toolroll 0.9.46 → 0.9.47

package/dist/browser-workspace.d.ts

@@ -2,6 +2,7 @@
  * produced by the existing trusted server renderers, never by a model-supplied
  * fragment. These projections do not authenticate, mutate or grant authority. */
 import type { TeamSnapshot } from './team-contract.js';
+import type { RunActivity } from './activity-line.js';
 import type { BrandIconId } from './brand-icons.js';
 import type { AssignmentSnapshot } from './assignment.js';
 export { browserCrewFromIndex, browserWorkActionHref } from './browser-crew.js';
@@ -26,7 +27,12 @@ export type BrowserNavigationItem = {
     href: string;
     active: boolean;
     count?: number;
+    /** What the count covers, said aloud and on hover: "3 need you in shop". */
+    countLabel?: string;
 };
+/** The Tasks badge's words: the count and the projects it covers
+ * ("3 need you in shop", "1 needs you across all your projects"). */
+export declare function needsYouLabelOf(count: number, projectName: string | null, saturated?: boolean): string;
 export type BrowserChatLink = {
     kind: 'project' | 'task';
     title: string;
@@ -53,6 +59,8 @@ export type BrowserCrewItem = {
     detail?: string;
     /** "<name> is on it.": the person's own lead took it on, by the name they gave it. */
     lead?: string;
+    /** A running task: what its agent did last, and when. */
+    activity?: RunActivity;
 };
 export type BrowserMessage = {
     id: number;
@@ -419,6 +427,13 @@ export type BrowserTaskView = {
             action: BrowserLink | null;
         } | null;
     } | null;
+    /** What the agent did last on the live run, and when; the page words it against its own clock (activity-line.ts). */
+    activity?: RunActivity | null;
+    /** The task's live stream (/t/<id>/live): change nudges and who else has it open. Absent: the page reads on its beat. */
+    live?: {
+        href: string;
+        at: string | null;
+    } | null;
     /** Stop, on the Building card: the exact live build's stop form (posts its run id). */
     stop?: {
         action: string;
@@ -1166,6 +1181,8 @@ export type BrowserHomeAgent = {
     phase: string;
     project: string | null;
     since: string;
+    /** What the agent did last, and when. */
+    activity?: RunActivity;
 };
 export type BrowserHomeCount = {
     key: 'working' | 'waiting' | 'ready' | 'done';
@@ -1277,4 +1294,4 @@ export declare function browserProjectsOf(projects: readonly {
     name: string;
     path: string;
 }[]): BrowserProject[];
-export declare function browserNavigationOf(path: string, project?: string | null, needsYou?: number): BrowserNavigationItem[];
+export declare function browserNavigationOf(path: string, project?: string | null, needsYou?: number, tasksProject?: string | null, needsYouLabel?: string): BrowserNavigationItem[];

package/dist/browser-workspace.js

@@ -1,6 +1,12 @@
 import { browserCrewFromIndex } from './browser-crew.js';
 export { browserCrewFromIndex, browserWorkActionHref } from './browser-crew.js';
 import { workIndexPage } from './work-index.js';
+/** The Tasks badge's words: the count and the projects it covers
+ * ("3 need you in shop", "1 needs you across all your projects"). */
+export function needsYouLabelOf(count, projectName, saturated = false) {
+    const where = projectName === null ? 'across all your projects' : `in ${projectName}`;
+    return `${count}${saturated ? '+' : ''} ${count === 1 && !saturated ? 'needs' : 'need'} you ${where}`;
+}
 /** Safe inside a script[type=application/json] element. JSON escaping alone
  * does not stop the HTML parser from closing that element at </script>. */
 export function serializeBrowserWorkspace(workspace) {
@@ -31,14 +37,14 @@ export function browserProjectsOf(projects) {
                 knowledgeHref: `/settings/knowledge?repo=${encodeURIComponent(project.path)}` }];
     });
 }
-export function browserNavigationOf(path, project = null, needsYou = 0) {
+export function browserNavigationOf(path, project = null, needsYou = 0, tasksProject = project, needsYouLabel) {
     const pathname = path.split('?')[0].split('#')[0];
     const knowledge = pathname === '/settings/knowledge' || pathname.startsWith('/settings/knowledge/');
     return [
         { label: 'Chat', href: '/chat', active: pathname === '/chat' },
-        { label: 'Tasks', href: `/work${project === null ? '' : `?project=${encodeURIComponent(project)}`}`,
+        { label: 'Tasks', href: `/work${tasksProject === null ? '' : `?project=${encodeURIComponent(tasksProject)}`}`,
             active: pathname === '/work' || pathname === '/tasks' || pathname.startsWith('/t/') || pathname.startsWith('/r/'),
-            ...(needsYou > 0 ? { count: needsYou } : {}) },
+            ...(needsYou > 0 ? { count: needsYou, ...(needsYouLabel === undefined ? {} : { countLabel: needsYouLabel }) } : {}) },
         { label: 'Flows', href: '/flows', active: pathname === '/flows' || pathname.startsWith('/flows/') },
         { label: 'Projects', href: '/projects', active: pathname === '/projects' },
         { label: 'Knowledge', href: `/settings/knowledge${project === null ? '' : `?repo=${encodeURIComponent(project)}`}`, active: knowledge },

package/dist/builder.js

@@ -60,6 +60,7 @@ import { invokeAgent } from "./invoke.js";
 import { TELEGRAM_TOKEN_ENVS } from "./names.js";
 import { OPENROUTER_ENV_KEY, auditOf, ALL_CREDENTIAL_ENV } from "./provider.js";
 import { openLiveLog } from "./live.js";
+import { withRunActivity } from "./task-activity.js";
 import { CheckProgressTracker } from "./check-progress.js";
 import { captureParkEvidence, captureTerminalDiff, captureBaseTree, evidenceRoot, handoffName, isImagePath, WORKTREE_EVIDENCE_DIR, storeHandoffArtifact, looksLikeProtocolFile, mailboxName, progressFileName, proofFileName, rubricFileName, proposalFileName, quarantineMailboxes, readMailbox, readVerifiedArtifact, scanForSecrets, redactSecretLines, storeEvidence, validateScreenshotBytes, imageDimensions, SCREENSHOT_BYTE_CAP, boundStreamHeadTail } from "./evidence.js";
 import { PROOF_LIMITS, parseProof, serializeProof, adjudicate, artifactManifestOnly, sameDiffStatFacts } from "./proof.js";
@@ -1139,7 +1140,8 @@ export async function build(store, request) {
     // The live window (arc 1): display state beside the run, never evidence.
     // Every streaming transport emits events now (peek); a file that cannot
     // open is a null, and a null never costs a build.
-    const liveLog = openLiveLog(root, request.runId);
+    // What the agent did last rides the same stream into one row (live tasks).
+    const liveLog = withRunActivity(openLiveLog(root, request.runId), store, request.runId, clock);
     // The retry base (steering fix for run 1465's proof): the SAME pinned
     // base the machine will use to capture the sealed diff (settleProof
     // below, mirroring store.firstBuilderBase's own doc). Null on a first
@@ -1329,7 +1331,7 @@ export async function build(store, request) {
             omitEnv: AGENT_ENV_DENYLIST,
             ...(agent === undefined ? {} : { runner: agent }),
             ...(request.onProviderSpawn === undefined ? {} : { onSpawn: request.onProviderSpawn }),
-            ...(liveLog === null ? {} : { onStreamEvent: (event) => liveLog.observe(event) }),
+            onStreamEvent: (event) => liveLog.observe(event),
             // The receipt (finding 8): the stream proved the prompt reached the
             // agent — settle delivery NOW, durably, whatever happens to the run
             // later. The runner latches and isolates this callback; a throw

package/dist/desktop-update.d.ts

@@ -94,7 +94,6 @@ export declare function prepareDesktopUpdate(stateDir: string, installed: string
 export declare function sqliteLock(file: string, busyTimeoutMs?: number): DatabaseSync | null;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
-    version?: never;
     active: boolean;
     phase: string;
     detail: string;
@@ -108,6 +107,7 @@ export declare function desktopUpdateStatus(stateDir: string): {
     wasRunning?: never;
     backupPath?: never;
     updateId?: never;
+    version?: never;
     buildId?: never;
     workDir?: never;
 } | {

package/dist/flow-card-task.d.ts

@@ -0,0 +1,2 @@
+import type { Store } from "./store.js";
+export declare function flowCardTaskLine(store: Store, taskId: string, repo: string, now: Date, secrets?: readonly string[]): string;

package/dist/flow-card-task.js

@@ -0,0 +1,57 @@
+/** The task behind an agent zone, read through the same status as its task page.
+ * Only saved milestone progress belongs on the card; tool calls and logs do not. */
+import { assignmentOf } from "./assignment.js";
+import { scanForSecrets } from "./evidence.js";
+import { scrubIntegrationText } from "./integrations.js";
+import { assignmentStatusFacts, taskStatusOf } from "./task-status.js";
+import { taskWorkSummaryOf } from "./work-summary.js";
+import { buildProgressOf } from "./workspace-ui.js";
+/** Redact before shortening: a cut-off credential must never slip through a scanner.
+ * Structured arguments, commands and credential assignments aren't card copy. */
+function cardReason(text, fallback, secrets) {
+    if (text === null)
+        return fallback;
+    const raw = /[{}\[\]`]|\b[\w.-]+\s*=|(?:^|\s)--[\w-]+|\b(?:arguments|tool_input|command|cmd|password|passwd|token|secret|api[_ -]?key|authorization)\s*:|\bcurl\s/i.test(text);
+    if (raw || secrets.some(secret => secret !== "" && text.includes(secret)) || scanForSecrets(text).length > 0)
+        return fallback;
+    const clean = scrubIntegrationText(text, secrets).replace(/[\p{Cf}]/gu, "").replace(/[.\s]+$/, "");
+    if (clean === "" || clean.includes("[hidden]"))
+        return fallback;
+    return clean.length > 100 ? `${clean.slice(0, 99).trimEnd()}…` : clean;
+}
+export function flowCardTaskLine(store, taskId, repo, now, secrets = []) {
+    const access = { principal: "operator", repos: [repo], dependencyRepos: [repo] };
+    const assignment = assignmentOf(store, taskId, now, access);
+    if (assignment === null)
+        return "Task unavailable";
+    const work = taskWorkSummaryOf(store, assignment.activeTaskId, now, access);
+    if (work === null)
+        return "Task unavailable";
+    const live = work.liveRunId === null ? null : store.getRun(work.liveRunId);
+    const facts = assignmentStatusFacts(assignment, { work: work.status, planning: live?.role === "planner" });
+    // The canvas reads no evidence files. Keep the machine's recorded check visible
+    // when the full receipt has no artifact root from which to read its check.
+    const check = assignment.receipt === null ? null : store.runCheckFor(assignment.receipt.runId);
+    if (facts.checks?.status === "unavailable" && check !== null)
+        facts.checks = { ...facts.checks, status: check.status, exitCode: check.exitCode };
+    const status = taskStatusOf(facts);
+    if (status.headline === "Needs you") {
+        const fallback = status.need?.action.label ?? "Open the task";
+        // The question itself is useful; routine approvals are clearer as the short action.
+        const what = status.need?.key === "answer" || status.need?.key === "other"
+            ? cardReason(status.sentence, fallback, secrets) : fallback;
+        return `Waiting on you: ${what}`;
+    }
+    if (status.headline === "Building" && live !== null) {
+        const ref = store.lookupRef(assignment.activeTaskId);
+        const checkpoint = store.latestCheckpointForRun(live.id);
+        const progress = buildProgressOf(checkpoint?.taskRef !== ref?.id ? null : checkpoint?.snapshot.milestones.map(one => ({ description: null, state: one.state, note: one.note })));
+        if (progress?.stuck != null)
+            return `Stuck: ${cardReason(progress.stuck.why, `step ${progress.step} of ${progress.total}`, secrets)}`;
+        if (progress !== null)
+            return `Building · step ${progress.step} of ${progress.total}`;
+    }
+    if (status.headline === "Failed")
+        return `Stuck: ${cardReason(status.sentence, "Open the task", secrets)}`;
+    return status.headline === "Ready for review" ? "Ready" : status.headline;
+}

package/dist/flow-live.d.ts

@@ -12,8 +12,8 @@ export type FlowViewer = {
     response: ServerResponse;
     valid: () => boolean;
 };
-/** What changes when anything on the canvas changes: one row, one read, kept short and opaque. */
-export declare function flowFingerprint(store: Store, flow: number): string | null;
+/** What changes when anything on the canvas changes: metadata only, kept short and opaque. */
+export declare function flowFingerprint(store: Store, flow: number, now?: Date): string | null;
 export type FlowRooms = {
     /** Keep this page's stream on the flow until it closes; the first event says where the flow stands. */
     join: (flow: number, viewer: FlowViewer) => void;

package/dist/flow-live.js

@@ -2,9 +2,9 @@
  * The live canvas (v88): a flow open in several browsers stays the same in
  * all of them, and each shows who else has it open.
  *
- * - A change nudge. While anyone has a flow open, one cheap query a second
- *   reads the flow's fingerprint (its revision, cards, moves, comments,
- *   watchers, step runs and triggers); when it changes, every open page
+ * - A change nudge. While anyone has a flow open, a small read each second
+ *   checks the flow's fingerprint (its revision, cards, moves, comments,
+ *   watchers, step runs, linked task progress and triggers); when it changes, every open page
  *   hears "change" and reads the flow again the usual way. The nudge
  *   carries no card data: what a page shows is always what its own read
  *   returned, under its own checks.
@@ -20,17 +20,78 @@ const TICK_MS = 1_000;
 const CHECK_EVERY = 15;
 const HEARTBEAT_EVERY = 15;
 const PRESENCE_SETTLE_MS = 150;
-/** What changes when anything on the canvas changes: one row, one read, kept short and opaque. */
-export function flowFingerprint(store, flow) {
-    const row = store.handle.prepare(`SELECT f.state || '|' || f.revision || '|' || f.updated_at || '|' || coalesce(f.owner, '') AS head,
+// Statements belong to their database, without keeping closed Stores alive.
+const fingerprintStatements = new WeakMap();
+function fingerprintStatement(store) {
+    const cached = fingerprintStatements.get(store.handle);
+    if (cached !== undefined)
+        return cached;
+    // Match Store.taskFamilyOf/taskFamilyProjection: built-in tasks, same-repo
+    // edges, a revision brief bound to the parent's run, and at most 63 edges.
+    // Walk up only from active cards, then down from their proven roots. A
+    // missing/invalid/cyclic/over-depth ancestry leaves the linked task alone.
+    const statement = store.handle.prepare(`WITH RECURSIVE linked AS MATERIALIZED (
+      SELECT DISTINCT tr.id AS ref_id, tr.external_id AS id, tr.repo, tr.revision_of, tr.revision_brief_artifact
+      FROM flow_card c JOIN task_ref tr ON tr.external_id = c.task AND tr.backend = 'built-in'
+      JOIN task t ON t.id = tr.external_id
+      WHERE c.flow = $flow AND c.state = 'active' AND tr.repo IS NOT NULL
+    ), ancestors(linked_ref, ref_id, id, repo, revision_of, revision_brief_artifact, depth) AS (
+      SELECT ref_id, ref_id, id, repo, revision_of, revision_brief_artifact, 0 FROM linked
+      UNION ALL
+      SELECT child.linked_ref, parent.id, parent.external_id, parent.repo, parent.revision_of, parent.revision_brief_artifact, child.depth + 1
+      FROM ancestors child
+      JOIN task_ref parent ON parent.backend = 'built-in' AND parent.external_id = child.revision_of AND parent.repo IS child.repo
+      JOIN task t ON t.id = parent.external_id
+      JOIN artifact brief ON brief.id = child.revision_brief_artifact AND brief.kind = 'revision-brief'
+      JOIN run source_run ON source_run.id = brief.run AND source_run.task_ref = parent.id
+      WHERE child.depth < 63
+    ), roots AS MATERIALIZED (
+      SELECT DISTINCT ref_id, id, repo FROM ancestors WHERE revision_of IS NULL
+    ), descendants(ref_id, id, repo, depth) AS (
+      SELECT ref_id, id, repo, 0 FROM roots
+      UNION ALL
+      SELECT child.id, child.external_id, child.repo, parent.depth + 1 FROM descendants parent
+      JOIN task_ref child ON child.backend = 'built-in' AND child.revision_of = parent.id AND child.repo IS parent.repo
+      JOIN task t ON t.id = child.external_id
+      JOIN artifact brief ON brief.id = child.revision_brief_artifact AND brief.kind = 'revision-brief'
+      JOIN run source_run ON source_run.id = brief.run AND source_run.task_ref = parent.ref_id
+      WHERE parent.depth < 63
+    ), members AS (
+      SELECT ref_id FROM descendants
+      UNION
+      SELECT ref_id FROM linked WHERE NOT EXISTS (
+        SELECT 1 FROM ancestors WHERE linked_ref = linked.ref_id AND revision_of IS NULL
+      )
+    ) SELECT f.state || '|' || f.revision || '|' || f.updated_at || '|' || coalesce(f.owner, '') AS head,
     (SELECT count(*) || ':' || coalesce(max(updated_at), '') FROM flow_card WHERE flow = f.id) AS cards,
     (SELECT coalesce(max(e.id), 0) FROM flow_event e JOIN flow_card c ON c.id = e.card WHERE c.flow = f.id) AS moves,
     (SELECT coalesce(max(m.id), 0) FROM flow_comment m JOIN flow_card c ON c.id = m.card WHERE c.flow = f.id) AS comments,
     (SELECT count(*) || ':' || coalesce(max(w.added_at), '') FROM flow_card_watcher w JOIN flow_card c ON c.id = w.card WHERE c.flow = f.id) AS watchers,
     (SELECT count(*) || ':' || coalesce(sum(r.attempts), 0) || ':' || coalesce(max(coalesce(r.finished_at, r.started_at)), '') || ':' || coalesce(sum(r.state = 'running'), 0)
        FROM flow_step_run r JOIN flow_card c ON c.id = r.card WHERE c.flow = f.id) AS runs,
-    (SELECT count(*) || ':' || coalesce(max(updated_at), '') || ':' || coalesce(max(last_at), '') || ':' || coalesce(sum(failures), 0) FROM flow_trigger WHERE flow = f.id) AS triggers
-    FROM flow f WHERE f.id = ?`).get(flow);
+    (SELECT count(*) || ':' || coalesce(max(updated_at), '') || ':' || coalesce(max(last_at), '') || ':' || coalesce(sum(failures), 0) FROM flow_trigger WHERE flow = f.id) AS triggers,
+    (SELECT json_group_array(json_array(tr.id, t.id, t.state, t.updated_at, tr.plan,
+       s.digest, s.approved_digest, s.approved_at,
+       (SELECT max(p.id) FROM run_checkpoint p WHERE p.task_ref = tr.id),
+       (SELECT q.lease_id FROM claim q WHERE q.task_ref = tr.id AND q.released_at IS NULL AND q.expires_at > $now ORDER BY q.lease_generation DESC LIMIT 1),
+       (SELECT json_group_array(json_array(r.id, r.outcome, r.finished_at, r.reason,
+          (SELECT json_array(k.status, k.exit_code, k.updated_at) FROM run_check k WHERE k.run = r.id)) ORDER BY r.id) FROM run r WHERE r.task_ref = tr.id),
+       (SELECT json_group_array(json_array(d.id, d.state, d.question, d.answered_at) ORDER BY d.id) FROM decision d JOIN run r ON r.id = d.run WHERE r.task_ref = tr.id),
+       (SELECT json_group_array(json_array(h.id, h.reason) ORDER BY h.id) FROM hold h WHERE h.task_ref = tr.id AND (h.until IS NULL OR h.until > $now)),
+       (SELECT max(a.id) FROM action_ledger a WHERE a.task_id = t.id)) ORDER BY tr.id)
+     FROM task_ref tr JOIN task t ON t.id = tr.external_id
+     LEFT JOIN task_scope s ON s.task_id = t.id
+     WHERE tr.id IN (SELECT ref_id FROM members)) AS tasks
+    FROM flow f WHERE f.id = $flow`);
+    fingerprintStatements.set(store.handle, statement);
+    return statement;
+}
+/** What changes when anything on the canvas changes: metadata only, kept short and opaque. */
+export function flowFingerprint(store, flow, now = new Date()) {
+    // A revision can progress while its card still links to the original task,
+    // including a build in another project. The page read admits the viewer;
+    // this stream only carries a hash. No evidence files or logs are read.
+    const row = fingerprintStatement(store).get({ $flow: flow, $now: now.toISOString() });
     return row === undefined ? null : createHash("sha256").update(Object.values(row).map(String).join("|")).digest("hex").slice(0, 16);
 }
 export function createFlowRooms(fingerprint, tickMs = TICK_MS) {

package/dist/flows-ui.js

@@ -14,6 +14,8 @@ import { mailboxReady } from "./mailbox.js";
 import { labelOf, nameOf } from "./teammate-admin.js";
 import { callWords, receiptWords } from "./teammate-tools.js";
 import { undoFor } from "./teammate-week.js";
+import { flowCardTaskLine } from "./flow-card-task.js";
+import { readFlowSecrets } from "./flow-secrets.js";
 const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 const projectName = (repo) => repo.split(/[\\/]/).filter(Boolean).pop() ?? repo;
 export const FLOWS_CSS = `.flows{max-width:880px;min-width:0}.flows .card{padding:16px 18px;margin:12px 0}.flows .flow-row{display:flex;justify-content:space-between;align-items:baseline;gap:12px;flex-wrap:wrap}.flows .flow-row h2{font-size:1.05rem;margin:0}.flows .flow-counts{font-size:.85rem;color:var(--so-muted)}.flows form{display:grid;gap:10px;margin:0}.flows label{display:grid;gap:6px}.flows input,.flows select{box-sizing:border-box;width:100%;max-width:100%}.flows button{justify-self:start;min-height:44px}.flows .flow-fallback ol{padding-left:20px}.flows summary{cursor:pointer;min-height:44px;display:flex;align-items:center;font-weight:600}.flows .flow-buttons{display:flex;flex-wrap:wrap;align-items:center;gap:8px;margin:10px 0 0}.flows .flow-import{margin-top:18px;padding-top:14px;border-top:1px solid var(--so-line)}.flows .flow-import h3{font-size:.95rem;margin:0}.flows .flow-terms{list-style:none;padding:0;margin:8px 0 16px;display:grid;gap:10px}.flows .flow-terms li{white-space:pre-line;overflow-wrap:anywhere}.flows .flow-terms pre{white-space:pre-wrap;overflow-wrap:anywhere;font-size:.8rem;margin:6px 0 0}.flows .flow-import-preview h2{font-size:1rem;margin:20px 0 4px}.flows .flow-untrusted{font-weight:600}.flows button.primary{background:var(--primary);color:var(--primary-foreground);border-color:var(--primary)}.flows fieldset{border:0;padding:0;margin:0;display:grid;gap:10px;min-width:0}.flows legend{font-weight:600;padding:0;margin-bottom:6px}.flows textarea[hidden]{display:none}.flows button.secondary{background:transparent;color:var(--foreground);border:1px solid var(--border)}@media(max-width:600px){.flows input,.flows select{font-size:16px}}@media(max-width:760px){.flows .card{padding:10px 12px;margin:8px 0;position:relative}.flows .flow-row{row-gap:2px}.flows .flow-row h2 a::after{content:"";position:absolute;inset:0;border-radius:inherit}.flows .flow-counts{line-height:1.35}}`;
@@ -84,9 +86,19 @@ export function flowView(store, flow, viewer, selectedCard, setup = { dir: null,
     const sortZones = new Set(stages.filter(one => one.kind === "sort").map(one => one.id));
     const decisions = sortZones.size === 0 ? new Map() : store.flowSortDecisions(flow.id);
     const mates = new Map(store.teammates([flow.repo]).map(one => [one.id, one]));
+    const taskSecrets = new Map();
+    const secretsFor = (repo) => {
+        if (!taskSecrets.has(repo))
+            taskSecrets.set(repo, Object.values(readFlowSecrets(setup.dir, repo)));
+        return taskSecrets.get(repo);
+    };
+    const now = new Date();
     const cards = store.flowCards(flow.id, true).filter(card => card.state === "active" || Date.now() - Date.parse(card.updatedAt) < 7 * 86_400_000).map((card) => {
         const stage = stages.find(one => one.id === card.stage);
         const task = card.task ?? card.primaryTask;
+        // Build zones may file into another project; the flow alone does not admit its task's detail.
+        const taskRepo = card.task === null ? null : store.lookupRef(card.task)?.repo ?? null;
+        const canReadTask = taskRepo !== null && (taskRepo === flow.repo || (setup.repos.includes(taskRepo) && store.accountCanAccess(viewer.name, taskRepo)));
         const discussion = store.flowComments(card.id);
         const watchers = store.flowCardWatchers(card.id);
         const decider = stage?.kind === "approval" ? deciderOf(stage, flow) : null;
@@ -136,7 +148,9 @@ export function flowView(store, flow, viewer, selectedCard, setup = { dir: null,
             ...(content.items === undefined ? {} : { items: content.items.map((item, index) => ({ number: index + 1, title: item.title, lines: whyLines(item.why), source: item.source, url: item.url,
                     image: item.shot === null || content.shots === null ? null : { src: `/r/${content.shots.run}/evidence/${item.shot}`, caption: itemCaption(index + 1, item) } })) }) });
         return {
-            id: card.id, title: card.title, description: card.description, stage: card.stage, state: card.state, waiting: card.waiting,
+            id: card.id, title: card.title, description: card.description, stage: card.stage, state: card.state,
+            waiting: card.state === "active" && card.task !== null && (stage?.kind === "task" || stage?.kind === "report")
+                ? canReadTask ? flowCardTaskLine(store, card.task, taskRepo, now, secretsFor(taskRepo)) : "Task unavailable" : card.waiting,
             task: task === null ? null : { id: task, href: `/t/${encodeURIComponent(task)}` },
             createdBy: card.createdBy, updatedAt: card.updatedAt,
             canDecide,

package/dist/live.d.ts

@@ -25,6 +25,20 @@ export declare function liveDir(root: string): string;
 /** The exact filename, from the numeric id and nothing else — no user
  * input is ever parsed into this path. */
 export declare function liveLogPath(root: string, runId: number): string;
+/**
+ * The fixed tool vocabulary. Known harness tools map to OUR kinds and
+ * phrases; anything unrecognized gets the generic one. The tool's own
+ * name, arguments, and metadata never reach the file: a tool named after
+ * a secret stays unspoken.
+ */
+export type LiveActivityKind = "session" | "message" | "edit" | "command" | "read" | "search" | "lookup" | "plan" | "delegate" | "tool";
+export declare const LIVE_ACTIVITY_KINDS: readonly LiveActivityKind[];
+/**
+ * What one stream event says the agent just did, as one fixed kind: the
+ * last-activity line's only input. Never text, names or arguments; an
+ * event that says nothing (results, deltas, subagent chatter) is null.
+ */
+export declare function liveActivityKind(event: Record<string, unknown>): LiveActivityKind | null;
 /**
  * One stream event → zero or more display lines, in the fixed vocabulary.
  * Assistant TEXT is the agent's own words (sanitized below); tool use is a

package/dist/live.js

@@ -32,28 +32,77 @@ export function liveDir(root) {
 export function liveLogPath(root, runId) {
     return join(liveDir(root), `${Math.trunc(runId)}.log`);
 }
+export const LIVE_ACTIVITY_KINDS = ["session", "message", "edit", "command", "read", "search", "lookup", "plan", "delegate", "tool"];
+const TOOL_KINDS = new Map([
+    ["Edit", "edit"],
+    ["Write", "edit"],
+    ["MultiEdit", "edit"],
+    ["NotebookEdit", "edit"],
+    ["Bash", "command"],
+    ["Read", "read"],
+    ["Glob", "search"],
+    ["Grep", "search"],
+    ["LS", "read"],
+    ["WebFetch", "lookup"],
+    ["WebSearch", "lookup"],
+    ["TodoWrite", "plan"],
+    ["Task", "delegate"],
+]);
+const KIND_HEADLINES = {
+    session: "the agent session started",
+    message: "",
+    edit: "→ editing files",
+    command: "→ running a command",
+    read: "→ reading the code",
+    search: "→ searching the code",
+    lookup: "→ looking something up",
+    plan: "→ organizing its plan",
+    delegate: "→ delegating to a helper",
+    tool: "→ using a tool",
+};
+const toolKind = (name) => TOOL_KINDS.get(typeof name === "string" ? name : "") ?? "tool";
 /**
- * The fixed tool-headline vocabulary. Known harness tools map to OUR
- * phrases; anything unrecognized gets the generic line. The tool's own
- * name, arguments, and metadata never reach the file: a tool named after
- * a secret stays unspoken.
+ * What one stream event says the agent just did, as one fixed kind: the
+ * last-activity line's only input. Never text, names or arguments; an
+ * event that says nothing (results, deltas, subagent chatter) is null.
  */
-const TOOL_HEADLINES = new Map([
-    ["Edit", "→ editing files"],
-    ["Write", "→ editing files"],
-    ["MultiEdit", "→ editing files"],
-    ["NotebookEdit", "→ editing files"],
-    ["Bash", "→ running a command"],
-    ["Read", "→ reading the code"],
-    ["Glob", "→ searching the code"],
-    ["Grep", "→ searching the code"],
-    ["LS", "→ reading the code"],
-    ["WebFetch", "→ looking something up"],
-    ["WebSearch", "→ looking something up"],
-    ["TodoWrite", "→ organizing its plan"],
-    ["Task", "→ delegating to a helper"],
-]);
-const TOOL_HEADLINE_GENERIC = "→ using a tool";
+export function liveActivityKind(event) {
+    try {
+        const type = String(event["type"] ?? "");
+        if ((type === "system" && String(event["subtype"] ?? "") === "init") || type === "thread.started" || type === "init")
+            return "session";
+        if (type === "item.completed") {
+            const item = event["item"];
+            const kind = item === undefined || item === null ? "" : String(item["type"] ?? "");
+            return kind === "agent_message" ? "message" : kind === "command_execution" ? "command" : kind === "file_change" ? "edit" : kind === "web_search" ? "lookup" : null;
+        }
+        if (type === "message")
+            return String(event["role"] ?? "") === "assistant" && event["delta"] !== true ? "message" : null;
+        if (type === "tool_call" || type === "tool_use")
+            return toolKind(event["name"] ?? event["tool"]?.["name"]);
+        if (type !== "assistant")
+            return null;
+        const parent = event["parent_tool_use_id"];
+        if (parent !== undefined && parent !== null)
+            return null;
+        const content = event["message"]?.["content"];
+        if (!Array.isArray(content))
+            return null;
+        let last = null;
+        for (const block of content) {
+            if (block === null || typeof block !== "object")
+                continue;
+            if (block["type"] === "tool_use")
+                last = toolKind(block["name"]);
+            else if (block["type"] === "text" && typeof block["text"] === "string" && block["text"].trim() !== "")
+                last = "message";
+        }
+        return last;
+    }
+    catch {
+        return null;
+    }
+}
 /** Strip ANSI escapes and every control character; tabs become spaces. */
 function stripControls(text) {
     return text
@@ -108,7 +157,7 @@ export function renderTranscriptLines(event) {
     }
     if (type === "tool_call" || type === "tool_use") {
         const name = event["name"] ?? event["tool"]?.["name"];
-        return [TOOL_HEADLINES.get(typeof name === "string" ? name : "") ?? TOOL_HEADLINE_GENERIC];
+        return [KIND_HEADLINES[toolKind(name)]];
     }
     if (type !== "assistant")
         return [];
@@ -136,7 +185,7 @@ export function renderTranscriptLines(event) {
         }
         else if (kind === "tool_use") {
             const name = block["name"];
-            lines.push(TOOL_HEADLINES.get(typeof name === "string" ? name : "") ?? TOOL_HEADLINE_GENERIC);
+            lines.push(KIND_HEADLINES[toolKind(name)]);
         }
     }
     return lines;

package/dist/operate.js

@@ -90,7 +90,7 @@ import { openStore, openStoreNoMigrate, CONCURRENT_WRITER_WAIT_MS, isDatabaseBus
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import { authorizePlanUnderMode } from "./plan-auto.js";
 import { ghDispatchAdapter, mirrorTaskId, syncPass } from "./sync.js";
-import { sweepLiveLogs } from "./live.js";
+import { LIVE_FILE_BOUND, LIVE_RETAIN_MS, sweepLiveLogs } from "./live.js";
 import { configPath, addRepos, removeRepos, updateRepos, loadRepos, loadProjectRegistry, updateProjectRegistry } from "./repos.js";
 import { deleteProject, holdingsWords, projectHoldings, projectRunning } from "./project-delete.js";
 import { pushPass } from "./push.js";
@@ -4671,6 +4671,11 @@ async function reconcileCommand(flags, context) {
     // day, orphans on mtime, active runs untouchable. Never evidence, never
     // load-bearing — a sweep that finds nothing is the common case.
     const liveSwept = sweepLiveLogs(store, context.evidenceRoot, clock());
+    // What each agent did last goes by the same rules, from its own row.
+    try {
+        store.sweepRunActivity(clock(), LIVE_RETAIN_MS, LIVE_FILE_BOUND);
+    }
+    catch { /* display state: the next pass sweeps */ }
     const worktrees = new WorktreePool(store, {
         root: pool,
         ...(context.gitRunner === undefined ? {} : { runner: context.gitRunner }),

package/dist/planner.js

@@ -31,6 +31,7 @@ import { TOKEN_ENVS as TELEGRAM_TOKEN_ENVS } from "./telegram.js";
 import { evidenceRoot, mailboxName, planFileName, quarantineMailboxes, readMailbox, storeEvidence, writeEvidenceFile, } from "./evidence.js";
 import { MARKER as LEASE_MARKER } from "./worktree.js";
 import { openLiveLog } from "./live.js";
+import { withRunActivity } from "./task-activity.js";
 import { proveTreeUntouched, snapshotIgnored } from "./tree-proof.js";
 import { CLAUDE_LIMITS, ACCEPTANCE_LIMITS } from "./scope.js";
 import { normalizeStructuredJson, storeStructuredAttempt, validationErrorsJson, STRUCTURED_REPAIR_ATTEMPTS, STRUCTURED_REPAIR_MAX_TURNS, STRUCTURED_REPAIR_TIMEOUT_MS, } from "./structured-output.js";
@@ -590,7 +591,7 @@ export async function plan(store, request) {
     }
     // The live window (peek): the same transcript file the builder keeps,
     // so `toolroll peek` and the run page can watch this session too.
-    const liveLog = openLiveLog(root, request.runId);
+    const liveLog = withRunActivity(openLiveLog(root, request.runId), store, request.runId, clock);
     // The durable run row, not a caller's duplicate options, is the route
     // every correction inherits.
     const provider = logicalRun.provider;
@@ -730,7 +731,7 @@ export async function plan(store, request) {
             ...(agent === undefined ? {} : { runner: agent }),
             ...(request.onProviderSpawn === undefined ? {} : { onSpawn: request.onProviderSpawn }),
             clock,
-            ...(liveLog === null ? {} : { onStreamEvent: (event) => liveLog.observe(event) }),
+            onStreamEvent: (event) => liveLog.observe(event),
         });
         const firstProof = await proveAfterInvocation();
         if (firstProof !== null)
@@ -883,7 +884,7 @@ export async function plan(store, request) {
                     ...(agent === undefined ? {} : { runner: agent }),
                     ...(request.onProviderSpawn === undefined ? {} : { onSpawn: request.onProviderSpawn }),
                     clock,
-                    ...(liveLog === null ? {} : { onStreamEvent: (event) => liveLog.observe(event) }),
+                    onStreamEvent: (event) => liveLog.observe(event),
                 });
             }
             catch (error) {

package/dist/serve.d.ts

@@ -274,6 +274,11 @@ type Chrome = {
     scope?: "all" | "project" | "board-all";
     /** The saturated inbox count — never a sum of unbounded list reads. */
     inboxCount: number;
+    /** The project the Tasks count covers: the request's own project view
+     * (the open project, or /work's ?project=), null for every admitted project. */
+    inboxProject?: string | null;
+    /** The Tasks badge's words, naming what it covers: "3 need you in shop". */
+    inboxLabel?: string;
     inboxSaturated: boolean;
     settings: boolean;
     /** This database is a demo sandbox: banner every page, spend fenced. */