toolroll 0.9.54 → 0.9.56

package/dist/operate.js

@@ -22,7 +22,7 @@ import { checkoutPlan, cleanCheckouts, discardCheckout, finishedCheckouts, slimK
 import { closeOutCheckouts, closeOutRuns, stoppedWords } from "./run-closeout.js";
 import { MIN_DAYS, RETENTION_KINDS, countWords, dailyRetention, isRetentionKind, lastSweepAt, parsePeriod, periodLabel, periodWords, retentionPlan, sweepWords } from "./retention.js";
 import { checkPolicy, parseList, policyParts } from "./policy.js";
-import { billingOf, budgetHoldWords, budgetLabel, budgetStates, monthNamed, monthOf, spendItems, teammateNames, usd as spendUsd } from "./spend.js";
+import { billingOf, budgetHoldWords, budgetLabel, budgetStates, monthNamed, monthOf, spendItems, subagentNames, usd as spendUsd } from "./spend.js";
 import { spendCsv } from "./spend-ui.js";
 import { buildExport, exportSummary, exportZip, writeExportFolder } from "./export.js";
 import { startBudgetAlerts } from "./budget-alerts.js";
@@ -43,8 +43,8 @@ import { origin, readMonitoring } from "./monitoring-settings.js";
 import { logEvent } from "./log.js";
 import { FLOW_EVERY_MS, flowHousekeeping, moveCards, moveCardsAfter } from "./flow-cadence.js";
 import { readHooksBase, scheduleFromWords } from "./flow-triggers.js";
-import { sendTeammateSummaries } from "./teammate-admin.js";
-import { runRequestedUndos, sendTeammateWeeklies } from "./teammate-week.js";
+import { sendSubagentSummaries } from "./subagent-admin.js";
+import { runRequestedUndos, sendSubagentWeeklies } from "./subagent-week.js";
 import { refreshConnections } from "./mcp-connect.js";
 import { followDiscord } from "./discord.js";
 import { followTeams } from "./teams.js";
@@ -156,8 +156,8 @@ import { bridgePass, clearBotToken, createTransport, followBridge, hashPairingCo
 import { scanRepo } from "./capscan.js";
 import { computeGaps, describeCapability } from "./gaps.js";
 import { ask as promptAsk, askHidden as promptHidden, confirm as promptConfirm, interactive as promptInteractive, underAgent } from "./prompt.js";
-import { runMateCli, answerContextLines } from "./mate-cli.js";
-import { confirmCoordinatorProposal, dismissCoordinatorProposal } from "./mate-doors.js";
+import { runLeadCli, answerContextLines } from "./lead-cli.js";
+import { confirmCoordinatorProposal, dismissCoordinatorProposal } from "./lead-doors.js";
 import { verifyApproverByPassword as approverByPassword } from "./principal.js";
 import { activeRemote, REMOTE_MESSAGES, REMOTE_REFUSED_FLAGS, REMOTE_SCOPES, RemoteRefusal, remoteAllows, remoteLensOf, remoteProjectOf, remoteRowOf, remoteSecret, reproveRemote, withRemote } from "./operate-remote.js";
 import { projectAuthority } from "./project-access.js";
@@ -256,9 +256,9 @@ export const OPERATE_HELP = `toolroll — operating the queue
   toolroll integrations [--json]     which integrations work: Connected, Not set up or Broken, and what to do (--saved: no new checks)
   toolroll monitoring                where the audit stream and traces go, and how each destination is doing
   toolroll check-progress <run>      current or final approved check progress
-  toolroll spend [--month YYYY-MM] [--csv]   what agent work cost, by project, person, teammate and model
+  toolroll spend [--month YYYY-MM] [--csv]   what agent work cost, by project, person, subagent and model
   toolroll export --out <path> [--zip]   everything Toolroll knows, in a folder or .zip (no secrets)
-  toolroll budget list|set|remove    monthly budgets (--all | --project <p> | --person <name> | --teammate <id>) --usd <n> [--alerts-only]
+  toolroll budget list|set|remove    monthly budgets (--all | --project <p> | --person <name> | --subagent <id>) --usd <n> [--alerts-only]
   toolroll notifications [quiet|all]   how chats reach you: only when you're needed (the default), or every step
   toolroll notifications digest <HH:MM>|off   one evening message: what finished, what waits, what failed
   toolroll notifications mute|unmute --repo <p>   no pings for a project; the console and digest keep it
@@ -370,7 +370,7 @@ External trackers — build what a tracker nominates, under local approvals
 
   toolroll claim <id> --runner <name> [--ttl <seconds>]
   toolroll heartbeat <lease>         still working; extends the lease
-  toolroll release <lease>           done with it; fenced if superseded
+  toolroll worker release <lease>    done with it; fenced if superseded
   toolroll reap                      release every lease that ran out
 
   toolroll tick --runner <name> --token <t> --repo <path>
@@ -477,7 +477,7 @@ Agents — which provider and model each phase runs on
   toolroll chat --as <you> [--repo <path>…] [--say "…"] [--end]
       [--ceiling-usd <n>] [--json]                 (password at the prompt;
       --token <t> only for scripts — it lands in shell history)
-      the mate: one conversation across your projects, the same thread the
+      your lead: one conversation across your projects, the same thread the
       console shows; the password mints a spending session once; it reads
       and proposes, you confirm cards (confirm N / dismiss N / open N;
       confirm N yes for an irreversible answer)
@@ -625,7 +625,7 @@ export const OPERATE_VALUE_FLAGS = new Set([
     // v103: the ledger chain and evidence packs.
     "checkpoint", "out", "from", "to",
     // v105: spend and budgets.
-    "month", "usd", "person", "teammate",
+    "month", "usd", "person", "subagent", "teammate",
     // Sprint 8: the organisation policy.
     "providers", "models", "tools",
     "project-root", "schedule", "ceiling", "require",
@@ -869,7 +869,7 @@ async function dispatchOn(command, positional, flags, repoList, base, options, e
             ...(options.flowFetch === undefined ? {} : { flowFetch: options.flowFetch }),
             ...(options.integrationIo === undefined ? {} : { integrationIo: options.integrationIo }),
             ...(options.shouldStop === undefined ? {} : { shouldStop: options.shouldStop }),
-            ...(options.mateSeams === undefined ? {} : { mateSeams: options.mateSeams }),
+            ...(options.leadSeams === undefined ? {} : { leadSeams: options.leadSeams }),
             ...(options.waitSleep === undefined ? {} : { waitSleep: options.waitSleep }),
             ...(options.releaseIo === undefined ? {} : { releaseIo: options.releaseIo }),
             ...(options.installBin === undefined ? {} : { installBin: options.installBin }),
@@ -1023,7 +1023,7 @@ function telegramCanDeliver(context, token) {
 function telegramConversation(context, options = {}) {
     return {
         evidenceRoot: context.evidenceRoot,
-        ...(context.mateSeams?.subscriptionRunner === undefined ? {} : { subscriptionRunner: context.mateSeams.subscriptionRunner }),
+        ...(context.leadSeams?.subscriptionRunner === undefined ? {} : { subscriptionRunner: context.leadSeams.subscriptionRunner }),
         // Re-read on every card and every `/task`: the same console-url chat
         // links use, held to an https origin, and — inside `up`, where this
         // process also serves the console — equal to that console's own
@@ -1143,8 +1143,10 @@ async function dispatch(command, positional, flags, context) {
             return claimCommand(positional, flags, context);
         case "heartbeat":
             return leaseCommand("heartbeat", positional, flags, context);
-        case "release":
-            return leaseCommand("release", positional, flags, context);
+        case "worker":
+            if (positional[0] === "release")
+                return leaseCommand("release", positional.slice(1), flags, context);
+            return fail(context.write, context.json, "worker", "usage", "`toolroll worker release <lease>` returns a lease.", EXIT.usage);
         case "reap":
             return reapCommand(context);
         case "runner":
@@ -1476,18 +1478,20 @@ function claimCommand(positional, flags, context) {
  */
 function leaseCommand(command, positional, flags, context) {
     const { store, write, json, now } = context;
+    // `release` answers as the worker verb it now is (the bare `toolroll release <lease>` form is deprecated).
+    const name = command === "release" ? "worker release" : command;
     const lease = positional[0];
     if (lease === undefined)
-        return fail(write, json, command, "usage", `which lease? \`toolroll ${command} <lease>\``, EXIT.usage);
+        return fail(write, json, name, "usage", `which lease? \`toolroll ${name} <lease>\``, EXIT.usage);
     const ttl = readTtl(flags);
     if (ttl === null)
-        return fail(write, json, command, "usage", "--ttl takes whole seconds", EXIT.usage);
+        return fail(write, json, name, "usage", "--ttl takes whole seconds", EXIT.usage);
     const result = command === "heartbeat" ? heartbeat(store, lease, now, ttl) : release(store, lease, now);
     if (!result.ok) {
         const message = result.reason === "fenced"
             ? "superseded — another runner holds this task now; stop rather than retry"
             : "no such lease";
-        return fail(write, json, command, result.reason, message, EXIT.refused);
+        return fail(write, json, name, result.reason, message, EXIT.refused);
     }
     if (command === "release") {
         const task = store.getTask(String(refExternalId(store, result.claim.taskRef)));
@@ -1496,7 +1500,7 @@ function leaseCommand(command, positional, flags, context) {
         if (task !== null && task.state === "running")
             store.setTaskState(task.id, "queued", now);
     }
-    return succeed(write, json, command, { lease: result.claim }, () => [
+    return succeed(write, json, name, { lease: result.claim }, () => [
         command === "heartbeat"
             ? `Still yours until ${result.claim.expiresAt}.`
             : `Released ${result.claim.leaseId}.`,
@@ -2269,25 +2273,25 @@ async function tickCommand(flags, context) {
     const replyPass = housekeeping?.replies ?? { read: 0, taken: 0, problem: null };
     const stepPass = housekeeping?.steps ?? { ran: 0, problems: [] };
     const flowPass = housekeeping?.flows ?? { moved: 0, filed: [], problems: [] };
-    // Each AI teammate's daily summary to its manager (v92), once, after 5 pm; its weekly report (v97), Monday mornings.
+    // Each subagent's daily summary to its manager (v92), once, after 5 pm; its weekly report (v97), Monday mornings.
     if (!buildsOnly)
         try {
-            sendTeammateSummaries(store, repo, clock());
-            sendTeammateWeeklies(store, repo, clock());
+            sendSubagentSummaries(store, repo, clock());
+            sendSubagentWeeklies(store, repo, clock());
         }
         catch (error) {
-            flowPass.problems.push(`teammate summaries: ${error instanceof Error ? error.message : "could not send"}`);
+            flowPass.problems.push(`subagent summaries: ${error instanceof Error ? error.message : "could not send"}`);
         }
-    // Undoing a teammate's tool call asked for in chat (v97): made here, as the person who asked.
+    // Undoing a subagent's tool call asked for in chat (v97): made here, as the person who asked.
     if (!buildsOnly && context.shouldStop?.() !== true) {
         try {
             await runRequestedUndos(store, {}, clock());
         }
         catch (error) {
-            flowPass.problems.push(`teammate undo: ${error instanceof Error ? error.message : "could not run"}`);
+            flowPass.problems.push(`subagent undo: ${error instanceof Error ? error.message : "could not run"}`);
         }
     }
-    // Tools connected by signing in: a sign-in that runs out within ten minutes is renewed here, so a build or a teammate's call starts with a fresh one.
+    // Tools connected by signing in: a sign-in that runs out within ten minutes is renewed here, so a build or a subagent's call starts with a fresh one.
     if (!buildsOnly && context.shouldStop?.() !== true) {
         try {
             flowPass.problems.push(...(await refreshConnections(store, [repo], clock(), context.flowStepIo?.fetch === undefined ? {} : { fetcher: context.flowStepIo.fetch })).problems);
@@ -6046,19 +6050,19 @@ async function runWatchLoop(args) {
         : startTelegramFollower({ context, publicUrl: text(flags, "public-url"), signal: followController.signal, progress, label: "watch: bridge", died: { prefix: "watch: ", then: "taps wait for the next watch" } });
     const slackFollower = followSlack({ store, dir: dirname(context.databaseFile), signal: followController.signal,
         readProjects: telegramReadProjects(context), evidenceRoot: context.evidenceRoot,
-        ...(context.mateSeams?.subscriptionRunner ? { subscriptionRunner: context.mateSeams.subscriptionRunner } : {}),
+        ...(context.leadSeams?.subscriptionRunner ? { subscriptionRunner: context.leadSeams.subscriptionRunner } : {}),
         origin: () => phoneOrigin(process.env, dirname(context.databaseFile), { serverOrigin: text(flags, "public-url") ?? null }),
         notifications: () => effectivePrimary(process.env, dirname(context.databaseFile), loadBotToken(process.env, context.telegramTokenFile) !== null).channel === "slack",
     }).catch(() => progress("watch: Slack stopped. Check Slack settings before reconnecting."));
     const teamsFollower = followTeams({ store, dir: dirname(context.databaseFile), signal: followController.signal,
         readProjects: telegramReadProjects(context), evidenceRoot: context.evidenceRoot,
-        ...(context.mateSeams?.subscriptionRunner ? { subscriptionRunner: context.mateSeams.subscriptionRunner } : {}),
+        ...(context.leadSeams?.subscriptionRunner ? { subscriptionRunner: context.leadSeams.subscriptionRunner } : {}),
         origin: () => phoneOrigin(process.env, dirname(context.databaseFile), { serverOrigin: text(flags, "public-url") ?? null }),
         notifications: () => effectivePrimary(process.env, dirname(context.databaseFile), loadBotToken(process.env, context.telegramTokenFile) !== null).channel === "teams",
     }).catch(() => progress("watch: Teams stopped. Check Teams settings before reconnecting."));
     const discordFollower = followDiscord({ store, dir: dirname(context.databaseFile), signal: followController.signal,
         readProjects: telegramReadProjects(context), evidenceRoot: context.evidenceRoot,
-        ...(context.mateSeams?.subscriptionRunner ? { subscriptionRunner: context.mateSeams.subscriptionRunner } : {}),
+        ...(context.leadSeams?.subscriptionRunner ? { subscriptionRunner: context.leadSeams.subscriptionRunner } : {}),
         origin: () => phoneOrigin(process.env, dirname(context.databaseFile), { serverOrigin: text(flags, "public-url") ?? null }),
         notifications: () => effectivePrimary(process.env, dirname(context.databaseFile), loadBotToken(process.env, context.telegramTokenFile) !== null).channel === "discord",
     }).catch(() => progress("watch: Discord stopped. Check Discord settings before reconnecting."));
@@ -9983,7 +9987,7 @@ function describeApproveFailure(reason, id) {
     if (reason === "requester")
         return `you filed ${id}, and this project needs someone else to approve it`;
     if (reason === "person-required")
-        return `${id} is protected work: a person has to approve it, not an operating mode, a schedule or an AI teammate`;
+        return `${id} is protected work: a person has to approve it, not an operating mode, a schedule or a subagent`;
     if (reason === "second-approver")
         return `your approval of ${id} is recorded; it is protected work, so a second person needs to approve it (toolroll task approve ${id} as them)`;
     if (reason === "no-approvers") {
@@ -10100,7 +10104,7 @@ async function chatCommand(flags, context) {
         return fail(write, json, "chat", "usage", "Choose --follow or --no-follow.", EXIT.usage);
     const credentials = await askCredentials(flags, context);
     if (credentials === null) {
-        return fail(write, json, "chat", "usage", "the mate takes your name and password — `--as <you>` and the hidden prompt; `--token <t>` only where a script must (it lands in shell history)", EXIT.usage);
+        return fail(write, json, "chat", "usage", "the lead takes your name and password — `--as <you>` and the hidden prompt; `--token <t>` only where a script must (it lands in shell history)", EXIT.usage);
     }
     const ceilingGiven = text(flags, "ceiling-usd");
     // The ceiling: the `--repo` list, or the ENROLLED registry beside the
@@ -10116,7 +10120,7 @@ async function chatCommand(flags, context) {
             return fail(write, json, "chat", "registry", "the enrolled-project registry could not be read — name projects with --repo", EXIT.refused);
         repos = loaded.repos;
     }
-    const result = await runMateCli({
+    const result = await runLeadCli({
         store,
         databaseFile: context.databaseFile,
         write,
@@ -10127,7 +10131,7 @@ async function chatCommand(flags, context) {
         end: flags.has("end"),
         ...(flags.has("follow") || flags.has("no-follow") ? { follow: flags.has("follow") && !flags.has("no-follow") } : {}),
         ceilingUsd: ceilingGiven === undefined ? undefined : Number(ceilingGiven),
-        ...(context.mateSeams === undefined ? {} : { seams: { ...context.mateSeams, clock: context.mateSeams.clock ?? context.clock } }),
+        ...(context.leadSeams === undefined ? {} : { seams: { ...context.leadSeams, clock: context.leadSeams.clock ?? context.clock } }),
         ...(context.evidenceRoot === undefined ? {} : { evidenceRoot: context.evidenceRoot }),
         // The console's own address (and its public one): links there read as "the task", "the result", "Settings → Lead".
         appOrigin: [loadConsoleUrl(process.env, dirname(context.databaseFile)), phoneOrigin(process.env, dirname(context.databaseFile))],
@@ -10694,7 +10698,7 @@ async function projectDeleteCommand(positional, flags, context) {
         `Deleted ${repo}: ${holdingsWords(done.removed)}.`, ...done.left.map(one => `Git kept ${one}.`), `The ledger records it as entry #${done.ledgerId}.`,
     ]);
 }
-/** `spend [--month YYYY-MM] [--csv]` (v105): what agent work cost in a month, by project, person, teammate and model. */
+/** `spend [--month YYYY-MM] [--csv]` (v105): what agent work cost in a month, by project, person, subagent and model. */
 function spendCommand(flags, context) {
     const command = "spend";
     for (const name of flags.keys())
@@ -10704,7 +10708,7 @@ function spendCommand(flags, context) {
     if (month === null)
         return fail(context.write, context.json, command, "usage", "Use spend --month YYYY-MM.", EXIT.usage);
     const items = spendItems(context.store.handle, month.from, month.to);
-    const names = teammateNames(context.store.handle);
+    const names = subagentNames(context.store.handle);
     if (flags.has("csv")) {
         context.write(spendCsv(items, names).replace(/^\ufeff/, "").trimEnd());
         return EXIT.ok;
@@ -10718,7 +10722,7 @@ function spendCommand(flags, context) {
             byProject.set(item.project, (byProject.get(item.project) ?? 0) + (item.microusd ?? 0));
     // v105: subscription work is $0; what binds it is its plan's windows, as the provider last said.
     const limits = context.store.providerLimits();
-    const windows = limitsView(limits, [], { project: repo => basename(repo), teammate: id => String(id) }, context.clock())?.tiles ?? [];
+    const windows = limitsView(limits, [], { project: repo => basename(repo), subagent: id => String(id) }, context.clock())?.tiles ?? [];
     // Sized routing: each tier's tasks, time to a result and plan use, and what the tiers saved.
     const tiers = tierReport(context.store.handle, month.from, month.to, items);
     return succeed(context.write, context.json, command, { month: month.name, totalMicrousd: total, unpriced, items: items.length, budgets, limits, tiers: { rows: tiers.rows, saved: tiers.saved } }, () => [
@@ -10821,21 +10825,22 @@ async function budgetCommand(positional, flags, context) {
     const store = context.store;
     if (action === undefined || action === "list") {
         const budgets = store.monthSpend(context.clock()).budgets;
-        return succeed(context.write, context.json, command, { budgets }, () => budgets.length === 0 ? ["No budgets. `budget set --all|--project <path>|--person <name>|--teammate <id> --usd <n>` makes one."]
+        return succeed(context.write, context.json, command, { budgets }, () => budgets.length === 0 ? ["No budgets. `budget set --all|--project <path>|--person <name>|--subagent <id> --usd <n>` makes one."]
             : budgets.map(one => `#${one.id} ${budgetLabel(one).replace(/'s$/, "")}: ${spendUsd(one.spentMicrousd)} of ${spendUsd(one.limitMicrousd)} this month (${one.percent}%)${one.hardStop ? ", stops API work at 100%" : ", alerts only"}`));
     }
     if (action !== "set" && action !== "remove")
         return fail(context.write, context.json, command, "usage", "Use budget list, budget set or budget remove.", EXIT.usage);
-    const allowed = new Set(["all", "project", "person", "teammate", "usd", "alerts-only", "as", "token", "token-file", "token-env", "db", "json"]);
+    // --teammate: the flag's name before D5, still read this release.
+    const allowed = new Set(["all", "project", "person", "subagent", "teammate", "usd", "alerts-only", "as", "token", "token-file", "token-env", "db", "json"]);
     for (const name of flags.keys())
         if (!allowed.has(name))
             return fail(context.write, context.json, command, "usage", `--${name} is not a budget option.`, EXIT.usage);
     const chosen = [flags.has("all") ? { scope: "installation", key: "*" } : null,
         text(flags, "project") === undefined ? null : { scope: "project", key: resolve(text(flags, "project")) },
         text(flags, "person") === undefined ? null : { scope: "person", key: text(flags, "person") },
-        text(flags, "teammate") === undefined ? null : { scope: "teammate", key: text(flags, "teammate") }].filter(one => one !== null);
+        (text(flags, "subagent") ?? text(flags, "teammate")) === undefined ? null : { scope: "subagent", key: (text(flags, "subagent") ?? text(flags, "teammate")) }].filter(one => one !== null);
     if (chosen.length !== 1)
-        return fail(context.write, context.json, command, "usage", "Name one of --all, --project <path>, --person <name> or --teammate <id>.", EXIT.usage);
+        return fail(context.write, context.json, command, "usage", "Name one of --all, --project <path>, --person <name> or --subagent <id>.", EXIT.usage);
     const target = chosen[0];
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
@@ -10844,9 +10849,9 @@ async function budgetCommand(positional, flags, context) {
     }
     const known = target.scope === "installation" || (target.scope === "project" ? store.knownRepos().includes(target.key)
         : target.scope === "person" ? store.accountFacts().some(one => one.name === target.key && one.revokedAt === null)
-            : store.handle.prepare("SELECT 1 FROM teammate WHERE id = ?").get(Number(target.key)) !== undefined);
+            : store.handle.prepare("SELECT 1 FROM subagent WHERE id = ?").get(Number(target.key)) !== undefined);
     if (!known)
-        return fail(context.write, context.json, command, "not-found", "That isn't a project, person or teammate here.", EXIT.refused);
+        return fail(context.write, context.json, command, "not-found", "That isn't a project, person or subagent here.", EXIT.refused);
     if (action === "remove") {
         const existing = store.budgets().find(one => one.scope === target.scope && one.key === target.key);
         if (existing === undefined || !store.removeBudget(existing.id, acting.name, context.clock()))

package/dist/people-audit-ui.d.ts

@@ -1,5 +1,6 @@
 import { type AuditAction } from "./remote-audit.js";
 import type { ApiTokenRow } from "./store.js";
+import { type Html } from "./html.js";
 export declare const PEOPLE_AUDIT_CSS: string;
 export type PersonAuditView = {
     name: string;
@@ -11,4 +12,4 @@ export type PersonAuditView = {
     now: Date;
 };
 export declare const personHref: (name: string, more?: Record<string, string>) => string;
-export declare function personAuditHtml(view: PersonAuditView): string;
+export declare function personAuditHtml(view: PersonAuditView): Html;

package/dist/people-audit-ui.js

@@ -5,7 +5,7 @@
  */
 import { basename } from "node:path";
 import { tokenStatus } from "./remote-audit.js";
-const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+import { html } from "./html.js";
 const stamp = (value) => `${value.slice(0, 16).replace("T", " ")} UTC`;
 export const PEOPLE_AUDIT_CSS = `.person-audit{max-width:820px;min-width:0;overflow-wrap:anywhere}.person-audit h2{font-size:1.05rem;margin:1.25rem 0 8px}` +
     `.person-audit .rows{display:grid;border:1px solid var(--so-line);border-radius:10px;overflow:hidden}.person-audit .row-item{padding:10px 14px;border-bottom:1px solid var(--so-line);min-width:0}` +
@@ -17,22 +17,22 @@ export const PEOPLE_AUDIT_CSS = `.person-audit{max-width:820px;min-width:0;overf
     `@media(max-width:600px){.person-audit .row-item a{min-height:44px}}`;
 export const personHref = (name, more = {}) => `/people?${new URLSearchParams({ person: name, ...more }).toString()}`;
 export function personAuditHtml(view) {
-    const tokens = view.tokens.length === 0 ? `<p class="meta">No API tokens.</p>` : `<div class="rows">${view.tokens.map(one => {
+    const tokens = view.tokens.length === 0 ? html `<p class="meta">No API tokens.</p>` : html `<div class="rows">${view.tokens.map(one => {
         const status = tokenStatus(one, view.now);
-        return `<div class="row-item" data-token-name="${e(one.name)}"><p><a href="${e(personHref(view.name, { "token-name": one.name }))}">${e(one.name)}</a></p>` +
-            `<p class="meta">${status === "active" ? "Active" : status === "expired" ? "Expired" : "Revoked"} · ${one.access === "act" ? "Can act" : "Read only"} · ` +
-            `last used ${one.lastUsedAt === null ? "never" : e(stamp(one.lastUsedAt))}</p></div>`;
-    }).join("")}</div>`;
-    const filtered = view.token === null ? "" : `<p class="meta">With ${e(view.token)}</p><p><a href="${e(personHref(view.name))}">All tokens</a></p>`;
-    const actions = view.actions.length === 0 ? `<p class="meta">No remote actions${view.token === null ? "" : " with this token"}.</p>` : `<div class="rows">${view.actions.map(actionHtml).join("")}</div>`;
-    const older = view.nextCursor === null ? "" : `<p><a href="${e(personHref(view.name, { ...(view.token === null ? {} : { "token-name": view.token }), before: view.nextCursor }))}">Older actions</a></p>`;
-    return `<p><a href="/people">People</a></p><h1>${e(view.name)}</h1><section class="person-audit"><h2>API tokens</h2>${tokens}` +
-        `<h2>Remote activity</h2>${filtered}${actions}${older}</section>`;
+        return html `<div class="row-item" data-token-name="${one.name}"><p><a href="${personHref(view.name, { "token-name": one.name })}">${one.name}</a></p>\
+<p class="meta">${status === "active" ? "Active" : status === "expired" ? "Expired" : "Revoked"} · ${one.access === "act" ? "Can act" : "Read only"} · \
+last used ${one.lastUsedAt === null ? "never" : stamp(one.lastUsedAt)}</p></div>`;
+    })}</div>`;
+    const filtered = view.token === null ? "" : html `<p class="meta">With ${view.token}</p><p><a href="${personHref(view.name)}">All tokens</a></p>`;
+    const actions = view.actions.length === 0 ? html `<p class="meta">No remote actions${view.token === null ? "" : " with this token"}.</p>` : html `<div class="rows">${view.actions.map(actionHtml)}</div>`;
+    const older = view.nextCursor === null ? "" : html `<p><a href="${personHref(view.name, { ...(view.token === null ? {} : { "token-name": view.token }), before: view.nextCursor })}">Older actions</a></p>`;
+    return html `<p><a href="/people">People</a></p><h1>${view.name}</h1><section class="person-audit"><h2>API tokens</h2>${tokens}\
+<h2>Remote activity</h2>${filtered}${actions}${older}</section>`;
 }
 function actionHtml(action) {
     const label = action.outcome === "ok" ? "OK" : action.outcome === "refused" ? "Refused" : "Error";
     const detail = [stamp(action.at), action.token ?? "unknown token", action.source === "mcp" ? "Agent (MCP)" : "CLI",
         ...(action.repo === null ? [] : [basename(action.repo)]), ...(action.reason === null ? [] : [action.reason])];
-    return `<div class="row-item" data-action="${action.id}"><p><span class="outcome outcome-${action.outcome}">${label}</span>${e(action.name)}` +
-        `${action.taskId === null ? "" : ` · <a href="/t/${encodeURIComponent(action.taskId)}">${e(action.taskId)}</a>`}</p><p class="meta">${detail.map(e).join(" · ")}</p></div>`;
+    return html `<div class="row-item" data-action="${action.id}"><p><span class="outcome outcome-${action.outcome}">${label}</span>${action.name}\
+${action.taskId === null ? "" : html ` · <a href="/t/${encodeURIComponent(action.taskId)}">${action.taskId}</a>`}</p><p class="meta">${detail.join(" · ")}</p></div>`;
 }

package/dist/policy-ui.d.ts

@@ -4,6 +4,7 @@
  * action ledger. Anyone signed in reads it; an instance operator changes it
  * with their password.
  */
+import { type Html } from "./html.js";
 import type { LedgerEntry } from "./action-ledger.js";
 import { type SavedPolicy } from "./policy.js";
 export declare const POLICY_CSS: string;
@@ -14,7 +15,7 @@ export type PolicyView = {
     /** The project tools here, as a hint for the tools list. */
     toolNames: string[];
 };
-export declare function policyHtml(view: PolicyView, csrf: string, notice: {
+export declare function policyHtml(view: PolicyView, notice: {
     said?: string | null;
     problem?: string | null;
-}): string;
+}): Html;

package/dist/policy-ui.js

@@ -1,6 +1,12 @@
+/**
+ * Settings → Policy (sprint 8): the organisation policy — allowed providers,
+ * models and tools, and the permission ceiling — and its history from the
+ * action ledger. Anyone signed in reads it; an instance operator changes it
+ * with their password.
+ */
+import { html, postForm } from "./html.js";
 import { whenUtc } from "./when-html.js";
 import { LEVEL_HINTS, LEVEL_NAMES, PERMISSION_LEVELS, POLICY_PROVIDERS, PROVIDER_NAMES, policyParts } from "./policy.js";
-const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 export const POLICY_CSS = `.policy{max-width:720px;min-width:0}.policy dl{display:grid;grid-template-columns:max-content minmax(0,1fr);gap:6px 16px;margin:12px 0 0;font-size:.875rem}` +
     `.policy dt{color:var(--muted-foreground)}.policy dd{margin:0;overflow-wrap:anywhere}.policy fieldset{border:0;padding:0;margin:20px 0 0;min-width:0}` +
     `.policy legend{font-weight:600;font-size:.875rem;margin-bottom:8px}.policy legend{padding:0}.policy .providers{display:grid;grid-template-columns:repeat(auto-fill,minmax(132px,1fr));gap:0 16px}.policy .providers label{display:flex;gap:8px;align-items:center;min-height:44px;margin:0;padding:0;font-weight:400}` +
@@ -13,30 +19,18 @@ export const POLICY_CSS = `.policy{max-width:720px;min-width:0}.policy dl{displa
 function historyItem(entry) {
     const what = entry.action.replace(/^organisation policy: /, "");
     const [before, after] = (entry.detail ?? "").split(" → ");
-    return `<li><span class="what">${e(what.charAt(0).toUpperCase() + what.slice(1))}: ${e(before ?? "")} → <strong>${e(after ?? "")}</strong></span>` +
-        `<span class="meta">${e(entry.actor)} · ${whenUtc(entry.at)}</span></li>`;
+    return html `<li><span class="what">${what.charAt(0).toUpperCase() + what.slice(1)}: ${before ?? ""} → <strong>${after ?? ""}</strong></span><span class="meta">${entry.actor} · ${whenUtc(entry.at)}</span></li>`;
 }
-export function policyHtml(view, csrf, notice) {
-    const note = notice.problem ? `<p class="problem" role="alert">${e(notice.problem)}</p>` : notice.said ? `<p role="status">${e(notice.said)}</p>` : "";
+export function policyHtml(view, notice) {
+    const note = notice.problem ? html `<p class="problem" role="alert">${notice.problem}</p>` : notice.said ? html `<p role="status">${notice.said}</p>` : "";
     const parts = policyParts(view.policy);
-    const changed = view.policy.updatedBy === null ? "" : `<p class="meta">Changed by ${e(view.policy.updatedBy)} on ${e((view.policy.updatedAt ?? "").slice(0, 10))}.</p>`;
-    const current = `<dl><dt>Providers</dt><dd>${e(parts.providers === "any" ? "Any" : parts.providers)}</dd><dt>Models</dt><dd>${e(parts.models === "any" ? "Any" : parts.models)}</dd>` +
-        `<dt>Tools</dt><dd>${e(parts.tools === "any" ? "Any" : parts.tools)}</dd><dt>Ceiling</dt><dd>${e(parts.ceiling)}</dd></dl>${changed}`;
-    const history = view.history.length === 0 ? "" : `<details><summary>History (${view.history.length})</summary><ol>${view.history.map(historyItem).join("")}</ol></details>`;
+    const changed = view.policy.updatedBy === null ? "" : html `<p class="meta">Changed by ${view.policy.updatedBy} on ${(view.policy.updatedAt ?? "").slice(0, 10)}.</p>`;
+    const current = html `<dl><dt>Providers</dt><dd>${parts.providers === "any" ? "Any" : parts.providers}</dd><dt>Models</dt><dd>${parts.models === "any" ? "Any" : parts.models}</dd><dt>Tools</dt><dd>${parts.tools === "any" ? "Any" : parts.tools}</dd><dt>Ceiling</dt><dd>${parts.ceiling}</dd></dl>${changed}`;
+    const history = view.history.length === 0 ? "" : html `<details><summary>History (${view.history.length})</summary><ol>${view.history.map(historyItem)}</ol></details>`;
     if (!view.canChange)
-        return `<section class="policy">${note}${current}<p class="meta">An instance operator sets the policy.</p>${history}</section>`;
-    const providers = POLICY_PROVIDERS.map(one => `<label><input type="checkbox" name="provider" value="${one}"${view.policy.providers === null || view.policy.providers.includes(one) ? " checked" : ""}> ${PROVIDER_NAMES[one]}</label>`).join("");
-    const levels = [...PERMISSION_LEVELS].reverse().map(level => `<label class="choice"><input type="radio" name="ceiling" value="${level}"${view.policy.ceiling === level ? " checked" : ""}>` +
-        `<span><strong>${LEVEL_NAMES[level]}</strong><small>${e(LEVEL_HINTS[level])}</small></span></label>`).join("");
+        return html `<section class="policy">${note}${current}<p class="meta">An instance operator sets the policy.</p>${history}</section>`;
+    const providers = POLICY_PROVIDERS.map(one => html `<label><input type="checkbox" name="provider" value="${one}"${view.policy.providers === null || view.policy.providers.includes(one) ? html ` checked` : ""}> ${PROVIDER_NAMES[one]}</label>`);
+    const levels = [...PERMISSION_LEVELS].reverse().map(level => html `<label class="choice"><input type="radio" name="ceiling" value="${level}"${view.policy.ceiling === level ? html ` checked` : ""}><span><strong>${LEVEL_NAMES[level]}</strong><small>${LEVEL_HINTS[level]}</small></span></label>`);
     const toolHint = view.toolNames.length === 0 ? "" : ` Tools here: ${view.toolNames.slice(0, 12).join(", ")}${view.toolNames.length > 12 ? "…" : ""}.`;
-    return `<section class="policy">${note}${changed}` +
-        `<form method="post" action="/settings/policy"><input type="hidden" name="csrf" value="${e(csrf)}">` +
-        `<fieldset><legend>Providers</legend><div class="providers">${providers}</div></fieldset>` +
-        `<fieldset><legend><label for="policy-models">Models</label></legend><textarea id="policy-models" name="models" spellcheck="false" placeholder="Any model" aria-describedby="policy-models-hint">${e((view.policy.models ?? []).join("\n"))}</textarea>` +
-        `<span class="hint" id="policy-models-hint">One per line; end with * to allow a family. Blank allows any.</span></fieldset>` +
-        `<fieldset><legend><label for="policy-tools">Project tools</label></legend><textarea id="policy-tools" name="tools" spellcheck="false" placeholder="Any tool" aria-describedby="policy-tools-hint">${e((view.policy.tools ?? []).join("\n"))}</textarea>` +
-        `<span class="hint" id="policy-tools-hint">One per line. Blank allows any.${e(toolHint)}</span></fieldset>` +
-        `<fieldset><legend>Permission ceiling</legend>${levels}</fieldset>` +
-        `<div class="step-up"><label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label></div>` +
-        `<button type="submit">Save policy</button></form>${history}</section>`;
+    return html `<section class="policy">${note}${changed}${postForm("/settings/policy", html `<fieldset><legend>Providers</legend><div class="providers">${providers}</div></fieldset><fieldset><legend><label for="policy-models">Models</label></legend><textarea id="policy-models" name="models" spellcheck="false" placeholder="Any model" aria-describedby="policy-models-hint">${(view.policy.models ?? []).join("\n")}</textarea><span class="hint" id="policy-models-hint">One per line; end with * to allow a family. Blank allows any.</span></fieldset><fieldset><legend><label for="policy-tools">Project tools</label></legend><textarea id="policy-tools" name="tools" spellcheck="false" placeholder="Any tool" aria-describedby="policy-tools-hint">${(view.policy.tools ?? []).join("\n")}</textarea><span class="hint" id="policy-tools-hint">One per line. Blank allows any.${toolHint}</span></fieldset><fieldset><legend>Permission ceiling</legend>${levels}</fieldset><div class="step-up"><label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label></div><button type="submit">Save policy</button>`)}${history}</section>`;
 }

package/dist/policy.d.ts

@@ -15,7 +15,7 @@
  * (lowered), or, when there is none, doesn't run (refused); the words say which.
  *
  * Every road that admits work asks here: scope approval, the tick before a
- * run starts (and build() as the last look), the lead and project chats, teammates and flow steps.
+ * run starts (and build() as the last look), the lead and project chats, subagents and flow steps.
  */
 import type { Database } from "./store.js";
 import type { ExecutionProfile } from "./scope.js";

package/dist/principal.d.ts

@@ -9,7 +9,7 @@ export type VerifiedApprover = {
     readonly repos: readonly string[];
     readonly ceilingDigest: string;
 };
-/** The mate's ceiling digest: the admitted repos IN ORDER, hashed — `rN`
+/** The lead's ceiling digest: the admitted repos IN ORDER, hashed — `rN`
  * is an index, so two surfaces naming the same repos in a different order
  * hold different ceilings (slice-2 review, finding 3). */
 export declare function ceilingDigestOf(repos: readonly string[]): string;

package/dist/principal.js

@@ -1,7 +1,7 @@
 /**
  * The branded approver principal (mate arc, ruling 3).
  *
- * Every act the mate proposes and every confirmation an operator taps
+ * Every act the lead proposes and every confirmation an operator taps
  * runs under a principal that PROVES it was authenticated — a password
  * ceremony, or a cookie session the edge already proved (csrf, role,
  * generation) and this module re-proves against the approver row. The
@@ -15,7 +15,7 @@
  */
 import { createHash } from "node:crypto";
 import { authenticateAccount } from "./scope.js";
-/** The mate's ceiling digest: the admitted repos IN ORDER, hashed — `rN`
+/** The lead's ceiling digest: the admitted repos IN ORDER, hashed — `rN`
  * is an index, so two surfaces naming the same repos in a different order
  * hold different ceilings (slice-2 review, finding 3). */
 export function ceilingDigestOf(repos) {

package/dist/project-delete-ui.d.ts

@@ -4,6 +4,7 @@
  * then read exactly what goes and confirm with their password (or a fresh
  * sign-in with the identity provider). The repository itself stays.
  */
+import { type Html } from "./html.js";
 import { type ProjectHoldings } from "./project-delete.js";
 export declare const PROJECT_DELETE_CSS: string;
 export type ProjectSettingsView = {
@@ -21,9 +22,9 @@ export type ProjectSettingsView = {
     };
 };
 /** The project's page: its path, what Toolroll holds for it, and (for an instance operator) Delete project. */
-export declare function projectSettingsHtml(view: ProjectSettingsView, csrf: string, notice: {
+export declare function projectSettingsHtml(view: ProjectSettingsView, notice: {
     said?: string | null;
     problem?: string | null;
-}): string;
+}): Html;
 /** The second step: exactly what goes, and the password. */
-export declare function projectDeleteConfirmHtml(view: ProjectSettingsView, csrf: string, problem: string | null): string;
+export declare function projectDeleteConfirmHtml(view: ProjectSettingsView, problem: string | null): Html;

package/dist/project-delete-ui.js

@@ -4,8 +4,8 @@
  * then read exactly what goes and confirm with their password (or a fresh
  * sign-in with the identity provider). The repository itself stays.
  */
+import { html, postForm } from "./html.js";
 import { holdingsWords } from "./project-delete.js";
-const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 export const PROJECT_DELETE_CSS = `.project-settings,.project-delete{max-width:720px;min-width:0}.project-settings .path,.project-delete .path{font-family:var(--font-mono);font-size:.8125rem;overflow-wrap:anywhere;word-break:break-all}` +
     `.project-settings details.danger-zone{margin-top:24px;border:1px solid var(--border);border-radius:10px;padding:0 14px}.project-settings details.danger-zone summary{min-height:44px;display:flex;align-items:center;cursor:pointer;font-weight:500;color:var(--danger)}` +
     `.project-settings details.danger-zone[open]{padding-bottom:14px}.project-settings form,.project-delete form{display:grid;gap:12px;margin-top:12px}.project-settings label,.project-delete label{display:grid;gap:4px;font-size:.8125rem;font-weight:500}` +
@@ -16,39 +16,32 @@ export const PROJECT_DELETE_CSS = `.project-settings,.project-delete{max-width:7
     `.project-settings .builds-at-once .builds-row{display:flex;gap:8px;align-items:stretch}.project-settings .builds-at-once input{width:5.5rem;min-height:44px;margin:0;box-sizing:border-box}.project-settings .builds-at-once button{min-height:44px;margin:0}` +
     `.project-settings .builds-at-once .meta{margin:0}.project-settings form.remove-project{margin-top:20px;gap:4px}.project-settings form.remove-project button{min-height:44px}.project-settings form.remove-project .meta{margin:0}`;
 /** Builds at once: one number, one Save. The worker's cap is said only when it lowers the number. */
-function buildsHtml(view, csrf) {
+function buildsHtml(view) {
     const b = view.builds;
     if (b === undefined)
         return "";
     const capped = b.capacity !== null && b.capacity < b.setting ? ` Its worker runs ${b.capacity} at once, so ${b.capacity} for now.` : "";
     const now = `${b.building} building now.${capped}`;
     if (!b.canChange)
-        return `<section class="builds-at-once"><h2>Builds at once</h2><p>Up to ${b.setting}. ${e(now)}</p></section>`;
-    return `<section class="builds-at-once"><h2>Builds at once</h2><form method="post" action="/settings/project/concurrency">` +
-        `<input type="hidden" name="csrf" value="${e(csrf)}"><input type="hidden" name="repo" value="${e(view.repo)}">` +
-        `<div class="builds-row"><input type="number" name="concurrency" min="1" max="64" step="1" inputmode="numeric" value="${b.setting}" aria-label="Builds at once" aria-describedby="builds-now"><button type="submit">Save</button></div>` +
-        `<p class="meta" id="builds-now">${e(now)}</p></form></section>`;
+        return html `<section class="builds-at-once"><h2>Builds at once</h2><p>Up to ${b.setting}. ${now}</p></section>`;
+    return html `<section class="builds-at-once"><h2>Builds at once</h2>${postForm("/settings/project/concurrency", html `<div class="builds-row"><input type="number" name="concurrency" min="1" max="64" step="1" inputmode="numeric" value="${b.setting}" aria-label="Builds at once" aria-describedby="builds-now"><button type="submit">Save</button></div><p class="meta" id="builds-now">${now}</p>`, { hidden: { repo: view.repo } })}</section>`;
 }
-const note = (notice) => notice.problem ? `<p class="problem" role="alert">${e(notice.problem)}</p>` : notice.said ? `<p role="status">${e(notice.said)}</p>` : "";
+const note = (notice) => notice.problem ? html `<p class="problem" role="alert">${notice.problem}</p>` : notice.said ? html `<p role="status">${notice.said}</p>` : "";
 /** The project's page: its path, what Toolroll holds for it, and (for an instance operator) Delete project. */
-export function projectSettingsHtml(view, csrf, notice) {
-    const held = `<p>Toolroll holds ${e(holdingsWords(view.holdings))} for <strong>${e(view.name)}</strong>.</p>`;
-    const head = `<section class="project-settings">${note(notice)}<p class="path">${e(view.repo)}</p>${held}${buildsHtml(view, csrf)}`;
+export function projectSettingsHtml(view, notice) {
+    const held = html `<p>Toolroll holds ${holdingsWords(view.holdings)} for <strong>${view.name}</strong>.</p>`;
+    const head = html `${note(notice)}<p class="path">${view.repo}</p>${held}${buildsHtml(view)}`;
     if (!view.canDelete)
-        return `${head}<p class="meta">An instance operator can delete a project.</p></section>`;
+        return html `<section class="project-settings">${head}<p class="meta">An instance operator can delete a project.</p></section>`;
     const body = view.running.length > 0
-        ? `<p class="problem">Its work is running: ${e(view.running.join(", "))}. Stop it before deleting the project.</p>`
-        : `<p>Removes everything Toolroll holds for ${e(view.name)}. The repository and its own branches stay. There's no undo.</p>` +
-            `<form method="post" action="/settings/project/delete"><input type="hidden" name="csrf" value="${e(csrf)}"><input type="hidden" name="repo" value="${e(view.repo)}">` +
-            `<label><span>Type <strong>${e(view.name)}</strong> to continue</span><input name="name" autocomplete="off" autocapitalize="off" spellcheck="false" required></label>` +
-            `<button type="submit">Continue</button></form>`;
+        ? html `<p class="problem">Its work is running: ${view.running.join(", ")}. Stop it before deleting the project.</p>`
+        : html `<p>Removes everything Toolroll holds for ${view.name}. The repository and its own branches stay. There's no undo.</p>${postForm("/settings/project/delete", html `<label><span>Type <strong>${view.name}</strong> to continue</span><input name="name" autocomplete="off" autocapitalize="off" spellcheck="false" required></label><button type="submit">Continue</button>`, { hidden: { repo: view.repo } })}`;
     // Removing is the reversible step: off the lists and the builder, everything kept.
-    const remove = `<form class="remove-project" method="post" action="/projects/remove"><input type="hidden" name="csrf" value="${e(csrf)}"><input type="hidden" name="repo" value="${e(view.repo)}">` +
-        `<button type="submit">Remove from Toolroll</button><p class="meta">Its tasks and results stay saved. Add it again to bring it back.</p></form>`;
-    return `${head}${remove}<details class="danger-zone"${notice.problem ? " open" : ""}><summary>Delete project</summary>${body}</details></section>`;
+    const remove = postForm("/projects/remove", html `<button type="submit">Remove from Toolroll</button><p class="meta">Its tasks and results stay saved. Add it again to bring it back.</p>`, { attrs: { class: "remove-project" }, hidden: { repo: view.repo } });
+    return html `<section class="project-settings">${head}${remove}<details class="danger-zone"${notice.problem ? html ` open` : ""}><summary>Delete project</summary>${body}</details></section>`;
 }
 /** The second step: exactly what goes, and the password. */
-export function projectDeleteConfirmHtml(view, csrf, problem) {
+export function projectDeleteConfirmHtml(view, problem) {
     const h = view.holdings;
     const count = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
     const items = [
@@ -56,13 +49,8 @@ export function projectDeleteConfirmHtml(view, csrf, problem) {
         "The checkouts and branches Toolroll made",
         ...(h.chats > 0 ? [count(h.chats, "chat")] : []),
         ...(h.flows > 0 ? [`${count(h.flows, "flow")} and ${count(h.cards, "card")}`] : []),
-        ...(h.teammates > 0 ? [count(h.teammates, "teammate")] : []),
+        ...(h.subagents > 0 ? [count(h.subagents, "subagent")] : []),
         "Its budgets, settings and knowledge",
     ];
-    return `<section class="project-delete">${problem === null ? "" : `<p class="problem" role="alert">${e(problem)}</p>`}` +
-        `<p>This removes:</p><ul class="removes">${items.map(one => `<li>${e(one)}</li>`).join("")}</ul>` +
-        `<p>The repository at <span class="path">${e(view.repo)}</span> and its own branches stay. The ledger keeps its history. There's no undo.</p>` +
-        `<form method="post" action="/settings/project/delete"><input type="hidden" name="csrf" value="${e(csrf)}"><input type="hidden" name="repo" value="${e(view.repo)}"><input type="hidden" name="name" value="${e(view.name)}"><input type="hidden" name="step" value="delete">` +
-        `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label>` +
-        `<div class="actions"><button type="submit" class="danger">Delete project</button><a href="/settings/project?repo=${e(encodeURIComponent(view.repo))}">Cancel</a></div></form></section>`;
+    return html `<section class="project-delete">${problem === null ? "" : html `<p class="problem" role="alert">${problem}</p>`}<p>This removes:</p><ul class="removes">${items.map(one => html `<li>${one}</li>`)}</ul><p>The repository at <span class="path">${view.repo}</span> and its own branches stay. The ledger keeps its history. There's no undo.</p>${postForm("/settings/project/delete", html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label><div class="actions"><button type="submit" class="danger">Delete project</button><a href="/settings/project?repo=${encodeURIComponent(view.repo)}">Cancel</a></div>`, { hidden: { repo: view.repo, name: view.name, step: "delete" } })}</section>`;
 }