toolroll 0.9.53 → 0.9.55

package/dist/lead-context.d.ts

@@ -1,3 +1,13 @@
+/** Bounded DB memory shared by browser and terminal lead turns. No provider,
+ * repository scan, mutation, or hidden approval happens while catching up.
+ *
+ * The bundle is ordered by importance and built fresh each turn: who the lead
+ * is (name, persona), who it is talking to (first name, time zone, today), what
+ * it knows about them (their confirmed lines), the people, AI teammates and team
+ * chats it works with (one line each), the channel, what needs them now,
+ * projects by name with their active decisions, then the rest. Over 8 KB, the
+ * least important goes first: the rest, then people, then decisions. */
+import { type Html } from './html.js';
 import type { Store } from './store.js';
 import { type LeadChannel } from './contracts/lead-context.js';
 import { type AssignmentCatchUp } from './assignment-brief.js';
@@ -31,5 +41,5 @@ export declare function firstNameOf(account: string): string;
 export declare function leadChannelOf(label: string): LeadChannel | undefined;
 export declare function leadContext(store: Store, repos: readonly string[], now: Date, options?: LeadContextOptions): string;
 /** The same saved brief is useful before chat spending is authorized. */
-export declare function leadBriefHtml(brief: AssignmentCatchUp): string;
+export declare function leadBriefHtml(brief: AssignmentCatchUp): Html;
 export declare const LEAD_CONTEXT_CSS = ".lead-promise-list{list-style:none;margin:0;padding:0}.lead-promise-list li{display:grid;grid-template-columns:minmax(0,1fr) auto;column-gap:.75rem;align-items:center;padding:.5rem 0;border-bottom:1px solid var(--border);min-width:0}.lead-promise-list li:last-child{border-bottom:0}.lead-promise-list p{margin:0;overflow-wrap:anywhere}.lead-promise-list form{grid-column:2;grid-row:1/span 2;margin:0}.lead-promise-list button{min-height:44px;width:auto;white-space:nowrap}.lead-promise-list .nowrap{white-space:nowrap}.lead-brief{margin:1rem 0;min-width:0}.lead-brief h2{font-size:1.1rem;margin:0 0 .8rem}.repository-context input[name=q]{display:block;box-sizing:border-box;min-height:44px;width:100%;margin:.4rem 0 .75rem;padding:.6rem .75rem;border:1px solid var(--border);border-radius:8px;background:var(--surface);color:inherit;font:inherit}.repository-context form{margin:.5rem 0 1rem}.repository-context summary{min-height:44px;padding:.75rem 0;overflow-wrap:anywhere}.lead-brief h3{font-size:.85rem;margin:1rem 0 .4rem;color:var(--muted-foreground)}.lead-brief ul{list-style:none;margin:0;padding:0}.lead-brief li{display:grid;grid-template-columns:minmax(0,1fr) auto;column-gap:.75rem;align-items:center;padding:.35rem 0;border-bottom:1px solid var(--border);min-width:0}.lead-brief li a{display:flex;min-height:44px;align-items:center;font-weight:500;overflow-wrap:anywhere;text-decoration:none}.lead-brief li a:hover{text-decoration:underline}.lead-brief-state{font-size:.75rem;font-weight:600;padding:.15rem .5rem;border-radius:.375rem;background:var(--so-neutral-soft);color:var(--so-neutral-ink);white-space:nowrap}.lead-brief-state--needs-decision,.lead-brief-state--ready-to-check{background:var(--so-attention-soft);color:var(--so-attention)}.lead-brief-state--working,.lead-brief-state--checking{background:var(--so-info-soft);color:var(--so-info)}.lead-brief-state--complete{background:var(--so-success-soft);color:var(--so-success)}.lead-brief li a.lead-brief-act{grid-column:1/-1;justify-self:start;display:inline-flex;min-height:40px;margin:.15rem 0 .4rem;font-weight:600}@media(max-width:760px){.lead-brief li a.lead-brief-act{justify-self:stretch;justify-content:center;min-height:44px}}.lead-brief-detail{grid-column:1/-1;font-size:.85rem;color:var(--muted-foreground);overflow-wrap:anywhere;padding-bottom:.35rem}@media(max-width:760px){.lead-brief{margin:.5rem 0}.lead-brief h2{margin:0 0 .25rem}.lead-brief h3{margin:.5rem 0 0}.lead-brief li{padding:0 0 .375rem}.lead-brief-detail{margin-top:-.375rem;padding-bottom:0;line-height:1.35;pointer-events:none}}";

package/dist/lead-context.js

@@ -7,6 +7,7 @@
  * chats it works with (one line each), the channel, what needs them now,
  * projects by name with their active decisions, then the rest. Over 8 KB, the
  * least important goes first: the rest, then people, then decisions. */
+import { html } from './html.js';
 import { PLATFORM_LIMITS, TEXT_LIMITS } from './text-limits.js';
 import { LEAD_CONTEXT_COUNTS, leadContextSchema } from './contracts/lead-context.js';
 import { contractError } from './contracts/contract.js';
@@ -186,7 +187,6 @@ export function leadContext(store, repos, now, options = {}) {
         document = JSON.stringify(data);
     return document;
 }
-const escape = (value) => value.replace(/[&<>"']/g, char => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[char]);
 const STATE_WORDS = { 'needs-decision': 'Needs you', 'ready-to-check': 'Ready', working: 'Working', checking: 'Checking', complete: 'Complete', cancelled: 'Cancelled' };
 /** The same saved brief is useful before chat spending is authorized. */
 export function leadBriefHtml(brief) {
@@ -208,14 +208,12 @@ export function leadBriefHtml(brief) {
         const stateChip = (state, detail) => {
             // Replaced, never "Cancelled".
             const words = state === 'cancelled' && /^Replaced by \S+/.test(detail ?? '') ? detail.replace(/\.$/, '') : STATE_WORDS[state] ?? state;
-            return words === group.title ? '' : `<span class="lead-brief-state lead-brief-state--${state}">${escape(words)}</span>`;
+            return words === group.title ? '' : html `<span class="lead-brief-state lead-brief-state--${state}">${words}</span>`;
         };
-        return [`<section><h3>${group.title}</h3><ul>${entries.map(one => `<li><a href="/chat?task=${encodeURIComponent(one.rootId)}">${escape(one.title)}</a>` +
-                stateChip(one.state, one.detail) +
-                (quiet ? '' : `<span class="lead-brief-detail">${escape(publicChatText(one.detail || one.outcome || '', 160))}</span>`) +
-                // Needs you: the one action that resolves it, under its sentence.
-                (one.state === 'needs-decision' && one.nextAction !== null && one.nextHref ? `<a class="lead-brief-act button-link" href="${escape(one.nextHref)}" data-catch-up-action>${escape(one.nextAction.label)}</a>` : '') + `</li>`).join('')}</ul></section>`];
+        return [html `<section><h3>${group.title}</h3><ul>${entries.map(one => html `<li><a href="/chat?task=${encodeURIComponent(one.rootId)}">${one.title}</a>${stateChip(one.state, one.detail)}${quiet ? '' : html `<span class="lead-brief-detail">${publicChatText(one.detail || one.outcome || '', 160)}</span>`}${
+            // Needs you: the one action that resolves it, under its sentence.
+            one.state === 'needs-decision' && one.nextAction !== null && one.nextHref ? html `<a class="lead-brief-act button-link" href="${one.nextHref}" data-catch-up-action>${one.nextAction.label}</a>` : ''}</li>`)}</ul></section>`];
     });
-    return `<section class="lead-brief" aria-label="Project catch-up"><h2>Catch up</h2>${sections.length ? sections.join('') : '<p class="meta">Nothing needs you right now.</p>'}${brief.assignments.length > 3 || brief.omissions.candidateScanLimited || brief.omissions.assignments > 0 ? '<a href="/work">See all tasks</a>' : ''}</section>`;
+    return html `<section class="lead-brief" aria-label="Project catch-up"><h2>Catch up</h2>${sections.length ? sections : html `<p class="meta">Nothing needs you right now.</p>`}${brief.assignments.length > 3 || brief.omissions.candidateScanLimited || brief.omissions.assignments > 0 ? html `<a href="/work">See all tasks</a>` : ''}</section>`;
 }
 export const LEAD_CONTEXT_CSS = '.lead-promise-list{list-style:none;margin:0;padding:0}.lead-promise-list li{display:grid;grid-template-columns:minmax(0,1fr) auto;column-gap:.75rem;align-items:center;padding:.5rem 0;border-bottom:1px solid var(--border);min-width:0}.lead-promise-list li:last-child{border-bottom:0}.lead-promise-list p{margin:0;overflow-wrap:anywhere}.lead-promise-list form{grid-column:2;grid-row:1/span 2;margin:0}.lead-promise-list button{min-height:44px;width:auto;white-space:nowrap}.lead-promise-list .nowrap{white-space:nowrap}.lead-brief{margin:1rem 0;min-width:0}.lead-brief h2{font-size:1.1rem;margin:0 0 .8rem}.repository-context input[name=q]{display:block;box-sizing:border-box;min-height:44px;width:100%;margin:.4rem 0 .75rem;padding:.6rem .75rem;border:1px solid var(--border);border-radius:8px;background:var(--surface);color:inherit;font:inherit}.repository-context form{margin:.5rem 0 1rem}.repository-context summary{min-height:44px;padding:.75rem 0;overflow-wrap:anywhere}.lead-brief h3{font-size:.85rem;margin:1rem 0 .4rem;color:var(--muted-foreground)}.lead-brief ul{list-style:none;margin:0;padding:0}.lead-brief li{display:grid;grid-template-columns:minmax(0,1fr) auto;column-gap:.75rem;align-items:center;padding:.35rem 0;border-bottom:1px solid var(--border);min-width:0}.lead-brief li a{display:flex;min-height:44px;align-items:center;font-weight:500;overflow-wrap:anywhere;text-decoration:none}.lead-brief li a:hover{text-decoration:underline}.lead-brief-state{font-size:.75rem;font-weight:600;padding:.15rem .5rem;border-radius:.375rem;background:var(--so-neutral-soft);color:var(--so-neutral-ink);white-space:nowrap}.lead-brief-state--needs-decision,.lead-brief-state--ready-to-check{background:var(--so-attention-soft);color:var(--so-attention)}.lead-brief-state--working,.lead-brief-state--checking{background:var(--so-info-soft);color:var(--so-info)}.lead-brief-state--complete{background:var(--so-success-soft);color:var(--so-success)}.lead-brief li a.lead-brief-act{grid-column:1/-1;justify-self:start;display:inline-flex;min-height:40px;margin:.15rem 0 .4rem;font-weight:600}@media(max-width:760px){.lead-brief li a.lead-brief-act{justify-self:stretch;justify-content:center;min-height:44px}}.lead-brief-detail{grid-column:1/-1;font-size:.85rem;color:var(--muted-foreground);overflow-wrap:anywhere;padding-bottom:.35rem}@media(max-width:760px){.lead-brief{margin:.5rem 0}.lead-brief h2{margin:0 0 .25rem}.lead-brief h3{margin:.5rem 0 0}.lead-brief li{padding:0 0 .375rem}.lead-brief-detail{margin-top:-.375rem;padding-bottom:0;line-height:1.35;pointer-events:none}}';

package/dist/ledger-view.d.ts

@@ -1,4 +1,5 @@
 import type { LedgerEntry } from "./action-ledger.js";
+import { type Html } from "./html.js";
 /** v103: the chain's state in one line, and (for an instance operator) a checkpoint to copy off the machine. */
 export type LedgerChainView = {
     ok: boolean;
@@ -21,4 +22,4 @@ export type LedgerChainView = {
     /** Today (UTC, YYYY-MM-DD): the audit export's default range ends here. */
     today: string;
 };
-export declare function ledgerBody(rows: LedgerEntry[], projects: readonly string[], params: URLSearchParams, chain?: LedgerChainView): string;
+export declare function ledgerBody(rows: LedgerEntry[], projects: readonly string[], params: URLSearchParams, chain?: LedgerChainView): Html;

package/dist/ledger-view.js

@@ -1,23 +1,28 @@
 import { projectName } from "./project.js";
 import { exactWhenHtml } from "./when-html.js";
-const html = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+import { html, postForm, styleElement } from "./html.js";
 /** The ledger's kinds of event, as the filter names them. */
 const EVENT_KINDS = [["work", "Work"], ["request", "Requests"], ["access", "Access"], ["sign-in", "Sign-ins"], ["policy", "Policy changes"]];
 function chainHtml(chain) {
-    const html = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
     const status = chain.ok
-        ? `<p class="ledger-chain ok" data-ledger-chain="ok"><strong>Chain verified</strong> · ${chain.entries} entries through #${chain.through ?? 0} · head <code>${html(chain.head.slice(0, 16))}…</code>${chain.checkedAt === null ? "" : ` · checked in full ${html(chain.checkedAt.slice(11, 16))} UTC`}</p>`
-        : `<p class="ledger-chain problem" role="alert" data-ledger-chain="broken"><strong>Chain broken</strong> · ${html(chain.problem?.what ?? "the chain doesn't verify")}</p>`;
-    const latest = chain.latest === null ? "" : `<p class="meta ledger-checkpoint">Latest checkpoint (${html(chain.latest.at.slice(0, 16).replace("T", " "))} UTC), copy it somewhere outside this machine: <code class="ledger-checkpoint-value">${chain.latest.through}:${html(chain.latest.hash)}</code></p>`;
-    const make = chain.csrf === null ? "" : `<form method="post" action="/ledger/checkpoint" class="ledger-checkpoint-form"><input type="hidden" name="csrf" value="${html(chain.csrf)}"><button type="submit">Make a checkpoint</button></form>`;
+        ? html `<p class="ledger-chain ok" data-ledger-chain="ok"><strong>Chain verified</strong> · ${chain.entries} entries through #${chain.through ?? 0} · head <code>${chain.head.slice(0, 16)}…</code>${chain.checkedAt === null ? "" : ` · checked in full ${chain.checkedAt.slice(11, 16)} UTC`}</p>`
+        : html `<p class="ledger-chain problem" role="alert" data-ledger-chain="broken"><strong>Chain broken</strong> · ${chain.problem?.what ?? "the chain doesn't verify"}</p>`;
+    const latest = chain.latest === null ? "" : html `<p class="meta ledger-checkpoint">Latest checkpoint (${chain.latest.at.slice(0, 16).replace("T", " ")} UTC), copy it somewhere outside this machine: <code class="ledger-checkpoint-value">${chain.latest.through}:${chain.latest.hash}</code></p>`;
+    const make = chain.csrf === null ? "" : postForm("/ledger/checkpoint", html `<button type="submit">Make a checkpoint</button>`, { attrs: { class: "ledger-checkpoint-form" } });
     const start = new Date(Date.parse(`${chain.today}T00:00:00Z`) - 29 * 86_400_000).toISOString().slice(0, 10);
-    const exportForm = `<details class="ledger-filter-panel"><summary>Audit export</summary><form method="get" action="/ledger/export" class="ledger-filters ledger-export" aria-label="Audit export">` +
-        `<label>From<input type="date" name="from" value="${html(start)}" required></label><label>To<input type="date" name="to" value="${html(chain.today)}" required></label>` +
-        `<button type="submit">Download</button></form><p class="meta">Every entry in the range with its seal, and an evidence pack for each task it names. JSON.</p></details>`;
-    return `<section class="ledger-chain-panel" aria-label="Ledger integrity">${status}${latest}${make}${exportForm}</section>`;
+    const exportForm = html `<details class="ledger-filter-panel"><summary>Audit export</summary><form method="get" action="/ledger/export" class="ledger-filters ledger-export" aria-label="Audit export"><label>From<input type="date" name="from" value="${start}" required></label><label>To<input type="date" name="to" value="${chain.today}" required></label><button type="submit">Download</button></form><p class="meta">Every entry in the range with its seal, and an evidence pack for each task it names. JSON.</p></details>`;
+    return html `<section class="ledger-chain-panel" aria-label="Ledger integrity">${status}${latest}${make}${exportForm}</section>`;
 }
+const LEDGER_CSS = `
+.ledger-heading{display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap}.ledger-heading h1{margin:0}.ledger-caption{margin:8px 0 12px}
+.ledger-filter-panel{margin-bottom:12px}.ledger-filter-panel summary{font-size:13px;padding:6px 0;cursor:pointer}.ledger-filters{display:grid;grid-template-columns:repeat(5,minmax(0,1fr)) auto auto;gap:8px;align-items:end;margin:0 0 12px}.ledger-filters label{display:grid;gap:3px;min-width:0;font-size:12px}.ledger-filters input,.ledger-filters select{width:100%;min-width:0;box-sizing:border-box;margin:0;padding:6px 8px;font-size:13px}.ledger-filters button{padding:7px 12px}.ledger-filters>a{padding:8px 0;font-size:13px}
+.ledger-detail{display:block;color:var(--muted-foreground);font-size:12px}.ledger-list{border:1px solid var(--border);border-radius:8px;overflow:hidden}.ledger-event{display:grid;grid-template-columns:140px minmax(90px,1fr) minmax(160px,2fr) minmax(100px,1fr) minmax(100px,1fr);gap:8px;align-items:baseline;padding:7px 10px;border-bottom:1px solid var(--border);font-size:13px;line-height:1.4;overflow-wrap:anywhere}.ledger-event:last-child{border-bottom:0}.ledger-event .actor{color:inherit;font-weight:600;text-decoration:none}.ledger-time,.ledger-place,.ledger-result small{font-size:11px;color:var(--muted-foreground)}.ledger-time time{font-variant-numeric:tabular-nums}.ledger-place a{display:block}.ledger-result small{display:block}.ledger-labels{font-size:11px;color:var(--muted-foreground);font-weight:600}.ledger-empty{padding:12px}
+@media(max-width:1000px){.ledger-filters{grid-template-columns:repeat(3,minmax(0,1fr)) auto}.ledger-event{grid-template-columns:122px minmax(80px,1fr) minmax(130px,2fr) minmax(85px,1fr)}.ledger-place{grid-column:2/4}.ledger-result{grid-column:4;grid-row:1/3}.ledger-labels{display:none}}
+@media(max-width:600px){.ledger-filters{grid-template-columns:repeat(2,minmax(0,1fr))}.ledger-event{grid-template-columns:minmax(0,1fr) auto;gap:2px 8px;padding:8px 10px}.ledger-actor{grid-column:1;grid-row:1}.ledger-action{grid-column:1;grid-row:2}.ledger-result{grid-column:2;grid-row:1/3;text-align:right}.ledger-time{grid-column:1;grid-row:3}.ledger-place{grid-column:2;grid-row:3;text-align:right}.ledger-place a{display:inline}.ledger-heading>a{font-size:13px}}
+.ledger-chain-panel{margin:0 0 12px}.ledger-chain{margin:0 0 4px;font-size:13px}.ledger-chain.ok strong{color:var(--success)}.ledger-checkpoint code{overflow-wrap:anywhere;user-select:all}.ledger-checkpoint-form{margin:6px 0 0}.ledger-export{grid-template-columns:repeat(2,minmax(0,180px)) auto;margin-bottom:4px}
+`;
 export function ledgerBody(rows, projects, params, chain) {
-    const selected = (key, value) => params.get(key) === value ? " selected" : "";
+    const selected = (key, value) => params.get(key) === value ? html ` selected` : "";
     const more = rows.length > 50;
     const shown = rows.slice(0, 50);
     const fresh = new URLSearchParams();
@@ -31,29 +36,22 @@ export function ledgerBody(rows, projects, params, chain) {
         next.set("before", String(shown.at(-1).id));
     const csv = new URLSearchParams(fresh);
     csv.set("format", "csv");
-    return `<style>
-.ledger-heading{display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap}.ledger-heading h1{margin:0}.ledger-caption{margin:8px 0 12px}
-.ledger-filter-panel{margin-bottom:12px}.ledger-filter-panel summary{font-size:13px;padding:6px 0;cursor:pointer}.ledger-filters{display:grid;grid-template-columns:repeat(5,minmax(0,1fr)) auto auto;gap:8px;align-items:end;margin:0 0 12px}.ledger-filters label{display:grid;gap:3px;min-width:0;font-size:12px}.ledger-filters input,.ledger-filters select{width:100%;min-width:0;box-sizing:border-box;margin:0;padding:6px 8px;font-size:13px}.ledger-filters button{padding:7px 12px}.ledger-filters>a{padding:8px 0;font-size:13px}
-.ledger-detail{display:block;color:var(--muted-foreground);font-size:12px}.ledger-list{border:1px solid var(--border);border-radius:8px;overflow:hidden}.ledger-event{display:grid;grid-template-columns:140px minmax(90px,1fr) minmax(160px,2fr) minmax(100px,1fr) minmax(100px,1fr);gap:8px;align-items:baseline;padding:7px 10px;border-bottom:1px solid var(--border);font-size:13px;line-height:1.4;overflow-wrap:anywhere}.ledger-event:last-child{border-bottom:0}.ledger-event .actor{color:inherit;font-weight:600;text-decoration:none}.ledger-time,.ledger-place,.ledger-result small{font-size:11px;color:var(--muted-foreground)}.ledger-time time{font-variant-numeric:tabular-nums}.ledger-place a{display:block}.ledger-result small{display:block}.ledger-labels{font-size:11px;color:var(--muted-foreground);font-weight:600}.ledger-empty{padding:12px}
-@media(max-width:1000px){.ledger-filters{grid-template-columns:repeat(3,minmax(0,1fr)) auto}.ledger-event{grid-template-columns:122px minmax(80px,1fr) minmax(130px,2fr) minmax(85px,1fr)}.ledger-place{grid-column:2/4}.ledger-result{grid-column:4;grid-row:1/3}.ledger-labels{display:none}}
-@media(max-width:600px){.ledger-filters{grid-template-columns:repeat(2,minmax(0,1fr))}.ledger-event{grid-template-columns:minmax(0,1fr) auto;gap:2px 8px;padding:8px 10px}.ledger-actor{grid-column:1;grid-row:1}.ledger-action{grid-column:1;grid-row:2}.ledger-result{grid-column:2;grid-row:1/3;text-align:right}.ledger-time{grid-column:1;grid-row:3}.ledger-place{grid-column:2;grid-row:3;text-align:right}.ledger-place a{display:inline}.ledger-heading>a{font-size:13px}}
-.ledger-chain-panel{margin:0 0 12px}.ledger-chain{margin:0 0 4px;font-size:13px}.ledger-chain.ok strong{color:var(--success)}.ledger-checkpoint code{overflow-wrap:anywhere;user-select:all}.ledger-checkpoint-form{margin:6px 0 0}.ledger-export{grid-template-columns:repeat(2,minmax(0,180px)) auto;margin-bottom:4px}
-</style><div class="ledger-heading"><h1>Action ledger</h1><a href="/ledger?${html(csv.toString())}" download>Export CSV</a></div>${chain === undefined ? "" : chainHtml(chain)}
+    return html `${styleElement(LEDGER_CSS)}<div class="ledger-heading"><h1>Action ledger</h1><a href="/ledger?${csv.toString()}" download>Export CSV</a></div>${chain === undefined ? "" : chainHtml(chain)}
 <p class="meta ledger-caption">${shown.length} actions on this page · CSV includes all matching actions · Times in UTC</p>
 <details class="ledger-filter-panel"><summary>Filters · ${fresh.size === 0 ? "all actions" : `${fresh.size} active`}</summary>
 <form method="get" action="/ledger" class="ledger-filters" aria-label="Filter action ledger">
-<label>Project<select name="project"><option value="">All accessible projects</option>${projects.map(repo => `<option value="${html(repo)}"${selected("project", repo)}>${html(projectName(repo))}</option>`).join("")}</select></label>
-<label>Person or worker<input type="text" name="actor" value="${html(params.get("actor") ?? "")}" placeholder="Any actor"></label>
-<label>Events<select name="source"><option value="">All events</option>${EVENT_KINDS.map(([value, label]) => `<option value="${value}"${selected("source", value)}>${label}</option>`).join("")}</select></label>
-<label>Outcome<input type="text" name="outcome" value="${html(params.get("outcome") ?? "")}" placeholder="Any outcome"></label>
-<label>Task<input type="text" name="task" value="${html(params.get("task") ?? "")}" placeholder="Any task"></label>
+<label>Project<select name="project"><option value="">All accessible projects</option>${projects.map(repo => html `<option value="${repo}"${selected("project", repo)}>${projectName(repo)}</option>`)}</select></label>
+<label>Person or worker<input type="text" name="actor" value="${params.get("actor") ?? ""}" placeholder="Any actor"></label>
+<label>Events<select name="source"><option value="">All events</option>${EVENT_KINDS.map(([value, label]) => html `<option value="${value}"${selected("source", value)}>${label}</option>`)}</select></label>
+<label>Outcome<input type="text" name="outcome" value="${params.get("outcome") ?? ""}" placeholder="Any outcome"></label>
+<label>Task<input type="text" name="task" value="${params.get("task") ?? ""}" placeholder="Any task"></label>
 <button type="submit">Filter</button><a href="/ledger">Clear</a></form></details>
-<div class="ledger-list" aria-label="Action history"><div class="ledger-event ledger-labels" aria-hidden="true"><span>Time</span><span>Actor</span><span>Action</span><span>Project / work</span><span>Outcome / event</span></div>${shown.length === 0 ? `<p class="ledger-empty">No actions match these filters yet.</p>` : shown.map(row => {
-        const subject = row.runId !== null ? `<a href="/r/${row.runId}">Run #${row.runId}</a>` : row.taskId !== null ? `<a href="/t/${encodeURIComponent(row.taskId)}">${html(row.taskId)}</a>` : "";
+<div class="ledger-list" aria-label="Action history"><div class="ledger-event ledger-labels" aria-hidden="true"><span>Time</span><span>Actor</span><span>Action</span><span>Project / work</span><span>Outcome / event</span></div>${shown.length === 0 ? html `<p class="ledger-empty">No actions match these filters yet.</p>` : shown.map(row => {
+        const subject = row.runId !== null ? html `<a href="/r/${row.runId}">Run #${row.runId}</a>` : row.taskId !== null ? html `<a href="/t/${encodeURIComponent(row.taskId)}">${row.taskId}</a>` : "";
         const byActor = new URLSearchParams(fresh);
         byActor.set("actor", row.actor);
-        return `<article class="ledger-event" data-ledger-id="${row.id}"><div class="ledger-time">${exactWhenHtml(row.at)}</div><div class="ledger-actor"><a class="actor" href="/ledger?${html(byActor.toString())}" title="Filter by this actor">${html(row.actor)}</a></div><div class="ledger-action">${html(row.action)}${row.detail === null ? "" : `<small class="ledger-detail">${html(row.detail)}</small>`}</div><div class="ledger-place">${row.repo === null ? "Instance" : html(projectName(row.repo))} ${subject}</div><div class="ledger-result">${html(row.outcome)}<small>${html(row.source)}</small></div></article>`;
-    }).join("")}</div>
-<p class="row"><a href="/ledger?${html(fresh.toString())}">Newest actions</a>${more ? `<a rel="next" href="/ledger?${html(next.toString())}">Older actions</a>` : ""}</p>
+        return html `<article class="ledger-event" data-ledger-id="${row.id}"><div class="ledger-time">${exactWhenHtml(row.at)}</div><div class="ledger-actor"><a class="actor" href="/ledger?${byActor.toString()}" title="Filter by this actor">${row.actor}</a></div><div class="ledger-action">${row.action}${row.detail === null ? "" : html `<small class="ledger-detail">${row.detail}</small>`}</div><div class="ledger-place">${row.repo === null ? "Instance" : projectName(row.repo)} ${subject}</div><div class="ledger-result">${row.outcome}<small>${row.source}</small></div></article>`;
+    })}</div>
+<p class="row"><a href="/ledger?${fresh.toString()}">Newest actions</a>${more ? html `<a rel="next" href="/ledger?${next.toString()}">Older actions</a>` : ""}</p>
 <p class="meta">Accepted requests record acceptance; worker events record results. History starts from this upgrade. Review evidence is on each task or run.</p>`;
 }

package/dist/limits-ui.d.ts

@@ -6,6 +6,7 @@
  */
 import type { BrowserLimits } from "./browser-workspace.js";
 import { type BudgetState } from "./spend.js";
+import { type Html } from "./html.js";
 /** "in 25 min", "in 2 h 10 min", or a day and hour ("Fri 11 PM") beyond a day. */
 export declare function resetWords(resetsAt: string, now: Date): string;
 export declare function limitsView(windows: readonly {
@@ -22,5 +23,5 @@ export declare function limitsView(windows: readonly {
     teammate: (id: number) => string;
 }, now: Date): BrowserLimits | null;
 /** The same tiles for the page without scripts. */
-export declare function limitsHtml(limits: BrowserLimits | null): string;
+export declare function limitsHtml(limits: BrowserLimits | null): Html;
 export declare const LIMITS_CSS: string;

package/dist/limits-ui.js

@@ -1,5 +1,6 @@
 import { windowLabel } from "./provider-limits.js";
 import { usd } from "./spend.js";
+import { html } from "./html.js";
 const PROVIDER_NAMES = { claude: "Claude", codex: "Codex", gemini: "Gemini" };
 /** Plan names worth showing; anything else (an internal billing name) is left off. */
 const PLAN_NAMES = { free: "Free", plus: "Plus", pro: "Pro", max: "Max", team: "Team", business: "Business", enterprise: "Enterprise", edu: "Edu" };
@@ -47,16 +48,15 @@ export function limitsView(windows, budgets, names, now) {
     }
     return tiles.length === 0 ? null : { tiles };
 }
-const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 /** The same tiles for the page without scripts. */
 export function limitsHtml(limits) {
     if (limits === null)
-        return "";
-    return `<section class="limits" aria-label="Limits"><ul>${limits.tiles.map(tile => {
-        const body = `<p class="limit-name"><strong>${e(tile.name)}</strong> ${e(tile.window)}</p><p class="limit-value"><strong>${e(tile.value)}</strong> ${e(tile.unit)}</p>` +
-            `<span class="limit-bar" aria-hidden="true"><span style="width:${Math.min(100, Math.max(0, tile.percent))}%"></span></span><p class="limit-detail">${e(tile.detail)}</p>`;
-        return `<li class="limit limit-${tile.tone}" data-limit="${e(tile.key)}"${tile.title === null ? "" : ` title="${e(tile.title)}"`}>${tile.href === null ? body : `<a href="${e(tile.href)}">${body}</a>`}</li>`;
-    }).join("")}</ul></section>`;
+        return html ``;
+    return html `<section class="limits" aria-label="Limits"><ul>${limits.tiles.map(tile => {
+        const body = html `<p class="limit-name"><strong>${tile.name}</strong> ${tile.window}</p><p class="limit-value"><strong>${tile.value}</strong> ${tile.unit}</p>\
+<span class="limit-bar" aria-hidden="true"><span style="width:${Math.min(100, Math.max(0, tile.percent))}%"></span></span><p class="limit-detail">${tile.detail}</p>`;
+        return html `<li class="limit limit-${tile.tone}" data-limit="${tile.key}"${tile.title === null ? "" : html ` title="${tile.title}"`}>${tile.href === null ? body : html `<a href="${tile.href}">${body}</a>`}</li>`;
+    })}</ul></section>`;
 }
 export const LIMITS_CSS = `.limits ul{list-style:none;margin:0 0 16px;padding:0;display:grid;grid-template-columns:repeat(auto-fill,minmax(176px,1fr));gap:8px}` +
     `.limit{border:1px solid var(--border);border-radius:10px;background:var(--card);padding:12px 14px;min-width:0}.limit a{color:inherit;text-decoration:none;display:block}` +

package/dist/live-bus.d.ts

@@ -15,7 +15,10 @@
  *   an invalidation, never content. The page reads itself again under its
  *   own checks, so redaction stays the page's.
  * - The safety net. Every room also checks itself about every 30 s, so a
- *   missed signal heals, and sends a keep-alive between.
+ *   missed signal heals; the page's connection sends a keep-alive between,
+ *   each after every room proves its viewer again.
+ * - One connection per page. A page opens one stream (GET /live) and joins
+ *   every room it shows; each event names its room.
  * - Back-pressure. Each page's stream is bounded: a page that falls behind
  *   gets one `reload` and ends so its EventSource can reconnect.
  *
@@ -67,23 +70,62 @@ export declare class LiveStream {
     send(event: string, data: unknown): void;
     keepAlive(): void;
 }
+/**
+ * One page's live connection: its bounded stream, one keep-alive, and every
+ * room it joined. Each event names its room, so one EventSource serves the
+ * whole page. It ends when the page goes, when it falls behind (one
+ * `reload`), or when its last room lets it go. A keep-alive is a delivery
+ * too: every room proves its viewer again first, so a page whose session
+ * lapsed with nothing written hears its rooms go, never another frame.
+ */
+export declare class LiveConnection {
+    readonly response: ServerResponse;
+    readonly stream: LiveStream;
+    private readonly leaves;
+    private readonly proofs;
+    private readonly timer;
+    private closed;
+    constructor(response: ServerResponse, options?: {
+        limitBytes?: number;
+        keepAliveMs?: number;
+    });
+    private keepAlive;
+    /** Run before each keep-alive: a room proves its viewer again (and leaves if it no longer passes). Returns the undo. */
+    onKeepAlive(prove: () => void): () => void;
+    get open(): boolean;
+    /** An event for one room: its data says which. */
+    send(room: string, event: string, data?: Record<string, unknown>): void;
+    /** Run when the connection ends; returns the undo for a room that leaves first. */
+    onClose(leave: () => void): () => void;
+    close(): void;
+    /** Rooms joined and not yet left. */
+    get rooms(): number;
+}
+/** One page in one room: who, the room's name as the page asked for it, the page's connection, and its re-proof. */
 export type LiveViewer = {
     name: string;
-    response: ServerResponse;
+    room: string;
+    connection: LiveConnection;
     valid: () => boolean;
 };
 export type LiveRooms<K, V extends LiveViewer> = {
-    /** Keep this page's stream on the room until it closes; the first events say where it stands and who's here. */
+    /** Keep this page on the room until it leaves; the first events say where the room stands (and who's here). */
     join: (key: K, viewer: V) => void;
-    /** Every stream, ended (the server is closing). */
+    /** Every page leaves (the server is closing). */
     close: () => void;
     size: () => number;
 };
+/** `minIntervalMs`: a busy room says `change` at most this often — the first at once, the latest after. */
 export type LiveRoomOptions = {
     bus?: LiveBus | null;
     safetyNetMs?: number;
-    keepAliveMs?: number;
-    limitBytes?: number;
+    minIntervalMs?: number;
 };
-/** Rooms of open pages that hear the bus. `presence` says who else is here, as each page should see it. */
-export declare function createLiveRooms<K, V extends LiveViewer>(fingerprint: (key: K) => string | null, presence: (viewers: readonly V[], me: string) => unknown, options?: LiveRoomOptions): LiveRooms<K, V>;
+/**
+ * Rooms of open pages that hear the bus. `presence` says who else is here, as
+ * each page should see it (null: the room has no presence). A viewer that no
+ * longer passes its re-proof hears `gone` and leaves; a room whose subject is
+ * gone (fingerprint null) sends everyone `gone`. A connection with no rooms
+ * left ends.
+ */
+export declare function createLiveRooms<K, V extends LiveViewer>(fingerprint: (key: K) => string | null, presence: ((viewers: readonly V[], me: string) => unknown) | null, options?: LiveRoomOptions): LiveRooms<K, V>;

package/dist/live-bus.js

@@ -15,7 +15,10 @@
  *   an invalidation, never content. The page reads itself again under its
  *   own checks, so redaction stays the page's.
  * - The safety net. Every room also checks itself about every 30 s, so a
- *   missed signal heals, and sends a keep-alive between.
+ *   missed signal heals; the page's connection sends a keep-alive between,
+ *   each after every room proves its viewer again.
+ * - One connection per page. A page opens one stream (GET /live) and joins
+ *   every room it shows; each event names its room.
  * - Back-pressure. Each page's stream is bounded: a page that falls behind
  *   gets one `reload` and ends so its EventSource can reconnect.
  *
@@ -183,34 +186,98 @@ export class LiveStream {
         this.write(": keep-alive\n\n");
     }
 }
+/**
+ * One page's live connection: its bounded stream, one keep-alive, and every
+ * room it joined. Each event names its room, so one EventSource serves the
+ * whole page. It ends when the page goes, when it falls behind (one
+ * `reload`), or when its last room lets it go. A keep-alive is a delivery
+ * too: every room proves its viewer again first, so a page whose session
+ * lapsed with nothing written hears its rooms go, never another frame.
+ */
+export class LiveConnection {
+    response;
+    stream;
+    leaves = new Set();
+    proofs = new Set();
+    timer;
+    closed = false;
+    constructor(response, options = {}) {
+        this.response = response;
+        this.stream = new LiveStream(response, options.limitBytes, () => this.close());
+        this.timer = setInterval(() => this.keepAlive(), options.keepAliveMs ?? KEEP_ALIVE_MS);
+        this.timer.unref();
+        response.once("close", () => this.close());
+    }
+    keepAlive() {
+        for (const prove of [...this.proofs]) {
+            if (!this.open)
+                return;
+            prove();
+        }
+        if (this.open)
+            this.stream.keepAlive();
+    }
+    /** Run before each keep-alive: a room proves its viewer again (and leaves if it no longer passes). Returns the undo. */
+    onKeepAlive(prove) { this.proofs.add(prove); return () => { this.proofs.delete(prove); }; }
+    get open() { return !this.closed && this.stream.open; }
+    /** An event for one room: its data says which. */
+    send(room, event, data = {}) { this.stream.send(event, { room, ...data }); }
+    /** Run when the connection ends; returns the undo for a room that leaves first. */
+    onClose(leave) { this.leaves.add(leave); return () => { this.leaves.delete(leave); }; }
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        clearInterval(this.timer);
+        for (const leave of [...this.leaves])
+            leave();
+        this.leaves.clear();
+        this.proofs.clear();
+        if (!this.response.writableEnded)
+            this.response.end();
+    }
+    /** Rooms joined and not yet left. */
+    get rooms() { return this.leaves.size; }
+}
 const PRESENCE_SETTLE_MS = 150;
-/** Rooms of open pages that hear the bus. `presence` says who else is here, as each page should see it. */
+/**
+ * Rooms of open pages that hear the bus. `presence` says who else is here, as
+ * each page should see it (null: the room has no presence). A viewer that no
+ * longer passes its re-proof hears `gone` and leaves; a room whose subject is
+ * gone (fingerprint null) sends everyone `gone`. A connection with no rooms
+ * left ends.
+ */
 export function createLiveRooms(fingerprint, presence, options = {}) {
     const bus = options.bus ?? null;
-    const keepAliveMs = options.keepAliveMs ?? KEEP_ALIVE_MS;
-    const checkEvery = Math.max(1, Math.round((options.safetyNetMs ?? SAFETY_NET_MS) / keepAliveMs));
+    const safetyNetMs = options.safetyNetMs ?? SAFETY_NET_MS;
+    const minIntervalMs = options.minIntervalMs ?? 0;
     const rooms = new Map();
     let unsubscribe = null;
-    const here = (room, viewer) => presence([...room.viewers.keys()], viewer.name);
-    const announce = (room) => {
+    const announce = (key, room) => {
+        if (presence === null || rooms.get(key) !== room)
+            return;
         // A page that moves from one card to the next leaves and joins at once: say it once, after it settles.
         if (room.settling !== null)
             clearTimeout(room.settling);
         room.settling = setTimeout(() => {
             room.settling = null;
-            for (const [viewer, stream] of room.viewers)
-                stream.send("here", { people: here(room, viewer) });
+            for (const viewer of [...room.viewers.keys()])
+                deliver(key, room, viewer, "here", { people: presence([...room.viewers.keys()], viewer.name) });
         }, PRESENCE_SETTLE_MS);
         room.settling.unref();
     };
     const leave = (key, viewer) => {
         const room = rooms.get(key);
-        if (room === undefined || !room.viewers.delete(viewer))
+        const forget = room?.viewers.get(viewer);
+        if (room === undefined || forget === undefined)
             return;
-        if (!viewer.response.writableEnded)
-            viewer.response.end();
+        room.viewers.delete(viewer);
+        forget();
+        // The page's last room: its connection has nothing left to say.
+        if (viewer.connection.rooms === 0)
+            viewer.connection.close();
         if (room.viewers.size > 0) {
-            announce(room);
+            announce(key, room);
             return;
         }
         clearInterval(room.timer);
@@ -218,30 +285,46 @@ export function createLiveRooms(fingerprint, presence, options = {}) {
             clearTimeout(room.settling);
         if (room.retry !== null)
             clearTimeout(room.retry);
+        if (room.holding !== null)
+            clearTimeout(room.holding);
         rooms.delete(key);
         if (rooms.size === 0 && unsubscribe !== null) {
             unsubscribe();
             unsubscribe = null;
         }
     };
-    const drop = (key, viewer) => {
-        rooms.get(key)?.viewers.get(viewer)?.send("gone", {});
-        leave(key, viewer);
-    };
-    /** Recheck who may still see the room, then whether what it shows moved. */
-    const refresh = (key, room, revision) => {
-        // A signed-out or narrowed account stops hearing about it, at the first write after.
-        for (const viewer of [...room.viewers.keys()]) {
-            let ok = false;
+    /** The final delivery boundary, including queued frames and sends that may overflow. */
+    const deliver = (key, room, viewer, event, data = {}) => {
+        if (rooms.get(key) !== room || !room.viewers.has(viewer))
+            return false;
+        if (!viewer.connection.open) {
+            leave(key, viewer);
+            return false;
+        }
+        let valid = false;
+        try {
+            valid = viewer.valid();
+        }
+        catch { /* A failed proof releases only this room. */ }
+        if (!valid || event === "gone") {
+            // A failed proof may send only the generic departure, never the pending room data.
             try {
-                ok = viewer.valid();
+                viewer.connection.send(viewer.room, "gone");
             }
-            catch {
-                ok = false;
+            finally {
+                leave(key, viewer);
             }
-            if (!ok)
-                drop(key, viewer);
+            return false;
         }
+        if (event !== undefined)
+            viewer.connection.send(viewer.room, event, data);
+        return viewer.connection.open && room.viewers.has(viewer);
+    };
+    /** Recheck who may still see the room, then whether what it shows moved. */
+    const refresh = (key, room, revision) => {
+        // A signed-out or narrowed account stops hearing about it, at the first write after.
+        for (const viewer of [...room.viewers.keys()])
+            deliver(key, room, viewer);
         if (rooms.get(key) !== room)
             return;
         let now;
@@ -259,25 +342,28 @@ export function createLiveRooms(fingerprint, presence, options = {}) {
         }
         if (now === null) {
             for (const viewer of [...room.viewers.keys()])
-                drop(key, viewer);
+                deliver(key, room, viewer, "gone");
             return;
         }
         if (now === room.last)
             return;
         room.last = now;
-        for (const stream of room.viewers.values())
-            stream.send("change", { at: now, revision: revision ?? bus?.revision() ?? null });
-    };
-    const tick = (key, room) => {
-        room.ticks += 1;
-        if (room.ticks % checkEvery === 0) {
-            const before = room.last;
-            refresh(key, room, null);
-            if (rooms.get(key) === room && room.last !== before)
-                return;
+        room.revision = revision ?? bus?.revision() ?? null;
+        if (room.holding !== null)
+            return;
+        const wait = room.saidAt + minIntervalMs - Date.now();
+        if (wait > 0) {
+            room.holding = setTimeout(() => { room.holding = null; if (rooms.get(key) === room)
+                say(key, room); }, wait);
+            room.holding.unref();
+            return;
         }
-        for (const stream of room.viewers.values())
-            stream.keepAlive();
+        say(key, room);
+    };
+    const say = (key, room) => {
+        room.saidAt = Date.now();
+        for (const viewer of [...room.viewers.keys()])
+            deliver(key, room, viewer, "change", { at: room.last, revision: room.revision });
     };
     const heard = (change) => {
         for (const [key, room] of [...rooms])
@@ -292,24 +378,21 @@ export function createLiveRooms(fingerprint, presence, options = {}) {
                     last = fingerprint(key);
                 }
                 catch { /* the next signal or the safety net reads it */ }
-                const created = { viewers: new Map(), last, timer: setInterval(() => tick(key, created), keepAliveMs), ticks: 0, settling: null, retry: null };
+                const created = { viewers: new Map(), last, timer: setInterval(() => refresh(key, created, null), safetyNetMs), settling: null, retry: null, saidAt: 0, holding: null, revision: null };
                 created.timer.unref();
                 room = created;
                 rooms.set(key, room);
                 if (bus !== null && unsubscribe === null)
                     unsubscribe = bus.subscribe(heard);
             }
-            // Remove an overflowed page immediately, even while its final bytes
-            // wait for the client. Peers must not keep seeing stale presence.
-            const stream = new LiveStream(viewer.response, options.limitBytes, () => leave(key, viewer));
-            room.viewers.set(viewer, stream);
-            viewer.response.once("close", () => leave(key, viewer));
-            stream.send("change", { at: room.last, revision: bus?.revision() ?? null });
-            if (!stream.open)
+            const joined = room;
+            const forget = viewer.connection.onClose(() => leave(key, viewer));
+            const unprove = viewer.connection.onKeepAlive(() => { deliver(key, joined, viewer); });
+            room.viewers.set(viewer, () => { forget(); unprove(); });
+            if (!deliver(key, room, viewer, "change", { at: room.last, revision: bus?.revision() ?? null }) || presence === null)
                 return;
-            stream.send("here", { people: here(room, viewer) });
-            if (stream.open)
-                announce(room);
+            if (deliver(key, room, viewer, "here", { people: presence([...room.viewers.keys()], viewer.name) }))
+                announce(key, room);
         },
         close() {
             for (const [key, room] of [...rooms])

package/dist/mate-tools.js

@@ -494,7 +494,7 @@ const MATE_TOOL_HANDLERS = {
         description: "When the owner asks to approve one thing (a plan waiting on them, or a flow card waiting at a Person decides step), send that item's own Approve and Send back buttons to their paired chat right away. Their tap there is the approval (two taps, as on any decision card); you never approve. Give task for a plan, or card for a flow card (its number from get_flows). When it can't be approved in chat, the answer says why: say that in one line and open show_control approval (a plan) or the flow, never that you can't approve.",
         handle: (ctx, args) => {
             const pairedHere = ctx.channel === "telegram";
-            const paired = ctx.store.handle.prepare("SELECT 1 FROM telegram_binding WHERE approver = ? AND approver_generation = ? AND revoked_at IS NULL LIMIT 1")
+            const paired = ctx.store.handle.prepare("SELECT 1 FROM chat_binding WHERE provider = 'telegram' AND approver = ? AND generation = ? AND revoked IS NULL LIMIT 1")
                 .get(ctx.who.name, ctx.store.accountOf(ctx.who.name)?.generation ?? -1) !== undefined;
             const stamp = ctx.now.getTime();
             if (args["card"] !== undefined) {
@@ -520,7 +520,8 @@ const MATE_TOOL_HANDLERS = {
             if (task === null || admittedRef(ctx, task) === null)
                 return notFound();
             const current = ctx.store.taskFamilyOf(task, ctx.who.repos, false)?.current.id ?? task;
-            const plan = planInChat(ctx.store, current, ctx.who.name, ctx.now, ctx.evidenceRoot);
+            // Its buttons go to the paired Telegram chat (pairedHere), so it is that chat's authority that counts.
+            const plan = planInChat(ctx.store, current, ctx.who.name, ctx.now, "telegram", ctx.evidenceRoot);
             if (!plan.ok)
                 return { ok: true, body: { offered: false, task: current, why: plan.why, control: "approval" } };
             if (!pairedHere || !paired)