toolroll 0.9.38 → 0.9.40

package/dist/browser-workspace.d.ts

@@ -100,6 +100,10 @@ export type BrowserConversation = {
     resultRunId: number | null;
     /** A project's own thread (v77); absent or null for the lead conversation or a task. */
     project?: string | null;
+    /** The lead thread a change in reachable projects replaced (mate arc ruling 9): shown above a divider, read only. */
+    previous?: {
+        messages: BrowserMessage[];
+    } | null;
 };
 /** A page rebuilt as React components (shadcn/ui). The server still renders
  * its HTML as the no-JavaScript fallback; forms post to the same routes. */
@@ -176,6 +180,8 @@ export type BrowserLimits = {
 export type BrowserSettingsView = {
     kind: 'settings';
     said: string | null;
+    /** Using it from a phone, under Chat apps (approvers only). */
+    phone?: BrowserPhoneCard;
     /** The settings destinations under short headings; a chat app's tile says whether it is connected and gets alerts. */
     groups: BrowserSettingsGroup[];
     theme: 'system' | 'light' | 'dark';

package/dist/desktop-update.d.ts

@@ -125,6 +125,7 @@ export declare function prepareDesktopUpdate(stateDir: string, installed: string
 export declare function sqliteLock(file: string, busyTimeoutMs?: number): DatabaseSync | null;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
+    version?: never;
     active: boolean;
     phase: string;
     detail: string;
@@ -138,7 +139,6 @@ export declare function desktopUpdateStatus(stateDir: string): {
     wasRunning?: never;
     backupPath?: never;
     updateId?: never;
-    version?: never;
     buildId?: never;
     workDir?: never;
 } | {

package/dist/mate-cli.js

@@ -316,7 +316,10 @@ export async function runMateCli(input) {
                 say(done ? `dismissed ${act[2]}` : "that proposal was already acted on");
             }
             else {
-                const outcome = confirmMateProposal(store, who, proposal.id, now, { confirm: act[3] !== undefined, via: "cli", ...(input.evidenceRoot === undefined ? {} : { evidenceRoot: input.evidenceRoot }) });
+                const outcome = confirmMateProposal(store, who, proposal.id, now, { confirm: act[3] !== undefined, via: "cli", chatProvider: () => {
+                        const current = store.getChatConfig();
+                        return current === null ? null : { config: current, key: isDirectChatProvider(current.provider) ? keyFor(current, input.databaseFile, env) : null };
+                    }, ...(input.evidenceRoot === undefined ? {} : { evidenceRoot: input.evidenceRoot }) });
                 emit({ ok: outcome.ok, act: "confirm", proposal: proposal.id, ...(outcome.ok ? { said: outcome.said, taskId: outcome.taskId } : { reason: outcome.reason, said: outcome.said }) });
                 say(outcome.ok ? outcome.said : outcome.reason === "needs-confirm" ? `${outcome.said}: confirm ${act[2]} yes` : `refused: ${outcome.said}`);
                 if (outcome.ok && outcome.kind === "scope" && outcome.taskId !== null)

package/dist/mate-doors.d.ts

@@ -1,6 +1,7 @@
 import { type SharedActionOptions } from './chat-actions.js';
 import { type CoordinatorProposal, type MateProposal, type Store } from "./store.js";
 import type { VerifiedApprover } from "./principal.js";
+import { type TeamChatProviderResolver } from './team-chat-authorization.js';
 export type ProposalKind = MateProposal["kind"];
 export type DoorOutcome = {
     ok: true;
@@ -14,8 +15,10 @@ export type DoorOutcome = {
     reason: DoorRefusal;
     said: string;
 };
-export type DoorRefusal = "standing" | "not-yours" | "ceiling-changed" | "not-pending" | "session-ended" | "turn-not-answered" | "not-confirmable" | "needs-confirm" | "stale" | "claimed" | "not-queued" | "contest-open" | "unknown-task" | "unknown-decision" | "already-answered" | "expired" | "outside-ceiling" | "refused";
+export type DoorRefusal = "standing" | "not-yours" | "ceiling-changed" | "not-pending" | "session-ended" | "turn-not-answered" | "turn-running" | "not-confirmable" | "needs-confirm" | "stale" | "claimed" | "not-queued" | "contest-open" | "unknown-task" | "unknown-decision" | "already-answered" | "expired" | "outside-ceiling" | "refused";
 export type DoorOptions = {
+    /** Resolved inside the transaction. Without it, only current subscription terms are available. */
+    chatProvider?: TeamChatProviderResolver;
     evidenceRoot?: string;
     /** Only the secure human review endpoint supplies this; never saved or model-authored. */
     actionReview?: SharedActionOptions["review"];
@@ -36,6 +39,32 @@ export type DoorOptions = {
 };
 /** A coordinator proposal lives seven days (§9); the door refuses an older one whatever the sweep did (v3 review, finding 3). */
 export declare const COORDINATOR_PROPOSAL_TTL_MS: number;
+/** The plain reasons a card shows instead of its controls; the door refuses with the same words. */
+export declare const PROPOSAL_CONTRIBUTOR_REASON = "An authorized contributor can act on this proposal.";
+export declare const PROPOSAL_CHAT_REASON = "Enable chat in this conversation before acting on a proposal.";
+export declare const PROPOSAL_WAIT_REASON = "Available when the current reply finishes.";
+/** Unbound claims get the same wall-clock allowance as a provider turn. */
+export declare const TEAM_UNBOUND_CLAIM_MS = 120000;
+export type ProposalGate = {
+    ok: true;
+} | {
+    ok: false;
+    reason: Extract<DoorRefusal, "not-yours" | "session-ended" | "turn-running">;
+    said: string;
+};
+/**
+ * Whether `who` may act on a card in `thread` right now: the one gate the
+ * cards and the confirm door share. Re-proved from saved state and live provider facts, so
+ * every caller (console, CLI, Telegram) reaches the same answer: the thread
+ * is theirs (or they contribute to its team conversation), chat is enabled
+ * for it under their current generation, and no turn in that thread is
+ * live. A team message still marked running after its turn finished is not
+ * live; the delivery sweep settles it.
+ */
+export declare function proposalActGate(store: Store, who: {
+    name: string;
+    generation: number;
+}, thread: number, now: Date, provider?: TeamChatProviderResolver): ProposalGate;
 export declare function confirmMateProposal(store: Store, who: VerifiedApprover, proposalId: number, now: Date, options: DoorOptions): DoorOutcome;
 /** The operator declines the mate's card: `pending → dismissed`. */
 export declare function dismissMateProposal(store: Store, who: VerifiedApprover, proposalId: number, now: Date): boolean;

package/dist/mate-doors.js

@@ -17,6 +17,9 @@ import { executeSharedAction, sharedActionPayload, sharedActionAllowsChallenge,
 import { isCheckLevel, setTaskCheckLevel } from "./check-levels.js";
 import { mateTurnKeepsProposals, verifiedAuthor } from "./store.js";
 import { isVerifiedApprover, reproveApprover } from "./principal.js";
+import { TURN_WALL_CLOCK_MS } from './converse.js';
+import { teamChatAuthorization, subscriptionTeamChatProvider } from './team-chat-authorization.js';
+import { readProjectAccess } from "./project-access.js";
 import { TeamLeads } from './team-leads.js';
 import { fileTaskProposal } from "./proposal.js";
 import { proposeGuarded } from "./scope.js";
@@ -74,6 +77,38 @@ function recordInTaskChat(store, who, proposal, outcome, via, now) {
     const thread = store.openMateThread(who.name, who.ceilingDigest, now, { kind: "task", key: root }).thread;
     store.appendMateMessage({ thread: thread.id, turn: null, role: "assistant", text: `${where} — ${label}: ${said}` }, now);
 }
+/** The plain reasons a card shows instead of its controls; the door refuses with the same words. */
+export const PROPOSAL_CONTRIBUTOR_REASON = "An authorized contributor can act on this proposal.";
+export const PROPOSAL_CHAT_REASON = "Enable chat in this conversation before acting on a proposal.";
+export const PROPOSAL_WAIT_REASON = "Available when the current reply finishes.";
+/** Unbound claims get the same wall-clock allowance as a provider turn. */
+export const TEAM_UNBOUND_CLAIM_MS = TURN_WALL_CLOCK_MS;
+/**
+ * Whether `who` may act on a card in `thread` right now: the one gate the
+ * cards and the confirm door share. Re-proved from saved state and live provider facts, so
+ * every caller (console, CLI, Telegram) reaches the same answer: the thread
+ * is theirs (or they contribute to its team conversation), chat is enabled
+ * for it under their current generation, and no turn in that thread is
+ * live. A team message still marked running after its turn finished is not
+ * live; the delivery sweep settles it.
+ */
+export function proposalActGate(store, who, thread, now, provider = () => subscriptionTeamChatProvider(store)) {
+    const row = store.getMateThread(thread);
+    const shared = row === null ? undefined : store.handle.prepare("SELECT id,projects_json FROM team_conversation WHERE thread=?").get(thread);
+    if (row === null || (shared ? !store.canUseTeamMateThread(who.name, who.generation, thread) : row.approver !== who.name))
+        return { ok: false, reason: "not-yours", said: PROPOSAL_CONTRIBUTOR_REASON };
+    const session = shared ? store.teamMateSession(who.name, thread) : store.activeMateSession(who.name);
+    const authorized = shared
+        ? teamChatAuthorization(store, who, { id: String(shared['id']), threadId: thread, projects: [...(readProjectAccess(shared['projects_json']) ?? [])] }, provider()).enabled
+        : session !== null && session.endedAt === null && session.approverGeneration === who.generation;
+    if (!authorized) {
+        return { ok: false, reason: "session-ended", said: PROPOSAL_CHAT_REASON };
+    }
+    const live = store.handle.prepare(`SELECT 1 FROM mate_turn WHERE thread=? AND state IN ('queued','running')
+    UNION ALL SELECT 1 FROM team_message q JOIN team_conversation c ON c.id=q.conversation LEFT JOIN mate_turn t ON t.id=q.turn_id
+      WHERE c.thread=? AND q.status='running' AND ((q.turn_id IS NULL AND q.claimed_at>?) OR t.state IN ('queued','running')) LIMIT 1`).get(thread, thread, new Date(now.getTime() - TEAM_UNBOUND_CLAIM_MS).toISOString());
+    return live === undefined ? { ok: true } : { ok: false, reason: "turn-running", said: PROPOSAL_WAIT_REASON };
+}
 export function confirmMateProposal(store, who, proposalId, now, options) {
     if (!isVerifiedApprover(who))
         return { ok: false, kind: null, reason: "standing", said: "your approver standing changed — sign in again" };
@@ -89,10 +124,11 @@ export function confirmMateProposal(store, who, proposalId, now, options) {
         const shared = thread !== null && store.handle.prepare("SELECT id,lead FROM team_conversation WHERE thread=?").get(thread.id);
         if (thread === null || (shared ? !store.canUseTeamMateThread(who.name, who.generation, thread.id) : thread.approver !== who.name))
             return { ok: false, kind: null, reason: "not-yours", said: "no such proposal" };
-        const session = shared ? store.teamMateSession(who.name, thread.id) : store.activeMateSession(who.name);
-        if (session === null || session.approverGeneration !== who.generation) {
-            return { ok: false, kind: proposal.kind, reason: "session-ended", said: "the mate session this was proposed in has ended — its cards cannot be confirmed" };
-        }
+        // The card's own gate: chat enabled for this thread and no live turn in it.
+        const gate = proposalActGate(store, who, thread.id, now, options.chatProvider);
+        if (!gate.ok)
+            return { ok: false, kind: proposal.kind, reason: gate.reason, said: gate.said };
+        const session = (shared ? store.teamMateSession(who.name, thread.id) : store.activeMateSession(who.name));
         if (proposal.ceilingDigest !== who.ceilingDigest || session.ceilingDigest !== who.ceilingDigest) {
             return { ok: false, kind: proposal.kind, reason: "ceiling-changed", said: "the admitted projects changed since this was proposed — it cannot be confirmed" };
         }

package/dist/serve.js

@@ -272,7 +272,7 @@ import { checkTeamsCredentials, clearTeamsCredentials, loadTeamsCredentials, sav
 import { verifyApproverByPassword, verifyApproverStanding } from "./principal.js";
 import { runMateTurn, MATE_MESSAGE_MAX_CHARS } from "./mate.js";
 import { replyHtmlInline, shapeReply } from "./reply-shape.js";
-import { confirmCoordinatorProposal, confirmMateProposal, dismissCoordinatorProposal, dismissMateProposal } from "./mate-doors.js";
+import { confirmCoordinatorProposal, confirmMateProposal, dismissCoordinatorProposal, dismissMateProposal, proposalActGate, PROPOSAL_WAIT_REASON } from "./mate-doors.js";
 import { envValue } from "./names.js";
 import { cachedRelease, isNewer, runnerVersions, setUpdateChecks, updateChecksOff } from "./releases.js";
 import { installMethod } from "./install-method.js";
@@ -739,11 +739,25 @@ export function createDecisionServer(options) {
     const connectVisits = new Map();
     /** Flows open in a browser (v88): who's here, and a nudge when one changes. */
     const flowRooms = createFlowRooms(flow => flowFingerprint(store, flow));
+    const teamChatProvider = () => { const enabled = chatEnablement(); return enabled.ok ? { config: enabled.config, key: enabled.key } : null; };
     const team = createTeamRuntime({ store, repos: codingProjects, evidenceRoot, clock, workspaceRevision,
         ...(options.chatFetcher ? { fetcher: options.chatFetcher } : {}),
-        provider: () => { const enabled = chatEnablement(); return enabled.ok ? { config: enabled.config, key: enabled.key } : null; },
+        provider: teamChatProvider,
         ...(options.subscriptionChatRunner ? { subscriptionRunner: options.subscriptionChatRunner } : {}),
     });
+    // Only browser sessions receive HTML cards. The CLI keeps its summary contract.
+    const teamBrowserReply = (reply, actor, csrf) => {
+        const snapshot = reply.snapshot;
+        if (!snapshot?.selected || !snapshot.proposals)
+            return reply;
+        return { ...reply, snapshot: { ...snapshot, proposals: snapshot.proposals.map(summary => {
+                    const proposal = store.getMateProposal(summary.id);
+                    if (!proposal || proposal.thread !== snapshot.selected.threadId)
+                        return summary;
+                    const decision = proposal.kind === 'answer' && typeof proposal.payload['decision'] === 'number' ? store.getDecision(proposal.payload['decision']) : null;
+                    return { ...summary, card: teamProposalCardParts(store, actor, proposal, snapshot, csrf, decision, clock(), teamChatProvider).card };
+                }) } };
+    };
     const teamEndpoint = (request, response) => handleTeamHttp(request, response, {
         authenticate: request => {
             const who = identify(request, request.method === 'POST');
@@ -773,7 +787,11 @@ export function createDecisionServer(options) {
                 return false;
             return request.headers['x-csrf-token'] === who.session.csrf;
         },
-        execute: team.execute, cursor: team.cursor, streams: teamStreams,
+        execute: async (actor, input) => {
+            const reply = await team.execute(actor, input);
+            const who = identify(request, false);
+            return who?.via === 'cookie' ? teamBrowserReply(reply, actor, who.session.csrf) : reply;
+        }, cursor: team.cursor, streams: teamStreams,
     });
     const sessionEndpoint = createSessionEndpoint({ store, workspace: coding, projects: codingProjects, projectAllowed: repo => rowVisible(liveCeiling(), repo) });
     /** The enumerable admission list for roll-up SQL: repos-only ceilings
@@ -3585,11 +3603,11 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "chat is a browser surface — it keeps your drafts in the session");
             if (url.searchParams.get('private') !== '1' && !url.searchParams.has('task') && !url.searchParams.has('result') && !url.searchParams.has('project')) {
-                const reply = await team.execute({ name: who.name, generation: who.session.generation }, {
+                const reply = teamBrowserReply(await team.execute({ name: who.name, generation: who.session.generation }, {
                     operation: url.searchParams.has('conversation') ? 'show' : 'list',
                     args: { ...(url.searchParams.has('conversation') ? { conversationId: url.searchParams.get('conversation') } : {}),
                         ...(url.searchParams.has('lead') ? { leadId: url.searchParams.get('lead') } : {}) },
-                });
+                }), { name: who.name, generation: who.session.generation }, who.session.csrf);
                 if (!reply.ok || !reply.snapshot)
                     return refuse(response, who, 403, reply.message, '/chat?private=1');
                 if (url.searchParams.has('proposal')) {
@@ -3599,11 +3617,7 @@ export function createDecisionServer(options) {
                         return refuse(response, who, 404, 'This proposal is unavailable.', '/chat');
                     const back = '/chat?conversation=' + encodeURIComponent(selected.id);
                     const decision = proposal.kind === 'answer' && typeof proposal.payload['decision'] === 'number' ? store.getDecision(proposal.payload['decision']) : null;
-                    const active = reply.snapshot.messages.some(message => message.status === 'running');
-                    const canAct = reply.snapshot.canSend && reply.snapshot.chatAuthorization?.enabled === true;
-                    let card = mateProposalCard(proposal, who.session.csrf, !canAct || active, decision, back);
-                    if (!canAct)
-                        card = card.replace('Available when the current turn finishes.', reply.snapshot.canSend ? 'Enable chat in this conversation before acting on a proposal.' : 'An authorized contributor can act on this proposal.');
+                    const card = teamProposalCardParts(store, { name: who.name, generation: who.session.generation }, proposal, reply.snapshot, who.session.csrf, decision, clock(), teamChatProvider).html;
                     return sendScreen(response, 200, screen('Review action', `<p><a href="${escape(back)}">Back to conversation</a></p>` + card, { chrome: chromeFor(null, 'chat', undefined, 'all') }));
                 }
                 if (reply.snapshot.leads.length > 0 || url.searchParams.has('conversation') || url.searchParams.get('team') === '1') {
@@ -4290,7 +4304,7 @@ export function createDecisionServer(options) {
             })(), (() => {
                 const chosen = store.notificationPreference(who.name);
                 return { mode: chosen.mode, digestAt: chosen.digestAt, screenshots: chosen.screenshots, projects: notificationProjects(store, who.name) };
-            })(), telegramTrouble(store, loadBotToken(process.env, options.telegramTokenFile))));
+            })(), telegramTrouble(store, loadBotToken(process.env, options.telegramTokenFile)), who.via === "cookie" ? phoneSetup(who) ?? null : null));
         }
         if (url.pathname === "/push/key") {
             // Session-gated: the key is not secret, but strangers get nothing.
@@ -4464,12 +4478,19 @@ export function createDecisionServer(options) {
         return first !== undefined && String(first["id"]) === rootId;
     }
     /** After the first Ready result, once (onboarding): the phone, by a chat app or the console over Tailscale. */
+    /** Chat's one-line pointer to the phone setup: after the first Ready result, until put away or Telegram is paired. */
     function phoneCard(who, now) {
         if (who.role !== "approver" || store.isDemo() || store.firstSuccessAt(now) === null || store.installationFact(PHONE_CARD_FACT) !== null)
             return undefined;
         const botId = options.telegramTokenFile === undefined ? null : loadBotToken(process.env, options.telegramTokenFile)?.botId ?? null;
         if (botId !== null && store.liveTelegramBindings(botId).length > 0)
             return undefined;
+        return phoneSetup(who);
+    }
+    /** The phone setup itself (Settings → Chat apps): a chat app, or this console over Tailscale. */
+    function phoneSetup(who) {
+        if (who.role !== "approver" || store.isDemo())
+            return undefined;
         const port = servedPort() ?? 4180;
         const address = server.address();
         const bound = typeof address === "object" && address !== null ? address.address : "127.0.0.1";
@@ -4509,7 +4530,11 @@ export function createDecisionServer(options) {
         const ask = last?.role === "assistant" && last.turn !== null && store.getMateTurn(last.turn)?.approver === who.name ? store.mateAskOpen(last.turn, now) : null;
         // Answered questions stay readable above the answer; only their buttons go.
         const asks = new Map(messages.flatMap(one => { const asked = one.role === "assistant" && one.turn !== null ? store.mateAsk(one.turn) : null; return asked === null ? [] : [[asked.turn, asked]]; }));
+        // The thread a ceiling change replaced (ruling 9): read after the open, display only.
+        const replaced = store.replacedLeadThread(opened.thread);
+        const previousProposals = replaced === null ? [] : store.listMateProposals(replaced.id);
         return {
+            previous: replaced === null ? null : { messages: store.listMateMessages(replaced.id, 40), proposals: previousProposals, decisions: decisionsFor(store, previousProposals) },
             messages,
             ask,
             asks,
@@ -9621,7 +9646,7 @@ export function createDecisionServer(options) {
                     noteMate(who.session.csrf, null, "that proposal was already acted on");
                 return redirect(response, chatReturnWithLatest(back));
             }
-            const outcome = confirmMateProposal(store, principal, id, now, { confirm: body.get("confirm") === "yes", via: "web", evidenceRoot, held: options.attended?.coordinator, ...(body.has("nonce") ? { actionReview: { nonce: body.get("nonce") ?? "", password: body.get("token") ?? "" } } : {}) });
+            const outcome = confirmMateProposal(store, principal, id, now, { chatProvider: teamChatProvider, confirm: body.get("confirm") === "yes", via: "web", evidenceRoot, held: options.attended?.coordinator, ...(body.has("nonce") ? { actionReview: { nonce: body.get("nonce") ?? "", password: body.get("token") ?? "" } } : {}) });
             if (cardJson) {
                 if (!outcome.ok)
                     return cardAnswer(outcome.reason === "standing" ? 403 : outcome.reason === "not-yours" ? 404 : 409, false, outcome.said);
@@ -15406,6 +15431,8 @@ ${THEME_DARK}
     min-height: min(32rem, 48vh); padding: .25rem;
   }
   .thread .msg { max-width: 48rem; line-height: 1.65; overflow-wrap: anywhere; }
+  .chat-previous-divider { display: flex; align-items: center; gap: .6rem; margin: 1rem 0; color: var(--so-muted); font-size: .8rem; }
+  .chat-previous-divider::before, .chat-previous-divider::after { content: ""; flex: 1; border-top: 1px solid var(--so-line); }
   .thread .msg p { margin: .3rem 0; }
   .thread .msg.op {
     align-self: flex-end; max-width: min(82%, 40rem); padding: .75rem 1rem;
@@ -18250,7 +18277,7 @@ function proposalCardParts(view, csrf, inert, decision, returnTo = null) {
                             `</div>`;
     }
     else if (view.state === "pending") {
-        acts = `<p class="meta proposal-wait">Available when the current turn finishes.</p>`;
+        acts = `<p class="meta proposal-wait">${escape(PROPOSAL_WAIT_REASON)}</p>`;
     }
     else if (view.state === "confirmed") {
         const filed = outcome !== null && typeof outcome.taskId === "string" ? outcome.taskId : null;
@@ -18299,7 +18326,7 @@ function proposalCardParts(view, csrf, inert, decision, returnTo = null) {
         ],
         primary,
         dismissable: pending && view.kind !== "control",
-        note: view.state === "pending" && inert ? "Available when the current reply finishes."
+        note: view.state === "pending" && inert ? PROPOSAL_WAIT_REASON
             : pending && view.kind === "cancel" ? "Cancelling is confirmed on the task itself."
                 : view.state === "dismissed" ? "Dismissed." : view.state === "expired" ? "Expired — this conversation moved on." : null,
     };
@@ -18311,6 +18338,18 @@ function mateProposalCard(proposal, csrf, inert, decision, returnTo = null) {
 function mateProposalCardParts(proposal, csrf, inert, decision, returnTo = null) {
     return proposalCardParts({ id: proposal.id, kind: proposal.kind, payload: proposal.payload, state: proposal.state, outcome: proposal.outcome, by: { mate: true }, actionBase: "/chat/proposal" }, csrf, inert, decision, returnTo);
 }
+/** Review and inline team cards share the same server-decided controls and reasons. */
+function teamProposalCardParts(store, actor, proposal, snapshot, csrf, decision, now, provider) {
+    const gate = proposalActGate(store, actor, proposal.thread, now, provider);
+    const reason = !gate.ok ? gate.said : null;
+    const back = '/chat?conversation=' + encodeURIComponent(snapshot.selected.id);
+    const parts = mateProposalCardParts(proposal, csrf, reason !== null, decision, back);
+    if (reason !== null && reason !== PROPOSAL_WAIT_REASON && proposal.state === 'pending') {
+        parts.html = parts.html.replace(PROPOSAL_WAIT_REASON, reason);
+        parts.card = { ...parts.card, note: reason };
+    }
+    return parts;
+}
 function coordinatorProposalCard(proposal, csrf, now, decision, returnTo = null) {
     return proposalCard({ id: proposal.id, kind: proposal.kind, payload: proposal.payload, state: proposal.state, outcome: proposal.outcome, by: { mate: false, name: proposal.name, ago: relativeAge(proposal.createdAt, now) }, actionBase: "/proposals" }, csrf, false, decision, returnTo);
 }
@@ -18330,6 +18369,24 @@ function coordinatorProposalsSection(proposals, decisions, csrf, now, heading =
         proposals.map(one => coordinatorProposalCard(one, csrf, now, decisions.get(typeof one.payload["decision"] === "number" ? one.payload["decision"] : -1) ?? null, returnTo)).join("") +
         `</div>`);
 }
+const REPLACED_THREAD_DIVIDER = "New conversation — the projects I can reach changed";
+/** The replaced thread as the React conversation renders it: words and card outcomes, no buttons. */
+function replacedBrowserMessages(previous, csrf) {
+    return mateBrowserMessages({ ...previous, pending: null, ask: null, asks: new Map() }, csrf, null).map(message => ({
+        ...message, cardsHtml: "",
+        cards: (message.cards ?? []).map(card => ({ ...card, primary: null, dismissable: false })),
+    }));
+}
+/** The replaced thread for the server-rendered page: read only, then the divider. */
+function replacedThreadHtml(previous) {
+    if (previous == null)
+        return "";
+    return `<section class="thread chat-previous" aria-label="Earlier conversation" data-previous-thread>` +
+        previous.messages.map(one => one.role === "operator"
+            ? `<div class="msg op" data-previous-message="${one.id}"><p style="white-space:pre-wrap">${escape(one.text)}</p></div>`
+            : `<div class="msg mate" data-previous-message="${one.id}">${renderChatText(one.text)}</div>`).join("") +
+        `<p class="chat-previous-divider" role="separator" data-thread-divider>${escape(REPLACED_THREAD_DIVIDER)}</p></section>`;
+}
 /** The lead's question as buttons: each option sends itself as the next message (the same POST as a typed one);
  * "Something else" moves to the composer. Nothing shows while a reply is running. */
 function mateAskHtml(ask, csrf, target, composer, open = true) {
@@ -18378,6 +18435,7 @@ function mateChatVersion(rows) {
     const focus = rows.focusTask;
     const facts = [
         rows.messages.map(one => [one.id, one.role, one.turn]),
+        rows.previous == null ? null : rows.previous.messages.map(one => one.id),
         rows.proposals.map(one => [one.id, one.state, one.outcome === null ? null : JSON.stringify(one.outcome)]),
         rows.coordinatorProposals.map(one => [one.id, one.state, one.outcome === null ? null : JSON.stringify(one.outcome)]),
         [...rows.decisions.values()].map(one => [one.id, one.state, one.choice ?? null]),
@@ -18504,6 +18562,7 @@ function matePage(chrome, data) {
     }
     const lastMessage = data.messages.at(-1);
     const latestReply = data.pending === null && lastMessage?.role === "assistant" ? lastMessage.id : null;
+    conversation.push(replacedThreadHtml(data.previous));
     conversation.push(mateThreadHtml({ ...data, problem: null, chatProject }));
     conversation.push(
     // The New update action (package 2): hidden until a live update lands
@@ -18524,6 +18583,7 @@ function matePage(chrome, data) {
                 messages: mateBrowserMessages(data, data.csrf, data.focusTask === null && chatProject === null ? null : returnTo, { task: data.focusTask?.id ?? null, project: chatProject }),
                 pendingTurnId: data.pending?.id ?? null, requestId: randomBytes(16).toString('hex'), maxChars: MATE_MESSAGE_MAX_CHARS,
                 taskId: data.focusTask?.id ?? null, resultRunId: data.resultRunId ?? null, project: chatProject,
+                ...(data.previous == null ? {} : { previous: { messages: replacedBrowserMessages(data.previous, data.csrf) } }),
             },
             focus: data.focusTask === null ? null : { id: data.focusTask.id, title: data.focusTask.title,
                 html: taskChatLiveRegion(data.focusTask, data.csrf, requestContext.getStore()?.workspaceRead === true, data.pending !== null) },
@@ -24057,7 +24117,7 @@ function notificationProjects(store, account) {
         .map(one => ({ repo: one.path, name: one.name, muted: muted.has(one.path) }))
         .sort((a, b) => a.name.localeCompare(b.name));
 }
-function settingsPage(chrome, existing, hasEnv, csrf, problem, messaging = null, push = null, providerKeys = null, digest = null, permissionDefault = null, qualityDefault = null, email = null, telegramDelivery = null, workers = null, updates = null, firstResult = null, chatNotices = null, telegramFailing = false) {
+function settingsPage(chrome, existing, hasEnv, csrf, problem, messaging = null, push = null, providerKeys = null, digest = null, permissionDefault = null, qualityDefault = null, email = null, telegramDelivery = null, workers = null, updates = null, firstResult = null, chatNotices = null, telegramFailing = false, phone = null) {
     const permissionCard = permissionDefault === null
         ? ""
         : [
@@ -24283,10 +24343,12 @@ function settingsPage(chrome, existing, hasEnv, csrf, problem, messaging = null,
         workers,
         updates,
         firstResult,
+        ...(phone === null ? {} : { phone }),
     };
     return screen("Settings", [
         "<h1>Settings</h1>",
         settingsTiles(view.groups),
+        phone === null ? "" : phoneSetupHtml(phone),
         appearanceCard(csrf),
         permissionCard,
         qualityCard,
@@ -24312,6 +24374,15 @@ function settingsPage(chrome, existing, hasEnv, csrf, problem, messaging = null,
         `</details>`,
     ].join("\n"), { chrome, workspace: { view }, functional: { script: SETTINGS_AUTOSAVE_SCRIPT + (pushScript ?? ""), ...(pushScript === null ? {} : { fetches: true }) } });
 }
+/** The phone setup for the server-rendered Settings page: the same choices as the React card. */
+function phoneSetupHtml(phone) {
+    const [first, ...others] = phone.chatApps;
+    return `<section class="card" id="phone" aria-labelledby="phone-card-title" data-phone-card><h2 id="phone-card-title">Use it from your phone</h2>` +
+        `<p>${first === undefined ? "" : `<a href="${escape(first.href)}">Pair ${escape(first.label)}</a>`}${others.length === 0 ? "" : ` · or ${others.map(one => `<a href="${escape(one.href)}">${escape(one.label)}</a>`).join(", ")}`}</p>` +
+        `<p class="meta" data-phone-tailnet>${phone.tailnet === null ? `Or install <a href="https://tailscale.com/download">Tailscale</a> on this computer and your phone, then reload this page for the address.`
+            : phone.tailnet.restart === null ? `Or on your phone open <code>${escape(phone.tailnet.address)}</code> and sign in.`
+                : `Or start Toolroll with <code>${escape(phone.tailnet.restart)}</code>, then on your phone open <code>${escape(phone.tailnet.address)}</code> and sign in.`}</p></section>`;
+}
 /** Every worker that is not retired: its capacity, and the tasks it holds now. */
 function settingsWorkers(store, now) {
     const claims = store.liveClaims(null, now);

package/dist/store.d.ts

@@ -6323,6 +6323,11 @@ export declare class Store {
     };
     /** The approver's live thread for one scope, read only — null when none is open. */
     liveMateThreadFor(approver: string, scope?: MateThreadScope): MateThread | null;
+    /** The lead thread a ceiling change closed just before `current` (ruling 9),
+     * read only and for display only: it never continues and never reaches the
+     * model. Null when there is none, when it was ended or revoked (its text is
+     * gone), or when it closed under the same ceiling. */
+    replacedLeadThread(current: MateThread): MateThread | null;
     /** The task a paired chat is talking about (v78), or null for the lead conversation. */
     chatFocus(surface: string, binding: number): string | null;
     setChatFocus(surface: string, binding: number, task: string | null, now: Date): void;

package/dist/store.js

@@ -19275,6 +19275,20 @@ export class Store {
         const row = this.db.prepare("SELECT * FROM mate_thread WHERE approver = ? AND scope_kind = ? AND scope_key IS ? AND closed_at IS NULL AND NOT EXISTS (SELECT 1 FROM team_conversation tc WHERE tc.thread=mate_thread.id) ORDER BY id DESC LIMIT 1").get(approver, scope.kind, scope.kind === "lead" ? null : scope.key);
         return row === undefined ? null : readMateThread(row);
     }
+    /** The lead thread a ceiling change closed just before `current` (ruling 9),
+     * read only and for display only: it never continues and never reaches the
+     * model. Null when there is none, when it was ended or revoked (its text is
+     * gone), or when it closed under the same ceiling. */
+    replacedLeadThread(current) {
+        if (current.scope.kind !== "lead")
+            return null;
+        const row = this.db.prepare(`SELECT * FROM mate_thread WHERE approver = ? AND scope_kind = 'lead' AND scope_key IS NULL AND id < ? AND closed_at IS NOT NULL
+      AND NOT EXISTS (SELECT 1 FROM team_conversation tc WHERE tc.thread=mate_thread.id) ORDER BY id DESC LIMIT 1`).get(current.approver, current.id);
+        if (row === undefined || String(row["ceiling_digest"]) === current.ceilingDigest)
+            return null;
+        const previous = readMateThread(row);
+        return this.db.prepare("SELECT 1 FROM mate_message WHERE thread = ? LIMIT 1").get(previous.id) === undefined ? null : previous;
+    }
     /** The task a paired chat is talking about (v78), or null for the lead conversation. */
     chatFocus(surface, binding) {
         const row = this.db.prepare("SELECT task FROM chat_focus WHERE surface = ? AND binding = ?").get(surface, binding);

package/dist/team-chat-authorization.d.ts

@@ -0,0 +1,11 @@
+import type { Store, ChatConfig } from './store.js';
+import type { TeamActor, TeamChatAuthorization, TeamSnapshot } from './team-contract.js';
+export type TeamChatProvider = {
+    config: ChatConfig;
+    key: string | null;
+};
+export type TeamChatProviderResolver = () => TeamChatProvider | null;
+/** Subscription-only surfaces can resolve current terms from saved settings.
+ * Direct API callers must supply their live key; a stored grant is never proof of it. */
+export declare function subscriptionTeamChatProvider(store: Store): TeamChatProvider | null;
+export declare function teamChatAuthorization(store: Store, actor: TeamActor, conversation: Pick<NonNullable<TeamSnapshot['selected']>, 'id' | 'threadId' | 'projects'> | null, live: TeamChatProvider | null): TeamChatAuthorization;

package/dist/team-chat-authorization.js

@@ -0,0 +1,33 @@
+/** The live grant shared by team execution, proposal cards and confirmation doors. */
+import { createHash } from 'node:crypto';
+import { ceilingDigestOf } from './principal.js';
+import { credentialKeyOf, isDirectChatProvider, priceForConfig, subscriptionCredentialKey } from './converse.js';
+const hash = (value) => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+/** Subscription-only surfaces can resolve current terms from saved settings.
+ * Direct API callers must supply their live key; a stored grant is never proof of it. */
+export function subscriptionTeamChatProvider(store) {
+    const config = store.getChatConfig();
+    return config && !isDirectChatProvider(config.provider) ? { config, key: null } : null;
+}
+export function teamChatAuthorization(store, actor, conversation, live) {
+    const config = live?.config;
+    const empty = { enabled: false, provider: config?.provider ?? null, model: config?.model ?? null,
+        dailyTurns: config?.dailyTurns ?? 0, weeklyCeilingUsd: null, conversationCeilingUsd: null, termsDigest: '' };
+    if (!conversation)
+        return empty;
+    if (!live || !config)
+        return { ...empty, waitingReason: 'Choose a chat provider in Settings.' };
+    const direct = isDirectChatProvider(config.provider);
+    if (direct && (live.key === null || priceForConfig(config) === null))
+        return { ...empty, waitingReason: 'The configured chat connection is unavailable. Open Settings.' };
+    const credential = direct ? credentialKeyOf(config.provider, live.key) : subscriptionCredentialKey(config.provider);
+    const session = store.teamMateSession(actor.name, conversation.threadId);
+    const ceiling = direct ? (session ? session.ceilingMicrousd / 1_000_000 : Math.min(5, config.weeklyCeilingMicrousd / 1_000_000)) : null;
+    const termsDigest = hash({ version: 1, actor: actor.name, generation: actor.generation, conversation: conversation.id,
+        projects: conversation.projects, credential, provider: config.provider, model: config.model,
+        daily: config.dailyTurns, weekly: config.weeklyCeilingMicrousd, priceIn: config.priceInMicrousd, priceOut: config.priceOutMicrousd, ceiling });
+    const enabled = session !== null && session.approverGeneration === actor.generation && session.endedAt === null
+        && session.credentialKey === credential && session.ceilingDigest === ceilingDigestOf(conversation.projects) && session.termsDigest === termsDigest;
+    return { enabled, provider: config.provider, model: config.model, dailyTurns: config.dailyTurns,
+        weeklyCeilingUsd: direct ? config.weeklyCeilingMicrousd / 1_000_000 : null, conversationCeilingUsd: ceiling, termsDigest };
+}

package/dist/team-contract.d.ts

@@ -1,4 +1,5 @@
 import type { WorkIndexPage } from './work-index.js';
+import type { BrowserActionCard } from './browser-workspace.js';
 /** Shared central-team transport contract. Requests never establish actor identity. */
 export type TeamActor = {
     name: string;
@@ -52,6 +53,15 @@ export type TeamChatAuthorization = {
     termsDigest: string;
     waitingReason?: string;
 };
+/** Browser cards extend the existing CLI summary; both refer to the same saved proposal. */
+export type TeamProposal = {
+    id: number;
+    turnId: number;
+    title: string;
+    state: string;
+    href: string;
+    card?: BrowserActionCard;
+};
 export type TeamSnapshot = {
     leads: TeamLead[];
     conversations: TeamConversation[];
@@ -67,13 +77,7 @@ export type TeamSnapshot = {
     accounts: string[];
     chatAuthorization?: TeamChatAuthorization;
     tasks?: WorkIndexPage;
-    proposals?: {
-        id: number;
-        turnId: number;
-        title: string;
-        state: string;
-        href: string;
-    }[];
+    proposals?: TeamProposal[];
 };
 export declare const TEAM_OPERATIONS: readonly ['list', 'show', 'create-lead', 'update-lead', 'create-conversation', 'member', 'send', 'edit', 'withdraw', 'read', 'authorize', 'follow', 'stop', 'transfer'];
 export type TeamOperation = typeof TEAM_OPERATIONS[number];

package/dist/team-runtime.d.ts

@@ -1,16 +1,14 @@
-import type { Store, ChatConfig } from './store.js';
+import type { Store } from './store.js';
 import type { WorkspaceRevision } from './workspace-revision.js';
 import { TeamLeads } from './team-leads.js';
 import type { TeamActor, TeamExecute } from './team-contract.js';
 import { type MateTurnInput } from './mate.js';
+import { type TeamChatProviderResolver } from './team-chat-authorization.js';
 export type TeamRuntimeOptions = {
     store: Store;
     repos: () => readonly string[];
     evidenceRoot: string;
-    provider: () => {
-        config: ChatConfig;
-        key: string | null;
-    } | null;
+    provider: TeamChatProviderResolver;
     subscriptionRunner?: MateTurnInput['subscriptionRunner'];
     fetcher?: typeof fetch;
     clock?: () => Date;

package/dist/team-runtime.js

@@ -4,9 +4,10 @@ import { createHash, randomUUID } from 'node:crypto';
 import { deliverTeamUpdates, startTeamUpdates } from './team-updates.js';
 import { workIndexPage } from './work-index.js';
 import { TeamLeads } from './team-leads.js';
-import { ceilingDigestOf, verifyApproverStanding } from './principal.js';
+import { verifyApproverStanding } from './principal.js';
 import { credentialKeyOf, isDirectChatProvider, priceForConfig, subscriptionCredentialKey, mateWorstCaseForPrice } from './converse.js';
 import { runMateTurn } from './mate.js';
+import { teamChatAuthorization } from './team-chat-authorization.js';
 import { updateAdmissionPaused } from './desktop-update-gate.js';
 const hash = (value) => createHash('sha256').update(JSON.stringify(value)).digest('hex');
 const response = (ok, code, message) => ({ version: 1, ok, code, message });
@@ -20,28 +21,7 @@ export function createTeamRuntime(options) {
     const waiting = new Map();
     const pages = new Map();
     let timer = null, closed = false, passing = false, lastDelivery = 0;
-    function authorization(actor, snapshot) {
-        const live = options.provider(), config = live?.config, conversation = snapshot.selected;
-        const empty = { enabled: false, provider: config?.provider ?? null, model: config?.model ?? null,
-            dailyTurns: config?.dailyTurns ?? 0, weeklyCeilingUsd: null, conversationCeilingUsd: null, termsDigest: '' };
-        if (!conversation)
-            return empty;
-        if (!live || !config)
-            return { ...empty, waitingReason: 'Choose a chat provider in Settings.' };
-        const direct = isDirectChatProvider(config.provider);
-        if (direct && (live.key === null || priceForConfig(config) === null))
-            return { ...empty, waitingReason: 'The configured chat connection is unavailable. Open Settings.' };
-        const credential = direct ? credentialKeyOf(config.provider, live.key) : subscriptionCredentialKey(config.provider);
-        const session = store.teamMateSession(actor.name, conversation.threadId);
-        const ceiling = direct ? (session ? session.ceilingMicrousd / 1_000_000 : Math.min(5, config.weeklyCeilingMicrousd / 1_000_000)) : null;
-        const termsDigest = hash({ version: 1, actor: actor.name, generation: actor.generation, conversation: conversation.id,
-            projects: conversation.projects, credential, provider: config.provider, model: config.model,
-            daily: config.dailyTurns, weekly: config.weeklyCeilingMicrousd, priceIn: config.priceInMicrousd, priceOut: config.priceOutMicrousd, ceiling });
-        const enabled = session !== null && session.approverGeneration === actor.generation && session.endedAt === null
-            && session.credentialKey === credential && session.ceilingDigest === ceilingDigestOf(conversation.projects) && session.termsDigest === termsDigest;
-        return { enabled, provider: config.provider, model: config.model, dailyTurns: config.dailyTurns,
-            weeklyCeilingUsd: direct ? config.weeklyCeilingMicrousd / 1_000_000 : null, conversationCeilingUsd: ceiling, termsDigest };
-    }
+    const authorization = (actor, snapshot) => teamChatAuthorization(store, actor, snapshot.selected, options.provider());
     function admission(actor, id) {
         const conversation = domain.access(actor, id, 'contributor').conversation;
         const grant = authorization(actor, { selected: conversation }), live = options.provider();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.38",
+  "version": "0.9.40",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"