toolroll 0.9.53 → 0.9.55

package/dist/server-telemetry.d.ts

@@ -2,9 +2,10 @@ import type { BudgetLimit } from './request-budget.js';
 import type { IncomingMessage, ServerResponse } from 'node:http';
 export declare const TELEMETRY_WINDOW_MS = 300000;
 export declare const LATENCY_BUCKETS: number[];
-export declare const ROUTE_FAMILIES: readonly ['cli', 'mcp', 'team', 'team-stream', 'chat', 'chat-stream', 'flows', 'flow-stream', 'tasks', 'results', 'decisions', 'sessions', 'settings', 'projects', 'assets', 'auth', 'metrics', 'health', 'console', 'other'];
+export declare const ROUTE_FAMILIES: readonly ['cli', 'mcp', 'team', 'live', 'chat', 'flows', 'tasks', 'results', 'decisions', 'sessions', 'settings', 'projects', 'assets', 'auth', 'metrics', 'health', 'console', 'other'];
 export type RouteFamily = typeof ROUTE_FAMILIES[number];
-export type StreamFamily = 'team-stream' | 'chat-stream' | 'flow-stream' | 'other';
+/** Every page's live updates are one stream (GET /live). */
+export type StreamFamily = 'live' | 'other';
 export declare const STREAM_FAMILIES: readonly StreamFamily[];
 export declare const QUEUE_BUCKETS: number[];
 /** Only literals from the allowlist can become labels, including for unknown or malformed paths. */
@@ -54,7 +55,7 @@ export type HealthSnapshot = {
 export declare class ServerTelemetry {
     readonly clock: () => number;
     readonly requests: TimingHistogram;
-    readonly routes: Map<"assets" | "auth" | "chat" | "chat-stream" | "cli" | "console" | "decisions" | "flow-stream" | "flows" | "health" | "mcp" | "metrics" | "other" | "projects" | "results" | "sessions" | "settings" | "tasks" | "team" | "team-stream", TimingHistogram>;
+    readonly routes: Map<"assets" | "auth" | "chat" | "cli" | "console" | "decisions" | "flows" | "health" | "live" | "mcp" | "metrics" | "other" | "projects" | "results" | "sessions" | "settings" | "tasks" | "team", TimingHistogram>;
     readonly eventLoop: TimingHistogram;
     readonly writeWait: TimingHistogram;
     readonly writeHold: TimingHistogram;

package/dist/server-telemetry.js

@@ -5,8 +5,8 @@ const SLICE_MS = 10_000;
 /** monitorEventLoopDelay samples by sleeping this long, so every raw sample includes it. */
 const EVENT_LOOP_RESOLUTION_MS = 20;
 export const LATENCY_BUCKETS = [0.0001, 0.00025, 0.0005, 0.001, 0.0025, 0.005, 0.01, 0.015, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 15, 30, 60];
-export const ROUTE_FAMILIES = ['cli', 'mcp', 'team', 'team-stream', 'chat', 'chat-stream', 'flows', 'flow-stream', 'tasks', 'results', 'decisions', 'sessions', 'settings', 'projects', 'assets', 'auth', 'metrics', 'health', 'console', 'other'];
-export const STREAM_FAMILIES = ['team-stream', 'chat-stream', 'flow-stream', 'other'];
+export const ROUTE_FAMILIES = ['cli', 'mcp', 'team', 'live', 'chat', 'flows', 'tasks', 'results', 'decisions', 'sessions', 'settings', 'projects', 'assets', 'auth', 'metrics', 'health', 'console', 'other'];
+export const STREAM_FAMILIES = ['live', 'other'];
 export const QUEUE_BUCKETS = [0, 1024, 4096, 16384, 65536, 262144, 1048576];
 /** Only literals from the allowlist can become labels, including for unknown or malformed paths. */
 export function routeFamily(raw) {
@@ -21,14 +21,10 @@ export function routeFamily(raw) {
         return 'cli';
     if (path === '/mcp' || path.startsWith('/mcp/'))
         return 'mcp';
-    if (path === '/api/team/events')
-        return 'team-stream';
+    if (path === '/live')
+        return 'live';
     if (path === '/api/team')
         return 'team';
-    if (path === '/chat/stream')
-        return 'chat-stream';
-    if (/^\/flows\/[^/]+\/live$/.test(path))
-        return 'flow-stream';
     if (path === '/metrics')
         return 'metrics';
     if (path === '/health')

package/dist/skills-ui.d.ts

@@ -1,3 +1,4 @@
+import { type Html } from "./html.js";
 import type { SkillsSnapshot, SkillsView, skillTestResult } from "./project-skills.js";
 export declare const SKILLS_CSS = ".skills{max-width:780px;min-width:0;overflow-wrap:anywhere}.skills h2{font-size:1.1rem}.skills .card{padding:18px;margin:14px 0;min-width:0}.skills form,.skills label{display:grid;gap:10px}.skills input,.skills textarea,.skills select{box-sizing:border-box;width:100%;max-width:100%;min-width:0}.skills textarea{resize:vertical;min-height:130px}.skills button{justify-self:start;white-space:nowrap;min-height:44px}.skills summary{cursor:pointer;min-height:44px;display:flex;align-items:center;gap:10px;flex-wrap:wrap}.skills pre{white-space:pre-wrap;overflow-wrap:anywhere;max-height:360px;overflow:auto;font-size:.9rem}.skills .skill-heading{display:flex;align-items:baseline;justify-content:space-between;gap:12px}.skills .skill-heading h2{margin:0}.skills .skill-state{font-size:.85rem;flex-shrink:0}.skills .skill-source{font-size:.85rem}.skills .skill-controls{display:flex;gap:12px;flex-wrap:wrap}.skills .skill-controls form{margin:0}.skills details details{margin-top:10px}.skills [hidden]{display:none!important}.skills .skill-files{max-height:200px;overflow:auto}.skills .problem{padding:12px}@media(max-width:600px){.skills input,.skills textarea,.skills select{font-size:16px}.skills .card{padding:14px}.skills .skill-heading{align-items:flex-start}}";
 export declare function skillsHtml(view: SkillsView, csrf: string, canManage: boolean, options?: {
@@ -5,7 +6,7 @@ export declare function skillsHtml(view: SkillsView, csrf: string, canManage: bo
     error?: string;
     draft?: Record<string, string>;
     agent?: string;
-}): string;
-export declare function skillsSnapshotHtml(snapshot: SkillsSnapshot | null): string;
+}): Html;
+export declare function skillsSnapshotHtml(snapshot: SkillsSnapshot | null): Html | "";
 export declare function skillsScript(): string;
-export declare function skillTestFeedbackHtml(test: NonNullable<ReturnType<typeof skillTestResult>>, csrf: string, canManage: boolean, error?: string, draft?: string): string;
+export declare function skillTestFeedbackHtml(test: NonNullable<ReturnType<typeof skillTestResult>>, csrf: string, canManage: boolean, error?: string, draft?: string): Html;

package/dist/skills-ui.js

@@ -1,28 +1,26 @@
 import { randomUUID } from "node:crypto";
 import { whenUtc } from "./when-html.js";
-const e = (value) => String(value ?? "").replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
-const hidden = (data) => Object.entries(data)
-    .map(([k, v]) => `<input type="hidden" name="${e(k)}" value="${e(v)}">`)
-    .join("");
+import { html, joinHtml, postForm } from "./html.js";
+// Hidden fields as they always were: a missing value is an empty field.
+const fields = (data) => Object.fromEntries(Object.entries(data).map(([k, v]) => [k, String(v ?? "")]));
 export const SKILLS_CSS = `.skills{max-width:780px;min-width:0;overflow-wrap:anywhere}.skills h2{font-size:1.1rem}.skills .card{padding:18px;margin:14px 0;min-width:0}.skills form,.skills label{display:grid;gap:10px}.skills input,.skills textarea,.skills select{box-sizing:border-box;width:100%;max-width:100%;min-width:0}.skills textarea{resize:vertical;min-height:130px}.skills button{justify-self:start;white-space:nowrap;min-height:44px}.skills summary{cursor:pointer;min-height:44px;display:flex;align-items:center;gap:10px;flex-wrap:wrap}.skills pre{white-space:pre-wrap;overflow-wrap:anywhere;max-height:360px;overflow:auto;font-size:.9rem}.skills .skill-heading{display:flex;align-items:baseline;justify-content:space-between;gap:12px}.skills .skill-heading h2{margin:0}.skills .skill-state{font-size:.85rem;flex-shrink:0}.skills .skill-source{font-size:.85rem}.skills .skill-controls{display:flex;gap:12px;flex-wrap:wrap}.skills .skill-controls form{margin:0}.skills details details{margin-top:10px}.skills [hidden]{display:none!important}.skills .skill-files{max-height:200px;overflow:auto}.skills .problem{padding:12px}@media(max-width:600px){.skills input,.skills textarea,.skills select{font-size:16px}.skills .card{padding:14px}.skills .skill-heading{align-items:flex-start}}`;
 function source(skill) {
-    return `<p class="skill-source">${e(skill.source)} · ${skill.sha.slice(0, 10)}</p><p>${skill.files.length} files · ${Math.ceil(skill.files.reduce((n, f) => n + Buffer.from(f.base64, "base64").length, 0) / 1024)} KB</p><pre>${e(Buffer.from(skill.files.find((f) => f.path === "SKILL.md").base64, "base64").toString("utf8"))}</pre><details><summary>Package files</summary><ul class="skill-files">${skill.files.map((f) => `<li>${e(f.path)}</li>`).join("")}</ul></details>`;
+    return html `<p class="skill-source">${skill.source} · ${skill.sha.slice(0, 10)}</p><p>${skill.files.length} files · ${Math.ceil(skill.files.reduce((n, f) => n + Buffer.from(f.base64, "base64").length, 0) / 1024)} KB</p><pre>${Buffer.from(skill.files.find((f) => f.path === "SKILL.md").base64, "base64").toString("utf8")}</pre><details><summary>Package files</summary><ul class="skill-files">${skill.files.map((f) => html `<li>${f.path}</li>`)}</ul></details>`;
 }
 export function skillsHtml(view, csrf, canManage, options = {}) {
     const manage = canManage && !!csrf, base = {
-        csrf,
         repo: view.repo,
         identity: view.identity,
         revision: view.revision,
     };
-    const form = (action, contents, extra = {}) => `<form method="post" action="/settings/skills/change">${hidden({ ...base, action, ...extra })}${contents}</form>`;
+    const form = (action, contents, extra = {}) => postForm("/settings/skills/change", contents, { hidden: fields({ ...base, action, ...extra }) });
     const active = Object.values(view.selection).filter((c) => c.enabled).length;
     const renderSkill = (skill) => {
         const enabled = view.selection[skill.name]?.sha === skill.sha &&
             view.selection[skill.name]?.enabled === true;
         const replaced = view.selection[skill.name]?.enabled &&
             view.selection[skill.name]?.sha !== skill.sha;
-        return `<article class="card" id="skill-${skill.sha}"><div class="skill-heading"><h2>${e(skill.name)}</h2><span class="skill-state">${enabled ? "Enabled" : "In library"}</span></div><p>${e(skill.description)}</p>${skill.requirements ? `<p><strong>Requires:</strong> ${e(skill.requirements)} <span class="meta">Availability is checked when the agent tests or uses it.</span></p>` : ""}${skill.warnings.map((w) => `<p class="meta">${e(w)}</p>`).join("")}<details${options.focus === skill.sha ? " open" : ""}><summary>Review skill</summary>${source(skill)}${manage ? form(enabled ? "disable" : "enable", `${replaced ? "<p>Replaces the enabled version of this skill for new tasks.</p>" : ""}<button>${enabled ? "Disable skill" : "Enable skill"}</button>`, { sha: skill.sha }) : ""}</details>${manage ? `<details${options.draft?.["sha"] === skill.sha ? " open" : ""}><summary>Test skill</summary>${form("test", `<p>${e(options.agent ?? "Uses this project’s configured report agent")}. Runs a read-only sample through the normal task and approval flow.</p><label>Sample request<textarea name="sample" required maxlength="800" placeholder="Review this project’s home page and suggest three clearer button labels.">${e(options.draft?.["sha"] === skill.sha ? (options.draft?.["sample"] ?? "") : "")}</textarea></label><p class="meta">The report shows what worked and what needs tools or permission. Enabled status alone does not prove use.</p><button>Create test</button>`, { sha: skill.sha, nonce: randomUUID() })}</details>` : ""}</article>`;
+        return html `<article class="card" id="skill-${skill.sha}"><div class="skill-heading"><h2>${skill.name}</h2><span class="skill-state">${enabled ? "Enabled" : "In library"}</span></div><p>${skill.description}</p>${skill.requirements ? html `<p><strong>Requires:</strong> ${skill.requirements} <span class="meta">Availability is checked when the agent tests or uses it.</span></p>` : ""}${skill.warnings.map((w) => html `<p class="meta">${w}</p>`)}<details${options.focus === skill.sha ? html ` open` : ""}><summary>Review skill</summary>${source(skill)}${manage ? form(enabled ? "disable" : "enable", html `${replaced ? html `<p>Replaces the enabled version of this skill for new tasks.</p>` : ""}<button>${enabled ? "Disable skill" : "Enable skill"}</button>`, { sha: skill.sha }) : ""}</details>${manage ? html `<details${options.draft?.["sha"] === skill.sha ? html ` open` : ""}><summary>Test skill</summary>${form("test", html `<p>${options.agent ?? "Uses this project’s configured report agent"}. Runs a read-only sample through the normal task and approval flow.</p><label>Sample request<textarea name="sample" required maxlength="800" placeholder="Review this project’s home page and suggest three clearer button labels.">${options.draft?.["sha"] === skill.sha ? (options.draft?.["sample"] ?? "") : ""}</textarea></label><p class="meta">The report shows what worked and what needs tools or permission. Enabled status alone does not prove use.</p><button>Create test</button>`, { sha: skill.sha, nonce: randomUUID() })}</details>` : ""}</article>`;
     };
     const names = [...new Set(view.library.map((s) => s.name))];
     const cards = names
@@ -31,29 +29,28 @@ export function skillsHtml(view, csrf, canManage, options = {}) {
             versions.find((s) => s.sha === view.selection[name]?.sha) ??
             versions.at(-1);
         const older = versions.filter((s) => s !== primary);
-        return `<div data-skill-group data-skill-query="${e(name + " " + primary.description)}">${renderSkill(primary)}${older.length ? `<details><summary>Other versions (${older.length})</summary>${older.map(renderSkill).join("")}</details>` : ""}</div>`;
-    })
-        .join("");
+        return html `<div data-skill-group data-skill-query="${name + " " + primary.description}">${renderSkill(primary)}${older.length ? html `<details><summary>Other versions (${older.length})</summary>${older.map(renderSkill)}</details>` : ""}</div>`;
+    });
     const search = names.length > 5
-        ? '<label>Search library<input type="search" data-skill-search placeholder="Name or description"></label><p data-skill-no-matches hidden>No matching skills.</p>'
+        ? html `<label>Search library<input type="search" data-skill-search placeholder="Name or description"></label><p data-skill-no-matches hidden>No matching skills.</p>`
         : "";
     const d = options.draft ?? {};
     const add = manage
-        ? `<details class="card"${options.error && options.draft?.["method"] ? " open" : ""}><summary>Add skill</summary><form method="post" action="/settings/skills/import" data-skill-import>${hidden(base)}<label>Add from<select name="method" data-skill-method><option value="paste"${d["method"] === "paste" ? " selected" : ""}>Paste SKILL.md</option><option value="github"${d["method"] === "github" ? " selected" : ""}>GitHub folder</option><option value="folder"${d["method"] === "folder" ? " selected" : ""}>Local folder</option></select></label><div data-skill-input="paste"><label>SKILL.md<textarea name="content" rows="8" maxlength="24576" placeholder="---&#10;name: design-review&#10;description: Review interface copy and layout.&#10;---&#10;Write your instructions here.">${e(d["content"])}</textarea></label></div><div data-skill-input="github"><label>Public GitHub folder<input name="url" type="url" value="${e(d["url"])}" placeholder="https://github.com/owner/repo/tree/main/skills/review"></label></div><div data-skill-input="folder"><label>Skill folder<input type="file" webkitdirectory multiple data-skill-folder></label><input type="hidden" name="files" value=""><p class="meta">Choose the folder containing SKILL.md. Up to 64 files, 1 MB total.</p><noscript>Folder uploads require JavaScript. You can paste SKILL.md or use a GitHub folder.</noscript></div><p class="meta">Added to your library first. Review its source and requirements before enabling it.</p><p data-skill-error role="alert" hidden></p><button>Add to library</button></form></details>`
+        ? html `<details class="card"${options.error && options.draft?.["method"] ? html ` open` : ""}><summary>Add skill</summary>${postForm("/settings/skills/import", html `<label>Add from<select name="method" data-skill-method><option value="paste"${d["method"] === "paste" ? html ` selected` : ""}>Paste SKILL.md</option><option value="github"${d["method"] === "github" ? html ` selected` : ""}>GitHub folder</option><option value="folder"${d["method"] === "folder" ? html ` selected` : ""}>Local folder</option></select></label><div data-skill-input="paste"><label>SKILL.md<textarea name="content" rows="8" maxlength="24576" placeholder="---&#10;name: design-review&#10;description: Review interface copy and layout.&#10;---&#10;Write your instructions here.">${d["content"]}</textarea></label></div><div data-skill-input="github"><label>Public GitHub folder<input name="url" type="url" value="${d["url"]}" placeholder="https://github.com/owner/repo/tree/main/skills/review"></label></div><div data-skill-input="folder"><label>Skill folder<input type="file" webkitdirectory multiple data-skill-folder></label><input type="hidden" name="files" value=""><p class="meta">Choose the folder containing SKILL.md. Up to 64 files, 1 MB total.</p><noscript>Folder uploads require JavaScript. You can paste SKILL.md or use a GitHub folder.</noscript></div><p class="meta">Added to your library first. Review its source and requirements before enabling it.</p><p data-skill-error role="alert" hidden></p><button>Add to library</button>`, { attrs: { "data-skill-import": true }, hidden: fields(base) })}</details>`
         : "";
     const history = view.history.length
-        ? `<details><summary>Change history</summary>${view.history.map((h) => `<div class="card"><p>Selection ${h.revision} · ${e(h.actor)} · ${whenUtc(h.at)}</p><ul>${h.enabled.length ? h.enabled.map((s) => `<li>${e(s.name)} · ${e(s.version)}</li>`).join("") : "<li>No skills enabled</li>"}</ul>${manage && h.revision !== view.revision ? form("restore", "<button>Restore selection</button>", { restore: h.revision }) : '<span class="meta">Current selection</span>'}</div>`).join("")}</details>`
+        ? html `<details><summary>Change history</summary>${view.history.map((h) => html `<div class="card"><p>Selection ${h.revision} · ${h.actor} · ${whenUtc(h.at)}</p><ul>${h.enabled.length ? h.enabled.map((s) => html `<li>${s.name} · ${s.version}</li>`) : html `<li>No skills enabled</li>`}</ul>${manage && h.revision !== view.revision ? form("restore", html `<button>Restore selection</button>`, { restore: h.revision }) : html `<span class="meta">Current selection</span>`}</div>`)}</details>`
         : "";
-    return `<section class="skills">${options.error ? `<p class="problem" role="alert">${e(options.error)}</p>` : ""}<p>${active ? `${active} skill${active === 1 ? "" : "s"} enabled for new tasks.` : "No skills enabled for this project."} Active tasks keep their saved versions.</p>${add}${search}${cards || "<p>Your library is empty. Add a skill to review and enable it here.</p>"}${history}</section>`;
+    return html `<section class="skills">${options.error ? html `<p class="problem" role="alert">${options.error}</p>` : ""}<p>${active ? `${active} skill${active === 1 ? "" : "s"} enabled for new tasks.` : "No skills enabled for this project."} Active tasks keep their saved versions.</p>${add}${search}${cards.length ? cards : html `<p>Your library is empty. Add a skill to review and enable it here.</p>`}${history}</section>`;
 }
 export function skillsSnapshotHtml(snapshot) {
     if (!snapshot || !snapshot.packages.length)
         return "";
-    return `<details class="skills"><summary>Skills supplied (${snapshot.packages.length})</summary><p class="meta">Exact versions supplied to this run. This does not confirm the agent read or applied them.</p>${snapshot.packages.map((s) => `<details><summary>${e(s.name)} · ${s.sha.slice(0, 10)}</summary>${source(s)}</details>`).join("")}</details>`;
+    return html `<details class="skills"><summary>Skills supplied (${snapshot.packages.length})</summary><p class="meta">Exact versions supplied to this run. This does not confirm the agent read or applied them.</p>${snapshot.packages.map((s) => html `<details><summary>${s.name} · ${s.sha.slice(0, 10)}</summary>${source(s)}</details>`)}</details>`;
 }
 export function skillsScript() {
     return `(()=>{const search=document.querySelector('[data-skill-search]');if(search)search.addEventListener('input',()=>{let found=0;document.querySelectorAll('[data-skill-group]').forEach(el=>{el.hidden=!el.dataset.skillQuery.toLowerCase().includes(search.value.trim().toLowerCase());if(!el.hidden)found++;});document.querySelector('[data-skill-no-matches]').hidden=found>0;});const form=document.querySelector('[data-skill-import]');if(!form)return;const method=form.querySelector('[data-skill-method]'),error=form.querySelector('[data-skill-error]');function sync(){form.querySelectorAll('[data-skill-input]').forEach(el=>{el.hidden=el.dataset.skillInput!==method.value;el.querySelectorAll('input,textarea').forEach(i=>i.disabled=el.hidden);});}method.addEventListener('change',sync);sync();form.addEventListener('submit',async event=>{if(method.value!=='folder')return;if(form.dataset.prepared==='yes'){delete form.dataset.prepared;return;}event.preventDefault();error.hidden=true;const button=form.querySelector('button');button.disabled=true;try{const files=Array.from(form.querySelector('[data-skill-folder]').files);if(!files.length||files.length>64||files.reduce((n,f)=>n+f.size,0)>1048576||files.some(f=>f.size>262144))throw Error('Choose one skill folder with up to 64 files and 1 MB total.');const packed=[];for(const file of files){const parts=file.webkitRelativePath.split('/');parts.shift();const data=new Uint8Array(await file.arrayBuffer());let binary='';for(const byte of data)binary+=String.fromCharCode(byte);packed.push({path:parts.join('/'),base64:btoa(binary)});}form.querySelector('[name=files]').value=JSON.stringify(packed);form.dataset.prepared='yes';button.disabled=false;form.requestSubmit();}catch(e){error.textContent=e.message||'The folder could not be read. Select it again.';error.hidden=false;button.disabled=false;}});})();`;
 }
 export function skillTestFeedbackHtml(test, csrf, canManage, error = "", draft = "") {
-    return `<section class="skills" id="skill-test-feedback"><h2>Improve this test</h2>${test.sourceRun ? `<p>Revises test run #${test.sourceRun}.</p>` : ""}${test.feedback ? `<details><summary>Feedback for this test</summary><p>${e(test.feedback)}</p></details>` : ""}${test.revisions.length ? `<p>${test.revisions.map((id, i) => `<a href="/t/${encodeURIComponent(id)}">Test revision ${i + 1}</a>`).join(" · ")}</p>` : ""}${error ? `<p role="alert">${e(error)}</p>` : ""}${canManage && csrf ? `<form method="post" action="/settings/skills/revise">${hidden({ csrf, repo: test.repo, run: test.run, nonce: randomUUID() })}<label>What should change?<textarea name="feedback" required maxlength="500" rows="3" placeholder="Try a clearer action label and explain why it fits the user’s goal.">${e(draft)}</textarea></label><p class="meta">Creates another report task with this skill version and your feedback. Review its scope before it runs.</p><button>Create revision</button></form>` : ""}</section>`;
+    return html `<section class="skills" id="skill-test-feedback"><h2>Improve this test</h2>${test.sourceRun ? html `<p>Revises test run #${test.sourceRun}.</p>` : ""}${test.feedback ? html `<details><summary>Feedback for this test</summary><p>${test.feedback}</p></details>` : ""}${test.revisions.length ? html `<p>${joinHtml(test.revisions.map((id, i) => html `<a href="/t/${encodeURIComponent(id)}">Test revision ${i + 1}</a>`), " · ")}</p>` : ""}${error ? html `<p role="alert">${error}</p>` : ""}${canManage && csrf ? postForm("/settings/skills/revise", html `<label>What should change?<textarea name="feedback" required maxlength="500" rows="3" placeholder="Try a clearer action label and explain why it fits the user’s goal.">${draft}</textarea></label><p class="meta">Creates another report task with this skill version and your feedback. Review its scope before it runs.</p><button>Create revision</button>`, { hidden: fields({ repo: test.repo, run: test.run, nonce: randomUUID() }) }) : ""}</section>`;
 }

package/dist/skills.d.ts

@@ -67,7 +67,7 @@ export declare function applyInstall(repo: string, writeContext: boolean): Insta
  * project setup flow.
  */
 export declare const CLAUDE_CODE_MANAGED_MARK = "<!-- standing-orders:claude-code-skill:v1 -->";
-export declare const CLAUDE_CODE_GUIDES: readonly ["console", "operating", "runner"];
+export declare const CLAUDE_CODE_GUIDES: readonly ["console", "operating", "runner", "release"];
 /** The thin user-level skill `toolroll onboard` writes (agent-onboard.ts). */
 export declare const OPERATOR_SKILL_MARK = "<!-- toolroll:operator-skill:v1";
 export type ClaudeCodeSkillFile = {

package/dist/skills.js

@@ -161,7 +161,7 @@ export function applyInstall(repo, writeContext) {
  * project setup flow.
  */
 export const CLAUDE_CODE_MANAGED_MARK = "<!-- standing-orders:claude-code-skill:v1 -->";
-export const CLAUDE_CODE_GUIDES = ["console", "operating", "runner"];
+export const CLAUDE_CODE_GUIDES = ["console", "operating", "runner", "release"];
 /** The thin user-level skill `toolroll onboard` writes (agent-onboard.ts). */
 export const OPERATOR_SKILL_MARK = "<!-- toolroll:operator-skill:v1";
 export function defaultClaudeCodeSkillDir(home = homedir()) {
@@ -213,6 +213,7 @@ Use the installed \`toolroll\` command. Its live help is authoritative.
 - [Console guide](console.md) — where a person can review and act.
 - [Operating guide](operating.md) — the command contract and safe workflow.
 - [Runner guide](runner.md) — claims, leases, heartbeats, and fencing.
+- [Release guide](release.md) — releasing Toolroll itself with \`toolroll release <branch>\`.
 `;
 }
 /** One linked file, generated from the guide embedded in this binary. */

package/dist/slack-api.d.ts

@@ -1,5 +1,9 @@
 import { ChatDeliveryError } from "./chat-delivery-state.js";
-import { type SlackIdentity } from "./slack-state.js";
+import { type ChatIdentity } from "./chat-delivery-state.js";
+/** A Slack app installation: the chat identity, with the workspace (team) it belongs to. */
+export type SlackIdentity = ChatIdentity & {
+    team: string;
+};
 export type SlackCredentials = SlackIdentity & {
     appToken: string;
     botToken: string;

package/dist/slack-api.js

@@ -2,7 +2,7 @@ import { ChatDeliveryError } from "./chat-delivery-state.js";
 import { chmodSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { join } from "node:path";
 import { randomBytes } from "node:crypto";
-import { slackHash } from "./slack-state.js";
+import { chatHash } from "./chat-delivery-state.js";
 export class SlackError extends ChatDeliveryError {
     constructor(code, retryMs = 5_000, uncertain = false) {
         super(code, retryMs, uncertain);
@@ -128,7 +128,7 @@ export async function checkSlackCredentials(appToken, botToken, fetcher = fetch)
         app: String(detail.app_id),
         bot: String(auth.user_id),
         workspace: typeof auth.team === "string" ? auth.team : "Slack",
-        installation: slackHash(`${auth.team_id}:${detail.app_id}:${auth.user_id}`),
+        installation: chatHash(`${auth.team_id}:${detail.app_id}:${auth.user_id}`),
     };
 }
 export function object(value) {

package/dist/slack-chat.d.ts

@@ -1,5 +1,5 @@
-import { SlackState, type SlackIdentity, type SlackBinding, type SlackEvent } from "./slack-state.js";
-import { uploadSlackBytes, type SlackApi } from "./slack-api.js";
+import { ChatState, type ChatBinding, type ChatContent, type ChatEvent } from "./chat-delivery-state.js";
+import { uploadSlackBytes, type SlackApi, type SlackIdentity } from "./slack-api.js";
 import { type Store } from "./store.js";
 import type { SubscriptionMateRunner } from "./subscription-chat.js";
 export type SlackChatOptions = {
@@ -17,9 +17,14 @@ export type SlackChatOptions = {
     upload?: typeof uploadSlackBytes;
 };
 /** Synchronous receipt before ACK. Never stores response_url, raw tokens, or a pairing code. */
-export declare function receiveSlack(state: SlackState, identity: SlackIdentity, type: string, raw: unknown, now: Date): boolean;
+export declare function receiveSlack(state: ChatState, identity: SlackIdentity, type: string, raw: unknown, now: Date): boolean;
 export declare const processSlackEvent: (options: SlackChatOptions) => Promise<boolean>;
-export declare const applySlackAction: (options: SlackChatOptions, event: SlackEvent, binding: SlackBinding, repos: readonly string[]) => void;
+export declare const applySlackAction: (options: SlackChatOptions, event: ChatEvent, binding: ChatBinding, repos: readonly string[]) => {
+    merge: import("./chat-decide.js").ChatMerge;
+    part: number;
+    shown: string;
+    content: ChatContent;
+} | null;
 export declare const planSlackNotifications: (options: SlackChatOptions) => Promise<void>;
 export declare const planSlackRooms: (options: SlackChatOptions) => Promise<void>;
 export declare function slackBlocks(text: string, buttons?: Record<string, unknown>[]): Record<string, unknown>[];

package/dist/slack-chat.js

@@ -9,8 +9,7 @@ import { processChatEvent, applyChatAction, planChatNotifications, channelAccess
 import { proposalPreview, proposalLink, proposalOutcomeText, armedCardText, armedYesLabel, } from "./chat-channel.js";
 import { MATE_MESSAGE_MAX_CHARS } from "./mate.js";
 import { renderReply } from "./reply-shape.js";
-import { SlackState, slackHash, } from "./slack-state.js";
-import { ChatDeliveryError, partContent } from "./chat-delivery-state.js";
+import { ChatDeliveryError, ChatState, chatHash, partContent } from "./chat-delivery-state.js";
 import { readChatPart } from "./contracts/chat-content.js";
 import { readSlackBlockActions, readSlackButton, SLACK_LINK_ACTION } from "./contracts/slack-callback.js";
 import { object, slackId, slackTs, slackMember, SlackError, uploadSlackBytes, } from "./slack-api.js";
@@ -64,12 +63,12 @@ export function receiveSlack(state, identity, type, raw, now) {
         const match = /^pair ([a-f0-9]{32})$/.exec(event.text.trim());
         kind = match ? "pair" : "message";
         payload = match
-            ? { hash: slackHash(match[1]) }
+            ? { hash: chatHash(match[1]) }
             : {
                 text: event.text.slice(0, MATE_MESSAGE_MAX_CHARS + 1),
                 originalLength: event.text.length,
             };
-        id = slackHash(`${identity.installation}:event:${body.event_id}`);
+        id = chatHash(`${identity.installation}:event:${body.event_id}`);
     }
     else if (type === "interactive" && body.type === "block_actions") {
         const interaction = readSlackBlockActions(body);
@@ -88,7 +87,7 @@ export function receiveSlack(state, identity, type, raw, now) {
         const button = readSlackButton(interaction.value);
         payload = button.ok ? { token: button.value.value } : { problem: button.issues.map(issue => issue.line).join("; ") };
         const tapped = actions[0];
-        id = slackHash(`${identity.installation}:action:${member}:${ts}:${tapped?.value ?? ""}:${tapped?.action_ts ?? ""}`);
+        id = chatHash(`${identity.installation}:action:${member}:${ts}:${tapped?.value ?? ""}:${tapped?.action_ts ?? ""}`);
     }
     else
         return false;
@@ -131,7 +130,7 @@ export function receiveSlack(state, identity, type, raw, now) {
 }
 const delivery = (options) => ({
     ...options,
-    state: new SlackState(options.store),
+    state: new ChatState(options.store, "slack"),
     label: "Slack",
     member: (member, channel) => slackMember(options.api, options.identity, member, channel),
     // A 👍 on the owner's message where the app has reactions:write; Slack shows bots no typing indicator.
@@ -201,26 +200,20 @@ function linkButton(origin, link) {
     }
 }
 export async function deliverSlackPart(options) {
-    const state = new SlackState(options.store), { store, identity } = options, now = nowOf(options);
+    const state = new ChatState(options.store, "slack"), { store, identity } = options, now = nowOf(options);
     if (!state.owns(identity.installation, options.owner, now) ||
         !options.current())
         return false;
-    const row = state.db
-        .prepare("SELECT p.* FROM slack_part p JOIN slack_event e ON e.id=p.event WHERE e.installation=? AND p.state='pending' AND (e.kind!='notice' OR ?=1) AND (p.next_at IS NULL OR p.next_at<=?) ORDER BY p.id LIMIT 1")
-        .get(identity.installation, options.canNotify?.() === false ? 0 : 1, now.toISOString());
+    const row = state.nextPart(identity.installation, options.canNotify?.() !== false, now);
     if (!row)
         return false;
     const event = state.event(row.event), binding = event.binding === null ? null : state.bindingById(event.binding);
     if (!binding) {
-        state.db
-            .prepare("UPDATE slack_part SET state='dropped',problem='Chat access changed' WHERE id=?")
-            .run(row.id);
+        state.dropPart(row.id, "Chat access changed");
         return true;
     }
     if (new Date(row.created).getTime() + 86_400_000 < now.getTime()) {
-        state.db
-            .prepare("UPDATE slack_part SET state='dropped',problem='Delivery expired; open the saved chat to recover it' WHERE id=?")
-            .run(row.id);
+        state.dropPart(row.id, "Delivery expired; open the saved chat to recover it");
         return true;
     }
     try {
@@ -235,15 +228,15 @@ export async function deliverSlackPart(options) {
             !repos.includes(store.lookupRef(content.task)?.repo ?? ""))
             throw new SlackError("Connected projects changed");
         // A screenshot sent with a result goes in that result's thread once its message is placed, and waits until then.
-        const result = content.shot?.follows == null ? undefined : state.db.prepare("SELECT message,state,next_at FROM slack_part WHERE id=?").get(content.shot.follows);
-        if (result !== undefined && !slackTs(result["message"]) && result["state"] === "pending") {
-            state.db.prepare("UPDATE slack_part SET next_at=? WHERE id=?").run(shotWaitsUntil(result["next_at"], now), row.id);
+        const result = content.shot?.follows == null ? null : state.part(content.shot.follows);
+        if (result !== null && !slackTs(result.message) && result.state === "pending") {
+            state.holdPart(row.id, shotWaitsUntil(result.next_at, now));
             return true;
         }
-        const follows = result?.["message"];
+        const follows = result?.message;
         const thread = slackTs(follows) ? String(follows) : event.thread;
         if (content.image && content.shot && resultShotsPruned(options.evidenceRoot, content.image.run)) {
-            state.db.prepare("UPDATE slack_part SET state='dropped',problem='Removed by retention' WHERE id=?").run(row.id);
+            state.dropPart(row.id, "Removed by retention");
             return true;
         }
         if (content.image) {
@@ -262,17 +255,13 @@ export async function deliverSlackPart(options) {
                         typeof allocated.upload_url !== "string")
                         throw new SlackError("Slack did not identify the upload");
                     file = allocated.file_id;
-                    state.db
-                        .prepare("UPDATE slack_part SET file=? WHERE id=?")
-                        .run(file, row.id);
+                    state.setPartFile(row.id, file);
                     await access(options, binding, session?.ceilingDigest);
                     const fresh = verifyResultImage(store, options.evidenceRoot, repos, content.image);
                     if (!fresh.ok)
                         throw new SlackError("Screenshot evidence changed before upload");
                     await (options.upload ?? uploadSlackBytes)(allocated.upload_url, fresh.bytes);
-                    state.db
-                        .prepare("UPDATE slack_part SET uploaded=1 WHERE id=?")
-                        .run(row.id);
+                    state.setPartFile(row.id, null, true);
                 }
                 await access(options, binding, session?.ceilingDigest);
                 if (!verifyResultImage(store, options.evidenceRoot, repos, content.image)
@@ -288,9 +277,7 @@ export async function deliverSlackPart(options) {
                         .map(object)
                         .find((receipt) => (receipt.thread_ts ?? "") === thread && slackTs(receipt.ts));
                     if (found) {
-                        state.db
-                            .prepare("UPDATE slack_part SET state='sent',message=?,problem=NULL WHERE id=?")
-                            .run(String(found.ts), row.id);
+                        state.partSent(row.id, String(found.ts), nowOf(options), false);
                         return true;
                     }
                 }
@@ -308,9 +295,7 @@ export async function deliverSlackPart(options) {
                 if (!Array.isArray(completed.files) ||
                     !completed.files.some((value) => object(value).id === file))
                     throw new SlackError("Slack did not confirm the file identity", 15_000, true);
-                state.db
-                    .prepare("UPDATE slack_part SET state='sent',problem=NULL WHERE id=?")
-                    .run(row.id);
+                state.partSent(row.id, null, nowOf(options), false);
                 return true;
             }
         }
@@ -327,9 +312,7 @@ export async function deliverSlackPart(options) {
                         ? armedCardText(proposal, preview.text)
                         : preview.text.replace("\n\nConfirm or Dismiss below. Nothing changes until you confirm.", "");
                 if (preview.buttons && preview.text.length <= 10_000) {
-                    const tokens = state.db
-                        .prepare("SELECT token,phase FROM slack_action WHERE part=? AND consumed IS NULL AND expires>? ORDER BY rowid")
-                        .all(row.id, now.toISOString());
+                    const tokens = state.partTokens(row.id, now);
                     buttons = tokens.map((action) => ({
                         type: "button",
                         text: {
@@ -398,6 +381,10 @@ export async function deliverSlackPart(options) {
                         value: one.token,
                     }))
                     : []),
+                // A result's, plan's, failure's or pull request's own buttons (chat-decide.ts): its acts, then its links.
+                ...(content.decide?.rows.flat() ?? []).flatMap((one, index) => "token" in one
+                    ? [{ type: "button", text: { type: "plain_text", text: one.label }, action_id: `toolroll_decide_${index}`, value: one.token, ...(index === 0 ? { style: "primary" } : {}) }]
+                    : linkButton(options.origin(), one.link).map(button => ({ ...button, action_id: `toolroll_link_${index + 10}` }))),
                 ...linkButton(options.origin(), content.link),
                 // [Look first] beside [Merge] or [Accept and finish]: each button's own action id.
                 ...(content.also ?? []).flatMap((one, index) => linkButton(options.origin(), one).map(button => ({ ...button, action_id: `toolroll_link_${index + 2}` }))),
@@ -427,17 +414,13 @@ export async function deliverSlackPart(options) {
             });
         if (!slackTs(answer.ts) || (target && answer.ts !== target))
             throw new SlackError("Slack did not confirm the message identity", 15_000, true);
-        state.db
-            .prepare("UPDATE slack_part SET state='sent',message=?,attempts=attempts+1,problem=NULL,next_at=NULL WHERE id=?")
-            .run(answer.ts, row.id);
-        state.db
-            .prepare("UPDATE slack_runtime SET problem=NULL WHERE installation=? AND owner=?")
-            .run(identity.installation, options.owner);
+        state.partSent(row.id, String(answer.ts), nowOf(options));
+        state.setProblem(identity.installation, options.owner, null);
         return true;
     }
     catch (error) {
         if (error instanceof ChatDeliveryError && error.permanent) {
-            state.prepare("UPDATE chat_part SET state='dropped',next_at=NULL,problem=? WHERE id=?").run(error.message, row.id);
+            state.dropPart(row.id, error.message);
             return true;
         }
         // No permission to upload files here: one plain line instead of the result's screenshots.
@@ -449,18 +432,12 @@ export async function deliverSlackPart(options) {
         const problem = error instanceof SlackError
             ? error
             : new SlackError("Slack delivery is waiting to retry", 15_000, true);
-        state.db
-            .prepare("UPDATE slack_runtime SET problem=? WHERE installation=? AND owner=?")
-            .run(problem.message, identity.installation, options.owner);
+        state.setProblem(identity.installation, options.owner, problem.message);
         const until = new Date(nowOf(options).getTime() +
             Math.max(problem.retryMs, [5000, 15000, 60000, 300000][Math.min(row.attempts, 3)])).toISOString();
-        state.db
-            .prepare("UPDATE slack_part SET attempts=attempts+1,uncertain=uncertain+?,next_at=?,problem=? WHERE id=?")
-            .run(problem.uncertain ? 1 : 0, until, problem.message, row.id);
+        state.partFailed(row.id, { problem: problem.message, until, uncertain: problem.uncertain });
         if (problem.code === "ratelimited")
-            state.db
-                .prepare("UPDATE slack_runtime SET retry_at=? WHERE installation=?")
-                .run(until, identity.installation);
+            state.deferUntil(identity.installation, until);
         return true;
     }
 }

package/dist/slack-settings.d.ts

@@ -1,7 +1,8 @@
 import type { Store } from "./store.js";
-export declare function slackSettingsHtml(store: Store, dir: string, csrf: string, options?: {
+import { type Html } from "./html.js";
+export declare function slackSettingsHtml(store: Store, dir: string, options?: {
     code?: string;
     problem?: string;
     now?: Date;
     who?: string;
-}): string;
+}): Html;

package/dist/slack-settings.js

@@ -1,75 +1,41 @@
 import { loadPrimary } from "./webhooks.js";
+import { html, postForm } from "./html.js";
 import { loadSlackCredentials } from "./slack-api.js";
-import { SlackState } from "./slack-state.js";
-const escape = (text) => text
-    .replaceAll("&", "&")
-    .replaceAll("<", "&lt;")
-    .replaceAll(">", "&gt;")
-    .replaceAll('"', "&quot;")
-    .replaceAll("'", "&#39;");
-export function slackSettingsHtml(store, dir, csrf, options = {}) {
-    const credentials = loadSlackCredentials(dir), state = new SlackState(store), bindings = credentials ? state.bindings(credentials.installation).filter(one => state.live(one)) : [], binding = options.who === undefined ? null : bindings.find(one => one.approver === options.who) ?? null, others = bindings.length - (binding === null ? 0 : 1);
-    const runtime = credentials
-        ? state.db
-            .prepare("SELECT connected,problem,lease_until FROM slack_runtime WHERE installation=?")
-            .get(credentials.installation)
-        : null;
+import { ChatState } from "./chat-delivery-state.js";
+export function slackSettingsHtml(store, dir, options = {}) {
+    const credentials = loadSlackCredentials(dir), state = new ChatState(store, "slack"), bindings = credentials ? state.bindings(credentials.installation).filter(one => state.live(one)) : [], binding = options.who === undefined ? null : bindings.find(one => one.approver === options.who) ?? null, others = bindings.length - (binding === null ? 0 : 1);
+    const runtime = credentials ? state.runtime(credentials.installation) : null;
     const now = options.now ?? new Date(), live = runtime &&
-        typeof runtime.lease_until === "string" &&
-        runtime.lease_until > now.toISOString() &&
+        runtime.leaseUntil !== null &&
+        runtime.leaseUntil > now.toISOString() &&
         runtime.connected;
-    const hidden = `<input type="hidden" name="csrf" value="${escape(csrf)}">`;
-    const password = '<label>Your Toolroll password<input style="min-height:44px" type="password" name="password" autocomplete="current-password" required></label>';
-    const post = (action, content) => `<form method="post" action="/settings/slack/${action}" class="card">${hidden}${content}</form>`;
-    let content = "";
+    const password = html `<label>Your Toolroll password<input style="min-height:44px" type="password" name="password" autocomplete="current-password" required></label>`;
+    const post = (action, content) => postForm(`/settings/slack/${action}`, content, { attrs: { class: "card" } });
+    const parts = [];
     if (!credentials) {
-        content =
-            "<p>Manage projects and review results in a private Slack conversation.</p>" +
-                '<details open><summary>Create your Slack app</summary><ol><li>Download the <a href="/settings/slack/manifest">app manifest</a>, then <a href="https://api.slack.com/apps" target="_blank" rel="noopener noreferrer">create an app</a> in your workspace using that manifest.</li><li>Under Basic Information, create an app-level token with <code>connections:write</code>.</li><li>Under OAuth &amp; Permissions, install the app and copy its bot token.</li></ol></details>' +
-                post("connect", '<label>App token<input style="min-height:44px" type="password" name="app-token" autocomplete="off" placeholder="xapp-…" required></label><label>Bot token<input style="min-height:44px" type="password" name="bot-token" autocomplete="off" placeholder="xoxb-…" required></label>' +
-                    password +
-                    '<p class="meta">Tokens stay on this installation. Next, pair your own Slack account.</p><button type="submit">Connect Slack</button>');
+        parts.push(html `<p>Manage projects and review results in a private Slack conversation.</p>`, html `<details open><summary>Create your Slack app</summary><ol><li>Download the <a href="/settings/slack/manifest">app manifest</a>, then <a href="https://api.slack.com/apps" target="_blank" rel="noopener noreferrer">create an app</a> in your workspace using that manifest.</li><li>Under Basic Information, create an app-level token with <code>connections:write</code>.</li><li>Under OAuth &amp; Permissions, install the app and copy its bot token.</li></ol></details>`, post("connect", html `<label>App token<input style="min-height:44px" type="password" name="app-token" autocomplete="off" placeholder="xapp-…" required></label><label>Bot token<input style="min-height:44px" type="password" name="bot-token" autocomplete="off" placeholder="xoxb-…" required></label>${password}<p class="meta">Tokens stay on this installation. Next, pair your own Slack account.</p><button type="submit">Connect Slack</button>`));
     }
     else {
-        content = `<p><strong>${escape(credentials.workspace)}</strong> · ${live ? "Connected" : "Waiting for connection"}</p>`;
+        parts.push(html `<p><strong>${credentials.workspace}</strong> · ${live ? "Connected" : "Waiting for connection"}</p>`);
         if (runtime?.problem)
-            content += `<p role="status">${escape(String(runtime.problem))}</p>`;
+            parts.push(html `<p role="status">${String(runtime.problem)}</p>`);
         if (!live && !runtime?.problem)
-            content +=
-                "<p>Keep the Toolroll worker running to receive Slack messages.</p>";
+            parts.push(html `<p>Keep the Toolroll worker running to receive Slack messages.</p>`);
         if (options.code) {
-            content +=
-                "<h2>Pair your account</h2><p>Send this in a direct message to your Toolroll Slack app. It expires in 10 minutes.</p>" +
-                    `<label>Pairing message<input type="text" readonly value="pair ${escape(options.code)}" autocomplete="off" style="width:100%;max-width:100%;font-size:14px;min-height:44px"></label>` +
-                    '<a class="button-link" style="min-height:44px;white-space:nowrap" href="/settings/slack">Check connection</a>';
+            parts.push(html `<h2>Pair your account</h2><p>Send this in a direct message to your Toolroll Slack app. It expires in 10 minutes.</p>`, html `<label>Pairing message<input type="text" readonly value="pair ${options.code}" autocomplete="off" style="width:100%;max-width:100%;font-size:14px;min-height:44px"></label>`, html `<a class="button-link" style="min-height:44px;white-space:nowrap" href="/settings/slack">Check connection</a>`);
         }
         else if (binding && state.live(binding)) {
-            const pending = Number(state.db
-                .prepare("SELECT count(*) n FROM slack_part p JOIN slack_event e ON e.id=p.event WHERE e.binding=? AND p.state='pending'")
-                .get(binding.id)?.n ?? 0);
-            const failed = Number(state.db
-                .prepare("SELECT count(*) n FROM slack_part p JOIN slack_event e ON e.id=p.event WHERE e.binding=? AND p.state='dropped'")
-                .get(binding.id)?.n ?? 0);
-            content +=
-                `<p>Your Slack account is paired.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} paired too.` : ""}${pending ? ` ${pending} replies waiting to send.` : ""}${failed ? ` ${failed} replies could not be delivered. Open the saved chat to recover them.` : ""}</p>` +
-                    "<p>Try “What needs my attention?” or “Show the evidence for the latest result.”</p>" +
-                    '<p><a href="/chat">Open saved chat</a></p>' +
-                    (loadPrimary(process.env, dir) === "slack"
-                        ? "<p>Task updates are sent here.</p>"
-                        : post("alerts", '<button type="submit">Send task updates here</button>'));
+            const { pending, dropped: failed } = state.partCounts(binding.id);
+            parts.push(html `<p>Your Slack account is paired.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} paired too.` : ""}${pending ? ` ${pending} replies waiting to send.` : ""}${failed ? ` ${failed} replies could not be delivered. Open the saved chat to recover them.` : ""}</p>`, html `<p>Try “What needs my attention?” or “Show the evidence for the latest result.”</p>`, html `<p><a href="/chat">Open saved chat</a></p>`, loadPrimary(process.env, dir) === "slack"
+                ? html `<p>Task updates are sent here.</p>`
+                : post("alerts", html `<button type="submit">Send task updates here</button>`));
         }
         else {
-            content += post("pair", "<h2>Pair your account</h2><p>Your paired Slack account can read your connected projects and confirm proposed changes. Password approvals still open in Toolroll." +
-                (others ? ` ${others} teammate${others === 1 ? " is" : "s are"} already paired.` : "") + "</p>" +
-                password +
-                '<button type="submit">Create pairing code</button>');
+            parts.push(post("pair", html `<h2>Pair your account</h2><p>Your paired Slack account can read your connected projects and confirm proposed changes. Password approvals still open in Toolroll.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} already paired.` : ""}</p>${password}<button type="submit">Create pairing code</button>`));
         }
         if (binding && state.live(binding) && !options.code)
-            content += post("unpair", password + '<p class="meta">Unpairing ends every open button in your chat. Teammates are unaffected.</p><button type="submit">Unpair my account</button>');
-        content +=
-            "<details><summary>Connection settings</summary>" +
-                post("disconnect", password + '<button type="submit">Disconnect Slack</button>') +
-                "</details>";
+            parts.push(post("unpair", html `${password}<p class="meta">Unpairing ends every open button in your chat. Teammates are unaffected.</p><button type="submit">Unpair my account</button>`));
+        parts.push(html `<details><summary>Connection settings</summary>${post("disconnect", html `${password}<button type="submit">Disconnect Slack</button>`)}</details>`);
     }
-    return `<section style="max-width:42rem;overflow-wrap:anywhere"><p><a href="/settings">Settings</a></p><h1>Slack</h1>${options.problem ? `<p class="problem" role="alert">${escape(options.problem)}</p>` : ""}${content}<details><summary>Access and setup</summary><p>Private messages and threads use your Toolroll permissions. Shared channels are not supported. Secure review links use this installation’s configured HTTPS console address.</p><p>Socket Mode connects out to Slack. It does not need a public webhook or a Tailscale account.</p></details></section>`;
+    return html `<section style="max-width:42rem;overflow-wrap:anywhere"><p><a href="/settings">Settings</a></p><h1>Slack</h1>${options.problem ? html `<p class="problem" role="alert">${options.problem}</p>` : ""}${parts}<details><summary>Access and setup</summary><p>Private messages and threads use your Toolroll permissions. Shared channels are not supported. Secure review links use this installation’s configured HTTPS console address.</p><p>Socket Mode connects out to Slack. It does not need a public webhook or a Tailscale account.</p></details></section>`;
 }