toolroll 0.9.54 → 0.9.56

package/dist/contracts/{teammate-turn.js → subagent-turn.js}

@@ -1,21 +1,21 @@
 /**
- * A teammate's turn (teammates.ts): one schema for the JSON Schema Claude answers in (`--json-schema`) and the reader
+ * A subagent's turn (subagents.ts): one schema for the JSON Schema Claude answers in (`--json-schema`) and the reader
  * that takes the answer back. One flat object with every field (a root union is refused by the API); fields a turn
  * does not use are "" (or [] for options).
  *
  * The text limits (TURN_LIMITS, from TEXT_LIMITS) are deliberately not in the schema: the CLI refuses an answer a few
  * characters over one whole, so they are checked after parsing and an answer over one is asked once to shorten
- * (teammate-work.ts), then kept whole. What the zone allows — which actions, which answers, a note for a send-back, a
+ * (subagent-work.ts), then kept whole. What the zone allows — which actions, which answers, a note for a send-back, a
  * question for an ask, a tool for a tool call — is checked after parsing too (`readTurn`), by path.
  *
  * A turn is kept as the step's decision (`flow_step_run.decision_json`) as it was read, so a saved one is this shape.
  */
 import { z } from "zod";
 import { parseContract, toModelSchema } from "./contract.js";
-/** What a teammate may do on one turn. A decision zone: approve, send back, or hand it to a person. A work zone: pick
+/** What a subagent may do on one turn. A decision zone: approve, send back, or hand it to a person. A work zone: pick
  * where it goes, ask its person, or say it can't. v94: "use_tool" asks for one tool call. */
 export const TURN_ACTIONS = ["approve", "send_back", "hand_off", "route", "ask", "cant", "use_tool"];
-export const teammateTurnSchema = z.object({
+export const subagentTurnSchema = z.object({
     action: z.enum(TURN_ACTIONS),
     /** route: one of the zone's answers, exactly as written. */
     answer: z.string(),
@@ -35,17 +35,17 @@ export const teammateTurnSchema = z.object({
     remember: z.string(),
 });
 /** What Claude's `--json-schema` is for a turn: the turn schema, exactly. */
-export const TURN_MODEL_SCHEMA = toModelSchema(teammateTurnSchema);
+export const TURN_MODEL_SCHEMA = toModelSchema(subagentTurnSchema);
 /** Older and plain-text turns default absent or non-text fields to "", and keep only string options. */
 export function readTurnAnswer(value) {
     if (typeof value === "object" && value !== null && !Array.isArray(value)) {
         const body = { ...value };
-        for (const key of Object.keys(teammateTurnSchema.shape)) {
+        for (const key of Object.keys(subagentTurnSchema.shape)) {
             if (key !== "action" && key !== "options" && typeof body[key] !== "string")
                 body[key] = "";
         }
         body["options"] = Array.isArray(body["options"]) ? body["options"].filter(one => typeof one === "string") : [];
         value = body;
     }
-    return parseContract(teammateTurnSchema, value);
+    return parseContract(subagentTurnSchema, value);
 }

package/dist/control-ui.d.ts

@@ -1,12 +1,12 @@
 /** Shared setup views over the existing project configuration and approval doors. */
+import { type Html } from "./html.js";
 import type { ProviderId } from "./provider.js";
 import type { ProviderConnection } from "./provider-connection.js";
 import { type ModelChoice } from "./setup-guide.js";
 import type { SetupInputs } from "./control-setup.js";
 import { type OpenRouterModels } from "./openrouter-models.js";
-export declare function hiddenFields(values: Record<string, string>): string;
 export declare function connectionWords(connection: ProviderConnection): string;
-export declare function connectionHtml(provider: ProviderId, connection: ProviderConnection, task?: string): string;
+export declare function connectionHtml(provider: ProviderId, connection: ProviderConnection, task?: string): Html;
 export declare function controlSetupHtml(data: {
     repo: string;
     csrf: string;
@@ -25,5 +25,6 @@ export declare function controlSetupHtml(data: {
         installed: boolean;
         message?: string;
     };
-}): string;
-export declare function setupPreviewHtml(inputs: SetupInputs, fields: Record<string, string>): string;
+}): Html;
+/** `fields` may still carry the session's csrf (a caller's habit): postForm writes the one CSRF field. */
+export declare function setupPreviewHtml(inputs: SetupInputs, fields: Record<string, string>): Html;

package/dist/control-ui.js

@@ -1,9 +1,7 @@
+/** Shared setup views over the existing project configuration and approval doors. */
+import { html, joinHtml, postForm } from "./html.js";
 import { ASSISTANTS } from "./setup-guide.js";
 import { openRouterPicker } from "./openrouter-models.js";
-const escape = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
-export function hiddenFields(values) {
-    return Object.entries(values).map(([name, value]) => `<input type="hidden" name="${escape(name)}" value="${escape(value)}">`).join("");
-}
 export function connectionWords(connection) {
     return {
         connected: "Connected", "signed-out": "Not signed in", "not-installed": "CLI not installed",
@@ -12,42 +10,19 @@ export function connectionWords(connection) {
 }
 export function connectionHtml(provider, connection, task = "") {
     const query = new URLSearchParams({ provider, ...(task ? { task } : {}) });
-    return `<div class="card assistant-account"><p><strong>${escape(ASSISTANTS[provider].name)} · ${connectionWords(connection)}</strong></p>` +
-        `<p class="meta">${[connection.email, connection.plan, connection.method].filter(Boolean).map(one => escape(one)).join(" · ")}</p>` +
-        `<p class="meta">Checked ${escape(new Date(connection.checkedAt).toLocaleTimeString("en-US", { hour: "numeric", minute: "2-digit", timeZoneName: "short" }))} on the computer running this console. Sign-in does not prove model access or remaining quota.</p>` +
-        `<a class="button-link" href="/control/connection?${escape(query.toString())}">${connection.state === "connected" ? "Manage connection" : "Connect account"}</a> · ` +
-        `<a href="/control?${escape(query.toString())}&amp;check-connection=1">Check again</a></div>`;
+    return html `<div class="card assistant-account"><p><strong>${ASSISTANTS[provider].name} · ${connectionWords(connection)}</strong></p><p class="meta">${[connection.email, connection.plan, connection.method].filter(Boolean).join(" · ")}</p><p class="meta">Checked ${new Date(connection.checkedAt).toLocaleTimeString("en-US", { hour: "numeric", minute: "2-digit", timeZoneName: "short" })} on the computer running this console. Sign-in does not prove model access or remaining quota.</p><a class="button-link" href="/control/connection?${query.toString()}">${connection.state === "connected" ? "Manage connection" : "Connect account"}</a> · <a href="/control?${query.toString()}&amp;check-connection=1">Check again</a></div>`;
 }
 export function controlSetupHtml(data) {
     const { provider, inputs, task = "" } = data;
     const query = new URLSearchParams({ provider, ...(task ? { task } : {}) });
     const model = data.catalog !== null
         ? openRouterPicker(data.catalog, inputs.model || null, `/control?${query}&refresh-models=1`)
-        : `<label>Model<input type="text" name="model" value="${escape(inputs.model)}" list="setup-models" required autocomplete="off" placeholder="Exact model id or supported alias"></label>` +
-            `<datalist id="setup-models">${data.models.map(one => `<option value="${escape(one.value)}">${escape(one.label)}</option>`).join("")}</datalist>`;
-    return `<h1>Project setup</h1><p>${escape(data.repo)}</p>` +
-        `<p class="meta">Choose the default builder for new tasks and the preparation command for this project.</p>` +
-        `<nav class="assistant-picker row" aria-label="Choose provider">${Object.keys(ASSISTANTS).map(id => `<a class="button-link" href="/control?${escape(new URLSearchParams({ provider: id, ...(task ? { task } : {}) }).toString())}"${id === provider ? ' aria-current="page"' : ""}>${ASSISTANTS[id].name}</a>`).join(" ")}</nav>` +
-        connectionHtml(provider, data.connection, task) +
-        `<form method="post" action="/control/setup-preview" class="card">${hiddenFields({ csrf: data.csrf, repo: data.repo, provider, task })}` + model +
-        `<details class="setup-advanced"><summary>Project preparation</summary>` +
-        (data.preparation === null ? "" : `<p class="meta">Suggested from ${escape(data.preparation.evidence)}: ${escape(data.preparation.label)} — <code>${escape(data.preparation.command)}</code>. Review before approving.</p>`) +
-        `<label>Preparation command<textarea name="command" rows="2" maxlength="2000">${escape(inputs.command)}</textarea></label>` +
-        `<label>Preparation timeout in seconds<input name="seconds" type="number" min="1" max="3600" value="${escape(inputs.seconds)}" required></label>` +
-        `<p class="meta">Preparation applies to subsequent runs, including already approved tasks. Saving setup does not execute it.</p></details>` +
-        `<button type="submit">Review project setup</button></form>` +
-        `<section class="card"><h2>Agent instructions</h2>` +
-        (data.instructions.message ? `<p>${escape(data.instructions.message)}</p>` : data.instructions.installed ? `<p>Toolroll instructions are installed.</p>` :
-            `<p>Give the agent the project's Toolroll handoff instructions.</p><form method="post" action="/control/instructions-preview">${hiddenFields({ csrf: data.csrf, repo: data.repo })}<button>Review instructions</button></form>`) +
-        `</section><p><a href="/fleet">Configure planning, repair, and review agents</a> · <a href="/tasks/new">Describe a task</a></p>`;
+        : html `<label>Model<input type="text" name="model" value="${inputs.model}" list="setup-models" required autocomplete="off" placeholder="Exact model id or supported alias"></label><datalist id="setup-models">${data.models.map(one => html `<option value="${one.value}">${one.label}</option>`)}</datalist>`;
+    return html `<h1>Project setup</h1><p>${data.repo}</p><p class="meta">Choose the default builder for new tasks and the preparation command for this project.</p><nav class="assistant-picker row" aria-label="Choose provider">${joinHtml(Object.keys(ASSISTANTS).map(id => html `<a class="button-link" href="/control?${new URLSearchParams({ provider: id, ...(task ? { task } : {}) }).toString()}"${id === provider ? html ` aria-current="page"` : ""}>${ASSISTANTS[id].name}</a>`), " ")}</nav>${connectionHtml(provider, data.connection, task)}${postForm("/control/setup-preview", html `${model}<details class="setup-advanced"><summary>Project preparation</summary>${data.preparation === null ? "" : html `<p class="meta">Suggested from ${data.preparation.evidence}: ${data.preparation.label} — <code>${data.preparation.command}</code>. Review before approving.</p>`}<label>Preparation command<textarea name="command" rows="2" maxlength="2000">${inputs.command}</textarea></label><label>Preparation timeout in seconds<input name="seconds" type="number" min="1" max="3600" value="${inputs.seconds}" required></label><p class="meta">Preparation applies to subsequent runs, including already approved tasks. Saving setup does not execute it.</p></details><button type="submit">Review project setup</button>`, { attrs: { class: "card" }, hidden: { repo: data.repo, provider, task } })}<section class="card"><h2>Agent instructions</h2>${data.instructions.message ? html `<p>${data.instructions.message}</p>` : data.instructions.installed ? html `<p>Toolroll instructions are installed.</p>` :
+        html `<p>Give the agent the project's Toolroll handoff instructions.</p>${postForm("/control/instructions-preview", html `<button>Review instructions</button>`, { hidden: { repo: data.repo } })}`}</section><p><a href="/fleet">Configure planning, repair, and review agents</a> · <a href="/tasks/new">Describe a task</a></p>`;
 }
+/** `fields` may still carry the session's csrf (a caller's habit): postForm writes the one CSRF field. */
 export function setupPreviewHtml(inputs, fields) {
-    return `<h1>Approve project setup</h1><div class="card"><p>${escape(fields.repo ?? "")}</p>` +
-        `<p><strong>Builder:</strong> ${escape(inputs.provider)} · ${escape(inputs.model)}</p>` +
-        `<p><strong>Preparation:</strong></p><pre class="recap">${escape(inputs.command || "No preparation command")}</pre>` +
-        `<p>Preparation timeout: ${escape(inputs.seconds)} seconds.</p>` +
-        `<p>The builder default applies to new tasks. Preparation applies to subsequent runs, including already approved tasks. Existing signed task settings and verification rules remain in force.</p>` +
-        `<form method="post" action="/control/setup-approve">${hiddenFields({ ...fields, ...inputs })}` +
-        `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label>` +
-        `<button>Approve project setup</button></form></div>`;
+    const { csrf: _csrf, ...rest } = fields;
+    return html `<h1>Approve project setup</h1><div class="card"><p>${fields.repo ?? ""}</p><p><strong>Builder:</strong> ${inputs.provider} · ${inputs.model}</p><p><strong>Preparation:</strong></p><pre class="recap">${inputs.command || "No preparation command"}</pre><p>Preparation timeout: ${inputs.seconds} seconds.</p><p>The builder default applies to new tasks. Preparation applies to subsequent runs, including already approved tasks. Existing signed task settings and verification rules remain in force.</p>${postForm("/control/setup-approve", html `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label><button>Approve project setup</button>`, { hidden: { ...rest, ...inputs } })}</div>`;
 }

package/dist/converse.d.ts

@@ -142,15 +142,15 @@ export type ProviderAnswer = {
  * ruling 14): a negative, fractional, or absurd usage is a malformed reply,
  * never a discount on the pinned settlement. */
 export declare function tokenCount(value: number): boolean;
-export declare const MATE_MAX_STEPS = 8;
-export declare const MATE_MAX_CALLS_PER_STEP = 4;
+export declare const LEAD_MAX_STEPS = 8;
+export declare const LEAD_MAX_CALLS_PER_STEP = 4;
 /** A tool result, measured AS EMBEDDED — the JSON-encoded string, escapes included. */
-export declare const MATE_TOOL_RESULT_CAP_BYTES = 16384;
+export declare const LEAD_TOOL_RESULT_CAP_BYTES = 16384;
 /** A tool call, measured as the serialized `{id, name, args}` — the id counts. */
-export declare const MATE_TOOL_CALL_CAP_BYTES = 2048;
-export declare const MATE_TOOL_CALL_ID_CAP_BYTES = 64;
+export declare const LEAD_TOOL_CALL_CAP_BYTES = 2048;
+export declare const LEAD_TOOL_CALL_ID_CAP_BYTES = 64;
 /** One step's assistant text; over it the reply is malformed (review finding 7). */
-export declare const MATE_STEP_TEXT_CAP_BYTES = 8192;
+export declare const LEAD_STEP_TEXT_CAP_BYTES = 8192;
 /**
  * The triangular worst case (mate arc, ruling 6; slice-1 review finding 7):
  * request s carries the base prompt plus every earlier step's calls,
@@ -160,7 +160,7 @@ export declare const MATE_STEP_TEXT_CAP_BYTES = 8192;
  * body), so each is budgeted at twice its cap — escaping at most doubles
  * a string. Each step may answer with the full output allowance.
  */
-export declare function mateWorstCaseForPrice(price: ModelPrice, baseBytes: number, caps?: {
+export declare function leadWorstCaseForPrice(price: ModelPrice, baseBytes: number, caps?: {
     steps?: number;
     callsPerStep?: number;
     resultCap?: number;
@@ -169,32 +169,32 @@ export declare function mateWorstCaseForPrice(price: ModelPrice, baseBytes: numb
 }): number;
 /** The bytes a tool result costs on the wire: its JSON string form. */
 export declare function embeddedBytes(text: string): number;
-export type MateToolSchema = {
+export type LeadToolSchema = {
     name: string;
     description: string;
     inputSchema: Record<string, unknown>;
 };
-export type MateToolCall = {
+export type LeadToolCall = {
     id: string;
     name: string;
     args: Record<string, unknown>;
 };
 /** A provider answer with tool calls allowed: text, calls, usage. */
-export type MateProviderAnswer = {
+export type LeadProviderAnswer = {
     text: string;
-    calls: MateToolCall[];
+    calls: LeadToolCall[];
     tokensIn: number;
     tokensOut: number;
     reportedCostMicrousd: number | null;
 };
-/** One message of the mate's own history, provider-neutral. */
-export type MateHistoryMessage = {
+/** One message of the lead's own history, provider-neutral. */
+export type LeadHistoryMessage = {
     role: "operator";
     text: string;
 } | {
     role: "assistant";
     text: string;
-    calls: MateToolCall[];
+    calls: LeadToolCall[];
 } | {
     role: "tool";
     callId: string;
@@ -207,36 +207,36 @@ export type MateHistoryMessage = {
  * most M per answer, each argument object under the call cap), and
  * anything else about the shape is malformed.
  */
-export declare function parseMateProviderWrapper(provider: DirectChatProviderId, bytes: Buffer): {
+export declare function parseLeadProviderWrapper(provider: DirectChatProviderId, bytes: Buffer): {
     ok: true;
-    answer: MateProviderAnswer;
+    answer: LeadProviderAnswer;
 } | {
     ok: false;
     problem: string;
 };
-/** The mate's request: system contract, the data document as the first
+/** The lead's request: system contract, the data document as the first
  * operator message, the history in provider-native shape, the tools. */
-export declare function composeMateRequest(args: {
+export declare function composeLeadRequest(args: {
     provider: DirectChatProviderId;
     model: string;
     key: string;
     system: string;
     dataDocument: string;
-    history: readonly MateHistoryMessage[];
-    tools: readonly MateToolSchema[];
+    history: readonly LeadHistoryMessage[];
+    tools: readonly LeadToolSchema[];
 }): {
     url: string;
     headers: Record<string, string>;
     body: string;
 };
-/** The mate's network call: the same transport posture as fleet chat's, the tool-capable parser at the end. */
-export declare function performMateRequest(request: {
+/** The lead's network call: the same transport posture as fleet chat's, the tool-capable parser at the end. */
+export declare function performLeadRequest(request: {
     url: string;
     headers: Record<string, string>;
     body: string;
 }, provider: DirectChatProviderId, signal: AbortSignal, fetcher?: typeof fetch): Promise<{
     ok: true;
-    answer: MateProviderAnswer;
+    answer: LeadProviderAnswer;
 } | {
     ok: false;
     problem: string;

package/dist/converse.js

@@ -357,16 +357,16 @@ export function parseAssistantEnvelope(text) {
 export function tokenCount(value) {
     return Number.isSafeInteger(value) && value >= 0 && value <= 1_000_000_000;
 }
-// ---------------------------------------------------------------- the mate
-export const MATE_MAX_STEPS = 8;
-export const MATE_MAX_CALLS_PER_STEP = 4;
+// ---------------------------------------------------------------- the lead
+export const LEAD_MAX_STEPS = 8;
+export const LEAD_MAX_CALLS_PER_STEP = 4;
 /** A tool result, measured AS EMBEDDED — the JSON-encoded string, escapes included. */
-export const MATE_TOOL_RESULT_CAP_BYTES = 16_384;
+export const LEAD_TOOL_RESULT_CAP_BYTES = 16_384;
 /** A tool call, measured as the serialized `{id, name, args}` — the id counts. */
-export const MATE_TOOL_CALL_CAP_BYTES = 2_048;
-export const MATE_TOOL_CALL_ID_CAP_BYTES = 64;
+export const LEAD_TOOL_CALL_CAP_BYTES = 2_048;
+export const LEAD_TOOL_CALL_ID_CAP_BYTES = 64;
 /** One step's assistant text; over it the reply is malformed (review finding 7). */
-export const MATE_STEP_TEXT_CAP_BYTES = 8_192;
+export const LEAD_STEP_TEXT_CAP_BYTES = 8_192;
 /**
  * The triangular worst case (mate arc, ruling 6; slice-1 review finding 7):
  * request s carries the base prompt plus every earlier step's calls,
@@ -376,12 +376,12 @@ export const MATE_STEP_TEXT_CAP_BYTES = 8_192;
  * body), so each is budgeted at twice its cap — escaping at most doubles
  * a string. Each step may answer with the full output allowance.
  */
-export function mateWorstCaseForPrice(price, baseBytes, caps = {}) {
-    const S = caps.steps ?? MATE_MAX_STEPS;
-    const M = caps.callsPerStep ?? MATE_MAX_CALLS_PER_STEP;
-    const R = caps.resultCap ?? MATE_TOOL_RESULT_CAP_BYTES;
-    const C = caps.callCap ?? MATE_TOOL_CALL_CAP_BYTES;
-    const T = caps.textCap ?? MATE_STEP_TEXT_CAP_BYTES;
+export function leadWorstCaseForPrice(price, baseBytes, caps = {}) {
+    const S = caps.steps ?? LEAD_MAX_STEPS;
+    const M = caps.callsPerStep ?? LEAD_MAX_CALLS_PER_STEP;
+    const R = caps.resultCap ?? LEAD_TOOL_RESULT_CAP_BYTES;
+    const C = caps.callCap ?? LEAD_TOOL_CALL_CAP_BYTES;
+    const T = caps.textCap ?? LEAD_STEP_TEXT_CAP_BYTES;
     const tokens = (bytes) => Math.ceil(bytes / 3);
     let input = 0;
     for (let s = 1; s <= S; s++) {
@@ -399,7 +399,7 @@ export function embeddedBytes(text) {
  * most M per answer, each argument object under the call cap), and
  * anything else about the shape is malformed.
  */
-export function parseMateProviderWrapper(provider, bytes) {
+export function parseLeadProviderWrapper(provider, bytes) {
     const parsed = strictJsonParse(bytes, WRAPPER_CAP_BYTES, 14);
     if (!parsed.ok)
         return { ok: false, problem: parsed.problem };
@@ -408,9 +408,9 @@ export function parseMateProviderWrapper(provider, bytes) {
         return { ok: false, problem: "not-an-object" };
     const readArgs = (raw) => {
         const text = typeof raw === "string" ? raw : JSON.stringify(raw ?? null);
-        if (Buffer.byteLength(text, "utf8") > MATE_TOOL_CALL_CAP_BYTES)
+        if (Buffer.byteLength(text, "utf8") > LEAD_TOOL_CALL_CAP_BYTES)
             return null;
-        const inner = strictJsonParse(Buffer.from(text, "utf8"), MATE_TOOL_CALL_CAP_BYTES, 6);
+        const inner = strictJsonParse(Buffer.from(text, "utf8"), LEAD_TOOL_CALL_CAP_BYTES, 6);
         if (!inner.ok || typeof inner.value !== "object" || inner.value === null || Array.isArray(inner.value))
             return null;
         return inner.value;
@@ -418,7 +418,7 @@ export function parseMateProviderWrapper(provider, bytes) {
     // A call is bounded WHOLE (finding 7): the id is repeated in the assistant
     // block and the result, so it is capped and counted inside the call cap.
     const readCall = (id, name, rawArgs) => {
-        if (typeof id !== "string" || id === "" || Buffer.byteLength(id, "utf8") > MATE_TOOL_CALL_ID_CAP_BYTES)
+        if (typeof id !== "string" || id === "" || Buffer.byteLength(id, "utf8") > LEAD_TOOL_CALL_ID_CAP_BYTES)
             return null;
         if (typeof name !== "string" || name === "" || name.length > 64)
             return null;
@@ -426,7 +426,7 @@ export function parseMateProviderWrapper(provider, bytes) {
         if (args === null)
             return null;
         const call = { id, name, args };
-        if (Buffer.byteLength(JSON.stringify(call), "utf8") > MATE_TOOL_CALL_CAP_BYTES)
+        if (Buffer.byteLength(JSON.stringify(call), "utf8") > LEAD_TOOL_CALL_CAP_BYTES)
             return null;
         return call;
     };
@@ -447,7 +447,7 @@ export function parseMateProviderWrapper(provider, bytes) {
         if (body["type"] !== "message")
             return { ok: false, problem: "wrong-type" };
         const content = body["content"];
-        if (!Array.isArray(content) || content.length === 0 || content.length > MATE_MAX_CALLS_PER_STEP + 1)
+        if (!Array.isArray(content) || content.length === 0 || content.length > LEAD_MAX_CALLS_PER_STEP + 1)
             return { ok: false, problem: "bad-content" };
         let text = "";
         const calls = [];
@@ -468,9 +468,9 @@ export function parseMateProviderWrapper(provider, bytes) {
                 return { ok: false, problem: "bad-block" };
             }
         }
-        if (calls.length > MATE_MAX_CALLS_PER_STEP)
+        if (calls.length > LEAD_MAX_CALLS_PER_STEP)
             return { ok: false, problem: "too-many-calls" };
-        if (Buffer.byteLength(text, "utf8") > MATE_STEP_TEXT_CAP_BYTES)
+        if (Buffer.byteLength(text, "utf8") > LEAD_STEP_TEXT_CAP_BYTES)
             return { ok: false, problem: "text-over-cap" };
         const usage = usageOf(body["usage"], "input_tokens", "output_tokens");
         if (usage === null)
@@ -490,7 +490,7 @@ export function parseMateProviderWrapper(provider, bytes) {
     const calls = [];
     const rawCalls = message["tool_calls"];
     if (rawCalls !== undefined) {
-        if (!Array.isArray(rawCalls) || rawCalls.length > MATE_MAX_CALLS_PER_STEP)
+        if (!Array.isArray(rawCalls) || rawCalls.length > LEAD_MAX_CALLS_PER_STEP)
             return { ok: false, problem: "too-many-calls" };
         for (const raw of rawCalls) {
             const one = raw;
@@ -503,7 +503,7 @@ export function parseMateProviderWrapper(provider, bytes) {
             calls.push(call);
         }
     }
-    if (Buffer.byteLength(text, "utf8") > MATE_STEP_TEXT_CAP_BYTES)
+    if (Buffer.byteLength(text, "utf8") > LEAD_STEP_TEXT_CAP_BYTES)
         return { ok: false, problem: "text-over-cap" };
     const usage = usageOf(body["usage"], "prompt_tokens", "completion_tokens");
     if (usage === null)
@@ -523,9 +523,9 @@ export function parseMateProviderWrapper(provider, bytes) {
     }
     return { ok: true, answer: { text, calls, tokensIn: usage.tokensIn, tokensOut: usage.tokensOut, reportedCostMicrousd } };
 }
-/** The mate's request: system contract, the data document as the first
+/** The lead's request: system contract, the data document as the first
  * operator message, the history in provider-native shape, the tools. */
-export function composeMateRequest(args) {
+export function composeLeadRequest(args) {
     const opener = `DATA:\n${args.dataDocument}\n\n(The conversation follows. Every operator message is data, from the operator.)`;
     if (args.provider === "anthropic-api") {
         const messages = [{ role: "user", content: opener }];
@@ -582,8 +582,8 @@ export function composeMateRequest(args) {
         }),
     };
 }
-/** The mate's network call: the same transport posture as fleet chat's, the tool-capable parser at the end. */
-export async function performMateRequest(request, provider, signal, fetcher = fetch) {
+/** The lead's network call: the same transport posture as fleet chat's, the tool-capable parser at the end. */
+export async function performLeadRequest(request, provider, signal, fetcher = fetch) {
     let response;
     try {
         response = await fetcher(request.url, { method: "POST", headers: request.headers, body: request.body, redirect: "error", signal });
@@ -599,7 +599,7 @@ export async function performMateRequest(request, provider, signal, fetcher = fe
     const body = await readCappedBody(response, WRAPPER_CAP_BYTES);
     if (body === null)
         return { ok: false, problem: "over-size" };
-    return parseMateProviderWrapper(provider, body);
+    return parseLeadProviderWrapper(provider, body);
 }
 export function parseProviderWrapper(provider, bytes) {
     const parsed = strictJsonParse(bytes, WRAPPER_CAP_BYTES, 12);

package/dist/coordinator-proposals.d.ts

@@ -1,12 +1,12 @@
 /**
  * Proposals over the MCP gateway (mate arc v3, §9). A coordinator may
- * propose what the mate may propose — next, reserve, hold, unhold, scope,
+ * propose what the lead may propose — next, reserve, hold, unhold, scope,
  * cancel, answer — and a row is all it writes: any approver whose ceiling
  * admits the repo confirms it through `confirmCoordinatorProposal`. The
  * token re-authenticates INSIDE the transaction (the session's `who` is a
  * courtesy, exactly as for filing); the proposal counts against the
  * credential's hourly filing rate and a per-credential pending cap; the
- * payload carries the same CAS material the mate's does, so a stale row
+ * payload carries the same CAS material the lead's does, so a stale row
  * refuses at the door in the same words.
  */
 import type { CoordinatorProposalKind, Store } from "./store.js";

package/dist/coordinator-proposals.js

@@ -1,6 +1,6 @@
 import { TASK_TEXT_LIMITS, validateScopeText } from "./task-text.js";
 import { authenticateCoordinator } from "./coordinator.js";
-import { decisionOver, honestText, readTouches, readAcceptanceArg } from "./mate-tools.js";
+import { decisionOver, honestText, readTouches, readAcceptanceArg } from "./lead-tools.js";
 export const PER_CID_PENDING_PROPOSALS = 20;
 const TASK_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 /** The coordinator's proposal as a row; the shape of `args` is the MCP tool's. */

package/dist/coordinator.js

@@ -18,7 +18,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { canonicalRepos } from "./runner.js";
 import { fileTaskProposal } from "./proposal.js";
 import { describeScope } from "./scope.js";
-import { reportSummaryFor } from "./mate-tools.js";
+import { reportSummaryFor } from "./lead-tools.js";
 import { taskWorkSummaryOf } from "./work-summary.js";
 import { assignmentOf, assignmentBrief } from "./assignment.js";
 /** Module-private: the ONLY maker, reachable only through the token

package/dist/credentials-ui.d.ts

@@ -4,6 +4,7 @@
  * can see and end everyone's.
  */
 import type { ApiTokenRow, WebSessionRow } from "./store.js";
+import { type Html } from "./html.js";
 export declare const CREDENTIALS_CSS: string;
 /** "Chrome on macOS", from a user agent, for a person to recognise a session. */
 export declare function deviceWords(agent: string | null): string;
@@ -19,12 +20,12 @@ export type CredentialsView = {
     /** Request limits (request-budget-ui.ts): words for each token's line, and the operator's disclosure. */
     limits?: {
         note: (token: ApiTokenRow) => string;
-        section: string;
+        section: Html;
     };
 };
-export declare function credentialsHtml(view: CredentialsView, csrf: string, notice: {
+export declare function credentialsHtml(view: CredentialsView, notice: {
     said?: string | null;
     problem?: string | null;
-}): string;
+}): Html;
 /** The token, once: a focused page with no script. */
-export declare function tokenShownHtml(name: string, token: string, access: "read" | "act", expiresAt: string): string;
+export declare function tokenShownHtml(name: string, token: string, access: "read" | "act", expiresAt: string): Html;

package/dist/credentials-ui.js

@@ -1,6 +1,6 @@
 import { daysLeft, expiryNoticeDue, TOKEN_DAYS, tokenLive } from "./api-tokens.js";
 import { projectName } from "./project.js";
-const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+import { html, postForm } from "./html.js";
 export const CREDENTIALS_CSS = `.credentials{max-width:820px;min-width:0}.credentials .card{padding:14px 16px;margin:12px 0}.credentials h2{font-size:1.05rem;margin:0 0 8px}` +
     `.credentials .rows{display:grid;gap:0;border:1px solid var(--so-line);border-radius:10px;overflow:hidden}.credentials .row-item{display:flex;align-items:center;justify-content:space-between;gap:12px;padding:10px 14px;border-bottom:1px solid var(--so-line)}` +
     `.credentials .row-item:last-child{border-bottom:0}.credentials .row-item p{margin:0}.credentials .row-item .meta{font-size:.85rem}.credentials form{margin:0}.credentials button{min-height:40px;white-space:nowrap}` +
@@ -22,39 +22,38 @@ const when = (value, now) => {
     const minutes = Math.round((now - at) / 60_000);
     return minutes < 1 ? "just now" : minutes < 60 ? `${minutes} min ago` : minutes < 60 * 24 ? `${Math.round(minutes / 60)} h ago` : new Date(at).toISOString().slice(0, 10);
 };
-export function credentialsHtml(view, csrf, notice) {
-    const hidden = (fields) => Object.entries(fields).map(([k, v]) => `<input type="hidden" name="${e(k)}" value="${e(v)}">`).join("");
-    const post = (fields, label, style = "secondary") => `<form method="post" action="/settings/sessions">${hidden({ csrf, ...fields, ...(view.everyone ? { everyone: "1" } : {}) })}<button class="${style}">${label}</button></form>`;
-    const note = notice.problem ? `<p class="problem" role="alert">${e(notice.problem)}</p>` : notice.said ? `<p role="status">${e(notice.said)}</p>` : "";
-    const toggle = view.canSeeEveryone ? `<p class="meta"><a href="/settings/sessions${view.everyone ? "" : "?everyone=1"}">${view.everyone ? "Show only mine" : "Show everyone's"}</a></p>` : "";
-    const sessions = view.sessions.length === 0 ? `<p class="meta">No one else is signed in.</p>` : `<div class="rows">${view.sessions.map(one => `<div class="row-item" data-session="${e(one.idHash.slice(0, 12))}"><div><p>${view.everyone ? `<strong>${e(one.account)}</strong> · ` : ""}${e(deviceWords(one.agent))}${one.here ? `<span class="badge-here">This browser</span>` : ""}</p>` +
-        `<p class="meta">${one.ssoAt === null ? "Password" : "Identity provider"} · ${e(one.address ?? "unknown address")} · active ${e(when(one.lastSeen, view.now))} · signed in ${e(when(one.createdAt, view.now))}</p></div>` +
-        `${one.here ? "" : post({ action: "end-session", session: one.idHash }, "Sign out")}</div>`).join("")}</div>`;
+export function credentialsHtml(view, notice) {
+    const post = (fields, label, style = "secondary") => postForm("/settings/sessions", html `<button class="${style}">${label}</button>`, { hidden: { ...fields, ...(view.everyone ? { everyone: "1" } : {}) } });
+    const note = notice.problem ? html `<p class="problem" role="alert">${notice.problem}</p>` : notice.said ? html `<p role="status">${notice.said}</p>` : "";
+    const toggle = view.canSeeEveryone ? html `<p class="meta"><a href="/settings/sessions${view.everyone ? "" : "?everyone=1"}">${view.everyone ? "Show only mine" : "Show everyone's"}</a></p>` : "";
+    const sessions = view.sessions.length === 0 ? html `<p class="meta">No one else is signed in.</p>` : html `<div class="rows">${view.sessions.map(one => html `<div class="row-item" data-session="${one.idHash.slice(0, 12)}"><div><p>${view.everyone ? html `<strong>${one.account}</strong> · ` : ""}${deviceWords(one.agent)}${one.here ? html `<span class="badge-here">This browser</span>` : ""}</p>\
+<p class="meta">${one.ssoAt === null ? "Password" : "Identity provider"} · ${one.address ?? "unknown address"} · active ${when(one.lastSeen, view.now)} · signed in ${when(one.createdAt, view.now)}</p></div>\
+${one.here ? "" : post({ action: "end-session", session: one.idHash }, "Sign out")}</div>`)}</div>`;
     const others = view.sessions.filter(one => !one.here && one.account === view.who).length;
     const endOthers = others > 0 && !view.everyone ? post({ action: "end-others" }, `Sign out everywhere else (${others})`) : "";
     const live = view.tokens.filter(one => tokenLive(one, view.now));
     // v111: its projects, and one state: when it stops (soon, said once and marked) or, once replaced, when it ends.
     const ends = (one) => {
         if (one.replacedBy !== null && one.overlapUntil !== null)
-            return `<span class="soon">Replaced · stops ${e(one.overlapUntil.slice(11, 16))} UTC</span>`;
+            return html `<span class="soon">Replaced · stops ${one.overlapUntil.slice(11, 16)} UTC</span>`;
         if (expiryNoticeDue(one, view.now) === null)
-            return `Expires ${e(one.expiresAt.slice(0, 10))}`;
+            return html `Expires ${one.expiresAt.slice(0, 10)}`;
         const days = daysLeft(one.expiresAt, view.now);
-        return `<span class="soon">Expires ${days <= 1 ? "within a day" : `in ${days} days`}</span>`;
+        return html `<span class="soon">Expires ${days <= 1 ? "within a day" : `in ${days} days`}</span>`;
     };
-    const scope = (one) => one.projects === null ? "All projects" : one.projects.length === 0 ? "No projects" : one.projects.map(repo => e(projectName(repo))).join(", ");
-    const tokens = live.length === 0 ? `<p class="meta">No API tokens.</p>` : `<div class="rows">${live.map(one => `<div class="row-item" data-token="${e(one.id)}"><div><p>${view.everyone ? `<strong>${e(one.account)}</strong> · ` : ""}${e(one.name)} · ${one.access === "act" ? "Can act" : "Read only"}</p>` +
-        `<p class="meta">${scope(one)} · ${ends(one)} · last used ${e(when(one.lastUsedAt, view.now))}${view.limits === undefined ? "" : ` · ${e(view.limits.note(one))}`}</p></div>${post({ action: "revoke-token", token: one.id }, "Revoke")}</div>`).join("")}</div>`;
-    const create = `<details class="card"><summary>New API token</summary><form method="post" action="/settings/sessions" class="create">${hidden({ csrf, action: "create-token" })}` +
-        `<label>Name<input type="text" name="name" maxlength="60" required placeholder="for example: CI"></label>` +
-        `<label>It can<select name="access"><option value="read">Read (tasks, results, the ledger)</option><option value="act">Act as you (file and manage work; never approve)</option></select></label>` +
-        `<label>Expires in<select name="days">${TOKEN_DAYS.map(days => `<option value="${days}"${days === 90 ? " selected" : ""}>${days} days</option>`).join("")}</select></label>` +
-        `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label><button>Make the token</button></form></details>`;
-    return `<section class="credentials">${note}${toggle}<h2>Signed in</h2>${sessions}${endOthers}<h2 style="margin-top:1.5rem">API tokens</h2>` +
-        `<p class="meta">For scripts and CI: send <code>Authorization: Bearer &lt;token&gt;</code>. A token can't approve anything.</p>${tokens}${view.everyone ? "" : create}${view.limits?.section ?? ""}</section>`;
+    const scope = (one) => one.projects === null ? "All projects" : one.projects.length === 0 ? "No projects" : one.projects.map(repo => projectName(repo)).join(", ");
+    const tokens = live.length === 0 ? html `<p class="meta">No API tokens.</p>` : html `<div class="rows">${live.map(one => html `<div class="row-item" data-token="${one.id}"><div><p>${view.everyone ? html `<strong>${one.account}</strong> · ` : ""}${one.name} · ${one.access === "act" ? "Can act" : "Read only"}</p>\
+<p class="meta">${scope(one)} · ${ends(one)} · last used ${when(one.lastUsedAt, view.now)}${view.limits === undefined ? "" : ` · ${view.limits.note(one)}`}</p></div>${post({ action: "revoke-token", token: one.id }, "Revoke")}</div>`)}</div>`;
+    const create = html `<details class="card"><summary>New API token</summary>${postForm("/settings/sessions", html `\
+<label>Name<input type="text" name="name" maxlength="60" required placeholder="for example: CI"></label>\
+<label>It can<select name="access"><option value="read">Read (tasks, results, the ledger)</option><option value="act">Act as you (file and manage work; never approve)</option></select></label>\
+<label>Expires in<select name="days">${TOKEN_DAYS.map(days => html `<option value="${days}"${days === 90 ? " selected" : ""}>${days} days</option>`)}</select></label>\
+<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label><button>Make the token</button>`, { attrs: { class: "create" }, hidden: { action: "create-token" } })}</details>`;
+    return html `<section class="credentials">${note}${toggle}<h2>Signed in</h2>${sessions}${endOthers}<h2 style="margin-top:1.5rem">API tokens</h2>\
+<p class="meta">For scripts and CI: send <code>Authorization: Bearer &lt;token&gt;</code>. A token can't approve anything.</p>${tokens}${view.everyone ? "" : create}${view.limits?.section ?? ""}</section>`;
 }
 /** The token, once: a focused page with no script. */
 export function tokenShownHtml(name, token, access, expiresAt) {
-    return `<h1>${e(name)}</h1><div class="card"><p>Your API token, shown once. Only a hash is kept, so copy it now.</p><p class="mono secret-value">${e(token)}</p>` +
-        `<p class="meta">${access === "act" ? "It acts as you (never approves)" : "It reads"} until ${e(expiresAt.slice(0, 10))}. Revoke it any time on Sessions &amp; tokens.</p></div><p class="meta"><a href="/settings/sessions">Back to Sessions &amp; tokens</a></p>`;
+    return html `<h1>${name}</h1><div class="card"><p>Your API token, shown once. Only a hash is kept, so copy it now.</p><p class="mono secret-value">${token}</p>\
+<p class="meta">${access === "act" ? "It acts as you (never approves)" : "It reads"} until ${expiresAt.slice(0, 10)}. Revoke it any time on Sessions &amp; tokens.</p></div><p class="meta"><a href="/settings/sessions">Back to Sessions &amp; tokens</a></p>`;
 }

package/dist/demo-chat.d.ts

@@ -1,3 +1,4 @@
+import { type Html } from "./html.js";
 import type { DemoExchange } from "./demo.js";
 /** What a finished exchange's stored result holds, read back from its evidence. */
 export type DemoResultView = {
@@ -17,14 +18,13 @@ export type DemoResultView = {
     taskHref: string;
 };
 /** The conversation itself; the live script swaps this region in place. */
-export declare function demoThreadHtml(exchanges: readonly DemoExchange[], csrf: string, resultOf: (exchange: DemoExchange) => DemoResultView | null): string;
+export declare function demoThreadHtml(exchanges: readonly DemoExchange[], resultOf: (exchange: DemoExchange) => DemoResultView | null): Html;
 export declare function demoChatHtml(input: {
     exchanges: readonly DemoExchange[];
-    csrf: string;
     version: number;
     problem: string | null;
     resultOf: (exchange: DemoExchange) => DemoResultView | null;
-}): string;
+}): Html;
 /**
  * Keeps a running build live: polls while one is working and swaps the
  * thread in place, unless the visitor is typing inside it. Enter sends.