toolroll 0.9.54 → 0.9.56

package/dist/flow-share.js

@@ -24,7 +24,7 @@ import { addFlowTriggerTo, describeTrigger, HOOK_PATH, readHooksBase, triggerCon
 import { durationMinutes, durationWords, FlowContractError, flowTerms, inStepWords, LANGUAGE_WORDS, validateFlowDefinition } from "./flows.js";
 import { stageReferenceProblems } from "./contracts/stage-output.js";
 import { readVersioned } from "./contracts/contract.js";
-import { FLOW_ALIASES, FLOW_FILE_FORMAT, FLOW_FILE_VERSION, flowFileSchema, PARAMETER_ID } from "./contracts/flow.js";
+import { FLOW_ALIASES, FLOW_FILE_FORMAT, legacyFlowNeed, legacySubagentStep, FLOW_FILE_VERSION, flowFileSchema, PARAMETER_ID } from "./contracts/flow.js";
 import { parseSchedule } from "./flow-schedule.js";
 export { FLOW_FILE_FORMAT, FLOW_FILE_VERSION };
 /** The largest flow file Toolroll reads or fetches. */
@@ -38,7 +38,7 @@ function stepOf(stage, ask) {
     const step = { id: stage.id, title: stage.title, kind: stage.kind };
     const words = (minutes) => durationMinutes(durationWords(minutes)) === minutes ? durationWords(minutes) : minutes;
     // Only what the step's kind says: words a zone kept from a kind it was before stay behind.
-    if (stage.instructions !== null && (stage.kind === "task" || stage.kind === "report" || stage.kind === "draft" || stage.kind === "teammate"))
+    if (stage.instructions !== null && (stage.kind === "task" || stage.kind === "report" || stage.kind === "draft" || stage.kind === "subagent"))
         step["instructions"] = stage.instructions;
     if (stage.kind === "task")
         step["planning"] = stage.planning;
@@ -79,8 +79,8 @@ function stepOf(stage, ask) {
             ...(stage.wait.for === "hours" ? { from: stage.wait.from, until: stage.wait.to, ...(stage.wait.timeZone === undefined ? {} : { timeZone: stage.wait.timeZone }) } : { wait: words(stage.wait.minutes) }) });
     if (stage.merge !== undefined)
         step["merge"] = stage.merge;
-    if (stage.teammate !== undefined)
-        step["teammate"] = stage.teammate;
+    if (stage.subagent !== undefined)
+        step["subagent"] = stage.subagent;
     if (stage.reply === true)
         step["reply"] = true;
     // A choice's buttons; "end" ignores the card. A build in another project names a path on this computer, so it stays here.
@@ -135,8 +135,8 @@ function needsOf(definition, triggers, scripts) {
             needs.add("email");
         if (stage.tool !== undefined)
             needs.add(`tool:${stage.tool.server}`);
-        if (stage.teammate !== undefined)
-            needs.add(`teammate:${stage.teammate}`);
+        if (stage.subagent !== undefined)
+            needs.add(`subagent:${stage.subagent}`);
         for (const name of stage.secrets ?? [])
             needs.add(`secret:${name}`);
         for (const value of Object.values(stage.request?.headers ?? {}))
@@ -296,7 +296,7 @@ function stageInputOf(step, index, find) {
         ...(kind === "email" ? { email: { to: step["to"], subject: step["subject"], body: step["body"] } } : {}),
         ...(kind === "tool" ? { tool: { server: step["server"], name: step["tool"], args: typeof step["args"] === "object" && step["args"] !== null ? JSON.stringify(step["args"]) : step["args"] } } : {}),
         ...(kind === "wait" ? { wait: step["waitFor"] === "hours" ? { for: "hours", from: step["from"], to: step["until"], timeZone: step["timeZone"] } : { for: step["waitFor"] ?? "reply", minutes: minutes(step["wait"] ?? "3 days", "wait") } } : {}),
-        merge: step["merge"], teammate: step["teammate"], reply: step["reply"],
+        merge: step["merge"], subagent: step["subagent"], reply: step["reply"],
         ...(kind === "choose" ? { options: (list("options") ?? []).map((one, n) => ({ label: one["label"], to: one["goesTo"] === "end" ? "end" : find(one["goesTo"], `${at}.options[${n}].goesTo`) })) } : {}),
         ...(step["remindAfter"] === undefined ? {} : { limit: { minutes: minutes(step["remindAfter"], "remindAfter"), to: find(step["thenMoveTo"], `${at}.thenMoveTo`) } }),
         next: find(step["next"], `${at}.next`), onFail: find(fail, `${at}.${failKey}`),
@@ -371,6 +371,11 @@ export function parseFlowFile(text) {
         if (kind === "flow")
             refuse(`triggers[${index}].kind: a trigger from another flow can't come from a file; it names a flow on the installation it was made on`);
     });
+    // D5: a file written before subagents were named so (a "teammate" zone, a "teammate:" need) reads as one written since.
+    if (Array.isArray(input["zones"]))
+        input["zones"] = input["zones"].map(legacySubagentStep);
+    if (Array.isArray(input["needs"]))
+        input["needs"] = input["needs"].map(legacyFlowNeed);
     const read = readVersioned(flowFileSchema, input, {}, FLOW_ALIASES);
     if (!read.ok)
         return refuse(read.issues.map(one => one.line).join("\n"));
@@ -443,7 +448,7 @@ const NEED_WORDS = {
 };
 export function needWords(need) {
     const [kind, name] = need.includes(":") ? [need.slice(0, need.indexOf(":")), need.slice(need.indexOf(":") + 1)] : [need, ""];
-    return NEED_WORDS[need] ?? (kind === "secret" ? `A saved secret called ${name}` : kind === "tool" ? `The ${name} tool (Settings → Tools)` : kind === "teammate" ? `An AI teammate called ${name}` : kind === "script" ? `The ${name} script` : need);
+    return NEED_WORDS[need] ?? (kind === "secret" ? `A saved secret called ${name}` : kind === "tool" ? `The ${name} tool (Settings → Tools)` : kind === "subagent" ? `A subagent called ${name}` : kind === "script" ? `The ${name} script` : need);
 }
 /** The import in plain words, checked against the project it lands in. Throws FlowFileError. */
 export function planFlowImport(store, repo, file, given, actor) {

package/dist/flow-starters-ui.d.ts

@@ -4,6 +4,7 @@
  * that's on links to its flow; one that can't run here says why.
  */
 import type { StarterView } from "./flow-starters.js";
+import { type Html } from "./html.js";
 export declare const STARTERS_CSS: string;
 export declare function startersHtml(input: {
     repo: string;
@@ -17,4 +18,4 @@ export declare function startersHtml(input: {
     suggested: string | null;
     said: string | null;
     problem: string | null;
-}): string;
+}): Html;

package/dist/flow-starters-ui.js

@@ -1,4 +1,4 @@
-const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+import { html, postForm } from "./html.js";
 export const STARTERS_CSS = `.starters{max-width:760px;min-width:0}.starters h2{margin:24px 0 4px;font-size:.9375rem}` +
     `.starter{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:4px 16px;align-items:start;padding:14px 0;border-top:1px solid var(--so-line);min-width:0}` +
     `.starter:first-of-type{border-top:0}.starter>:not(.starter-action){grid-column:1}.starter h3{margin:0;font-size:.9375rem;display:flex;flex-wrap:wrap;gap:6px 10px;align-items:center}` +
@@ -13,23 +13,20 @@ export const STARTERS_CSS = `.starters{max-width:760px;min-width:0}.starters h2{
     `@media (max-width:560px){.starter{grid-template-columns:minmax(0,1fr)}.starter .starter-action{grid-column:1;grid-row:auto;margin-top:10px}` +
     `.starter .starter-action button,.starter .starter-action .button-link{width:100%;justify-content:center}.starters select{font-size:16px}}`;
 export function startersHtml(input) {
-    const note = input.problem ? `<p class="problem" role="alert">${e(input.problem)}</p>` : input.said ? `<p role="status">${e(input.said)}</p>` : "";
+    const note = input.problem ? html `<p class="problem" role="alert">${input.problem}</p>` : input.said ? html `<p role="status">${input.said}</p>` : "";
     const selector = input.projects.length > 1
-        ? `<form class="starters-project" method="get" action="/settings/flows"><label>Project<select name="repo">${input.projects.map(one => `<option value="${e(one.path)}"${one.path === input.repo ? " selected" : ""}>${e(one.name)}</option>`).join("")}</select></label><button>Show</button></form>` : "";
+        ? html `<form class="starters-project" method="get" action="/settings/flows"><label>Project<select name="repo">${input.projects.map(one => html `<option value="${one.path}"${one.path === input.repo && html ` selected`}>${one.name}</option>`)}</select></label><button>Show</button></form>` : "";
     // The one asked about ("Do this every time…") comes first, marked.
     const ordered = [...input.starters].sort((a, b) => Number(b.id === input.suggested) - Number(a.id === input.suggested));
     const rows = ordered.map(one => {
-        const action = one.on !== null ? `<p class="starter-action"><a class="button-link starter-open" href="/flows/${one.on.flow}">Open flow</a></p>`
+        const action = one.on !== null ? html `<p class="starter-action"><a class="button-link starter-open" href="/flows/${one.on.flow}">Open flow</a></p>`
             : one.blocked !== null || !input.canSwitch ? ""
-                : `<form method="post" action="/settings/flows/on" class="starter-action"><input type="hidden" name="csrf" value="${e(input.csrf)}"><input type="hidden" name="repo" value="${e(input.repo)}">` +
-                    `<input type="hidden" name="starter" value="${e(one.id)}"><button type="submit">Switch on</button></form>`;
-        return `<div class="starter" id="starter-${e(one.id)}" data-starter="${e(one.id)}" data-suggested="${one.id === input.suggested && one.on === null}">` +
-            `<h3>${e(one.name)}${one.on === null ? "" : ` <span class="starter-on"><i aria-hidden="true"></i>On</span>`}</h3>` +
-            `<p>${e(one.summary)}</p>` +
-            // What the yes agrees to, in full, before it; nothing to agree to once it's on or can't be.
-            (one.on === null && one.blocked === null ? `<ul>${one.does.map(line => `<li>${e(line)}</li>`).join("")}</ul><p class="starter-never">${e(one.never)}</p>` : "") +
-            (one.on === null && one.blocked !== null ? `<p class="starter-blocked">${e(one.blocked)}</p>` : "") + action + `</div>`;
-    }).join("");
-    const nobody = !input.canSwitch && input.starters.some(one => one.on === null) ? `<p class="meta">An approver switches these on.</p>` : "";
-    return `<section class="starters">${note}${selector}<h2>Starter flows</h2>${rows}${nobody}<p class="meta"><a href="/flows">All flows</a></p></section>`;
+                : postForm("/settings/flows/on", html `<button type="submit">Switch on</button>`, { attrs: { class: "starter-action" }, hidden: { repo: input.repo, starter: one.id } });
+        // What the yes agrees to, in full, before it; nothing to agree to once it's on or can't be.
+        const agrees = one.on === null && one.blocked === null && html `<ul>${one.does.map(line => html `<li>${line}</li>`)}</ul><p class="starter-never">${one.never}</p>`;
+        const head = html `<h3>${one.name}${one.on === null ? "" : html ` <span class="starter-on"><i aria-hidden="true"></i>On</span>`}</h3>`;
+        return html `<div class="starter" id="starter-${one.id}" data-starter="${one.id}" data-suggested="${String(one.id === input.suggested && one.on === null)}">${head}<p>${one.summary}</p>${agrees}${one.on === null && one.blocked !== null && html `<p class="starter-blocked">${one.blocked}</p>`}${action}</div>`;
+    });
+    const nobody = !input.canSwitch && input.starters.some(one => one.on === null) ? html `<p class="meta">An approver switches these on.</p>` : "";
+    return html `<section class="starters">${note}${selector}<h2>Starter flows</h2>${rows}${nobody}<p class="meta"><a href="/flows">All flows</a></p></section>`;
 }

package/dist/flow-steps.d.ts

@@ -2,8 +2,8 @@ import type { Runner } from "./backend.js";
 import { type DraftRunner } from "./flow-draft.js";
 import { type MailSender, type ToolCaller } from "./flow-actions.js";
 import type { Store } from "./store.js";
-import type { TurnRunner } from "./teammates.js";
-import type { ToolLister } from "./teammate-tools.js";
+import type { TurnRunner } from "./subagents.js";
+import type { ToolLister } from "./subagent-tools.js";
 export type StepIo = {
     /** `gh` for GitHub; git and the check's shell, both without a model. */
     gh: Runner;
@@ -27,9 +27,9 @@ export type StepIo = {
     callTool?: ToolCaller;
     /** Where the project tools' secrets live (default: this computer's home). */
     toolHome?: string;
-    /** Takes a teammate's turn (default: Claude through this computer's sign-in, answering in its fixed shape). */
-    teammate?: TurnRunner;
-    /** Lists what a project tool offers a teammate (default: starts its MCP server and asks). */
+    /** Takes a subagent's turn (default: Claude through this computer's sign-in, answering in its fixed shape). */
+    subagent?: TurnRunner;
+    /** Lists what a project tool offers a subagent (default: starts its MCP server and asks). */
     listTools?: ToolLister;
 };
 export type StepPass = {

package/dist/flow-steps.js

@@ -40,14 +40,14 @@ import { agentFence } from "./agent-fence.js";
 import { readProviderKey } from "./keys.js";
 import { replyInChannel } from "./chat-inbox.js";
 import { recordSent, threadOf } from "./flow-replies.js";
-import { ASKED, teammateReady, teammateTurn } from "./teammate-work.js";
+import { ASKED, subagentReady, subagentTurn } from "./subagent-work.js";
 import { budgetHoldWords, claudeMachineBilling, monthOf } from "./spend.js";
 import { toolRefusal } from "./policy.js";
 import { pullRequestStep } from "./flow-pull-request.js";
 import { withStageHandoff } from "./contracts/stage-output.js";
 const RETRY_MS = [5 * 60_000, 15 * 60_000];
-/** A teammate's turn tries again sooner: a card waiting on a person's colleague shouldn't wait long for a hiccup. */
-const TEAMMATE_RETRY_MS = [60_000, 5 * 60_000];
+/** A subagent's turn tries again sooner: a card waiting on a person's colleague shouldn't wait long for a hiccup. */
+const SUBAGENT_RETRY_MS = [60_000, 5 * 60_000];
 const OUTPUT_CHARS = 3000;
 /** How much of a step's output its run keeps as the log. */
 const LOG_CHARS = 64_000;
@@ -71,9 +71,9 @@ export async function runFlowSteps(store, repo, now, io) {
         const stage = known.definition?.stages.find(one => one.id === card.stage);
         if (stage === undefined)
             continue;
-        // v92: a teammate's turn — a zone it handles, or a decision it staffs (a person decides when it's paused or gone).
-        if (stage.kind === "teammate" || (stage.kind === "approval" && stage.teammate !== undefined)) {
-            await teammateStep(store, known.flow, known.definition, stage, card, now, io, pass);
+        // v92: a subagent's turn — a zone it handles, or a decision it staffs (a person decides when it's paused or gone).
+        if (stage.kind === "subagent" || (stage.kind === "approval" && stage.subagent !== undefined)) {
+            await subagentStep(store, known.flow, known.definition, stage, card, now, io, pass);
             continue;
         }
         // A pull request: opened for the card's result, then CI decides where it goes (flow-pull-request.ts).
@@ -108,7 +108,7 @@ export async function runFlowSteps(store, repo, now, io) {
         // (or everything) that holds key work holds them.
         const agents = stage.kind === "sort" ? [{ provider: "openrouter", billing: "api-key" }]
             : stage.kind === "draft" ? [{ provider: "claude", billing: claudeMachineBilling(store.handle) }] : null;
-        const held = agents === null ? null : budgetGate({ project: repo, person: null, teammate: null, agents });
+        const held = agents === null ? null : budgetGate({ project: repo, person: null, subagent: null, agents });
         if (held !== null && held.over !== null) {
             const waiting = `${budgetHoldWords(held, monthOf(now).name)}. Raise it on Spend to go on.`;
             if (card.waiting !== waiting)
@@ -183,32 +183,32 @@ function claimStep(store, card, step, now) {
         return store.claimFlowStep({ card: card.id, entry: card.entry, ...step }, now);
     });
 }
-/** One teammate turn, when one is due for this card: claimed like any step, retried on failure, and waiting while its question is open. */
-async function teammateStep(store, flow, definition, stage, card, now, io, pass) {
-    // v102: on a protected project an AI teammate never decides an approval; the engine asks the person.
+/** One subagent turn, when one is due for this card: claimed like any step, retried on failure, and waiting while its question is open. */
+async function subagentStep(store, flow, definition, stage, card, now, io, pass) {
+    // v102: on a protected project a subagent never decides an approval; the engine asks the person.
     if (stage.kind === "approval" && store.approvalRules(flow.repo).protectProject)
         return true;
-    const mate = stage.teammate === undefined ? null : store.teammateByHandle(flow.repo, stage.teammate);
-    const ready = teammateReady(store, mate, now);
+    const mate = stage.subagent === undefined ? null : store.subagentByHandle(flow.repo, stage.subagent);
+    const ready = subagentReady(store, mate, now);
     if (!ready.ok) {
         // A decision goes to its person (the engine asks them). A zone only it handles waits, saying why.
         if (stage.kind === "approval")
             return true;
-        const waiting = ready.why === "gone" ? `There's no teammate called ${stage.teammate ?? "(none)"} in this project.` : `${mate.handle} is ${ready.why === "paused" ? "paused" : `waiting: ${ready.why}`}.`;
+        const waiting = ready.why === "gone" ? `There's no subagent called ${stage.subagent ?? "(none)"} in this project.` : `${mate.handle} is ${ready.why === "paused" ? "paused" : `waiting: ${ready.why}`}.`;
         if (card.waiting !== waiting)
             store.updateFlowCard(card.id, { waiting }, now);
         return true;
     }
     // Waiting on a person: its own question, or (v94) a tool call they approve first.
-    if (store.openTeammateQuestionOn(card.id, card.entry) !== null)
+    if (store.openSubagentQuestionOn(card.id, card.entry) !== null)
         return true;
-    if (!claimStep(store, card, { stage: stage.id, kind: "teammate", script: null, scriptVersion: null }, now))
+    if (!claimStep(store, card, { stage: stage.id, kind: "subagent", script: null, scriptVersion: null }, now))
         return true;
     pass.ran++;
     const started = Date.now();
     let outcome;
     try {
-        outcome = await teammateTurn(store, flow, definition, stage, card, mate, now, { ...(io.teammate === undefined ? {} : { turn: io.teammate }), ...(io.evidenceRoot === undefined ? {} : { evidenceRoot: io.evidenceRoot }),
+        outcome = await subagentTurn(store, flow, definition, stage, card, mate, now, { ...(io.subagent === undefined ? {} : { turn: io.subagent }), ...(io.evidenceRoot === undefined ? {} : { evidenceRoot: io.evidenceRoot }),
             ...(io.callTool === undefined ? {} : { callTool: io.callTool }), ...(io.listTools === undefined ? {} : { listTools: io.listTools }), ...(io.toolHome === undefined ? {} : { toolHome: io.toolHome }) });
     }
     catch (error) {
@@ -218,15 +218,15 @@ async function teammateStep(store, flow, definition, stage, card, now, io, pass)
     const kept = { log: outcome.log === undefined ? null : keptLog(outcome.log), durationMs: Date.now() - started, ...(outcome.decisionJson === undefined ? {} : { decisionJson: outcome.decisionJson }) };
     if (outcome.state === "retry") {
         const attempts = run?.attempts ?? 1;
-        if (attempts <= TEAMMATE_RETRY_MS.length) {
-            store.finishFlowStep(card.id, card.entry, { state: "waiting", result: outcome.said, nextAt: new Date(now.getTime() + TEAMMATE_RETRY_MS[attempts - 1]).toISOString(), ...kept }, now);
+        if (attempts <= SUBAGENT_RETRY_MS.length) {
+            store.finishFlowStep(card.id, card.entry, { state: "waiting", result: outcome.said, nextAt: new Date(now.getTime() + SUBAGENT_RETRY_MS[attempts - 1]).toISOString(), ...kept }, now);
             if (stage.kind !== "approval")
                 store.updateFlowCard(card.id, { waiting: `${outcome.said} Trying again in ${attempts === 1 ? "a minute" : "5 minutes"}.` }, now);
             pass.problems.push(`flow card ${card.id}: ${outcome.said}`);
             return true;
         }
         outcome = { state: "failed", said: `${outcome.said} It didn't work after three tries.` };
-        store.addTeammateEvent({ teammate: mate.id, card: card.id, entry: card.entry, kind: "failed", said: `Couldn't take its turn on “${card.title}”: ${outcome.said}` }, now);
+        store.addSubagentEvent({ subagent: mate.id, card: card.id, entry: card.entry, kind: "failed", said: `Couldn't take its turn on “${card.title}”: ${outcome.said}` }, now);
         if (stage.kind !== "approval")
             store.updateFlowCard(card.id, { waiting: outcome.said }, now);
     }

package/dist/flow-triggers.d.ts

@@ -155,7 +155,7 @@ export declare function planeStatusLink(config: TriggerConfig | null, status: st
     label: string;
     href: string;
 } | null;
-/** v96: a schedule (a teammate's routine) makes its card now, once per press, and keeps its own times. */
+/** v96: a schedule (a subagent's routine) makes its card now, once per press, and keeps its own times. */
 export declare function runScheduleNow(store: Store, trigger: FlowTriggerRow, actor: string, now: Date): {
     ok: true;
     card: number;
@@ -208,6 +208,7 @@ export declare const FORM_PATH = "/hooks/form/";
 /** Share a button as a secret link anyone can fill in, without signing in. The link is shown once; only its hash is kept. */
 export declare function shareFlowButton(store: Store, trigger: FlowTriggerRow, now: Date, dir: string | null): TriggerMade;
 export declare function stopSharingFlowButton(store: Store, trigger: FlowTriggerRow, now: Date): void;
+/** The page's bytes (the public route writes them itself, with its own headers). */
 export type FormAnswer = {
     status: number;
     html: string;

package/dist/flow-triggers.js

@@ -1,4 +1,5 @@
 import { adapterPolicy } from "./server/route-policy.js";
+import { html, htmlString, postForm, styleElement } from "./html.js";
 /**
  * Flow triggers (v82): what starts cards in a flow without someone adding
  * them by hand.
@@ -730,7 +731,7 @@ export const NEEDS_YOU_HREF = "/work?view=needs-you";
 export function planeStatusLink(config, status) {
     return config?.kind === "plane-review" && status !== null && /waited over \d+ days for you\.$/.test(status) ? { label: "Needs you", href: NEEDS_YOU_HREF } : null;
 }
-/** v96: a schedule (a teammate's routine) makes its card now, once per press, and keeps its own times. */
+/** v96: a schedule (a subagent's routine) makes its card now, once per press, and keeps its own times. */
 export function runScheduleNow(store, trigger, actor, now) {
     const config = triggerConfigOf(trigger);
     if (config?.kind !== "schedule" || config.script !== undefined)
@@ -1107,11 +1108,7 @@ export function shareFlowButton(store, trigger, now, dir) {
 export function stopSharingFlowButton(store, trigger, now) {
     store.updateFlowTrigger(trigger.id, { hookHash: null }, now);
 }
-const esc = (value) => value.replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
-/** The public page: the button's name and its questions, nothing about the flow, the project or anyone in it. */
-function formHtml(label, body) {
-    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noindex">
-<title>${esc(label)}</title><style>
+const FORM_CSS = `
 :root{color-scheme:light dark;--bg:#f7f7f5;--card:#fff;--text:#1c1d1b;--muted:#666a63;--line:#dcded8;--accent:#2d5a45}
 @media (prefers-color-scheme:dark){:root{--bg:#141614;--card:#1d201d;--text:#ecefe9;--muted:#9ea39a;--line:#343934;--accent:#8fd0ae}}
 *{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--text);font:16px/1.5 system-ui,-apple-system,"Segoe UI",sans-serif}
@@ -1119,18 +1116,23 @@ main{max-width:560px;margin:0 auto;padding:40px 16px}h1{font-size:1.5rem;margin:
 label{display:grid;gap:6px;margin:0 0 16px;font-weight:600}input,textarea{font:inherit;color:inherit;background:transparent;border:1px solid var(--line);border-radius:10px;padding:10px 12px;width:100%}
 textarea{min-height:96px;resize:vertical}button{font:inherit;font-weight:600;border:0;border-radius:10px;padding:12px 18px;min-height:44px;background:var(--accent);color:var(--bg);cursor:pointer}
 p{color:var(--muted)}.trap{position:absolute;left:-10000px;width:1px;height:1px;overflow:hidden}a{color:var(--accent)}
-</style></head><body><main><h1>${esc(label)}</h1><div class="card">${body}</div></main></body></html>`;
+`;
+/** The public page: the button's name and its questions, nothing about the flow, the project or anyone in it. */
+function formHtml(label, body) {
+    return htmlString(html `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noindex">
+<title>${label}</title>${styleElement(FORM_CSS)}</head><body><main><h1>${label}</h1><div class="card">${body}</div></main></body></html>`);
 }
 /** GET a shared form: its questions. */
 export function flowFormPage(store, token, now) {
     const trigger = /^[A-Za-z0-9_-]{20,64}$/.test(token) ? store.flowTriggerByHook(hookHash(token)) : null;
     const config = trigger === null ? null : triggerConfigOf(trigger);
     if (trigger === null || config?.kind !== "button")
-        return { status: 404, html: formHtml("Not found", "<p>This form isn't available. Ask whoever shared it for a new link.</p>") };
+        return { status: 404, html: formHtml("Not found", html `<p>This form isn't available. Ask whoever shared it for a new link.</p>`) };
     if (!adapterPolicy({ caller: "anonymous", capability: "none" }, undefined, source => source === "flow" && store.getFlow(trigger.flow) !== null).ok)
         return { status: 403, html: "" };
-    const fields = config.questions.map((question, index) => `<label>${esc(question)}${index === 0 ? `<input name="a${index}" required maxlength="200" autocomplete="off">` : `<textarea name="a${index}" maxlength="3000"></textarea>`}</label>`).join("");
-    return { status: 200, html: formHtml(config.label, `<form method="post">${fields}<div class="trap" aria-hidden="true"><label>Leave this empty<input name="website" tabindex="-1" autocomplete="off"></label></div><input type="hidden" name="t" value="${now.getTime()}"><button>Send</button></form>`) };
+    const fields = config.questions.map((question, index) => html `<label>${question}${index === 0 ? html `<input name="a${index}" required maxlength="200" autocomplete="off">` : html `<textarea name="a${index}" maxlength="3000"></textarea>`}</label>`);
+    // Signed out by nature: no session, so no CSRF; the trap, the shown time and the hourly limit guard it. It posts back to its own address.
+    return { status: 200, html: formHtml(config.label, postForm("", html `${fields}<div class="trap" aria-hidden="true"><label>Leave this empty<input name="website" tabindex="-1" autocomplete="off"></label></div><input type="hidden" name="t" value="${now.getTime()}"><button>Send</button>`, { signedOut: true })) };
 }
 /** POST a shared form: at most one card per submission, keys refused, a limit per hour, and quiet about what a bot did wrong. */
 export function receiveFlowForm(store, token, fields, now) {
@@ -1140,8 +1142,8 @@ export function receiveFlowForm(store, token, fields, now) {
         return flowFormPage(store, token, now);
     if (!adapterPolicy({ caller: "anonymous", capability: "none" }, undefined, source => source === "flow" && store.getFlow(trigger.flow) !== null).ok)
         return { status: 403, html: "" };
-    const again = `<p><a href="${esc(FORM_PATH + token)}">Send another</a></p>`;
-    const thanks = formHtml(config.label, `<p>Thanks — it's been sent.</p>${again}`);
+    const again = html `<p><a href="${FORM_PATH + token}">Send another</a></p>`;
+    const thanks = formHtml(config.label, html `<p>Thanks — it's been sent.</p>${again}`);
     // A filled trap, or a page posted faster than a person could, gets thanks and makes nothing.
     const form = readFormSubmission(fields, config.questions.length);
     const shown = Number(form.t);
@@ -1149,14 +1151,14 @@ export function receiveFlowForm(store, token, fields, now) {
         return { status: 200, html: thanks };
     const recent = store.handle.prepare("SELECT COUNT(*) AS n FROM flow_trigger_event WHERE trigger = ? AND key LIKE 'form:%' AND at > ?").get(trigger.id, new Date(now.getTime() - 3_600_000).toISOString());
     if (Number(recent?.["n"] ?? 0) >= FORM_CARDS_PER_HOUR)
-        return { status: 429, html: formHtml(config.label, `<p>Too many sent in the last hour. Try again later.</p>`) };
+        return { status: 429, html: formHtml(config.label, html `<p>Too many sent in the last hour. Try again later.</p>`) };
     const answers = form.answers.map((answer, index) => (answer ?? "").replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "").trim().slice(0, index === 0 ? 200 : 3000));
     if (answers[0] === "")
-        return { status: 400, html: formHtml(config.label, `<p>Answer “${esc(config.questions[0])}” first.</p>${again}`) };
+        return { status: 400, html: formHtml(config.label, html `<p>Answer “${config.questions[0]}” first.</p>${again}`) };
     const details = config.questions.slice(1).map((question, index) => answers[index + 1] === "" ? null : `${question}\n${answers[index + 1]}`).filter(one => one !== null).join("\n\n");
     const made = makeCard(store, trigger, config, { key: `form:${now.toISOString()}:${randomUUID().slice(0, 8)}`, title: answers[0], description: `From the “${config.label}” form:\n\n${details}`.trim(), source: { kind: "form", label: `Form: ${config.label}`, url: null } }, "Form", now);
     if (made.made !== "added")
-        return { status: 400, html: formHtml(config.label, `<p>${made.note?.includes("key or password") ? "That looks like it holds a key or password. Take it out and send again." : "That couldn't be sent."}</p>${again}`) };
+        return { status: 400, html: formHtml(config.label, html `<p>${made.note?.includes("key or password") ? "That looks like it holds a key or password. Take it out and send again." : "That couldn't be sent."}</p>${again}`) };
     store.updateFlowTrigger(trigger.id, { lastAt: now.toISOString(), lastOutcome: "Someone sent the form." }, now);
     return { status: 200, html: thanks };
 }

package/dist/flows-cli.js

@@ -516,7 +516,7 @@ function zoneOf(stage, flow) {
         ...(stage.kind === 'approval' ? { decider: deciderOf(stage, flow) } : {}),
         ...(stage.script === null ? {} : { script: stage.script }),
         ...(stage.merge === undefined ? {} : { merge: stage.merge }),
-        ...(stage.teammate === undefined ? {} : { teammate: stage.teammate }),
+        ...(stage.subagent === undefined ? {} : { subagent: stage.subagent }),
         ...(stage.options === undefined ? {} : { options: stage.options.map(one => ({ label: one.label, to: one.to })) }),
         ...(stage.repo === undefined ? {} : { repo: stage.repo }),
     };

package/dist/flows-ui.d.ts

@@ -3,9 +3,10 @@
 import type { BrowserFlowView } from "./browser-workspace.js";
 import type { FlowRow, Store } from "./store.js";
 import { type FlowFile, type FlowImportPlan } from "./flow-share.js";
+import { type Html } from "./html.js";
 export declare const FLOWS_CSS = ".flows{max-width:880px;min-width:0}.flows .card{padding:16px 18px;margin:12px 0}.flows .flow-row{display:flex;justify-content:space-between;align-items:baseline;gap:12px;flex-wrap:wrap}.flows .flow-row h2{font-size:1.05rem;margin:0}.flows .flow-counts{font-size:.85rem;color:var(--so-muted)}.flows form{display:grid;gap:10px;margin:0}.flows label{display:grid;gap:6px}.flows input,.flows select{box-sizing:border-box;width:100%;max-width:100%}.flows button{justify-self:start;min-height:44px}.flows .flow-fallback ol{padding-left:20px}.flows summary{cursor:pointer;min-height:44px;display:flex;align-items:center;font-weight:600}.flows .flow-buttons{display:flex;flex-wrap:wrap;align-items:center;gap:8px;margin:10px 0 0}.flows .flow-import{margin-top:18px;padding-top:14px;border-top:1px solid var(--so-line)}.flows .flow-import h3{font-size:.95rem;margin:0}.flows .flow-terms{list-style:none;padding:0;margin:8px 0 16px;display:grid;gap:10px}.flows .flow-terms li{white-space:pre-line;overflow-wrap:anywhere}.flows .flow-terms pre{white-space:pre-wrap;overflow-wrap:anywhere;font-size:.8rem;margin:6px 0 0}.flows .flow-import-preview h2{font-size:1rem;margin:20px 0 4px}.flows .flow-untrusted{font-weight:600}.flows button.primary{background:var(--primary);color:var(--primary-foreground);border-color:var(--primary)}.flows fieldset{border:0;padding:0;margin:0;display:grid;gap:10px;min-width:0}.flows legend{font-weight:600;padding:0;margin-bottom:6px}.flows textarea[hidden]{display:none}.flows button.secondary{background:transparent;color:var(--foreground);border:1px solid var(--border)}@media(max-width:600px){.flows input,.flows select{font-size:16px}}@media(max-width:760px){.flows .card{padding:10px 12px;margin:8px 0;position:relative}.flows .flow-row{row-gap:2px}.flows .flow-row h2 a::after{content:\"\";position:absolute;inset:0;border-radius:inherit}.flows .flow-counts{line-height:1.35}}";
 /** The flows a person can open, with how many cards wait in each, and the new-flow form. */
-export declare function flowsListHtml(store: Store, flows: readonly FlowRow[], projects: readonly string[], csrf: string, canCreate: boolean, problem: string | null): string;
+export declare function flowsListHtml(store: Store, flows: readonly FlowRow[], projects: readonly string[], canCreate: boolean, problem: string | null): Html;
 /** Reads the chosen flow file into the form (the server reads it again, whole, before anything is made). */
 export declare const FLOW_IMPORT_SCRIPT = "(function(){var form=document.querySelector('[data-flow-import]');if(!form)return;var input=form.querySelector('[data-flow-file]'),text=form.querySelector('[data-flow-document]'),note=form.querySelector('[data-flow-file-note]'),address=form.querySelector('[name=url]');function say(words){note.textContent=words;note.hidden=words==='';}var reading=null;input.addEventListener('change',function(){text.value='';say('');var file=input.files&&input.files[0];if(!file){reading=null;return;}if(file.size>262144){say('That file is too big: a flow file is at most 256 KB.');input.value='';reading=null;return;}reading=file.text().then(function(value){text.value=value;});});form.addEventListener('submit',function(event){if(reading!==null&&text.value===''){event.preventDefault();reading.then(function(){form.requestSubmit();});return;}if(text.value===''&&address.value.trim()===''){event.preventDefault();say('Choose a flow file or give its address.');}});})();";
 /** An import's preview: the plan in plain words, what it asks for, and one Import button after the terms. */
@@ -18,7 +19,7 @@ export declare function flowImportHtml(input: {
     values: Record<string, string>;
     previewed: string;
     problem: string | null;
-}): string;
+}): Html;
 /** One flow's canvas for one person. */
 export declare function flowView(store: Store, flow: FlowRow, viewer: {
     name: string;
@@ -31,4 +32,4 @@ export declare function flowView(store: Store, flow: FlowRow, viewer: {
     toolHome?: string;
 }): BrowserFlowView;
 /** The page the canvas replaces when scripts can't run: each zone and its cards, in order. */
-export declare function flowFallbackHtml(view: BrowserFlowView): string;
+export declare function flowFallbackHtml(view: BrowserFlowView): Html;