FLOW_TEMPLATES, validateFlowDefinition } from "./flows.js";
+import { FlowContractError, FLOW_TEMPLATES, validateFlowDefinition, withZoneNames } from "./flows.js";
 import { TOOL_CATALOG, addToolTo, catalogTool, discoverTools, localAppOf, projectToolsOf, removeToolFrom, secretsSetFor, setToolSecret, splitCommandLine, testToolOf } from "./project-tools.js";
 import { changeLearning, learningView } from "./project-learning.js";
 import { applySavedKnowledge, changeKnowledge, knowledgeView, knowledgeVersion, readKnowledgeSnapshot } from "./project-knowledge.js";
@@ -178,12 +179,13 @@ import { parseReport } from "./scout-report.js";
 import { buildDataDocument, composeRequest, credentialKeyOf, isDirectChatProvider, isSubscriptionChatProvider, parseAssistantEnvelope, performChatRequest, priceOf, priceForConfig, worstCaseForPrice, settleForPrice, subscriptionCredentialKey, fetchOpenRouterCatalog, plausibleChatKey, PRICED_MODELS, settleMicrousd, worstCaseMicrousd, CHAT_KEY_ENV, TURN_WALL_CLOCK_MS, } from "./converse.js";
 import { fileTaskProposal, fileRoutineProposal } from "./proposal.js";
 import { TASK_TEXT_LIMITS, validateTaskText } from "./task-text.js";
+import { TEXT_LIMITS } from "./text-limits.js";
 import {} from "./store.js";
 import { attendedLivenessState } from "./liveness.js";
 import { approvalOf, approve as approveScope, attendedDigestOf, attendedTermsJson, authenticateApprover as checkApproverPassword, canonicalProfileJson, chainFromJson, profileDigestOf, proposeGuarded, scopeAuthorityOf, acceptanceLinesToInput, acceptanceToLines, acceptanceWords, parseAcceptanceCriteria, } from "./scope.js";
 import { isQualityMode, qualityModeTitle } from "./quality.js";
 import { LIMITS, hasForbiddenControls, validateNote } from "./decision.js";
-import { parseExecutionPlanDocument, PLAN_LIMITS, milestonesOf } from "./plan.js";
+import { parseExecutionPlanDocument, milestonesOf } from "./plan.js";
 import { contractChangesOf, decodePlanContractRecord, describeContractChanges } from "./planner-source.js";
 import { observeWorktree, parseBaseTreeSnapshot, aggregateNewNames, PEEK_LIMITS } from "./peek.js";
 import { readLiveWindow } from "./live.js";
@@ -194,7 +196,8 @@ import { parseGithubRepo, previewGithubRepo, cloneGithubRepo, listGithubRepos, i
 import { verifiedAuthor, LEAD_THREAD, isDigestTime, RESULT_SCREENSHOTS, MATE_ASK_OTHER } from "./store.js";
 import { RESULT_SHOT_CHOICES } from "./result-shots.js";
 import { digestTimes } from "./digest-times.js";
-import { updateRepos, addRepos, removeRepos } from "./repos.js";
+import { updateRepos, removeRepos } from "./repos.js";
+import { admitProject, releaseProject } from "./project-admission.js";
 import { run as execRun } from "./exec.js";
 import { findFirstTasks, firstResultWords, firstRunSteps, firstTaskJourney, firstTaskSuggestions, HOW_IT_WORKS, SANDBOX_COMMAND, signInCommandFor, START_COMMAND } from "./first-run.js";
 /** A user agent, reduced to safe display words — never echoed raw. */
@@ -276,6 +279,8 @@ import { PACKAGE_VERSION } from "./version.js";
 import { updateNoticeWords } from "./update-notice.js";
 import { whenHtml } from "./when-html.js";
 const SESSION_COOKIE = "standing-orders_session";
+/** Stands in for "no project" in a ceiling: no folder resolves to it, so it admits nothing. */
+const NO_PROJECT = "/\0no-project";
 /** Where `up`'s one-time sign-in link points, and how long it works. */
 export const SIGN_IN_LINK_PATH = "/login/once/";
 export const SIGN_IN_LINK_MS = 10 * 60_000;
@@ -632,7 +637,13 @@ export function createDecisionServer(options) {
     /** No ceiling configured at all: the legacy trust-everything mode, named. */
     const unscopedMode = ceiling.repos.length === 0 && ceiling.roots.length === 0;
     /** Per-row visibility under the ceiling — the authorization question for reads. */
-    const liveCeiling = () => ({ repos: [...ceiling.repos, ...(options.additionalProjectRepos?.() ?? [])], roots: ceiling.roots });
+    /** The exact repositories this console serves now: `up`'s live admitted set when it supplies one, else startup's. */
+    const exactRepos = () => options.admittedRepos?.() ?? ceiling.repos;
+    const liveCeiling = () => {
+        const repos = [...exactRepos(), ...(options.additionalProjectRepos?.() ?? [])];
+        // An admitted set that is empty for now is an empty ceiling, never the legacy unscoped mode.
+        return { repos: repos.length === 0 && ceiling.roots.length === 0 && !unscopedMode ? [NO_PROJECT] : repos, roots: ceiling.roots };
+    };
     // Native tools share the installation's login and can read beyond a project.
     // Account project membership cannot provide an OS read boundary.
     function codingActorAllowed(actor) {
@@ -651,12 +662,21 @@ export function createDecisionServer(options) {
      * ceiling; this server still filters every row through its own ceiling. */
     /** Projects deleted while this console runs: gone from its lists though a builder started with them still watches. */
     const deletedRepos = new Set();
+    /** Those still gone: a project added again (from here, `repos add`, or the lead) has its row back and shows again. */
+    const goneRepos = () => {
+        if (deletedRepos.size === 0)
+            return deletedRepos;
+        for (const one of store.listProjects())
+            deletedRepos.delete(one.path);
+        return deletedRepos;
+    };
     const managedRepos = () => {
         const seen = new Set();
         const repos = [];
-        for (const path of [...ceiling.repos, ...(options.currentRepos?.() ?? [])]) {
+        const gone = goneRepos();
+        for (const path of [...exactRepos(), ...(options.currentRepos?.() ?? [])]) {
             const canonical = canonicalProject(path) ?? path;
-            if (seen.has(canonical) || !visible(canonical) || deletedRepos.has(canonical))
+            if (seen.has(canonical) || !visible(canonical) || gone.has(canonical))
                 continue;
             seen.add(canonical);
             repos.push(canonical);
@@ -761,6 +781,13 @@ export function createDecisionServer(options) {
     const admissionList = () => restricted() ? [...(store.accountOf(requestContext.getStore().actor)?.projects ?? [])].filter(visible) : unscopedMode
         ? null
         : [...new Set([...managedRepos(), ...(ceiling.roots.length === 0 ? [] : store.knownRepos().filter(visible))])];
+    /** Every project this person may pick in the console — the switcher, Projects, Settings, Tools and Flows read this
+     * one list: the live admitted set (taskless projects included) and every project with saved work, each through
+     * the ceiling and this account's project grants. A project removed or deleted here is gone from it. */
+    const consoleProjects = () => {
+        const gone = goneRepos();
+        return [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(one => visible(one) && !gone.has(one));
+    };
     /** The task behind a resource, for the ceiling check; null = no ref (visible). */
     const taskRepoOf = (taskRef) => store.refForId(taskRef)?.repo ?? null;
     const server = createServer((request, response) => {
@@ -1110,6 +1137,8 @@ export function createDecisionServer(options) {
             response.end(`<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="refresh" content="0;url=${escape(to)}"><title>Toolroll</title>${HANDOFF_STYLE}<p>${escape(words)} <a href="${escape(to)}">Back to Toolroll</a></p>`);
         };
         const state = url.searchParams.get("state") ?? "";
+        // Every arrival is logged (never the code or state): a sign-in that never came back is then visible as an absence.
+        logEvent("info", "connect.callback", { error: url.searchParams.get("error"), known: connectVisits.has(state) });
         if (!startedHere(request, state))
             return done("/settings/tools", "problem", "That sign-in was started in another browser. Connect again from this one.");
         const visit = connectVisits.get(state);
@@ -2519,7 +2548,7 @@ export function createDecisionServer(options) {
                 return void response.end(spendCsv(items, teammateNames));
             }
             const shift = (by) => { const at = new Date(`${month.name}-01T00:00:00.000Z`); at.setUTCMonth(at.getUTCMonth() + by); return at.toISOString().slice(0, 7); };
-            const projects = [...new Set([...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const people = store.accountFacts().filter(one => one.revokedAt === null).map(one => one.name);
             const view = {
                 month: month.name, previous: shift(-1), next: month.name === current.name ? null : shift(1),
@@ -2535,7 +2564,7 @@ export function createDecisionServer(options) {
         }
         if (url.pathname === "/ledger") {
             const admitted = admissionList();
-            const projects = admitted ?? [...new Set([...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = admitted ?? consoleProjects();
             const chosen = url.searchParams.get("project") ?? "";
             if (chosen !== "" && !projects.includes(chosen))
                 return refuse(response, who, 403, "That project is outside your access.", "/ledger");
@@ -2694,7 +2723,7 @@ export function createDecisionServer(options) {
                 return seen;
             };
             const csrf = who.via === "cookie" ? who.session.csrf : "";
-            const projectChoices = [...new Set([...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projectChoices = consoleProjects();
             const accessFields = (selected) => `<label>Project access<select name="access"><option value="selected"${selected !== null ? " selected" : ""}>Selected projects</option><option value="all"${selected === null ? " selected" : ""}>All projects</option></select></label>` +
                 `<p class="meta">Operators with all-project access also manage the instance.</p><fieldset><legend>Projects</legend>${projectChoices.length === 0 ? `<p class="meta">Add a project before granting selected access.</p>` : projectChoices.map(repo => `<label class="row"><input type="checkbox" name="projects" value="${escape(repo)}"${selected?.includes(repo) ? " checked" : ""}>${escape(projectName(repo))}</label>`).join("")}</fieldset>`;
             const cards = accounts.map(one => {
@@ -3192,7 +3221,7 @@ export function createDecisionServer(options) {
         }
         // Flows → New: the gallery, and each template's page.
         if (url.pathname === "/flows/new") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const canUse = who.via === "cookie" && who.role === "approver" && projects.length > 0;
             // The chosen project, else the one being looked at: its tools are what each card says is connected.
             const asked = url.searchParams.get("repo");
@@ -3202,7 +3231,7 @@ export function createDecisionServer(options) {
         const galleryRead = /^\/flows\/new\/([a-z-]{1,40})$/.exec(url.pathname);
         if (galleryRead !== null) {
             const template = galleryTemplateOf(galleryRead[1]);
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             if (template === null)
                 return refuse(response, who, 404, "There's no template by that name.", "/flows/new");
             if (who.via !== "cookie" || who.role !== "approver")
@@ -3216,13 +3245,13 @@ export function createDecisionServer(options) {
             return sendGalleryUse(response, who, template, projects, repo, null, template.name, problem === null ? null : problem.slice(0, 400), said === null ? null : said.slice(0, 400));
         }
         if (url.pathname === "/flows") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const flows = store.listFlows(projects);
             return sendScreen(response, 200, screen("Flows", `<h1>Flows</h1>${flowsListHtml(store, flows, projects, who.via === "cookie" ? who.session.csrf : "", who.via === "cookie" && who.role === "approver", url.searchParams.get("problem"))}`, { chrome: chromeFor(project, "flows"), functional: { script: FLOW_IMPORT_SCRIPT } }));
         }
         // starter kits — the gallery, and each kit's checklist in a project.
         if (url.pathname === "/kits" || /^\/kits\/[a-z-]{1,40}$/.test(url.pathname)) {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const csrf = who.via === "cookie" ? who.session.csrf : "", canSetUp = who.via === "cookie" && who.role === "approver";
             if (url.pathname === "/kits") {
                 return sendScreen(response, 200, screen("Starter kits", `<h1>Starter kits</h1>${kitsGalleryHtml(store, projects, projectName, csrf, canSetUp, { problem: url.searchParams.get("problem") })}`, { chrome: chromeFor(project, "flows") }));
@@ -3235,7 +3264,7 @@ export function createDecisionServer(options) {
         }
         // v92: AI teammates — the team, and one page per teammate.
         if (url.pathname === "/teammates") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             return sendScreen(response, 200, screen("Teammates", `<h1>Teammates</h1>${teammatesListHtml(store, store.teammates(projects), projects, projectName, who.via === "cookie" ? who.session.csrf : "", who.via === "cookie" && who.role === "approver", { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") })}`, { chrome: chromeFor(project, "flows") }));
         }
         const teammateRead = /^\/teammates\/([1-9][0-9]{0,9})(\/soul\.md)?$/.exec(url.pathname);
@@ -3307,7 +3336,7 @@ export function createDecisionServer(options) {
             if (flow === null || flow.state !== "active" || !visible(flow.repo))
                 return refuse(response, who, 404, "No such flow in your projects.", "/flows");
             const selected = Number(url.searchParams.get("card")), start = Number(url.searchParams.get("start"));
-            const view = flowView(store, flow, { name: who.name, approver: who.via === "cookie" && who.role === "approver" }, Number.isSafeInteger(selected) && selected > 0 ? selected : null, { dir: options.configDir ?? null, repos: [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible), startTrigger: Number.isSafeInteger(start) && start > 0 ? start : null,
+            const view = flowView(store, flow, { name: who.name, approver: who.via === "cookie" && who.role === "approver" }, Number.isSafeInteger(selected) && selected > 0 ? selected : null, { dir: options.configDir ?? null, repos: consoleProjects(), startTrigger: Number.isSafeInteger(start) && start > 0 ? start : null,
                 sortReady: keyStatus("openrouter", providerHome).set, toolHome });
             if (url.searchParams.get("format") === "json")
                 return respond(response, 200, "application/json; charset=utf-8", JSON.stringify(view));
@@ -3886,7 +3915,7 @@ export function createDecisionServer(options) {
             return sendScreen(response, 200, screen("Models", `<p><a href="/settings">Settings</a></p><h1>Models</h1>${modelsHtml(view)}`, { chrome: chromeFor(project, "settings"), functional: { script: modelsScript() } }));
         }
         if (url.pathname === "/settings/skills") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const chosen = url.searchParams.get("repo") ?? project ?? projects[0] ?? "";
             if (chosen && !projects.includes(chosen))
                 return refuse(response, who, 403, "That project is outside your access.", "/projects");
@@ -3904,7 +3933,7 @@ export function createDecisionServer(options) {
             return sendScreen(response, 200, screen('Skills', `<p><a href="/settings">Settings</a></p><h1>Skills</h1>${url.searchParams.get('saved') === '1' ? '<p role="status">Saved.</p>' : ''}${selector}${content}`, { chrome: chromeFor(chosen || project, 'settings'), functional: { script: skillsScript() } }));
         }
         if (url.pathname === "/settings/tools") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const chosen = url.searchParams.get("repo") ?? project ?? projects[0] ?? "";
             if (chosen && !projects.includes(chosen))
                 return refuse(response, who, 403, "That project is outside your access.", "/projects");
@@ -3928,7 +3957,7 @@ export function createDecisionServer(options) {
         }
         // Settings → Project: what Toolroll holds for a project; an instance operator deletes it here.
         if (url.pathname === "/settings/project") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible).filter(one => !deletedRepos.has(one));
+            const projects = consoleProjects();
             const asked = url.searchParams.get("repo");
             const chosen = asked ?? (project != null && projects.includes(project) ? project : projects[0] ?? "");
             if (chosen && !projects.includes(chosen))
@@ -3940,7 +3969,7 @@ export function createDecisionServer(options) {
         }
         // v102: Settings → Approval rules, a project's separation of duties. Anyone who sees the project reads them; an instance operator sets them.
         if (url.pathname === "/settings/approval") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const chosen = url.searchParams.get("repo") ?? project ?? projects[0] ?? "";
             if (chosen && !projects.includes(chosen))
                 return refuse(response, who, 403, "That project is outside your access.", "/settings/approval");
@@ -3951,7 +3980,7 @@ export function createDecisionServer(options) {
         }
         // Sprint 8: Settings → Policy, the organisation policy and its history. Anyone signed in reads it; an instance operator changes it.
         if (url.pathname === "/settings/policy") {
-            const repos = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const repos = consoleProjects();
             const toolNames = [...new Set(repos.flatMap(repo => store.projectTools(repo).map(one => one.name)))].sort();
             const view = { policy: store.orgPolicy(), history: store.policyHistory(50), canChange: who.via === "cookie" && store.isInstanceOperator(who.name), toolNames };
             return sendScreen(response, 200, screen("Policy", `<p><a href="/settings">Settings</a></p><h1>Policy</h1>${policyHtml(view, who.via === "cookie" ? who.session.csrf : "", { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") })}`, { chrome: chromeFor(project, "settings") }));
@@ -3969,7 +3998,7 @@ export function createDecisionServer(options) {
         // Settings → Flows: the starter flows, each switched on with one yes. ?starter= marks the one a task's
         // "Do this every time…" asked about.
         if (url.pathname === "/settings/flows") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const chosen = url.searchParams.get("repo") ?? project ?? projects[0] ?? "";
             if (chosen && !projects.includes(chosen))
                 return refuse(response, who, 403, "That project is outside your access.", "/settings");
@@ -4093,13 +4122,13 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name) || !options.configDir)
                 return refuse(response, who, 403, "An instance operator sets up sign-in.", "/settings");
             const origin = consoleOrigin(request.headers.host);
-            const projects = [...new Set([...managedRepos(), ...store.knownRepos()])].filter(visible).map(path => ({ path, name: projectName(path) }));
+            const projects = consoleProjects().map(path => ({ path, name: projectName(path) }));
             const settings = ssoSettings();
             const html = ssoSettingsHtml({ settings, redirect: origin === null ? null : `${origin}${SSO_CALLBACK}`, projects, linked: settings !== null && store.ssoIdentitiesOf(who.name).some(one => one.issuer.replace(/\/+$/, "") === settings.issuer) }, who.session.csrf, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") });
             return sendScreen(response, 200, screen("Sign-in", `<p><a href="/settings">Settings</a></p><h1>Sign-in</h1>${html}`, { chrome: chromeFor(project, "settings") }));
         }
         if (url.pathname === "/settings/knowledge") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const chosen = url.searchParams.get("repo") ?? project ?? projects[0] ?? "";
             if (chosen && (!projects.includes(chosen) || !visible(chosen)))
                 return refuse(response, who, 403, "That project is outside your access.", "/settings/knowledge");
@@ -4137,7 +4166,7 @@ export function createDecisionServer(options) {
             return sendScreen(response, 200, screen('Knowledge', `<p><a href="/settings">Settings</a></p><h1>Knowledge</h1>${url.searchParams.get('saved') === '1' ? '<p role="status">Saved for future tasks.</p>' : ''}${selector}${content}`, { chrome: chromeFor(chosen || project, 'settings') }));
         }
         if (url.pathname === "/settings/learning") {
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const chosen = url.searchParams.get("repo") ?? project ?? projects[0] ?? "";
             if (chosen && (!projects.includes(chosen) || !visible(chosen)))
                 return refuse(response, who, 403, "That project is outside your access.", "/settings/learning");
@@ -5231,7 +5260,7 @@ export function createDecisionServer(options) {
                     ...store.listProjects().map(one => ({ path: one.path, name: one.name })),
                     ...managedRepos().map(path => ({ path, name: projectName(path) })),
                 ]) {
-                    if (seen.has(one.path) || !visible(one.path))
+                    if (seen.has(one.path) || !visible(one.path) || goneRepos().has(one.path))
                         continue;
                     seen.add(one.path);
                     rows.push(one);
@@ -5475,7 +5504,7 @@ export function createDecisionServer(options) {
         const recent = store.listProjects().filter(one => visible(one.path));
         const recentPaths = new Set(recent.map(one => one.path));
         const candidates = new Set();
-        for (const path of [...managedRepos(), ...store.knownRepos()]) {
+        for (const path of consoleProjects()) {
             const canonical = canonicalProject(path) ?? path;
             if (!recentPaths.has(canonical) && visible(canonical))
                 candidates.add(canonical);
@@ -6765,7 +6794,7 @@ export function createDecisionServer(options) {
             if (who.via !== 'cookie' || who.role !== 'approver')
                 return refuse(response, who, 403, 'Sign in as an approver to manage skills.', '/settings/skills');
             const repo = body.get('repo') ?? '', back = `/settings/skills?repo=${encodeURIComponent(repo)}`;
-            if (!visible(repo) || ![...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()].includes(repo))
+            if (!visible(repo) || !consoleProjects().includes(repo))
                 return refuse(response, who, 403, 'That project is outside your access.', '/projects');
             if ([...new Set(body.keys())].some(k => body.getAll(k).length !== 1))
                 return refuse(response, who, 400, 'Invalid skills form.', back);
@@ -6821,7 +6850,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie" || who.role !== "approver")
                 return refuse(response, who, 403, "Sign in as an approver to set kits up.", "/kits");
             const kit = kitOf(kitPost[1]);
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             const repo = body.get("repo") ?? "";
             if (kit === null || !projects.includes(repo) || !store.accountCanAccess(who.name, repo))
                 return redirect(response, `/kits?problem=${encodeURIComponent("Choose one of your projects.")}`);
@@ -6866,7 +6895,7 @@ export function createDecisionServer(options) {
             if (who.role !== "approver")
                 return refuse(response, who, 403, "Sign in as an approver to look after teammates.", "/teammates");
             if (teammatePost[2] === "new") {
-                const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+                const projects = consoleProjects();
                 const repo = body.get("repo") ?? "";
                 if (!projects.includes(repo))
                     return redirect(response, `/teammates?problem=${encodeURIComponent("Choose one of your projects.")}`);
@@ -6938,7 +6967,7 @@ export function createDecisionServer(options) {
         const galleryPost = /^\/flows\/new\/([a-z-]{1,40})$/.exec(url.pathname);
         if (galleryPost !== null) {
             const template = galleryTemplateOf(galleryPost[1]);
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             if (template === null)
                 return refuse(response, who, 404, "There's no template by that name.", "/flows/new");
             if (who.via !== "cookie" || who.role !== "approver" || store.isDemo())
@@ -6970,7 +6999,7 @@ export function createDecisionServer(options) {
         if (url.pathname === "/flows/new" || url.pathname === "/flows/example" || url.pathname === "/flows/import" || flowPost !== null || triggerPost !== null) {
             const now = clock();
             const answer = (status, payload) => respond(response, status, "application/json; charset=utf-8", JSON.stringify(payload));
-            const projects = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const projects = consoleProjects();
             if (who.via !== "cookie" || who.role !== "approver")
                 return url.pathname === "/flows/new" || url.pathname === "/flows/example" || url.pathname === "/flows/import" ? refuse(response, who, 403, "Sign in as an approver to create flows.", "/flows") : answer(403, { ok: false, said: "Sign in as an approver to change flows." });
             if (url.pathname === "/flows/example") {
@@ -7153,12 +7182,13 @@ export function createDecisionServer(options) {
                 return redirect(response, "/flows");
             }
             if (action === "save") {
-                let saved;
+                let saved, drawn;
                 try {
-                    saved = validateFlowDefinition(JSON.parse(body.get("definition") ?? "null"));
+                    drawn = JSON.parse(body.get("definition") ?? "null");
+                    saved = validateFlowDefinition(drawn);
                 }
                 catch (error) {
-                    return answer(400, { ok: false, said: error instanceof SyntaxError ? "That flow couldn't be read." : error instanceof Error ? error.message : "That flow isn't valid." });
+                    return answer(400, { ok: false, said: error instanceof SyntaxError ? "That flow couldn't be read." : error instanceof FlowContractError ? withZoneNames(error.lines, drawn) : error instanceof Error ? error.message : "That flow isn't valid." });
                 }
                 const name = (body.get("name") ?? flow.name).replace(/[\u0000-\u001f\u007f]/g, "").trim().slice(0, 80) || flow.name;
                 // The owner (v86) is whom "the owner decides" zones ask: someone who can approve on this project.
@@ -7244,7 +7274,7 @@ export function createDecisionServer(options) {
                 return back("problem", "Choose what the budget is for.");
             const scope = target[1], key = target[2];
             const known = scope === "installation" ? key === "*"
-                : scope === "project" ? [...new Set([...managedRepos(), ...store.knownRepos()])].filter(visible).includes(key)
+                : scope === "project" ? consoleProjects().includes(key)
                     : scope === "person" ? store.accountFacts().some(one => one.name === key && one.revokedAt === null)
                         : store.teammates([...new Set([...managedRepos(), ...store.knownRepos()])]).some(one => String(one.id) === key);
             if (!known)
@@ -7266,7 +7296,7 @@ export function createDecisionServer(options) {
         // Settings → Project → Builds at once: an approver for the project sets it; the ledger keeps before → after.
         if (url.pathname === "/settings/project/concurrency") {
             const repo = body.get("repo") ?? "";
-            const known = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const known = consoleProjects();
             if (!known.includes(repo))
                 return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
             if (who.via !== "cookie" || who.role !== "approver" || !store.accountCanAccess(who.name, repo))
@@ -7287,7 +7317,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
                 return refuse(response, who, 403, "An instance operator deletes projects.", "/settings/project");
             const repo = body.get("repo") ?? "";
-            const known = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const known = consoleProjects();
             if (!known.includes(repo))
                 return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
             const back = (key, words, to = repo) => redirect(response, `/settings/project?${to === "" ? "" : `repo=${encodeURIComponent(to)}&`}${key}=${encodeURIComponent(words)}`);
@@ -7343,7 +7373,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
                 return refuse(response, who, 403, "An instance operator sets approval rules.", "/settings/approval");
             const repo = body.get("repo") ?? "";
-            const known = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])].filter(visible);
+            const known = consoleProjects();
             if (!known.includes(repo))
                 return refuse(response, who, 403, "That project is outside your access.", "/settings/approval");
             const back = (key, words) => redirect(response, `/settings/approval?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}`);
@@ -7744,7 +7774,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie" || who.role !== "approver")
                 return refuse(response, who, 403, "Sign in as an approver to connect tools.", "/settings/tools");
             const repo = body.get("repo") ?? "";
-            const reachable = (one) => visible(one) && [...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()].includes(one);
+            const reachable = (one) => visible(one) && consoleProjects().includes(one);
             if (!reachable(repo))
                 return refuse(response, who, 403, "That project is outside your access.", "/projects");
             // "Also connect to …": a service connected on the shown project, signed in again for another project.
@@ -7817,13 +7847,13 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie" || who.role !== "approver")
                 return refuse(response, who, 403, "Sign in as an approver to manage tools.", "/settings/tools");
             const repo = body.get("repo") ?? "";
-            if (!visible(repo) || ![...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()].includes(repo))
+            if (!visible(repo) || !consoleProjects().includes(repo))
                 return refuse(response, who, 403, "That project is outside your access.", "/projects");
             const back = (key, words, anchor = "") => redirect(response, `/settings/tools?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}${anchor}`);
             // As for Connect: a post from a page that showed another project is refused, never applied here.
             const shown = body.get("shown") ?? "";
             if (shown !== repo) {
-                const page = visible(shown) && [...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()].includes(shown) ? shown : repo;
+                const page = visible(shown) && consoleProjects().includes(shown) ? shown : repo;
                 return redirect(response, `/settings/tools?repo=${encodeURIComponent(page)}&problem=${encodeURIComponent("The project changed; try again.")}`);
             }
             const action = body.get("action") ?? "";
@@ -7986,7 +8016,7 @@ export function createDecisionServer(options) {
             if (who.via !== 'cookie' || who.role !== 'approver')
                 return refuse(response, who, 403, 'Sign in as an approver to refresh project context.', '/settings/knowledge');
             const repo = body.get('repo') ?? '';
-            if (!visible(repo) || !store.accountCanAccess(who.name, repo) || ![...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()].includes(repo))
+            if (!visible(repo) || !store.accountCanAccess(who.name, repo) || !consoleProjects().includes(repo))
                 return refuse(response, who, 403, 'That project is outside your access.', '/settings/knowledge');
             const refreshed = await repositoryContext({ repo, query: '', refresh: true, cacheRoot: join(dirname(evidenceRoot), 'repository-context') });
             return sendScreen(response, refreshed.index.status === 'ready' ? 200 : 503, screen('Project context', `<h1>Project context</h1><p>${refreshed.index.status === 'ready' ? 'Code index refreshed.' : 'The index is unavailable. Source search still works.'}</p><a class="button-link" href="/settings/knowledge?repo=${encodeURIComponent(repo)}">Open knowledge</a>`, { chrome: chromeFor(repo, 'settings') }));
@@ -7995,7 +8025,7 @@ export function createDecisionServer(options) {
             if (who.via !== 'cookie' || who.role !== 'approver')
                 return refuse(response, who, 403, 'Sign in as an approver to decide memory proposals.', '/settings/knowledge');
             const repo = body.get('repo') ?? '', decision = body.get('decision') ?? '';
-            if (!visible(repo) || ![...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()].includes(repo))
+            if (!visible(repo) || !consoleProjects().includes(repo))
                 return refuse(response, who, 403, 'That project is outside your access.', '/settings/knowledge');
             if (!['accept', 'reject'].includes(decision) || !/^[0-9]{1,12}$/.test(body.get('proposal') ?? ''))
                 return refuse(response, who, 400, 'Choose accept or reject for one proposal.', '/settings/knowledge');
@@ -8011,7 +8041,7 @@ export function createDecisionServer(options) {
             if (who.via !== 'cookie' || who.role !== 'approver')
                 return refuse(response, who, 403, 'Sign in as an approver to change project decisions.', '/settings/knowledge');
             const repo = body.get('repo') ?? '', action = body.get('action') ?? '';
-            if (!visible(repo) || ![...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()].includes(repo))
+            if (!visible(repo) || !consoleProjects().includes(repo))
                 return refuse(response, who, 403, 'That project is outside your access.', '/settings/knowledge');
             if (['repo', 'action', 'claim', 'why', 'decision', 'reason'].some(k => body.getAll(k).length > 1) || !['record', 'retire'].includes(action))
                 return refuse(response, who, 400, 'Choose record or retire.', '/settings/knowledge');
@@ -8063,7 +8093,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "Sign in to change learning.", "/settings/learning");
             const repo = body.get("repo") ?? "", action = body.get("action") ?? "";
-            if (!visible(repo) || ![...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()].includes(repo))
+            if (!visible(repo) || !consoleProjects().includes(repo))
                 return refuse(response, who, 403, "That project is outside your access.", "/settings/learning");
             if (["repo", "action", "identity", "revision", "lesson", "version", "sha"].some(k => body.getAll(k).length > 1) || !["adopt", "disable", "reset", "enable", "pause"].includes(action) || !/^[0-9]+$/.test(body.get("revision") ?? ""))
                 return refuse(response, who, 400, "Invalid learning form.", "/settings/learning");
@@ -8505,6 +8535,25 @@ export function createDecisionServer(options) {
             sessions.persist(who.session);
             return redirect(response, safeReturn(body.get("return")));
         }
+        if (url.pathname === "/projects/remove") {
+            // The reversible remove: off every list and the builder; tasks, results and settings stay. Deleting is
+            // Settings → Project → Delete project. The same admission code as `repos remove` (project-admission.ts).
+            if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
+                return refuse(response, who, 403, "An instance operator removes projects.", "/settings/project");
+            const repo = body.get("repo") ?? "";
+            if (!consoleProjects().includes(repo))
+                return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
+            const released = await releaseProject(store, { registryFile: options.registryPath ?? null, path: repo, actor: { label: who.name, origin: "console" }, now });
+            if (!released.ok)
+                return redirect(response, `/settings/project?repo=${encodeURIComponent(repo)}&problem=${encodeURIComponent(`${projectName(repo)} wasn't removed: ${released.message}`)}`);
+            deletedRepos.add(repo);
+            if (who.session.project === repo) {
+                who.session.project = null;
+                who.session.projectRevision += 1;
+                sessions.persist(who.session);
+            }
+            return redirect(response, `/settings/project?said=${encodeURIComponent(`Removed ${projectName(repo)}. Its tasks and results stay saved.`)}`);
+        }
         if (url.pathname === "/projects/open") {
             // Sessions only: a bearer caller names its project per request and has
             // no session to mutate — refusing here keeps that boundary legible.
@@ -8526,18 +8575,19 @@ export function createDecisionServer(options) {
             if (!(await isGitRepo(canonical))) {
                 return void projectsScreen(response, who, "that path is not a git repository", 400, safeReturn(body.get("return")));
             }
-            // Opening an allowed repository enrolls it in this machine's durable
-            // project list. A co-located `up` notices that list and connects its
-            // builder; there is no separate restart or runner-binding step.
-            if (options.registryPath !== undefined) {
-                const enrolled = await updateRepos(options.registryPath, repos => addRepos(repos, [canonical]));
-                deletedRepos.delete(canonical);
-                if (!enrolled.ok) {
-                    return void projectsScreen(response, who, `that project is valid, but it could not be added — ${enrolled.message}`, 400, safeReturn(body.get("return")));
-                }
+            // An account limited to listed projects never widens its own list.
+            if (!visible(canonical)) {
+                return void projectsScreen(response, who, "That project is outside your access.", 403, safeReturn(body.get("return")));
+            }
+            // Opening an allowed repository admits it the same way `repos add` does
+            // (project-admission.ts). A co-located `up` notices the durable list and
+            // connects its builder; there is no separate restart or binding step.
+            const admitted = await admitProject(store, { registryFile: options.registryPath ?? null, path: canonical, actor: { label: who.name, origin: "console" }, now });
+            if (!admitted.ok) {
+                return void projectsScreen(response, who, admitted.reason === "not-git" ? "that path is not a git repository" : `that project is valid, but it could not be added — ${admitted.message}`, 400, safeReturn(body.get("return")));
             }
-            store.upsertProject(canonical, projectName(canonical), now);
-            who.session.project = canonical;
+            deletedRepos.delete(admitted.repo);
+            who.session.project = admitted.repo;
             who.session.projectRevision++;
             // The switcher (board pass) opens a project from any screen and
             // returns there — a same-site path only, never an off-site road.
@@ -9270,14 +9320,11 @@ export function createDecisionServer(options) {
             if (admitted === null) {
                 return projectsScreen(response, who, `the clone landed at ${cloned.target} but did not prove under the ceiling — it was left in place; enroll it by hand`, 400);
             }
-            if (options.registryPath !== undefined) {
-                const enrolled = await updateRepos(options.registryPath, (repos) => addRepos(repos, [admitted]));
-                deletedRepos.delete(admitted);
-                if (!enrolled.ok) {
-                    return projectsScreen(response, who, `${cloned.target} is cloned but not enrolled — ${enrolled.message}`, 400);
-                }
+            const joined = await admitProject(store, { registryFile: options.registryPath ?? null, path: admitted, actor: { label: who.name, origin: "console" }, now });
+            if (!joined.ok) {
+                return projectsScreen(response, who, `${cloned.target} is cloned but not added — ${joined.message}`, 400);
             }
-            store.upsertProject(admitted, projectName(admitted), now);
+            deletedRepos.delete(admitted);
             who.session.project = admitted;
             who.session.projectRevision += 1;
             return projectsScreen(response, who, options.upConsole === true
@@ -10853,8 +10900,8 @@ export function createDecisionServer(options) {
                 if (document === current.document.trim())
                     return redirect(response, taskHref(taskId));
                 const content = Buffer.from(`${document}\n`, "utf8");
-                if (content.length > PLAN_LIMITS.document) {
-                    return taskScreen(response, who, taskId, `plan not saved: it is over ${PLAN_LIMITS.document} bytes`, 400);
+                if (content.length > TEXT_LIMITS.planDocumentBytes) {
+                    return taskScreen(response, who, taskId, `plan not saved: it is over ${TEXT_LIMITS.planDocumentBytes} bytes`, 400);
                 }
                 try {
                     const name = `plan-edit-${randomUUID().replace(/-/g, "")}.md`;
@@ -22461,32 +22508,6 @@ function runsPage(chrome, rows, liveIds, nextCursor, verdicts = new Map(), accep
     const older = nextCursor === null ? "" : `<p><a href="/runs?before=${nextCursor}">older →</a></p>`;
     return screen("builds", [`<h1>Builds <a class="badge" href="/peek">Peek at the live ones \u2192</a></h1>`, buildsViews("builds"), `<p class="hint">one build = one attempt by an agent to complete a task, on its own branch</p>`, list, older].join("\n"), { chrome });
 }
-function structuredHandoffView(artifacts, root) {
-    const artifact = [...artifacts].reverse().find(one => one.kind === "handoff");
-    if (artifact === undefined)
-        return null;
-    const read = readVerifiedArtifact(root, artifact);
-    if (!read.ok)
-        return null;
-    try {
-        const parsed = JSON.parse(read.content.toString("utf8"));
-        if (parsed === null || typeof parsed !== "object" || typeof parsed["conclusion"] !== "string")
-            return null;
-        const conclusion = oneLineOf(parsed["conclusion"], 600);
-        if (conclusion === "" || hasForbiddenControls(conclusion))
-            return null;
-        const list = (name) => Array.isArray(parsed[name])
-            ? parsed[name]
-                .filter((one) => typeof one === "string" && one.trim() !== "" && !hasForbiddenControls(one))
-                .slice(0, 8)
-                .map(one => oneLineOf(one, 240))
-            : [];
-        return { conclusion, changes: list("changes"), verification: list("verification"), followUps: list("followUps") };
-    }
-    catch {
-        return null;
-    }
-}
 /** What a scout found, each with its link and picture, then any screenshot no item shows. Every link is the cited
  * http(s) address the report parser admitted; every picture is served from verified evidence. */
 function reportItemsHtml(items, shots, runId) {
@@ -22563,7 +22584,6 @@ function sharedResultFactsOf(run, proof, terminal, handoff, report, publication)
         publicationWords: receiptPublicationWords(publication),
     };
 }
-const SCREENSHOT_CAPTURE = /^agent-claimed screenshot at (.+) \(validated (?:png|jpeg)\)/;
 function proofBundleView(store, run, artifacts, root) {
     const verdictRow = store.proofVerdictFor(run.id);
     const acceptanceRow = store.proofAcceptance(run.id);
@@ -22679,74 +22699,6 @@ function completionReceiptView(store, run, artifacts, root, review = null) {
         facts: sharedResultFactsOf(run, proof, terminal, handoff, report, publication),
     };
 }
-const CAPTURE_EXIT = /\(exit ([0-9]{1,4})\)\s*$/;
-/**
- * Assemble the terminal-diff card's facts. Every branch names its state:
- * a failed capture (nonzero exit recorded in the capture string) reads as
- * the failure it is, unverifiable bytes read as their problem, and absence
- * returns null so old runs simply show nothing rather than a broken card.
- */
-function terminalDiffView(artifacts, root) {
-    const patchArtifact = artifacts.find(one => one.kind === "terminal-diff");
-    const statArtifact = artifacts.find(one => one.kind === "diff-stat");
-    if (patchArtifact === undefined && statArtifact === undefined)
-        return null;
-    const view = { patch: null, stat: null };
-    if (patchArtifact !== undefined) {
-        const exit = CAPTURE_EXIT.exec(patchArtifact.capture);
-        if (exit !== null && exit[1] !== "0") {
-            view.patch = { problem: `capture failed — ${patchArtifact.capture}` };
-        }
-        else {
-            const read = readVerifiedArtifact(root, patchArtifact);
-            view.patch = read.ok
-                ? { text: read.content.toString("utf8"), truncated: patchArtifact.truncated, artifactId: patchArtifact.id }
-                : { problem: `stored but unverifiable — ${read.problem}` };
-        }
-    }
-    if (statArtifact !== undefined) {
-        const exit = CAPTURE_EXIT.exec(statArtifact.capture);
-        if (exit !== null && exit[1] !== "0") {
-            view.stat = { problem: `capture failed — ${statArtifact.capture}` };
-        }
-        else {
-            const read = readVerifiedArtifact(root, statArtifact);
-            if (!read.ok) {
-                view.stat = { problem: `stored but unverifiable — ${read.problem}` };
-            }
-            else {
-                try {
-                    const parsed = JSON.parse(read.content.toString("utf8"));
-                    // Every field this page renders is type-proved (arc 6, finding 7):
-                    // "an object with a base key" was accepting any shape at all.
-                    const count = (value) => typeof value === "number" && Number.isFinite(value);
-                    const wellFormed = parsed !== null &&
-                        typeof parsed === "object" &&
-                        typeof parsed["base"] === "string" &&
-                        typeof parsed["head"] === "string" &&
-                        count(parsed["fileCount"]) &&
-                        count(parsed["additions"]) &&
-                        count(parsed["deletions"]) &&
-                        count(parsed["binaryCount"]) &&
-                        typeof parsed["filesTruncated"] === "boolean" &&
-                        Array.isArray(parsed["files"]) &&
-                        parsed["files"].every(one => one !== null &&
-                            typeof one === "object" &&
-                            typeof one["path"] === "string" &&
-                            (count(one["additions"]) || one["additions"] === null) &&
-                            (count(one["deletions"]) || one["deletions"] === null));
-                    view.stat = wellFormed
-                        ? parsed
-                        : { problem: "stat is not the shape this page knows" };
-                }
-                catch {
-                    view.stat = { problem: "stat did not parse as JSON" };
-                }
-            }
-        }
-    }
-    return view;
-}
 const REVIEW_DIFF_LINE_CAP = 4_000;
 /** Parse only the stable structure Git's unified patch format guarantees.
  * Unknown metadata remains visible, and a patch that cannot be structured