toolroll 0.9.53 → 0.9.55

package/dist/openrouter-models.js

@@ -1,5 +1,6 @@
 /** Live discovery for the UI. Prices are USD, separate from rounded budget pins. */
 import { createHash } from "node:crypto";
+import { html } from "./html.js";
 import { readCappedBody } from "./converse.js";
 import { validModelId } from "./provider.js";
 const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
@@ -76,7 +77,6 @@ export function openRouterModelsCache(fetcher = fetch) {
         return value;
     };
 }
-const escape = (s) => s.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
 export function modelDollars(amount) {
     if (amount === null)
         return "Not reported";
@@ -96,14 +96,10 @@ function details(model) {
 export function openRouterPicker(catalog, selected, refreshUrl) {
     const rows = catalog.ok ? catalog.models : [];
     const current = rows.find(row => row.id === selected);
-    const manual = selected && !current ? `<option selected value="${escape(selected)}" data-detail="This saved model is not in the loaded catalog. Availability and pricing are unverified.">${escape(selected)} · Saved choice</option>` : "";
-    return `<div data-openrouter-picker><p class="meta">${catalog.ok
-        ? `${rows.length} text models · ${catalog.source === "account" ? "Filtered for your OpenRouter account" : "Public catalog · Connect a key to check your account"} · Updated ${escape(catalog.checkedAt.slice(11, 16))} UTC`
-        : escape(catalog.problem)} <a href="${escape(refreshUrl)}">Refresh models</a></p>` +
-        `<label data-model-search hidden>Search models<input type="search" placeholder="Search by name or provider" autocomplete="off"></label>` +
-        `<label>Model<select name="model" aria-describedby="openrouter-price"><option value="__custom__"${selected === null ? " selected" : ""}>Choose a model</option>${manual}${rows.map(row => `<option value="${escape(row.id)}" data-detail="${escape(details(row))}"${row.id === selected ? " selected" : ""}>${escape(row.name)} · ${modelDollars(row.input)} in / ${modelDollars(row.output)} out per 1M</option>`).join("")}</select></label>` +
-        `<p id="openrouter-price" class="meta" aria-live="polite">${current ? escape(details(current)) : selected ? "This saved model is not in the loaded catalog. Availability and pricing are unverified." : "Choose a model to see its token prices and context size."}</p>` +
-        `<p data-model-count class="meta" aria-live="polite"></p><p class="meta"><a href="https://openrouter.ai/models" target="_blank" rel="noreferrer">Compare models on OpenRouter ↗</a> · Prices in USD; catalog browsing uses no model tokens.</p></div>`;
+    const manual = selected && !current ? html `<option selected value="${selected}" data-detail="This saved model is not in the loaded catalog. Availability and pricing are unverified.">${selected} · Saved choice</option>` : "";
+    return html `<div data-openrouter-picker><p class="meta">${catalog.ok
+        ? `${rows.length} text models · ${catalog.source === "account" ? "Filtered for your OpenRouter account" : "Public catalog · Connect a key to check your account"} · Updated ${catalog.checkedAt.slice(11, 16)} UTC`
+        : catalog.problem} <a href="${refreshUrl}">Refresh models</a></p><label data-model-search hidden>Search models<input type="search" placeholder="Search by name or provider" autocomplete="off"></label><label>Model<select name="model" aria-describedby="openrouter-price"><option value="__custom__"${selected === null ? html ` selected` : ""}>Choose a model</option>${manual}${rows.map(row => html `<option value="${row.id}" data-detail="${details(row)}"${row.id === selected ? html ` selected` : ""}>${row.name} · ${modelDollars(row.input)} in / ${modelDollars(row.output)} out per 1M</option>`)}</select></label><p id="openrouter-price" class="meta" aria-live="polite">${current ? details(current) : selected ? "This saved model is not in the loaded catalog. Availability and pricing are unverified." : "Choose a model to see its token prices and context size."}</p><p data-model-count class="meta" aria-live="polite"></p><p class="meta"><a href="https://openrouter.ai/models" target="_blank" rel="noreferrer">Compare models on OpenRouter ↗</a> · Prices in USD; catalog browsing uses no model tokens.</p></div>`;
 }
 /** Only filters already-rendered options; credentials never enter this script. */
 export function openRouterPickerScript() {

package/dist/operate.js

@@ -175,7 +175,7 @@ import { mintCoordinator, revokeCoordinator, listCoordinators } from "./coordina
 import { serveMcp } from "./mcp.js";
 import { createInterface } from "node:readline";
 import { propose, approve, addApprover, authenticateAccount, authenticateApprover as passwordApprover, describeScope, approvalOf, hashToken as hashApproverToken, fileAndSealUnderMode, modeFilingCoverage, acceptanceLinesToInput, parseAcceptanceCriteria, splitAcceptanceRubric, rubricIsPlaceholder, isCommitSha } from "./scope.js";
-import { presetTerms, modeTermsJson, modeDigestOf, modeTermsFromJson, modeWords, MODE_MAX_DAYS } from "./modes.js";
+import { CHAT_APPROVE_ALL, presetTerms, modeTermsJson, modeDigestOf, modeTermsFromJson, modeWords, MODE_MAX_DAYS } from "./modes.js";
 import { WorktreePool } from "./worktree.js";
 import { requestTaskStop, resumeTaskStop, taskControlOf } from "./task-control.js";
 import { worktreeAdoptionNotice } from "./worktree-notices.js";
@@ -370,7 +370,7 @@ External trackers — build what a tracker nominates, under local approvals
 
   toolroll claim <id> --runner <name> [--ttl <seconds>]
   toolroll heartbeat <lease>         still working; extends the lease
-  toolroll release <lease>           done with it; fenced if superseded
+  toolroll worker release <lease>    done with it; fenced if superseded
   toolroll reap                      release every lease that ran out
 
   toolroll tick --runner <name> --token <t> --repo <path>
@@ -1143,8 +1143,10 @@ async function dispatch(command, positional, flags, context) {
             return claimCommand(positional, flags, context);
         case "heartbeat":
             return leaseCommand("heartbeat", positional, flags, context);
-        case "release":
-            return leaseCommand("release", positional, flags, context);
+        case "worker":
+            if (positional[0] === "release")
+                return leaseCommand("release", positional.slice(1), flags, context);
+            return fail(context.write, context.json, "worker", "usage", "`toolroll worker release <lease>` returns a lease.", EXIT.usage);
         case "reap":
             return reapCommand(context);
         case "runner":
@@ -1476,18 +1478,20 @@ function claimCommand(positional, flags, context) {
  */
 function leaseCommand(command, positional, flags, context) {
     const { store, write, json, now } = context;
+    // `release` answers as the worker verb it now is (the bare `toolroll release <lease>` form is deprecated).
+    const name = command === "release" ? "worker release" : command;
     const lease = positional[0];
     if (lease === undefined)
-        return fail(write, json, command, "usage", `which lease? \`toolroll ${command} <lease>\``, EXIT.usage);
+        return fail(write, json, name, "usage", `which lease? \`toolroll ${name} <lease>\``, EXIT.usage);
     const ttl = readTtl(flags);
     if (ttl === null)
-        return fail(write, json, command, "usage", "--ttl takes whole seconds", EXIT.usage);
+        return fail(write, json, name, "usage", "--ttl takes whole seconds", EXIT.usage);
     const result = command === "heartbeat" ? heartbeat(store, lease, now, ttl) : release(store, lease, now);
     if (!result.ok) {
         const message = result.reason === "fenced"
             ? "superseded — another runner holds this task now; stop rather than retry"
             : "no such lease";
-        return fail(write, json, command, result.reason, message, EXIT.refused);
+        return fail(write, json, name, result.reason, message, EXIT.refused);
     }
     if (command === "release") {
         const task = store.getTask(String(refExternalId(store, result.claim.taskRef)));
@@ -1496,7 +1500,7 @@ function leaseCommand(command, positional, flags, context) {
         if (task !== null && task.state === "running")
             store.setTaskState(task.id, "queued", now);
     }
-    return succeed(write, json, command, { lease: result.claim }, () => [
+    return succeed(write, json, name, { lease: result.claim }, () => [
         command === "heartbeat"
             ? `Still yours until ${result.claim.expiresAt}.`
             : `Released ${result.claim.leaseId}.`,
@@ -4659,8 +4663,11 @@ async function modeCommand(positional, flags, context) {
         return fail(write, json, "mode set", "invalid", "--plan-auto requires automatic filing approval", EXIT.refused);
     }
     // Approving plans and merges from the signer's paired chat: never a preset default, only this flag.
-    if (flag(flags, "chat-approve"))
+    // The signature names every chat app it covers: a grant signed before that named Telegram alone, and stays so.
+    if (flag(flags, "chat-approve")) {
         terms.chatApprove = true;
+        terms.chatApproveChats = CHAT_APPROVE_ALL;
+    }
     // Automerge requires a live merge-capable grant on the repo (D1).
     if (terms.publication === "automerge" && !store.hasMergeCapableGrant(repo, now)) {
         return fail(write, json, "mode set", "no-grant", "automerge needs a merge-capable publication grant on this repo — file one first", EXIT.refused);

package/dist/people-audit-ui.d.ts

@@ -1,5 +1,6 @@
 import { type AuditAction } from "./remote-audit.js";
 import type { ApiTokenRow } from "./store.js";
+import { type Html } from "./html.js";
 export declare const PEOPLE_AUDIT_CSS: string;
 export type PersonAuditView = {
     name: string;
@@ -11,4 +12,4 @@ export type PersonAuditView = {
     now: Date;
 };
 export declare const personHref: (name: string, more?: Record<string, string>) => string;
-export declare function personAuditHtml(view: PersonAuditView): string;
+export declare function personAuditHtml(view: PersonAuditView): Html;

package/dist/people-audit-ui.js

@@ -5,7 +5,7 @@
  */
 import { basename } from "node:path";
 import { tokenStatus } from "./remote-audit.js";
-const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+import { html } from "./html.js";
 const stamp = (value) => `${value.slice(0, 16).replace("T", " ")} UTC`;
 export const PEOPLE_AUDIT_CSS = `.person-audit{max-width:820px;min-width:0;overflow-wrap:anywhere}.person-audit h2{font-size:1.05rem;margin:1.25rem 0 8px}` +
     `.person-audit .rows{display:grid;border:1px solid var(--so-line);border-radius:10px;overflow:hidden}.person-audit .row-item{padding:10px 14px;border-bottom:1px solid var(--so-line);min-width:0}` +
@@ -17,22 +17,22 @@ export const PEOPLE_AUDIT_CSS = `.person-audit{max-width:820px;min-width:0;overf
     `@media(max-width:600px){.person-audit .row-item a{min-height:44px}}`;
 export const personHref = (name, more = {}) => `/people?${new URLSearchParams({ person: name, ...more }).toString()}`;
 export function personAuditHtml(view) {
-    const tokens = view.tokens.length === 0 ? `<p class="meta">No API tokens.</p>` : `<div class="rows">${view.tokens.map(one => {
+    const tokens = view.tokens.length === 0 ? html `<p class="meta">No API tokens.</p>` : html `<div class="rows">${view.tokens.map(one => {
         const status = tokenStatus(one, view.now);
-        return `<div class="row-item" data-token-name="${e(one.name)}"><p><a href="${e(personHref(view.name, { "token-name": one.name }))}">${e(one.name)}</a></p>` +
-            `<p class="meta">${status === "active" ? "Active" : status === "expired" ? "Expired" : "Revoked"} · ${one.access === "act" ? "Can act" : "Read only"} · ` +
-            `last used ${one.lastUsedAt === null ? "never" : e(stamp(one.lastUsedAt))}</p></div>`;
-    }).join("")}</div>`;
-    const filtered = view.token === null ? "" : `<p class="meta">With ${e(view.token)}</p><p><a href="${e(personHref(view.name))}">All tokens</a></p>`;
-    const actions = view.actions.length === 0 ? `<p class="meta">No remote actions${view.token === null ? "" : " with this token"}.</p>` : `<div class="rows">${view.actions.map(actionHtml).join("")}</div>`;
-    const older = view.nextCursor === null ? "" : `<p><a href="${e(personHref(view.name, { ...(view.token === null ? {} : { "token-name": view.token }), before: view.nextCursor }))}">Older actions</a></p>`;
-    return `<p><a href="/people">People</a></p><h1>${e(view.name)}</h1><section class="person-audit"><h2>API tokens</h2>${tokens}` +
-        `<h2>Remote activity</h2>${filtered}${actions}${older}</section>`;
+        return html `<div class="row-item" data-token-name="${one.name}"><p><a href="${personHref(view.name, { "token-name": one.name })}">${one.name}</a></p>\
+<p class="meta">${status === "active" ? "Active" : status === "expired" ? "Expired" : "Revoked"} · ${one.access === "act" ? "Can act" : "Read only"} · \
+last used ${one.lastUsedAt === null ? "never" : stamp(one.lastUsedAt)}</p></div>`;
+    })}</div>`;
+    const filtered = view.token === null ? "" : html `<p class="meta">With ${view.token}</p><p><a href="${personHref(view.name)}">All tokens</a></p>`;
+    const actions = view.actions.length === 0 ? html `<p class="meta">No remote actions${view.token === null ? "" : " with this token"}.</p>` : html `<div class="rows">${view.actions.map(actionHtml)}</div>`;
+    const older = view.nextCursor === null ? "" : html `<p><a href="${personHref(view.name, { ...(view.token === null ? {} : { "token-name": view.token }), before: view.nextCursor })}">Older actions</a></p>`;
+    return html `<p><a href="/people">People</a></p><h1>${view.name}</h1><section class="person-audit"><h2>API tokens</h2>${tokens}\
+<h2>Remote activity</h2>${filtered}${actions}${older}</section>`;
 }
 function actionHtml(action) {
     const label = action.outcome === "ok" ? "OK" : action.outcome === "refused" ? "Refused" : "Error";
     const detail = [stamp(action.at), action.token ?? "unknown token", action.source === "mcp" ? "Agent (MCP)" : "CLI",
         ...(action.repo === null ? [] : [basename(action.repo)]), ...(action.reason === null ? [] : [action.reason])];
-    return `<div class="row-item" data-action="${action.id}"><p><span class="outcome outcome-${action.outcome}">${label}</span>${e(action.name)}` +
-        `${action.taskId === null ? "" : ` · <a href="/t/${encodeURIComponent(action.taskId)}">${e(action.taskId)}</a>`}</p><p class="meta">${detail.map(e).join(" · ")}</p></div>`;
+    return html `<div class="row-item" data-action="${action.id}"><p><span class="outcome outcome-${action.outcome}">${label}</span>${action.name}\
+${action.taskId === null ? "" : html ` · <a href="/t/${encodeURIComponent(action.taskId)}">${action.taskId}</a>`}</p><p class="meta">${detail.join(" · ")}</p></div>`;
 }

package/dist/plane-review.js

@@ -175,17 +175,11 @@ export function reviewPlane(store, now, canSee = () => true) {
         }
     }
     // Chat replies that couldn't be delivered.
-    for (const app of ["slack", "discord", "teams"]) {
-        if (!tableExists(store, `${app}_part`))
-            continue;
-        const name = { slack: "Slack", discord: "Discord", teams: "Teams" }[app];
-        for (const row of store.handle.prepare(`SELECT id, problem, attempts FROM ${app}_part WHERE state = 'dropped' AND created >= ? ORDER BY id`).all(since)) {
-            add(`chat/${app}`, `${name} replies weren't delivered`, ["reply", "replies"], { evidence: `After ${plural(Number(row["attempts"] ?? 0), "try", "tries")}: ${excerpt(str(row["problem"])) || "dropped"}` });
-        }
-    }
-    if (tableExists(store, "telegram_conversation_part")) {
-        for (const row of store.handle.prepare("SELECT last_error, attempts FROM telegram_conversation_part WHERE state = 'dropped' AND created_at >= ?").all(since)) {
-            add("chat/telegram", "Telegram replies weren't delivered", ["reply", "replies"], { evidence: `After ${plural(Number(row["attempts"] ?? 0), "try", "tries")}: ${excerpt(str(row["last_error"])) || "dropped"}` });
+    if (tableExists(store, "chat_part")) {
+        const names = { telegram: "Telegram", slack: "Slack", discord: "Discord", teams: "Teams" };
+        for (const row of store.handle.prepare("SELECT provider, problem, attempts FROM chat_part WHERE state = 'dropped' AND created >= ? ORDER BY provider = 'telegram' DESC, provider, id").all(since)) {
+            const app = String(row["provider"]);
+            add(`chat/${app}`, `${names[app] ?? app} replies weren't delivered`, ["reply", "replies"], { evidence: `After ${plural(Number(row["attempts"] ?? 0), "try", "tries")}: ${excerpt(str(row["problem"])) || "dropped"}` });
         }
     }
     if (tableExists(store, "notification_delivery")) {

package/dist/policy-ui.d.ts

@@ -4,6 +4,7 @@
  * action ledger. Anyone signed in reads it; an instance operator changes it
  * with their password.
  */
+import { type Html } from "./html.js";
 import type { LedgerEntry } from "./action-ledger.js";
 import { type SavedPolicy } from "./policy.js";
 export declare const POLICY_CSS: string;
@@ -14,7 +15,7 @@ export type PolicyView = {
     /** The project tools here, as a hint for the tools list. */
     toolNames: string[];
 };
-export declare function policyHtml(view: PolicyView, csrf: string, notice: {
+export declare function policyHtml(view: PolicyView, notice: {
     said?: string | null;
     problem?: string | null;
-}): string;
+}): Html;

package/dist/policy-ui.js

@@ -1,6 +1,12 @@
+/**
+ * Settings → Policy (sprint 8): the organisation policy — allowed providers,
+ * models and tools, and the permission ceiling — and its history from the
+ * action ledger. Anyone signed in reads it; an instance operator changes it
+ * with their password.
+ */
+import { html, postForm } from "./html.js";
 import { whenUtc } from "./when-html.js";
 import { LEVEL_HINTS, LEVEL_NAMES, PERMISSION_LEVELS, POLICY_PROVIDERS, PROVIDER_NAMES, policyParts } from "./policy.js";
-const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 export const POLICY_CSS = `.policy{max-width:720px;min-width:0}.policy dl{display:grid;grid-template-columns:max-content minmax(0,1fr);gap:6px 16px;margin:12px 0 0;font-size:.875rem}` +
     `.policy dt{color:var(--muted-foreground)}.policy dd{margin:0;overflow-wrap:anywhere}.policy fieldset{border:0;padding:0;margin:20px 0 0;min-width:0}` +
     `.policy legend{font-weight:600;font-size:.875rem;margin-bottom:8px}.policy legend{padding:0}.policy .providers{display:grid;grid-template-columns:repeat(auto-fill,minmax(132px,1fr));gap:0 16px}.policy .providers label{display:flex;gap:8px;align-items:center;min-height:44px;margin:0;padding:0;font-weight:400}` +
@@ -13,30 +19,18 @@ export const POLICY_CSS = `.policy{max-width:720px;min-width:0}.policy dl{displa
 function historyItem(entry) {
     const what = entry.action.replace(/^organisation policy: /, "");
     const [before, after] = (entry.detail ?? "").split(" → ");
-    return `<li><span class="what">${e(what.charAt(0).toUpperCase() + what.slice(1))}: ${e(before ?? "")} → <strong>${e(after ?? "")}</strong></span>` +
-        `<span class="meta">${e(entry.actor)} · ${whenUtc(entry.at)}</span></li>`;
+    return html `<li><span class="what">${what.charAt(0).toUpperCase() + what.slice(1)}: ${before ?? ""} → <strong>${after ?? ""}</strong></span><span class="meta">${entry.actor} · ${whenUtc(entry.at)}</span></li>`;
 }
-export function policyHtml(view, csrf, notice) {
-    const note = notice.problem ? `<p class="problem" role="alert">${e(notice.problem)}</p>` : notice.said ? `<p role="status">${e(notice.said)}</p>` : "";
+export function policyHtml(view, notice) {
+    const note = notice.problem ? html `<p class="problem" role="alert">${notice.problem}</p>` : notice.said ? html `<p role="status">${notice.said}</p>` : "";
     const parts = policyParts(view.policy);
-    const changed = view.policy.updatedBy === null ? "" : `<p class="meta">Changed by ${e(view.policy.updatedBy)} on ${e((view.policy.updatedAt ?? "").slice(0, 10))}.</p>`;
-    const current = `<dl><dt>Providers</dt><dd>${e(parts.providers === "any" ? "Any" : parts.providers)}</dd><dt>Models</dt><dd>${e(parts.models === "any" ? "Any" : parts.models)}</dd>` +
-        `<dt>Tools</dt><dd>${e(parts.tools === "any" ? "Any" : parts.tools)}</dd><dt>Ceiling</dt><dd>${e(parts.ceiling)}</dd></dl>${changed}`;
-    const history = view.history.length === 0 ? "" : `<details><summary>History (${view.history.length})</summary><ol>${view.history.map(historyItem).join("")}</ol></details>`;
+    const changed = view.policy.updatedBy === null ? "" : html `<p class="meta">Changed by ${view.policy.updatedBy} on ${(view.policy.updatedAt ?? "").slice(0, 10)}.</p>`;
+    const current = html `<dl><dt>Providers</dt><dd>${parts.providers === "any" ? "Any" : parts.providers}</dd><dt>Models</dt><dd>${parts.models === "any" ? "Any" : parts.models}</dd><dt>Tools</dt><dd>${parts.tools === "any" ? "Any" : parts.tools}</dd><dt>Ceiling</dt><dd>${parts.ceiling}</dd></dl>${changed}`;
+    const history = view.history.length === 0 ? "" : html `<details><summary>History (${view.history.length})</summary><ol>${view.history.map(historyItem)}</ol></details>`;
     if (!view.canChange)
-        return `<section class="policy">${note}${current}<p class="meta">An instance operator sets the policy.</p>${history}</section>`;
-    const providers = POLICY_PROVIDERS.map(one => `<label><input type="checkbox" name="provider" value="${one}"${view.policy.providers === null || view.policy.providers.includes(one) ? " checked" : ""}> ${PROVIDER_NAMES[one]}</label>`).join("");
-    const levels = [...PERMISSION_LEVELS].reverse().map(level => `<label class="choice"><input type="radio" name="ceiling" value="${level}"${view.policy.ceiling === level ? " checked" : ""}>` +
-        `<span><strong>${LEVEL_NAMES[level]}</strong><small>${e(LEVEL_HINTS[level])}</small></span></label>`).join("");
+        return html `<section class="policy">${note}${current}<p class="meta">An instance operator sets the policy.</p>${history}</section>`;
+    const providers = POLICY_PROVIDERS.map(one => html `<label><input type="checkbox" name="provider" value="${one}"${view.policy.providers === null || view.policy.providers.includes(one) ? html ` checked` : ""}> ${PROVIDER_NAMES[one]}</label>`);
+    const levels = [...PERMISSION_LEVELS].reverse().map(level => html `<label class="choice"><input type="radio" name="ceiling" value="${level}"${view.policy.ceiling === level ? html ` checked` : ""}><span><strong>${LEVEL_NAMES[level]}</strong><small>${LEVEL_HINTS[level]}</small></span></label>`);
     const toolHint = view.toolNames.length === 0 ? "" : ` Tools here: ${view.toolNames.slice(0, 12).join(", ")}${view.toolNames.length > 12 ? "…" : ""}.`;
-    return `<section class="policy">${note}${changed}` +
-        `<form method="post" action="/settings/policy"><input type="hidden" name="csrf" value="${e(csrf)}">` +
-        `<fieldset><legend>Providers</legend><div class="providers">${providers}</div></fieldset>` +
-        `<fieldset><legend><label for="policy-models">Models</label></legend><textarea id="policy-models" name="models" spellcheck="false" placeholder="Any model" aria-describedby="policy-models-hint">${e((view.policy.models ?? []).join("\n"))}</textarea>` +
-        `<span class="hint" id="policy-models-hint">One per line; end with * to allow a family. Blank allows any.</span></fieldset>` +
-        `<fieldset><legend><label for="policy-tools">Project tools</label></legend><textarea id="policy-tools" name="tools" spellcheck="false" placeholder="Any tool" aria-describedby="policy-tools-hint">${e((view.policy.tools ?? []).join("\n"))}</textarea>` +
-        `<span class="hint" id="policy-tools-hint">One per line. Blank allows any.${e(toolHint)}</span></fieldset>` +
-        `<fieldset><legend>Permission ceiling</legend>${levels}</fieldset>` +
-        `<div class="step-up"><label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label></div>` +
-        `<button type="submit">Save policy</button></form>${history}</section>`;
+    return html `<section class="policy">${note}${changed}${postForm("/settings/policy", html `<fieldset><legend>Providers</legend><div class="providers">${providers}</div></fieldset><fieldset><legend><label for="policy-models">Models</label></legend><textarea id="policy-models" name="models" spellcheck="false" placeholder="Any model" aria-describedby="policy-models-hint">${(view.policy.models ?? []).join("\n")}</textarea><span class="hint" id="policy-models-hint">One per line; end with * to allow a family. Blank allows any.</span></fieldset><fieldset><legend><label for="policy-tools">Project tools</label></legend><textarea id="policy-tools" name="tools" spellcheck="false" placeholder="Any tool" aria-describedby="policy-tools-hint">${(view.policy.tools ?? []).join("\n")}</textarea><span class="hint" id="policy-tools-hint">One per line. Blank allows any.${toolHint}</span></fieldset><fieldset><legend>Permission ceiling</legend>${levels}</fieldset><div class="step-up"><label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label></div><button type="submit">Save policy</button>`)}${history}</section>`;
 }

package/dist/project-delete-ui.d.ts

@@ -4,6 +4,7 @@
  * then read exactly what goes and confirm with their password (or a fresh
  * sign-in with the identity provider). The repository itself stays.
  */
+import { type Html } from "./html.js";
 import { type ProjectHoldings } from "./project-delete.js";
 export declare const PROJECT_DELETE_CSS: string;
 export type ProjectSettingsView = {
@@ -21,9 +22,9 @@ export type ProjectSettingsView = {
     };
 };
 /** The project's page: its path, what Toolroll holds for it, and (for an instance operator) Delete project. */
-export declare function projectSettingsHtml(view: ProjectSettingsView, csrf: string, notice: {
+export declare function projectSettingsHtml(view: ProjectSettingsView, notice: {
     said?: string | null;
     problem?: string | null;
-}): string;
+}): Html;
 /** The second step: exactly what goes, and the password. */
-export declare function projectDeleteConfirmHtml(view: ProjectSettingsView, csrf: string, problem: string | null): string;
+export declare function projectDeleteConfirmHtml(view: ProjectSettingsView, problem: string | null): Html;

package/dist/project-delete-ui.js

@@ -4,8 +4,8 @@
  * then read exactly what goes and confirm with their password (or a fresh
  * sign-in with the identity provider). The repository itself stays.
  */
+import { html, postForm } from "./html.js";
 import { holdingsWords } from "./project-delete.js";
-const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 export const PROJECT_DELETE_CSS = `.project-settings,.project-delete{max-width:720px;min-width:0}.project-settings .path,.project-delete .path{font-family:var(--font-mono);font-size:.8125rem;overflow-wrap:anywhere;word-break:break-all}` +
     `.project-settings details.danger-zone{margin-top:24px;border:1px solid var(--border);border-radius:10px;padding:0 14px}.project-settings details.danger-zone summary{min-height:44px;display:flex;align-items:center;cursor:pointer;font-weight:500;color:var(--danger)}` +
     `.project-settings details.danger-zone[open]{padding-bottom:14px}.project-settings form,.project-delete form{display:grid;gap:12px;margin-top:12px}.project-settings label,.project-delete label{display:grid;gap:4px;font-size:.8125rem;font-weight:500}` +
@@ -16,39 +16,32 @@ export const PROJECT_DELETE_CSS = `.project-settings,.project-delete{max-width:7
     `.project-settings .builds-at-once .builds-row{display:flex;gap:8px;align-items:stretch}.project-settings .builds-at-once input{width:5.5rem;min-height:44px;margin:0;box-sizing:border-box}.project-settings .builds-at-once button{min-height:44px;margin:0}` +
     `.project-settings .builds-at-once .meta{margin:0}.project-settings form.remove-project{margin-top:20px;gap:4px}.project-settings form.remove-project button{min-height:44px}.project-settings form.remove-project .meta{margin:0}`;
 /** Builds at once: one number, one Save. The worker's cap is said only when it lowers the number. */
-function buildsHtml(view, csrf) {
+function buildsHtml(view) {
     const b = view.builds;
     if (b === undefined)
         return "";
     const capped = b.capacity !== null && b.capacity < b.setting ? ` Its worker runs ${b.capacity} at once, so ${b.capacity} for now.` : "";
     const now = `${b.building} building now.${capped}`;
     if (!b.canChange)
-        return `<section class="builds-at-once"><h2>Builds at once</h2><p>Up to ${b.setting}. ${e(now)}</p></section>`;
-    return `<section class="builds-at-once"><h2>Builds at once</h2><form method="post" action="/settings/project/concurrency">` +
-        `<input type="hidden" name="csrf" value="${e(csrf)}"><input type="hidden" name="repo" value="${e(view.repo)}">` +
-        `<div class="builds-row"><input type="number" name="concurrency" min="1" max="64" step="1" inputmode="numeric" value="${b.setting}" aria-label="Builds at once" aria-describedby="builds-now"><button type="submit">Save</button></div>` +
-        `<p class="meta" id="builds-now">${e(now)}</p></form></section>`;
+        return html `<section class="builds-at-once"><h2>Builds at once</h2><p>Up to ${b.setting}. ${now}</p></section>`;
+    return html `<section class="builds-at-once"><h2>Builds at once</h2>${postForm("/settings/project/concurrency", html `<div class="builds-row"><input type="number" name="concurrency" min="1" max="64" step="1" inputmode="numeric" value="${b.setting}" aria-label="Builds at once" aria-describedby="builds-now"><button type="submit">Save</button></div><p class="meta" id="builds-now">${now}</p>`, { hidden: { repo: view.repo } })}</section>`;
 }
-const note = (notice) => notice.problem ? `<p class="problem" role="alert">${e(notice.problem)}</p>` : notice.said ? `<p role="status">${e(notice.said)}</p>` : "";
+const note = (notice) => notice.problem ? html `<p class="problem" role="alert">${notice.problem}</p>` : notice.said ? html `<p role="status">${notice.said}</p>` : "";
 /** The project's page: its path, what Toolroll holds for it, and (for an instance operator) Delete project. */
-export function projectSettingsHtml(view, csrf, notice) {
-    const held = `<p>Toolroll holds ${e(holdingsWords(view.holdings))} for <strong>${e(view.name)}</strong>.</p>`;
-    const head = `<section class="project-settings">${note(notice)}<p class="path">${e(view.repo)}</p>${held}${buildsHtml(view, csrf)}`;
+export function projectSettingsHtml(view, notice) {
+    const held = html `<p>Toolroll holds ${holdingsWords(view.holdings)} for <strong>${view.name}</strong>.</p>`;
+    const head = html `${note(notice)}<p class="path">${view.repo}</p>${held}${buildsHtml(view)}`;
     if (!view.canDelete)
-        return `${head}<p class="meta">An instance operator can delete a project.</p></section>`;
+        return html `<section class="project-settings">${head}<p class="meta">An instance operator can delete a project.</p></section>`;
     const body = view.running.length > 0
-        ? `<p class="problem">Its work is running: ${e(view.running.join(", "))}. Stop it before deleting the project.</p>`
-        : `<p>Removes everything Toolroll holds for ${e(view.name)}. The repository and its own branches stay. There's no undo.</p>` +
-            `<form method="post" action="/settings/project/delete"><input type="hidden" name="csrf" value="${e(csrf)}"><input type="hidden" name="repo" value="${e(view.repo)}">` +
-            `<label><span>Type <strong>${e(view.name)}</strong> to continue</span><input name="name" autocomplete="off" autocapitalize="off" spellcheck="false" required></label>` +
-            `<button type="submit">Continue</button></form>`;
+        ? html `<p class="problem">Its work is running: ${view.running.join(", ")}. Stop it before deleting the project.</p>`
+        : html `<p>Removes everything Toolroll holds for ${view.name}. The repository and its own branches stay. There's no undo.</p>${postForm("/settings/project/delete", html `<label><span>Type <strong>${view.name}</strong> to continue</span><input name="name" autocomplete="off" autocapitalize="off" spellcheck="false" required></label><button type="submit">Continue</button>`, { hidden: { repo: view.repo } })}`;
     // Removing is the reversible step: off the lists and the builder, everything kept.
-    const remove = `<form class="remove-project" method="post" action="/projects/remove"><input type="hidden" name="csrf" value="${e(csrf)}"><input type="hidden" name="repo" value="${e(view.repo)}">` +
-        `<button type="submit">Remove from Toolroll</button><p class="meta">Its tasks and results stay saved. Add it again to bring it back.</p></form>`;
-    return `${head}${remove}<details class="danger-zone"${notice.problem ? " open" : ""}><summary>Delete project</summary>${body}</details></section>`;
+    const remove = postForm("/projects/remove", html `<button type="submit">Remove from Toolroll</button><p class="meta">Its tasks and results stay saved. Add it again to bring it back.</p>`, { attrs: { class: "remove-project" }, hidden: { repo: view.repo } });
+    return html `<section class="project-settings">${head}${remove}<details class="danger-zone"${notice.problem ? html ` open` : ""}><summary>Delete project</summary>${body}</details></section>`;
 }
 /** The second step: exactly what goes, and the password. */
-export function projectDeleteConfirmHtml(view, csrf, problem) {
+export function projectDeleteConfirmHtml(view, problem) {
     const h = view.holdings;
     const count = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
     const items = [
@@ -59,10 +52,5 @@ export function projectDeleteConfirmHtml(view, csrf, problem) {
         ...(h.teammates > 0 ? [count(h.teammates, "teammate")] : []),
         "Its budgets, settings and knowledge",
     ];
-    return `<section class="project-delete">${problem === null ? "" : `<p class="problem" role="alert">${e(problem)}</p>`}` +
-        `<p>This removes:</p><ul class="removes">${items.map(one => `<li>${e(one)}</li>`).join("")}</ul>` +
-        `<p>The repository at <span class="path">${e(view.repo)}</span> and its own branches stay. The ledger keeps its history. There's no undo.</p>` +
-        `<form method="post" action="/settings/project/delete"><input type="hidden" name="csrf" value="${e(csrf)}"><input type="hidden" name="repo" value="${e(view.repo)}"><input type="hidden" name="name" value="${e(view.name)}"><input type="hidden" name="step" value="delete">` +
-        `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label>` +
-        `<div class="actions"><button type="submit" class="danger">Delete project</button><a href="/settings/project?repo=${e(encodeURIComponent(view.repo))}">Cancel</a></div></form></section>`;
+    return html `<section class="project-delete">${problem === null ? "" : html `<p class="problem" role="alert">${problem}</p>`}<p>This removes:</p><ul class="removes">${items.map(one => html `<li>${one}</li>`)}</ul><p>The repository at <span class="path">${view.repo}</span> and its own branches stay. The ledger keeps its history. There's no undo.</p>${postForm("/settings/project/delete", html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label><div class="actions"><button type="submit" class="danger">Delete project</button><a href="/settings/project?repo=${encodeURIComponent(view.repo)}">Cancel</a></div>`, { hidden: { repo: view.repo, name: view.name, step: "delete" } })}</section>`;
 }

package/dist/project-delete.js

@@ -207,35 +207,30 @@ function deleteRows(store, repo, d, now) {
     const notifications = json(ids(db, `SELECT id FROM notification WHERE project = ? OR ${IN("task_ref")} OR ${IN("source_run")}`, repo, T, R));
     const questions = json(ids(db, `SELECT id FROM teammate_question WHERE ${IN("teammate")} OR ${IN("card")}`, M, C));
     const proposals = json(ids(db, `SELECT id FROM mate_proposal WHERE ${IN("thread")}`, H));
-    const conversations = json(ids(db, `SELECT id FROM telegram_conversation WHERE ${IN("task_id")}`, K));
-    // Chats about the project's work, on every surface.
-    for (const surface of ["discord", "slack", "teams"]) {
-        del(`${surface}_progress`, IN("run"), R);
-        del(`${surface}_action`, IN("proposal"), proposals);
-        del(`${surface}_flow_action`, IN("card"), C);
-        del(`${surface}_flow_prompt`, IN("card"), C);
-        del(`${surface}_flow_choice`, IN("card"), C);
-        del(`${surface}_flow_note`, IN("card"), C);
-        del(`${surface}_question_action`, IN("question"), questions);
-        del(`${surface}_question_prompt`, IN("question"), questions);
-        del(`${surface}_ask_action`, IN("turn"), U);
-    }
-    del("telegram_action", IN("decision"), decisions);
-    del("telegram_decision_message", IN("decision"), decisions);
-    del("telegram_note_draft", IN("decision"), decisions);
-    del("telegram_proposal_action", IN("proposal"), proposals);
-    del("telegram_flow_action", IN("card"), C);
-    del("telegram_flow_prompt", IN("card"), C);
-    del("telegram_flow_choice", IN("card"), C);
+    // A chat message about one of the project's tasks (its turn named it), with its reply. Event ids are text ('m123'),
+    // and the same id can be another app's: each is kept whole, as provider:id.
+    const conversations = json(list(db, `SELECT provider || ':' || id FROM chat_event WHERE kind = 'message' AND json_extract(payload, '$.about.task') IN (SELECT value FROM json_each(?))`, K));
+    // Every app's planned parts about the project's work: a result screenshot, or a message naming one of its tasks or runs.
+    const parts = `SELECT provider || ':' || id FROM chat_part WHERE provider || ':' || event IN (SELECT value FROM json_each(?))
+    OR json_extract(payload, '$.image.taskId') IN (SELECT value FROM json_each(?)) OR json_extract(payload, '$.image.run') IN (SELECT value FROM json_each(?))`;
+    const doomedParts = `provider || ':' || part IN (${parts})`;
+    // Chats about the project's work, on every app.
+    del("chat_progress", IN("run"), R);
+    del("chat_action", `${IN("proposal")} OR ${IN("decision")} OR ${doomedParts}`, proposals, decisions, conversations, K, R);
+    del("chat_flow_action", `${IN("card")} OR ${doomedParts}`, C, conversations, K, R);
+    del("chat_flow_prompt", IN("card"), C);
+    del("chat_flow_choice", `${IN("card")} OR ${doomedParts}`, C, conversations, K, R);
+    del("chat_flow_note", IN("card"), C);
+    del("chat_question_action", `${IN("question")} OR ${doomedParts}`, questions, conversations, K, R);
+    del("chat_question_prompt", IN("question"), questions);
+    del("chat_ask_action", `${IN("turn")} OR ${doomedParts}`, U, conversations, K, R);
+    del("chat_note_draft", IN("decision"), decisions);
     del("flow_send", IN("card"), C);
-    del("telegram_question_action", IN("question"), questions);
-    del("telegram_question_prompt", IN("question"), questions);
     del("chat_decide_action", IN("task_id"), K);
     del("chat_decide_prompt", IN("task_id"), K);
-    del("telegram_task_message", `${IN("task_id")} OR ${IN("source_run")}`, K, R);
-    del("telegram_conversation_part", `${IN("conversation")} OR ${IN("source_run")} OR ${IN("task_id")}`, conversations, R, K);
-    del("telegram_conversation", IN("id"), conversations);
-    del("telegram_outbound_message", `project = ? OR ${IN("notification")} OR ${IN("task_ref")} OR ${IN("source_run")}`, repo, notifications, T, R);
+    del("chat_message_ref", `${IN("decision")} OR ${IN("task_id")} OR ${IN("run")} OR project = ? OR ${IN("notification")} OR ${IN("task_ref")}`, decisions, K, R, repo, notifications, T);
+    del("chat_part", `provider || ':' || id IN (${parts})`, conversations, K, R);
+    del("chat_event", `provider || ':' || id IN (SELECT value FROM json_each(?))`, conversations);
     del("chat_card_task", IN("task_ref"), T);
     del("chat_batch_item", IN("task_ref"), T);
     del("result_shot_sent", IN("run"), R);

package/dist/pull-request-ui.d.ts

@@ -1,6 +1,7 @@
 /** Settings → Projects → Pull requests: one project's pull-request setup, in plain words. Off shows what setup
  * found (or what to fix) and one Turn on; on shows where pull requests go and how they merge. Every change takes
  * the password; turning on restates the exact repository and branch that were checked. */
+import { type Html } from "./html.js";
 import type { Publishing, PublishingPlan } from "./pull-request-flow.js";
 export type PullRequestSettingsView = {
     repo: string;
@@ -19,5 +20,5 @@ export type PullRequestSettingsView = {
     said: string | null;
     problem: string | null;
 };
-export declare function pullRequestSettingsHtml(view: PullRequestSettingsView): string;
+export declare function pullRequestSettingsHtml(view: PullRequestSettingsView): Html;
 export declare const PULL_REQUEST_SETTINGS_CSS = "\n  .pr-settings { display: grid; gap: .6rem; max-width: 40rem; }\n  .pr-settings p, .pr-settings h2 { margin: 0; }\n  .pr-settings label { display: grid; gap: .25rem; }\n  .pr-settings label input[type=password], .pr-settings select { min-height: 44px; box-sizing: border-box; width: 100%; }\n  .pr-settings .pr-check { display: flex; align-items: center; gap: .5rem; min-height: 44px; }\n  .pr-settings button { min-height: 44px; justify-self: start; }\n  .pr-terms { margin: 0; padding-left: 1.1rem; display: grid; gap: .25rem; }\n  @media (max-width: 480px) { .pr-settings button { justify-self: stretch; } }\n";

package/dist/pull-request-ui.js

@@ -1,47 +1,32 @@
-const escape = (text) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+/** Settings → Projects → Pull requests: one project's pull-request setup, in plain words. Off shows what setup
+ * found (or what to fix) and one Turn on; on shows where pull requests go and how they merge. Every change takes
+ * the password; turning on restates the exact repository and branch that were checked. */
+import { html, postForm } from "./html.js";
 const METHOD_WORDS = { squash: "Squash and merge", merge: "Merge commit", rebase: "Rebase and merge" };
 export function pullRequestSettingsHtml(view) {
-    const hidden = (act) => `<input type="hidden" name="csrf" value="${escape(view.csrf)}"><input type="hidden" name="repo" value="${escape(view.repo)}"><input type="hidden" name="act" value="${act}">`;
-    const password = `<label>Password<input type="password" name="password" autocomplete="current-password" required></label>`;
+    const post = (act, body, hidden = {}) => postForm("/settings/pull-requests", body, { attrs: { class: "card pr-settings" }, hidden: { repo: view.repo, act, ...hidden } });
+    const password = html `<label>Password<input type="password" name="password" autocomplete="current-password" required></label>`;
     const notes = [
-        view.said === null ? "" : `<p class="notice" role="status">${escape(view.said)}</p>`,
-        view.problem === null ? "" : `<p class="problem" role="alert">${escape(view.problem)}</p>`,
-    ].join("");
-    const head = `<p class="meta">${escape(view.name)} · <span class="mono">${escape(view.repo)}</span></p>${notes}`;
+        view.said === null ? "" : html `<p class="notice" role="status">${view.said}</p>`,
+        view.problem === null ? "" : html `<p class="problem" role="alert">${view.problem}</p>`,
+    ];
+    const head = html `<p class="meta">${view.name} · <span class="mono">${view.repo}</span></p>${notes}`;
     const publishing = view.publishing;
     if (publishing.on) {
-        const status = `<section class="card pr-settings"><p><strong>On</strong> · <span class="mono">${escape(publishing.githubRepo)}</span> into <span class="mono">${escape(publishing.base)}</span></p>` +
-            `<p class="meta">${publishing.legacy ? "Every finished build opens a pull request (set up with publish grant)." : "Complete offers “Complete and open a pull request”."} Set up by ${escape(publishing.grantedBy)}.</p></section>`;
+        const status = html `<section class="card pr-settings"><p><strong>On</strong> · <span class="mono">${publishing.githubRepo}</span> into <span class="mono">${publishing.base}</span></p><p class="meta">${publishing.legacy ? "Every finished build opens a pull request (set up with publish grant)." : "Complete offers “Complete and open a pull request”."} Set up by ${publishing.grantedBy}.</p></section>`;
         if (!view.canChange)
-            return head + status;
-        const methods = ["squash", "merge", "rebase"].map(method => `<option value="${method}"${publishing.mergeMethod === method ? " selected" : ""}>${METHOD_WORDS[method]}${method === "squash" ? " (default)" : ""}</option>`).join("");
-        return head + status +
-            `<form method="post" action="/settings/pull-requests" class="card pr-settings">${hidden("settings")}` +
-            `<h2>Merging</h2>` +
-            `<label>Merge method<select name="method">${methods}</select></label>` +
-            `<label class="row pr-check"><input type="checkbox" name="when-green" value="1"${publishing.mergeWhenGreen ? " checked" : ""}> Merge when checks pass</label>` +
-            `<p class="meta">Off by default. When on, a pull request merges by itself once its checks pass on the completed commit. Branches are deleted after merging.</p>` +
-            `${password}<button type="submit">Save</button></form>` +
-            `<details class="settings-more"><summary>Turn off pull requests</summary>` +
-            `<form method="post" action="/settings/pull-requests" class="card pr-settings">${hidden("off")}` +
-            `<p class="meta">Nothing more is pushed. Open pull requests stay on GitHub.</p>${password}<button type="submit" class="danger">Turn off</button></form></details>`;
+            return html `${head}${status}`;
+        const methods = ["squash", "merge", "rebase"].map(method => html `<option value="${method}"${publishing.mergeMethod === method ? html ` selected` : ""}>${METHOD_WORDS[method]}${method === "squash" ? " (default)" : ""}</option>`);
+        return html `${head}${status}${post("settings", html `<h2>Merging</h2><label>Merge method<select name="method">${methods}</select></label><label class="row pr-check"><input type="checkbox" name="when-green" value="1"${publishing.mergeWhenGreen ? html ` checked` : ""}> Merge when checks pass</label><p class="meta">Off by default. When on, a pull request merges by itself once its checks pass on the completed commit. Branches are deleted after merging.</p>${password}<button type="submit">Save</button>`)}<details class="settings-more"><summary>Turn off pull requests</summary>${post("off", html `<p class="meta">Nothing more is pushed. Open pull requests stay on GitHub.</p>${password}<button type="submit" class="danger">Turn off</button>`)}</details>`;
     }
     const check = view.check;
     if (check === null)
-        return head + `<section class="card pr-settings"><p><strong>Off</strong></p><p class="meta">An approver can turn on pull requests.</p></section>`;
+        return html `${head}<section class="card pr-settings"><p><strong>Off</strong></p><p class="meta">An approver can turn on pull requests.</p></section>`;
     if (!check.ok) {
-        return head + `<section class="card pr-settings"><p><strong>Can’t turn on yet</strong></p><p>${escape(check.message)}</p>` +
-            `<p><a class="button-link" href="/settings/pull-requests?repo=${encodeURIComponent(view.repo)}">Check again</a></p></section>`;
+        return html `${head}<section class="card pr-settings"><p><strong>Can’t turn on yet</strong></p><p>${check.message}</p><p><a class="button-link" href="/settings/pull-requests?repo=${encodeURIComponent(view.repo)}">Check again</a></p></section>`;
     }
     const plan = check.plan;
-    return head +
-        `<form method="post" action="/settings/pull-requests" class="card pr-settings">${hidden("on")}` +
-        `<input type="hidden" name="github" value="${escape(plan.githubRepo)}"><input type="hidden" name="base" value="${escape(plan.base)}">` +
-        `<p><strong>Ready to turn on</strong></p>` +
-        `<ul class="pr-terms"><li>Pull requests open on <span class="mono">${escape(plan.githubRepo)}</span> into <span class="mono">${escape(plan.base)}</span>${plan.account === null ? "" : `, as ${escape(plan.account)}`}.</li>` +
-        `<li>Complete offers “Complete and open a pull request”, from the exact completed commit. A flow's Pull request zone can open one too.</li>` +
-        `<li>Merging squashes and deletes the branch. A person merges with their password; a flow merges only when its zone says so, after a person approved the card.</li></ul>` +
-        `${password}<button type="submit">Turn on pull requests</button></form>`;
+    return html `${head}${post("on", html `<p><strong>Ready to turn on</strong></p><ul class="pr-terms"><li>Pull requests open on <span class="mono">${plan.githubRepo}</span> into <span class="mono">${plan.base}</span>${plan.account === null ? "" : `, as ${plan.account}`}.</li><li>Complete offers “Complete and open a pull request”, from the exact completed commit. A flow's Pull request zone can open one too.</li><li>Merging squashes and deletes the branch. A person merges with their password; a flow merges only when its zone says so, after a person approved the card.</li></ul>${password}<button type="submit">Turn on pull requests</button>`, { github: plan.githubRepo, base: plan.base })}`;
 }
 export const PULL_REQUEST_SETTINGS_CSS = `
   .pr-settings { display: grid; gap: .6rem; max-width: 40rem; }