toolroll 0.9.46 → 0.9.48

package/dist/serve.js

@@ -8,7 +8,7 @@ import { projectBatchChecks, setProjectBatchChecks } from './batch-policy.js';
 import { CHECK_LEVEL_WORDS, isCheckLevel, liveQuickCommand, projectCheckLevel, quickVerifyKey, setProjectCheckLevel, suggestQuickCommand } from './check-levels.js';
 import { repositoryContextHtml } from './repository-context-ui.js';
 import { browserAssetsAvailable, browserWorkspaceDocument, serveBrowserAsset } from './browser-shell.js';
-import { browserCrewOf, browserCrewFromIndex, browserWorkActionHref, browserProjectsOf, browserNavigationOf } from './browser-workspace.js';
+import { browserCrewOf, browserCrewFromIndex, browserWorkActionHref, browserProjectsOf, browserNavigationOf, needsYouLabelOf } from './browser-workspace.js';
 import { configureLeadFollow, leadFollowStatus, runLeadFollowPass } from './lead-follow.js';
 import { cancelCommitment, conditionWords, openCommitments } from './lead-commitments.js';
 import { startMaintenance } from './maintenance.js';
@@ -44,6 +44,9 @@ import { addRoutine, removeRoutine, runRoutine } from "./teammate-desk.js";
 import { sendTeammateWeeklies, undoCall } from "./teammate-week.js";
 import { answerTeammateQuestion } from "./teammate-work.js";
 import { createFlowRooms, flowFingerprint } from "./flow-live.js";
+import { createLiveBus, followWorkspace } from "./live-bus.js";
+import { createTaskRooms, taskFingerprint } from "./task-live.js";
+import { runActivityOf } from "./task-activity.js";
 import { disconnectGoogle, finishGoogleConsent, GOOGLE_CALLBACK, googleConnected, googleConsent, readGoogleMail, saveGoogleClient } from "./google-mail.js";
 import { mailboxAccess, readThroughImap } from "./mailbox.js";
 import { readEmailSettings, saveEmailSettings, sendingAccount, sendThroughServer, setFlowSecret } from "./flow-actions.js";
@@ -240,6 +243,7 @@ import { createIntegrationMonitor } from "./integrations.js";
 import { BACKUP_CSS, backupHtml } from "./backup-ui.js";
 import { BACKUP_EVERY_HOURS, MAX_KEEP, backupFolderOf, backupNow, checkBackupFolder, defaultBackupFolder } from "./backup.js";
 import { prometheusMetrics } from "./metrics.js";
+import { healthWords, instrumentRequest } from "./server-telemetry.js";
 import { SPEND_CSS, spendCsv, spendHtml } from "./spend-ui.js";
 import { RETENTION_CSS, retentionHtml } from "./retention-ui.js";
 import { STORAGE_CSS, storageHtml } from "./storage-ui.js";
@@ -289,6 +293,7 @@ import { installMethod } from "./install-method.js";
 import { PACKAGE_VERSION } from "./version.js";
 import { updateNoticeWords } from "./update-notice.js";
 import { whenHtml } from "./when-html.js";
+import { ReadExecutor, attachReadExecutor, defaultReadWorkers } from "./read-executor.js";
 const SESSION_COOKIE = "standing-orders_session";
 /** Stands in for "no project" in a ceiling: no folder resolves to it, so it admits nothing. */
 const NO_PROJECT = "/\0no-project";
@@ -458,6 +463,11 @@ export function createDecisionServer(options) {
         }
     }
     const clock = options.clock ?? (() => new Date());
+    // Heavy reads (the work index behind `task list`) run on read-only worker connections, off the request loop.
+    const readFile = store.isDemo() ? null : store.databaseFile();
+    const readWorkers = options.readWorkers ?? (process.env["VITEST"] !== undefined ? 0 : defaultReadWorkers());
+    const reads = readFile === null || readWorkers < 1 ? null : new ReadExecutor(readFile, readWorkers);
+    const detachReads = reads === null ? () => { } : attachReadExecutor(store, reads);
     /** Task checkouts, for Settings → Storage: the pool's own root, or the folder beside the database. */
     const storagePool = (databaseFile) => new WorktreePool(store, { root: options.poolRoot ?? join(dirname(databaseFile), "worktrees") });
     const install = installMethod(options.installBin);
@@ -748,7 +758,11 @@ export function createDecisionServer(options) {
     /** One-click connections on their way: the service's sign-in page and back, 15 minutes at most. */
     const connectVisits = new Map();
     /** Flows open in a browser (v88): who's here, and a nudge when one changes. */
-    const flowRooms = createFlowRooms(flow => flowFingerprint(store, flow));
+    // Live views push on write (live-bus.ts): the revision triggers move, the rooms hear it.
+    const liveBus = createLiveBus();
+    const liveFollower = followWorkspace(store, () => workspaceRevision.current(), liveBus, { file: store.databaseFile() });
+    const flowRooms = createFlowRooms(flow => flowFingerprint(store, flow), { bus: liveBus });
+    const taskRooms = createTaskRooms(root => taskFingerprint(store, root, clock()), { bus: liveBus });
     const teamChatProvider = () => { const enabled = chatEnablement(); return enabled.ok ? { config: enabled.config, key: enabled.key } : null; };
     const team = createTeamRuntime({ store, repos: codingProjects, evidenceRoot, clock, workspaceRevision,
         ...(options.chatFetcher ? { fetcher: options.chatFetcher } : {}),
@@ -838,6 +852,7 @@ export function createDecisionServer(options) {
     /** The task behind a resource, for the ceiling check; null = no ref (visible). */
     const taskRepoOf = (taskRef) => store.refForId(taskRef)?.repo ?? null;
     const server = createServer((request, response) => {
+        instrumentRequest(store.telemetry, request, response);
         void handle(request, response).catch(error => {
             // Every unhandled error is logged (v99): the path and the message, never the request's body or query.
             logEvent("error", "serve.error", { method: request.method, path: redactedPath(new URL(request.url ?? "/", "http://placeholder").pathname), error: error instanceof Error ? error.message : String(error) });
@@ -854,6 +869,8 @@ export function createDecisionServer(options) {
             }
         });
     });
+    server.once('listening', () => store.telemetry.start());
+    server.once('close', () => store.telemetry.stop());
     // --public-url (arc 3): validated to EXACTLY an https origin. Its host
     // joins the allowed set, its origin authorizes POSTs, and cookies turn
     // Secure. Anything malformed refuses at startup, loudly.
@@ -1831,9 +1848,9 @@ export function createDecisionServer(options) {
         }
         const read = new Set(["/settings/flows", "/settings/skills", "/settings/knowledge", "/settings", "/settings/learning", "/recipes", "/recipes/run", "/recipes/start", "/recipes/new", "/recipes/edit", "/recipes/from-task", "/recipes/preview", "/recipes/export", "/", "/inbox", "/work", "/projects", "/people", "/ledger", "/ledger/export", "/next", "/board", "/tasks", "/tasks/new", "/runs", "/review", "/done", "/routines", "/menu"]);
         const write = new Set(["/settings/flows/on", "/settings/skills/import", "/settings/skills/change", "/settings/skills/revise", "/settings/knowledge/change", "/settings/knowledge/refresh", "/settings/learning/change", "/recipes/prepare", "/recipes/preview", "/recipes/import", "/recipes/save", "/recipes/launch", "/projects/select", "/tasks/add", "/routines/add"]);
-        const task = matchTaskPath(path, request.method === "GET" ? "(/evidence)?$" : "/(hold|unhold|requeue|cancel|scope|approve|plan|plan-edit|next|reopen|steer|accept-proof|accept-revision|reject-revision|route|retry-review|complete|merge|confirm-stopped|stop|resume-arm|resume)$");
+        const task = matchTaskPath(path, request.method === "GET" ? "(/evidence|/live)?$" : "/(hold|unhold|requeue|cancel|scope|approve|plan|plan-edit|next|reopen|steer|accept-proof|accept-revision|reject-revision|route|retry-review|complete|merge|confirm-stopped|stop|resume-arm|resume)$");
         const resource = request.method === "GET"
-            ? /^\/(?:r|d)\/[0-9]{1,15}(?:\/evidence\/[0-9]{1,15})?$/.test(path) || /^\/routines\/[0-9]{1,15}$/.test(path) || path === "/flows" || /^\/flows\/[0-9]{1,15}(\/insights|\/export|\/runs\/[0-9]{1,15}\/[0-9]{1,15})?$/.test(path) || path === "/flows/new" || /^\/flows\/new\/[a-z-]{1,40}$/.test(path)
+            ? /^\/(?:r|d)\/[0-9]{1,15}(?:\/evidence\/[0-9]{1,15})?$/.test(path) || /^\/routines\/[0-9]{1,15}$/.test(path) || path === "/flows" || /^\/flows\/[0-9]{1,15}(\/insights|\/export|\/live|\/runs\/[0-9]{1,15}\/[0-9]{1,15})?$/.test(path) || path === "/flows/new" || /^\/flows\/new\/[a-z-]{1,40}$/.test(path)
             : /^\/d\/[0-9]{1,15}\/answer$/.test(path) || /^\/routines\/[0-9]{1,15}\/(approve|refresh|pause|resume|run-now)$/.test(path) || path === "/flows/new" || /^\/flows\/new\/[a-z-]{1,40}$/.test(path) || path === "/flows/import" || /^\/flows\/[0-9]{1,15}\/(save|cards|archive|scripts)$/.test(path) || /^\/flows\/[0-9]{1,15}\/cards\/[0-9]{1,15}\/(move|decide|cancel|comment|assign|watch)$/.test(path) || /^\/flows\/[0-9]{1,15}\/triggers(\/[0-9]{1,15}\/(pause|resume|remove|check|press|renew|secret|share|unshare))?$/.test(path) || /^\/r\/[0-9]{1,15}\/(note|comment|revise|draft-repair|checks|add-tests)$/.test(path);
         if (!(request.method === "GET" ? read : write).has(path) && task === null && !resource) {
             refuse(response, who, 403, "This area requires instance access. Your account operates within its assigned projects.", "/projects");
@@ -1891,6 +1908,10 @@ export function createDecisionServer(options) {
             }
             project = wanted;
         }
+        // Every page's Tasks count covers this one project view, whatever project the page itself shows.
+        const facts = requestContext.getStore();
+        if (facts !== undefined)
+            facts.lens = project;
         // Exact result links carry their own read context. Check the stored
         // placement against both account and instance access before using it;
         // viewing a result never changes the session's selected project, and
@@ -1975,7 +1996,7 @@ export function createDecisionServer(options) {
             url.pathname !== "/menu" &&
             url.pathname !== "/recipes" &&
             // A flow names its own project; the list spans every project.
-            url.pathname !== "/flows" && url.pathname !== "/flows/import" && !/^\/flows\/[0-9]{1,15}(\/insights|\/export|\/runs\/[0-9]{1,15}\/[0-9]{1,15})?$/.test(url.pathname) &&
+            url.pathname !== "/flows" && url.pathname !== "/flows/import" && !/^\/flows\/[0-9]{1,15}(\/insights|\/export|\/live|\/runs\/[0-9]{1,15}\/[0-9]{1,15})?$/.test(url.pathname) &&
             // The gallery (Flows → New) asks for its project on each template's page.
             url.pathname !== "/flows/new" && !/^\/flows\/new\/[a-z-]{1,40}$/.test(url.pathname) &&
             // Teammates (v92) name their own project, like flows.
@@ -1983,7 +2004,7 @@ export function createDecisionServer(options) {
             // New work names its project in the form (a dropdown of known
             // projects); /tasks/add still admits the posted repo on its own.
             url.pathname !== "/tasks/new" && url.pathname !== "/tasks/add" &&
-            !/^\/t\/[^/]+(\/evidence)?$/.test(url.pathname) &&
+            !/^\/t\/[^/]+(\/evidence|\/live)?$/.test(url.pathname) &&
             !/^\/r\/[0-9]{1,15}(?:\/evidence\/[0-9]{1,15})?$/.test(url.pathname) &&
             !url.pathname.startsWith("/d/") && !url.pathname.startsWith("/contest/") &&
             url.pathname !== "/projects" &&
@@ -1993,7 +2014,7 @@ export function createDecisionServer(options) {
             url.pathname !== "/lead/status" && url.pathname !== "/onboarding/phone/dismiss" &&
             !url.pathname.startsWith("/chat/demo/") &&
             !/^\/chat\/action\/[0-9]{1,15}$/.test(url.pathname) &&
-            !url.pathname.startsWith("/settings") && url.pathname !== "/logout" && url.pathname !== "/people" && url.pathname !== "/ledger" && url.pathname !== "/ledger/export" && url.pathname !== "/metrics" && url.pathname !== "/spend" && url.pathname !== "/spend/budget" &&
+            !url.pathname.startsWith("/settings") && url.pathname !== "/logout" && url.pathname !== "/people" && url.pathname !== "/ledger" && url.pathname !== "/ledger/export" && url.pathname !== "/metrics" && url.pathname !== "/health" && url.pathname !== "/spend" && url.pathname !== "/spend/budget" &&
             !(url.pathname === "/board" && url.searchParams.get("scope") === "all");
         if (needsProject)
             return redirect(response, `/projects?return=${encodeURIComponent(safeReturn(url.pathname + url.search))}`);
@@ -2276,6 +2297,8 @@ export function createDecisionServer(options) {
             const docked = projectThread === null ? null : dockedConversation(who, null, projectThread, now, `/work?project=${encodeURIComponent(projectThread)}`);
             if (docked !== null)
                 page.workspace = { ...page.workspace, conversation: docked, pageHtml: page.body };
+            // Without a docked chat the list reads itself: 10 s while any of its tasks is building, else 30 s.
+            page.refreshSeconds = work.totals.running > 0 ? 10 : 30;
             return sendScreen(response, 200, page);
         }
         if (url.pathname === "/next") {
@@ -3057,6 +3080,26 @@ export function createDecisionServer(options) {
             const chrome = chromeFor(project, "tasks");
             return sendScreen(response, 200, newTaskPage(chrome, project, csrf, revision, null, chainable, store.permissionDefault().mode, store.qualityDefault().mode, chrome.projects ?? []));
         }
+        const taskLive = matchTaskPath(url.pathname, "/live$");
+        if (taskLive !== null) {
+            // The live task page: a nudge the moment the task changes, and who else
+            // has it open. Hints only — the page reads the task the usual way.
+            if (who.via !== "cookie")
+                return respond(response, 403, "application/json", JSON.stringify({ error: "session" }));
+            const family = familyOf(taskLive.taskId);
+            if (family === null || family.problem !== null)
+                return respond(response, 404, "application/json", JSON.stringify({ error: "task" }));
+            response.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-store", "x-content-type-options": "nosniff", "x-accel-buffering": "no" });
+            const name = who.name, repo = family.root.repo;
+            taskRooms.join(family.root.id, {
+                name, response,
+                // Rechecked while open, from the cookie and the account (never a request's context): a sign-out or a narrowed account stops it.
+                valid: () => { const again = identify(request, false); return again !== null && again.name === name && rowVisible(liveCeiling(), repo) && store.accountCanAccess(name, repo); },
+            });
+            request.once("close", () => { if (!response.writableEnded)
+                response.end(); });
+            return;
+        }
         const task = matchTaskPath(url.pathname, "");
         if (task !== null) {
             const family = familyOf(task.taskId);
@@ -3841,7 +3884,8 @@ export function createDecisionServer(options) {
             // Console v2: the landing's live view (who is working, four counts, Catch up in tabs).
             const home = focusTask === null && chatProject === null && !roomId ? chatHomeOf(who, repos, now) : null;
             const withFirstRun = (shown) => firstRun === undefined && phone === undefined && home === null ? shown
-                : { ...shown, workspace: { ...shown.workspace, ...(firstRun === undefined ? {} : { firstRun }), ...(phone === undefined ? {} : { phone }), ...(home === null ? {} : { home }) } };
+                : { ...shown, ...(home === null ? {} : { refreshSeconds: liveRefreshSeconds() }),
+                    workspace: { ...shown.workspace, ...(firstRun === undefined ? {} : { firstRun }), ...(phone === undefined ? {} : { phone }), ...(home === null ? {} : { home }) } };
             if (enabled.ok && mateSession !== null && principal !== null && !ceilingStale) {
                 {
                     const said = takeMateNote(who.session.csrf, mateSession.id);
@@ -4196,6 +4240,14 @@ export function createDecisionServer(options) {
             return sendScreen(response, 200, screen("Data", `<p><a href="/settings">Settings</a></p><h1>Data</h1>${dataExportHtml(who.session.csrf, { problem: url.searchParams.get("problem") })}`, { chrome: chromeFor(project, "settings") }));
         }
         // v104: Prometheus metrics, for an instance operator (a scraper sends one's API token).
+        if (url.pathname === "/health") {
+            if (!store.isInstanceOperator(who.name))
+                return refuse(response, who, 403, "An instance operator reads server health.", "/");
+            const health = store.telemetry.snapshot();
+            return request.headers.accept?.includes('application/json')
+                ? respond(response, 200, 'application/json; charset=utf-8', JSON.stringify(health))
+                : respond(response, 200, 'text/plain; charset=utf-8', `${healthWords(health)}\n`);
+        }
         if (url.pathname === "/metrics") {
             if (!store.isInstanceOperator(who.name))
                 return refuse(response, who, 403, "An instance operator reads metrics.", "/");
@@ -5173,17 +5225,24 @@ export function createDecisionServer(options) {
             catch {
                 notices.push('Crew updates are unavailable. Open Tasks to inspect saved work.');
             }
-            // "Wake me only for these": the navigation carries the count of tasks
-            // waiting on a person behind its Tasks link — the open project's, or
-            // everything this person may see — so it matches that page's Needs you tab.
-            let needsYou = 0;
+            // A running row says what its agent did last, and when (the task page's own line).
             try {
-                needsYou = (requestFacts.workCounts ?? workCountsByProject(store, clock(), workAccess()))
-                    .filter(one => s.chrome?.project == null || one.repo === s.chrome.project).reduce((sum, one) => sum + one.totals['needs-you'], 0);
-            }
-            catch {
-                needsYou = 0;
-            }
+                const now = clock(), live = new Map();
+                if (crew.crew.length > 0)
+                    for (const run of store.liveRuns(now)) {
+                        const root = familyOf(run.taskId)?.root.id;
+                        if (root !== undefined && !live.has(root))
+                            live.set(root, runActivityOf(store, run, now));
+                    }
+                if (live.size > 0)
+                    crew = { ...crew, crew: crew.crew.map(item => { const activity = live.get(item.id); return activity === undefined ? item : { ...item, activity }; }) };
+            }
+            catch { /* the rows keep their status; the line returns on the next read */ }
+            // "Wake me only for these": the navigation carries the sidebar's own
+            // Tasks count (chromeFor) and links to the project view it covers, so
+            // it matches that page's Needs you tab on every screen.
+            const needsYou = s.chrome.inboxCount;
+            const tasksProject = s.chrome.inboxProject === undefined ? s.chrome.project : s.chrome.inboxProject;
             // The person's own project and task conversations (v77), for the
             // sidebar's chat list; a thread whose project is out of view is left out.
             let chats = [];
@@ -5219,7 +5278,7 @@ export function createDecisionServer(options) {
                 catchUpHtml: extras.catchUpHtml ?? '', controlsHtml: extras.controlsHtml ?? '', notices, view: extras.view ?? null,
                 ...(s.chrome.demo ? { demo: { text: DEMO_BANNER, short: DEMO_BANNER_SHORT } } : {}),
                 pageHtml: extras.pageHtml === undefined ? (conversation === null ? pageHtml : null) : extras.pageHtml,
-                navigation: [...browserNavigationOf(currentPath, s.chrome.project, needsYou), { label: 'Workspace tools', href: '/menu', active: path.pathname === '/menu' }],
+                navigation: [...browserNavigationOf(currentPath, s.chrome.project, needsYou, tasksProject, s.chrome.inboxLabel), { label: 'Workspace tools', href: '/menu', active: path.pathname === '/menu' }],
                 chats,
                 ...(s.refreshSeconds === undefined ? {} : { refreshSeconds: Math.max(5, Math.floor(s.refreshSeconds)) }),
                 ...(s.chrome.signIn === undefined ? {} : { signIn: s.chrome.signIn }),
@@ -5274,12 +5333,6 @@ export function createDecisionServer(options) {
         // functional script polls.
         return page(response, status, html, nonce, s.functional?.fetches === true || chromeLayer || sensitiveChrome !== "");
     }
-    /** The badge cache: five seconds per project — mutations invalidate it. */
-    const badgeCache = new Map();
-    /** The needs-you count every surface wears for a project (workspace
-     * package 1): Work's own Needs-you membership, cached per viewer and
-     * project, so the rail, the phone tab, the scope bar, the project cards,
-     * the chat overview, and the Needs-you tab never disagree. */
     /** The Chat landing's live view: each agent at work now with its task and
      * phase, four counts, plan-window use (never dollars: subscriptions don't
      * bill per run) and Catch up's items, each tagged with its tab. Reads only. */
@@ -5289,7 +5342,8 @@ export function createDecisionServer(options) {
         const agents = store.liveRuns(now).filter(run => admitted(run.repo)).map(run => {
             const root = familyOf(run.taskId)?.root ?? null;
             return { runId: run.id, taskId: root?.id ?? run.taskId, title: root?.title ?? run.title, href: taskHref(root?.id ?? run.taskId),
-                agent: `${providerName(run.provider)} on ${run.runner}`, phase: homePhaseWords(run), project: run.repo === null ? null : projectName(run.repo), since: run.startedAt };
+                agent: `${providerName(run.provider)} on ${run.runner}`, phase: homePhaseWords(run), project: run.repo === null ? null : projectName(run.repo), since: run.startedAt,
+                activity: runActivityOf(store, run, now) };
         });
         const all = workIndexPage(store, now, access, { view: "all", limit: WORK_INDEX_MAX_LIMIT });
         const needs = workIndexPage(store, now, access, { view: "needs-you", limit: WORK_INDEX_MAX_LIMIT });
@@ -5323,19 +5377,13 @@ export function createDecisionServer(options) {
             planUse: (windows?.tiles ?? []).map(one => ({ name: one.name, window: one.window, percent: one.percent, detail: one.detail, tone: one.tone })),
         };
     }
+    /** The needs-you count every surface wears, read from this request's own
+     * Work counts (one query per request, never a cached earlier one), so a
+     * live page's badge and its Needs you tab always agree. */
     function needsYouBadge(project) {
-        const actor = requestContext.getStore()?.actor;
-        const key = `${actor ?? ""}:${actor === undefined ? "" : store.accountOf(actor)?.generation}:${project ?? ""}`;
-        const cached = badgeCache.get(key);
-        if (cached !== undefined && Date.now() - cached.at <= 5_000)
-            return cached;
-        const counted = needsYouCount(project);
-        const badge = { at: Date.now(), count: counted.count, saturated: counted.saturated };
-        badgeCache.set(key, badge);
-        return badge;
+        return needsYouCount(project);
     }
     const bustBadge = () => {
-        badgeCache.clear();
         paletteCache.clear();
     };
     /** The sidebar's facts for this request. */
@@ -5343,7 +5391,12 @@ export function createDecisionServer(options) {
         if (restricted() && !visible(project))
             project = null;
         const actor = requestContext.getStore()?.actor;
-        const badge = needsYouBadge(project);
+        // One Tasks count per request: Needs you in the request's project view
+        // (the open project, else every admitted project), never the page's own
+        // project — a flow or task in another project shows the same number.
+        const lens = requestContext.getStore()?.lens;
+        const inboxProject = lens !== undefined && (!restricted() || visible(lens)) ? lens : project;
+        const badge = needsYouBadge(inboxProject);
         const liveMode = project === null ? null : store.activeMode(project, clock());
         const liveModeTerms = liveMode === null ? null : modeTermsFromJson(liveMode.termsJson);
         let projectPeek = project === null ? null : undefined;
@@ -5383,6 +5436,9 @@ export function createDecisionServer(options) {
             ...(facts === undefined ? {} : { csrf: facts.csrf, returnTo: facts.returnTo }),
             inboxCount: badge.count,
             inboxSaturated: badge.saturated,
+            inboxProject,
+            inboxLabel: needsYouLabelOf(badge.count, inboxProject === null ? null
+                : store.listProjects().find(one => one.path === inboxProject)?.name ?? projectName(inboxProject), badge.saturated),
             settings: true,
             ...(store.isDemo() ? { demo: true } : {}),
             ...(() => { const signIn = signInNotices(store); return signIn.length === 0 ? {} : { signIn }; })(),
@@ -5436,6 +5492,10 @@ export function createDecisionServer(options) {
             .reduce((sum, one) => sum + one.totals['needs-you'], 0);
         return { count, saturated: false };
     }
+    /** A live page's own beat without a docked chat: 10 s while any admitted task is building, else 30 s. */
+    function liveRefreshSeconds() {
+        return projectCounts(clock()).some(one => one.totals.running > 0) ? 10 : 30;
+    }
     function projectFamilyPeek(repo, now) {
         const row = projectCounts(now).find(one => one.repo === repo);
         return { waiting: row?.totals['needs-you'] ?? 0, running: row?.totals.running ?? 0,
@@ -6239,6 +6299,9 @@ export function createDecisionServer(options) {
         // What went wrong reads the family's latest finished attempt, as the Tasks row does.
         presentedData.failure = failureOf(presentedData.family?.runs ?? data.runs, data.assignment ?? null);
         presentedData.runChecks = runChecksHere(data.assignment?.receipt?.runId ?? null, who, taskHref(taskId));
+        const liveRun = data.liveRunId == null ? undefined : data.runs.find(one => one.id === data.liveRunId);
+        if (liveRun !== undefined)
+            presentedData.activity = runActivityOf(store, liveRun, clock());
         presentedData.demo = store.isDemo();
         const paneProject = restricted() ? store.lookupRef(taskId)?.repo ?? null : who.via === "cookie" ? who.session.project : null;
         const page = taskPage(paneProject === null && !unscopedMode
@@ -6249,11 +6312,19 @@ export function createDecisionServer(options) {
         const docked = focus === null ? null : dockedConversation(who, focus, null, clock(), taskHref(focus.id));
         // The conversation is the page's own thread here, so the page drops its Ask tab;
         // only an approver is offered a road to message the agent.
-        const taskView = page.workspace?.view?.kind === "task" ? { ...page.workspace.view, ...(docked === null ? {} : { tabs: [] }), ...(who.role === "approver" ? {} : { chatHref: null }) } : page.workspace?.view;
+        const taskView = page.workspace?.view?.kind === "task" ? { ...page.workspace.view, ...(docked === null ? {} : { tabs: [] }), ...(who.role === "approver" ? {} : { chatHref: null }),
+            // A signed-in page hears the moment the task changes, and who else has it open.
+            ...(who.via === "cookie" ? { live: { href: `${taskHref(family?.root.id ?? taskId)}/live`, at: (() => { try {
+                        return taskFingerprint(store, family?.root.id ?? taskId, clock());
+                    }
+                    catch {
+                        return null;
+                    } })() } } : {}) } : page.workspace?.view;
         if (docked !== null)
             page.workspace = { ...page.workspace, ...(taskView === undefined ? {} : { view: taskView }), conversation: docked, pageHtml: page.body };
         else if (taskView !== undefined && page.workspace !== undefined)
             page.workspace = { ...page.workspace, view: taskView };
+        page.refreshSeconds = liveRefreshSeconds();
         return sendScreen(response, status, page);
     }
     /** The routine screen: the standing order restated, its verbs, its ledger. */
@@ -12509,7 +12580,10 @@ export function createDecisionServer(options) {
             stream.end();
         chatStreams.clear();
         flowRooms.close();
-        void Promise.all([closeCoding(), bounded(team.close()), bounded(leadMaintenance?.stop())]).then(() => closeServer(callback)).catch(error => {
+        taskRooms.close();
+        detachReads();
+        liveFollower.close();
+        void Promise.all([closeCoding(), bounded(team.close()), bounded(leadMaintenance?.stop()), bounded(reads?.close())]).then(() => closeServer(callback)).catch(error => {
             if (callback)
                 callback(error instanceof Error ? error : Error('Coding session shutdown failed.'));
             else
@@ -16781,9 +16855,9 @@ function shell(title, body, options = {}) {
     // destination it now lives under. The count rides Work: it is the
     // saturated needs-you count, exactly as the inbox row wore it.
     const primary = chrome.active === "code" ? "work" : primaryDestinationOf(chrome.active);
-    const primaryItem = (key, href, label, count) => `<a href="${href}" aria-label="${escape(label)}" title="${escape(label)}"${primary === key ? ' class="active" aria-current="page"' : ""}${key === "work" && count !== undefined ? ` data-waiting="${count}"` : ""}>` +
+    const primaryItem = (key, href, label, count) => `<a href="${href}" aria-label="${escape(key === "work" && count !== undefined && count > 0 && chrome.inboxLabel !== undefined ? `${label}, ${chrome.inboxLabel}` : label)}" title="${escape(label)}"${primary === key ? ' class="active" aria-current="page"' : ""}${key === "work" && count !== undefined ? ` data-waiting="${count}"` : ""}>` +
         `<span class="glyph">${NAV_ICONS[key] ?? ""}</span>${label}` +
-        `${count !== undefined && count > 0 ? ` <span class="count badge badge-open">${count}${chrome.inboxSaturated ? "+" : ""}</span>` : ""}</a>`;
+        `${count !== undefined && count > 0 ? ` <span${chrome.inboxLabel === undefined ? "" : ` aria-label="${escape(chrome.inboxLabel)}" title="${escape(chrome.inboxLabel)}"`} class="count badge badge-open">${count}${chrome.inboxSaturated ? "+" : ""}</span>` : ""}</a>`;
     const side = [
         `<aside class="side">`,
         `<div class="side-head"><a class="brand" href="${chrome.chat === true ? "/chat" : "/work"}"><span class="brand-long">Toolroll</span><span class="brand-short">T</span></a>`,
@@ -16869,7 +16943,7 @@ function shell(title, body, options = {}) {
     // A phone tab says THAT something waits, with a dot; the number is on
     // the Work views themselves (Linear Mobile's rule — one tap away).
     `<a href="${href}"${primary === key ? ' class="active" aria-current="page"' : ""}><span class="glyph">${TAB_ICONS[key]}</span>${label}` +
-        `${count !== undefined && count > 0 ? `<span class="dot-badge" role="img" aria-label="${count} waiting"></span>` : ""}</a>`;
+        `${count !== undefined && count > 0 ? `<span class="dot-badge" role="img" aria-label="${escape(chrome.inboxLabel ?? `${count} waiting`)}"></span>` : ""}</a>`;
     // Three primary tabs, the same three as the rail: chat where allowed,
     // work, projects. Tools and settings sit behind the header's menu action.
     const tabbar = [
@@ -22037,6 +22111,8 @@ function taskBodyParts(data) {
         retry,
         runChecks,
         progress,
+        // One quiet line under the step: what the agent did last, and when.
+        activity: liveRun === undefined ? null : data.activity ?? null,
         stop,
         record,
         earlier,

package/dist/server-telemetry.d.ts

@@ -0,0 +1,86 @@
+import type { BudgetLimit } from './request-budget.js';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+export declare const TELEMETRY_WINDOW_MS = 300000;
+export declare const LATENCY_BUCKETS: number[];
+export declare const ROUTE_FAMILIES: readonly ['cli', 'mcp', 'team', 'team-stream', 'chat', 'chat-stream', 'flows', 'flow-stream', 'tasks', 'results', 'decisions', 'sessions', 'settings', 'projects', 'assets', 'auth', 'metrics', 'health', 'console', 'other'];
+export type RouteFamily = typeof ROUTE_FAMILIES[number];
+export type StreamFamily = 'team-stream' | 'chat-stream' | 'flow-stream' | 'other';
+export declare const STREAM_FAMILIES: readonly StreamFamily[];
+export declare const QUEUE_BUCKETS: number[];
+/** Only literals from the allowlist can become labels, including for unknown or malformed paths. */
+export declare function routeFamily(raw: string): RouteFamily;
+type Counts = {
+    bins: number[];
+    count: number;
+    sum: number;
+    max: number;
+};
+export type LatencySummary = {
+    count: number;
+    p50Ms: number | null;
+    p99Ms: number | null;
+    maxMs: number | null;
+    totalMs: number;
+};
+/** Lifetime histogram plus a ring of ten-second slices. Cost and memory do not grow with traffic. */
+export declare class TimingHistogram {
+    private readonly clock;
+    readonly total: Counts;
+    private readonly slices;
+    constructor(clock: () => number);
+    observe(seconds: number, weight?: number): void;
+    private prune;
+    recent(): LatencySummary;
+}
+export type HealthSnapshot = {
+    version: 1;
+    windowSeconds: number;
+    uptimeSeconds: number;
+    requests: LatencySummary;
+    routes: Partial<Record<RouteFamily, LatencySummary>>;
+    eventLoop: LatencySummary;
+    writes: {
+        wait: LatencySummary;
+        hold: LatencySummary;
+        statement: LatencySummary;
+    };
+    streams: {
+        open: number;
+        queuedBytes: number;
+        maxQueuedBytes: number;
+    };
+    budgetRefusals: number;
+};
+export declare class ServerTelemetry {
+    readonly clock: () => number;
+    readonly requests: TimingHistogram;
+    readonly routes: Map<"assets" | "auth" | "chat" | "chat-stream" | "cli" | "console" | "decisions" | "flow-stream" | "flows" | "health" | "mcp" | "metrics" | "other" | "projects" | "results" | "sessions" | "settings" | "tasks" | "team" | "team-stream", TimingHistogram>;
+    readonly eventLoop: TimingHistogram;
+    readonly writeWait: TimingHistogram;
+    readonly writeHold: TimingHistogram;
+    readonly writeStatement: TimingHistogram;
+    readonly refusals: Map<string, number>;
+    private readonly recentRefusals;
+    private readonly streams;
+    private monitor;
+    private timer;
+    private readonly started;
+    constructor(clock?: () => number);
+    start(): void;
+    stop(): void;
+    /**
+     * Native nanosecond samples, folded into bounded buckets once a second, never one retained object per tick.
+     * Each raw sample includes the sampling timer's own interval, so it is subtracted: an idle loop reads near zero.
+     */
+    sampleEventLoop(): void;
+    budgetRefused(route: 'api' | 'mcp', reason: BudgetLimit | 'unavailable'): void;
+    private pruneRefusals;
+    observeRequest(family: RouteFamily, milliseconds: number): void;
+    openStream(response: ServerResponse, family: StreamFamily): void;
+    streamQueues(family?: StreamFamily): number[];
+    snapshot(): HealthSnapshot;
+}
+/** SSE latency is time to opening headers; a live view's lifetime is not request work. */
+export declare function instrumentRequest(telemetry: ServerTelemetry, request: IncomingMessage, response: ServerResponse): void;
+export declare function healthWords(health: HealthSnapshot): string;
+export {};