toolroll 0.9.54 → 0.9.56

package/dist/team-runtime.js

@@ -6,8 +6,8 @@ import { workIndexPage } from './work-index.js';
 import { TeamLeads } from './team-leads.js';
 import { teamScopeAllows } from './team-contract.js';
 import { verifyApproverStanding } from './principal.js';
-import { credentialKeyOf, isDirectChatProvider, priceForConfig, subscriptionCredentialKey, mateWorstCaseForPrice } from './converse.js';
-import { runMateTurn } from './mate.js';
+import { credentialKeyOf, isDirectChatProvider, priceForConfig, subscriptionCredentialKey, leadWorstCaseForPrice } from './converse.js';
+import { runLeadTurn } from './lead.js';
 import { teamChatAuthorization } from './team-chat-authorization.js';
 import { updateAdmissionPaused } from './desktop-update-gate.js';
 const hash = (value) => createHash('sha256').update(JSON.stringify(value)).digest('hex');
@@ -34,7 +34,7 @@ export function createTeamRuntime(options) {
         const stamp = hash([grant.termsDigest, grant.enabled, session?.id, session?.spentMicrousd, used, weekly, Boolean(latched), legacyBusy]);
         let reason = grant.waitingReason ?? (!grant.enabled ? 'Enable chat using the current provider and limits.' : null);
         if (!reason && live && session) {
-            const price = priceForConfig(live.config), minimum = isDirectChatProvider(live.config.provider) && price ? mateWorstCaseForPrice(price, 0, { steps: 1 }) : 0;
+            const price = priceForConfig(live.config), minimum = isDirectChatProvider(live.config.provider) && price ? leadWorstCaseForPrice(price, 0, { steps: 1 }) : 0;
             if (latched)
                 reason = 'A previous chat cost is unconfirmed. Open Settings to inspect it.';
             else if (used >= live.config.dailyTurns)
@@ -72,7 +72,7 @@ export function createTeamRuntime(options) {
         const waitingReason = selected && view.canSend && grant.enabled ? admission(actor, selected.id).reason : null;
         return { ...view, chatAuthorization: { ...grant, ...(waitingReason ? { waitingReason } : {}) },
             ...(selected ? { tasks: tasksFor(selected),
-                proposals: store.listMateProposals(selected.threadId).filter(p => p.state !== 'drafting').slice(-40).map(p => ({ id: p.id, turnId: p.turn, title: typeof p.payload['title'] === 'string' ? p.payload['title'].slice(0, 160) : `Review ${p.kind.replaceAll('_', ' ')}`, state: p.state, href: `/chat?conversation=${encodeURIComponent(selected.id)}&proposal=${p.id}` })) } : {}) };
+                proposals: store.listLeadProposals(selected.threadId).filter(p => p.state !== 'drafting').slice(-40).map(p => ({ id: p.id, turnId: p.turn, title: typeof p.payload['title'] === 'string' ? p.payload['title'].slice(0, 160) : `Review ${p.kind.replaceAll('_', ' ')}`, state: p.state, href: `/chat?conversation=${encodeURIComponent(selected.id)}&proposal=${p.id}` })) } : {}) };
     }
     function authorize(actor, args) {
         const id = typeof args['conversationId'] === 'string' ? args['conversationId'] : '';
@@ -113,7 +113,7 @@ export function createTeamRuntime(options) {
                 domain.finish(claim, { status: 'cancelled', error: 'Automatic updates were paused.' }, clock());
                 return;
             }
-            const provider = options.provider(), session = store.teamMateSession(claim.actor.name, claim.threadId), thread = store.getMateThread(claim.threadId);
+            const provider = options.provider(), session = store.teamMateSession(claim.actor.name, claim.threadId), thread = store.getLeadThread(claim.threadId);
             const proof = verifyApproverStanding(store, claim.actor.name, claim.actor.generation, claim.projects);
             if (!provider || !session || !thread || !proof.ok || !grant?.enabled) {
                 domain.finish(claim, { status: 'failed', error: grant?.waitingReason ?? 'Chat authorization changed. Enable chat before sending a new message.' }, clock());
@@ -122,14 +122,14 @@ export function createTeamRuntime(options) {
             const requestId = requestFor(claim);
             // A saved terminal provider receipt wins over delivery bookkeeping.
             // Neither failure nor an unconfirmed receipt causes another provider call.
-            const receipt = store.mateRequestReceipt(session.id, requestId);
+            const receipt = store.leadRequestReceipt(session.id, requestId);
             if (receipt) {
-                const turn = store.getMateTurn(receipt.turn);
+                const turn = store.getLeadTurn(receipt.turn);
                 domain.finish(claim, { status: turn?.state === 'answered' ? 'answered' : turn?.state === 'failed' && !domain.deliveryUncertain(turn.id) ? 'failed' : 'uncertain',
                     turnId: receipt.turn, ...(turn?.state === 'answered' ? {} : { error: 'Inspect the saved response; this message was not sent again.' }) }, clock());
                 return;
             }
-            const result = await runMateTurn({ store, who: proof.who, session, thread, ...provider, message: claim.text, requestId, channel: "console",
+            const result = await runLeadTurn({ store, who: proof.who, session, thread, ...provider, message: claim.text, requestId, channel: "console",
                 ...(() => { const name = view.leads.find(lead => lead.id === claim.leadId)?.name; return name === undefined ? {} : { leadName: name }; })(),
                 queuedMessageId: claim.messageId,
                 onAdmitted: turn => { if (!domain.current(claim) || !domain.bindTurn(claim, turn))

package/dist/team-ui.d.ts

@@ -1,3 +1,4 @@
+import { type Html } from './html.js';
 import type { TeamSnapshot } from './team-contract.js';
 /** Readable fallback uses the same admitted projection as the interactive UI. */
-export declare function teamWorkspaceHtml(snapshot: TeamSnapshot): string;
+export declare function teamWorkspaceHtml(snapshot: TeamSnapshot): Html;

package/dist/team-ui.js

@@ -1,9 +1,6 @@
-const escape = (value) => value.replace(/[&<>"']/g, char => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[char]);
+import { html } from './html.js';
 /** Readable fallback uses the same admitted projection as the interactive UI. */
 export function teamWorkspaceHtml(snapshot) {
     const selected = snapshot.selected;
-    return `<section class="team-workspace"><h1>${escape(selected?.title ?? 'Team chat')}</h1>` +
-        (selected ? `<p>${selected.visibility === 'team' ? 'Team' : 'Private'} · ${escape(snapshot.leads.find(lead => lead.id === selected.leadId)?.name ?? 'Lead')}</p>` : '') +
-        (snapshot.messages.length ? snapshot.messages.map(message => `<article><strong>${escape(message.author)}</strong><p style="white-space:pre-wrap;overflow-wrap:anywhere">${escape(message.text)}</p>${message.status === 'queued' || message.status === 'running' ? `<p>${message.status === 'queued' ? 'Queued' : 'Working'}</p>` : ''}${message.error ? `<p role="alert">${escape(message.error)}</p>` : ''}</article>`).join('') : '<p>Start a conversation with your team lead.</p>') +
-        '<noscript>Enable JavaScript to send messages and manage team conversations.</noscript><p><a href="/chat?private=1">Previous private chat</a></p></section>';
+    return html `<section class="team-workspace"><h1>${selected?.title ?? 'Team chat'}</h1>${selected ? html `<p>${selected.visibility === 'team' ? 'Team' : 'Private'} · ${snapshot.leads.find(lead => lead.id === selected.leadId)?.name ?? 'Lead'}</p>` : ''}${snapshot.messages.length ? snapshot.messages.map(message => html `<article><strong>${message.author}</strong><p style="white-space:pre-wrap;overflow-wrap:anywhere">${message.text}</p>${message.status === 'queued' || message.status === 'running' ? html `<p>${message.status === 'queued' ? 'Queued' : 'Working'}</p>` : ''}${message.error ? html `<p role="alert">${message.error}</p>` : ''}</article>`) : html `<p>Start a conversation with your team lead.</p>`}<noscript>Enable JavaScript to send messages and manage team conversations.</noscript><p><a href="/chat?private=1">Previous private chat</a></p></section>`;
 }

package/dist/teams-chat.js

@@ -1,13 +1,13 @@
 /** Microsoft Teams on the shared chat layer: activities in, Adaptive Cards
  * out, the same durable receipts, rooms and commands as every other channel. */
 import { resultShotsPruned } from "./result-shots.js";
-import { chatQuestionButtons } from "./teammate-question.js";
+import { chatQuestionButtons } from "./subagent-question.js";
 import { chatAskButtons } from "./chat-ask.js";
 import { ChatDeliveryError, ChatState, chatHash, partContent } from "./chat-delivery-state.js";
 import { channelAccess, chatObject as object, planChatNotifications, planRoomMessages, processChatEvent, splitChatText } from "./chat-delivery.js";
 import { PLATFORM_LIMITS } from "./text-limits.js";
 import { roomCommand } from "./chat-rooms.js";
-import { MATE_MESSAGE_MAX_CHARS } from "./mate.js";
+import { LEAD_MESSAGE_MAX_CHARS } from "./lead.js";
 import { renderReply } from "./reply-shape.js";
 import { armedCardText, armedYesLabel, proposalLink, proposalOutcomeText, proposalPreview } from "./chat-channel.js";
 import { chatFlowButtons } from "./chat-flow.js";
@@ -109,7 +109,7 @@ export function receiveTeams(state, identity, raw, serviceUrlClaim, now) {
         const text = isRoom ? withoutMentions(activity.text) : activity.text.trim();
         const pair = /^pair ([a-f0-9]{32})$/.exec(text);
         kind = pair ? "pair" : "message";
-        payload = pair ? { hash: chatHash(pair[1]) } : { text: text.slice(0, MATE_MESSAGE_MAX_CHARS + 1), originalLength: text.length,
+        payload = pair ? { hash: chatHash(pair[1]) } : { text: text.slice(0, LEAD_MESSAGE_MAX_CHARS + 1), originalLength: text.length,
             ...(Array.isArray(activity.attachments) && activity.attachments.length > 0 ? { unsupported: "Incoming files are not supported yet. Describe the request in a message; saved result screenshots open from their links." } : {}) };
         eventId = chatHash(`${identity.installation}:message:${id}`);
     }
@@ -176,7 +176,7 @@ export async function deliverTeamsPart(options) {
         return true;
     }
     try {
-        const session = event.session === null ? null : store.getMateSession(event.session);
+        const session = event.session === null ? null : store.getLeadSession(event.session);
         const repos = await channelAccess(shared, binding, session?.ceilingDigest);
         if (event.kind === "notice" && options.canNotify?.() === false)
             return false;
@@ -197,7 +197,7 @@ export async function deliverTeamsPart(options) {
             actions = openUrlAction(options.origin(), { label: "Open result", path: chatResultHref(content.image.taskId, content.image.run, "checks") });
         }
         if (content.proposal) {
-            const proposal = store.getMateProposal(content.proposal);
+            const proposal = store.getLeadProposal(content.proposal);
             if (!proposal)
                 text = "This proposal is unavailable.";
             else if (proposal.state !== "pending")
@@ -220,7 +220,7 @@ export async function deliverTeamsPart(options) {
         else if (!content.image) {
             // A flow decision (v88): Approve / Edit / Send back, then the link.
             const flow = content.flow || content.choose || content.note ? chatFlowButtons(state, row.id, now).map(one => ({ type: "Action.Submit", title: one.label, data: { so: one.token }, ...(one.action === "approve" ? { style: "positive" } : {}) })) : [];
-            // A teammate's question (v93): its options, then "Answer in words".
+            // A subagent's question (v93): its options, then "Answer in words".
             const asked = content.question ? chatQuestionButtons(state, row.id, now).map(one => ({ type: "Action.Submit", title: one.label.slice(0, 80), data: { so: one.token } })) : [];
             // The lead's question to its owner: its options, then "Something else".
             const owner = content.ask ? chatAskButtons(state, row.id, now).map(one => ({ type: "Action.Submit", title: one.label.slice(0, 80), data: { so: one.token } })) : [];

package/dist/teams-settings.d.ts

@@ -3,10 +3,11 @@
  * registration must point at is shown here; it has to be reachable from the
  * internet, which a tailnet-only address is not. */
 import type { Store } from "./store.js";
-export declare function teamsSettingsHtml(store: Store, dir: string, csrf: string, options?: {
+import { type Html } from "./html.js";
+export declare function teamsSettingsHtml(store: Store, dir: string, options?: {
     code?: string;
     problem?: string;
     now?: Date;
     who?: string;
     publicUrl?: string | null;
-}): string;
+}): Html;

package/dist/teams-settings.js

@@ -1,9 +1,9 @@
+import { html, joinHtml, postForm } from "./html.js";
 import { ChatState } from "./chat-delivery-state.js";
 import { loadTeamsCredentials } from "./teams-api.js";
 import { loadPrimary } from "./webhooks.js";
 import { TEAMS_MESSAGES_PATH } from "./teams.js";
-const escape = (text) => text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
-export function teamsSettingsHtml(store, dir, csrf, options = {}) {
+export function teamsSettingsHtml(store, dir, options = {}) {
     const credentials = loadTeamsCredentials(dir), state = new ChatState(store, "teams");
     const bindings = credentials ? state.bindings(credentials.installation).filter(one => state.live(one)) : [];
     const binding = options.who === undefined ? null : bindings.find(one => one.approver === options.who) ?? null;
@@ -11,47 +11,36 @@ export function teamsSettingsHtml(store, dir, csrf, options = {}) {
     const runtime = credentials ? state.runtime(credentials.installation) : null;
     const now = options.now ?? new Date();
     const live = runtime && runtime.leaseUntil !== null && runtime.leaseUntil > now.toISOString() && runtime.connected;
-    const hidden = `<input type="hidden" name="csrf" value="${escape(csrf)}">`;
-    const password = '<label>Your Toolroll password<input style="min-height:44px" type="password" name="password" autocomplete="current-password" required></label>';
-    const post = (action, content) => `<form method="post" action="/settings/teams/${action}" class="card">${hidden}${content}</form>`;
+    const password = html `<label>Your Toolroll password<input style="min-height:44px" type="password" name="password" autocomplete="current-password" required></label>`;
+    const post = (action, content) => postForm(`/settings/teams/${action}`, content, { attrs: { class: "card" } });
     const endpoint = options.publicUrl ? `${options.publicUrl.replace(/\/$/, "")}${TEAMS_MESSAGES_PATH}` : null;
-    let content = "";
+    const parts = [];
     if (!credentials) {
-        content =
-            "<p>Manage projects and review results in a Teams chat, and let a channel follow a team conversation.</p>" +
-                '<details open><summary>Register the bot</summary><ol><li>In <a href="https://portal.azure.com" target="_blank" rel="noopener noreferrer">Azure</a>, create an <em>Azure Bot</em> with a new single-tenant app registration; note the app (client) id and the directory (tenant) id, and create a client secret.</li>' +
-                `<li>Set its messaging endpoint to <code>${endpoint === null ? "https://your-public-address" + TEAMS_MESSAGES_PATH : escape(endpoint)}</code>. Microsoft must reach it from the internet: a tailnet-only address needs Tailscale Funnel (or another public tunnel) on that path.</li>` +
-                "<li>Enable the Microsoft Teams channel on the bot, then add the app to Teams (personal scope; team scope for channels).</li></ol></details>" +
-                post("connect", '<label>App (client) id<input style="min-height:44px" type="text" name="app-id" autocomplete="off" required></label>' +
-                    '<label>Directory (tenant) id<input style="min-height:44px" type="text" name="tenant" autocomplete="off" required></label>' +
-                    '<label>Client secret<input style="min-height:44px" type="password" name="secret" autocomplete="off" required></label>' +
-                    password + '<p class="meta">The secret stays on this installation. Next, pair your own Teams account.</p><button type="submit">Connect Teams</button>');
+        parts.push(html `<p>Manage projects and review results in a Teams chat, and let a channel follow a team conversation.</p>`, html `<details open><summary>Register the bot</summary><ol><li>In <a href="https://portal.azure.com" target="_blank" rel="noopener noreferrer">Azure</a>, create an <em>Azure Bot</em> with a new single-tenant app registration; note the app (client) id and the directory (tenant) id, and create a client secret.</li>`, html `<li>Set its messaging endpoint to <code>${endpoint === null ? "https://your-public-address" + TEAMS_MESSAGES_PATH : endpoint}</code>. Microsoft must reach it from the internet: a tailnet-only address needs Tailscale Funnel (or another public tunnel) on that path.</li>`, html `<li>Enable the Microsoft Teams channel on the bot, then add the app to Teams (personal scope; team scope for channels).</li></ol></details>`, post("connect", joinHtml([
+            html `<label>App (client) id<input style="min-height:44px" type="text" name="app-id" autocomplete="off" required></label>`,
+            html `<label>Directory (tenant) id<input style="min-height:44px" type="text" name="tenant" autocomplete="off" required></label>`,
+            html `<label>Client secret<input style="min-height:44px" type="password" name="secret" autocomplete="off" required></label>`,
+            html `${password}<p class="meta">The secret stays on this installation. Next, pair your own Teams account.</p><button type="submit">Connect Teams</button>`
+        ])));
     }
     else {
-        content = `<p><strong>Microsoft Teams</strong> · ${live ? "Signed in" : "Waiting for sign-in"}</p>`;
+        parts.push(html `<p><strong>Microsoft Teams</strong> · ${live ? "Signed in" : "Waiting for sign-in"}</p>`);
         if (endpoint !== null)
-            content += `<p class="meta">Messaging endpoint: <code>${escape(endpoint)}</code> — must be reachable from the internet.</p>`;
+            parts.push(html `<p class="meta">Messaging endpoint: <code>${endpoint}</code> — must be reachable from the internet.</p>`);
         if (runtime?.problem)
-            content += `<p role="status">${escape(String(runtime.problem))}</p>`;
+            parts.push(html `<p role="status">${String(runtime.problem)}</p>`);
         if (!live && !runtime?.problem)
-            content += "<p>Keep the Toolroll worker running to answer Teams messages.</p>";
+            parts.push(html `<p>Keep the Toolroll worker running to answer Teams messages.</p>`);
         if (options.code) {
-            content += "<h2>Pair your account</h2><p>Send this to the Toolroll bot in a personal Teams chat. It expires in 10 minutes.</p>" +
-                `<label>Pairing message<input type="text" readonly value="pair ${escape(options.code)}" autocomplete="off" style="width:100%;max-width:100%;font-size:14px;min-height:44px"></label>` +
-                '<a class="button-link" style="min-height:44px;white-space:nowrap" href="/settings/teams">Check connection</a>';
+            parts.push(html `<h2>Pair your account</h2><p>Send this to the Toolroll bot in a personal Teams chat. It expires in 10 minutes.</p>`, html `<label>Pairing message<input type="text" readonly value="pair ${options.code}" autocomplete="off" style="width:100%;max-width:100%;font-size:14px;min-height:44px"></label>`, html `<a class="button-link" style="min-height:44px;white-space:nowrap" href="/settings/teams">Check connection</a>`);
         }
         else if (binding && state.live(binding)) {
-            content += `<p>Your Teams account is paired.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} paired too.` : ""}</p>` +
-                "<p>Try “What needs my attention?” or send <code>status</code>. In a channel, mention the bot with <code>team</code> to follow a conversation.</p>" +
-                '<p><a href="/chat">Open saved chat</a></p>' +
-                (loadPrimary(process.env, dir) === "teams" ? "<p>Task updates are sent here.</p>" : post("alerts", '<button type="submit">Send task updates here</button>')) +
-                post("unpair", password + '<p class="meta">Unpairing ends every open button in your chat. Teammates are unaffected.</p><button type="submit">Unpair my account</button>');
+            parts.push(html `<p>Your Teams account is paired.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} paired too.` : ""}</p>`, html `<p>Try “What needs my attention?” or send <code>status</code>. In a channel, mention the bot with <code>team</code> to follow a conversation.</p>`, html `<p><a href="/chat">Open saved chat</a></p>`, loadPrimary(process.env, dir) === "teams" ? html `<p>Task updates are sent here.</p>` : post("alerts", html `<button type="submit">Send task updates here</button>`), post("unpair", html `${password}<p class="meta">Unpairing ends every open button in your chat. Teammates are unaffected.</p><button type="submit">Unpair my account</button>`));
         }
         else {
-            content += post("pair", "<h2>Pair your account</h2><p>Your paired Teams account can read your connected projects and confirm proposed changes. Password approvals still open in Toolroll." +
-                (others ? ` ${others} teammate${others === 1 ? " is" : "s are"} already paired.` : "") + "</p>" + password + '<button type="submit">Create pairing code</button>');
+            parts.push(post("pair", html `<h2>Pair your account</h2><p>Your paired Teams account can read your connected projects and confirm proposed changes. Password approvals still open in Toolroll.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} already paired.` : ""}</p>${password}<button type="submit">Create pairing code</button>`));
         }
-        content += "<details><summary>Connection settings</summary>" + post("disconnect", password + '<button type="submit">Disconnect Teams</button>') + "</details>";
+        parts.push(html `<details><summary>Connection settings</summary>${post("disconnect", html `${password}<button type="submit">Disconnect Teams</button>`)}</details>`);
     }
-    return `<section style="max-width:42rem;overflow-wrap:anywhere"><p><a href="/settings">Settings</a></p><h1>Teams</h1>${options.problem ? `<p class="problem" role="alert">${escape(options.problem)}</p>` : ""}${content}</section>`;
+    return html `<section style="max-width:42rem;overflow-wrap:anywhere"><p><a href="/settings">Settings</a></p><h1>Teams</h1>${options.problem ? html `<p class="problem" role="alert">${options.problem}</p>` : ""}${parts}</section>`;
 }

package/dist/telegram-flow.d.ts

@@ -1,6 +1,6 @@
 import { type FlowChoiceVisit, type FlowSendContent } from "./flow-send.js";
 import { type FlowStage } from "./flows.js";
-import { type InlineButton } from "./telegram-mate.js";
+import { type InlineButton } from "./telegram-lead.js";
 import type { FlowCardRow, FlowRow, Store, TelegramBinding, TelegramFlowAction, TelegramFlowChoice, TelegramFlowPrompt } from "./store.js";
 /** A flow decision's notice: one per visit, and again (`:ask:<ms>`) when the owner asks the lead to approve it. */
 export declare const FLOW_DECIDE_KEY: RegExp;
@@ -14,8 +14,8 @@ type Waiting = {
 export declare function flowDecisionAt(store: Store, cardId: number, entry: number): Waiting | null;
 /**
  * A flow decision as Telegram shows it: the action and where each button takes the card first, then the draft (as
- * the card holds it now, so what is approved is what is read) and why a teammate handed it over, then the flow and
- * zone. `said` is the saved notice's body: the words before its instruction are the teammate's handoff.
+ * the card holds it now, so what is approved is what is read) and why a subagent handed it over, then the flow and
+ * zone. `said` is the saved notice's body: the words before its instruction are the subagent's handoff.
  */
 export declare function flowDecisionText(waiting: Waiting, said: string | null, head?: string): string;
 /** Buttons for one visit, minted before the send; `place` stamps the message they landed on. */

package/dist/telegram-flow.js

@@ -25,7 +25,7 @@ import { keptDraft } from "./flow-draft.js";
 import { decideFlowCard, draftFor, flowCardHref, flowDefinitionOf } from "./flow-engine.js";
 import { chooseFlowCard, flowChoiceAt, flowPersonOf, flowSendPaths, readFlowSend } from "./flow-send.js";
 import { deciderOf, FLOW_END, replyTarget } from "./flows.js";
-import { phoneLinkButton } from "./telegram-mate.js";
+import { phoneLinkButton } from "./telegram-lead.js";
 import { telegramButton } from "./contracts/telegram-callback.js";
 /** A flow decision's notice: one per visit, and again (`:ask:<ms>`) when the owner asks the lead to approve it. */
 export const FLOW_DECIDE_KEY = /^flow-decide:([1-9][0-9]{0,14}):([1-9][0-9]{0,9})(?::ask:[0-9]{1,15})?$/;
@@ -49,8 +49,8 @@ function decisionTerms(waiting) {
 }
 /**
  * A flow decision as Telegram shows it: the action and where each button takes the card first, then the draft (as
- * the card holds it now, so what is approved is what is read) and why a teammate handed it over, then the flow and
- * zone. `said` is the saved notice's body: the words before its instruction are the teammate's handoff.
+ * the card holds it now, so what is approved is what is read) and why a subagent handed it over, then the flow and
+ * zone. `said` is the saved notice's body: the words before its instruction are the subagent's handoff.
  */
 export function flowDecisionText(waiting, said, head = `Approve “${waiting.card.title}”`) {
     const at = said === null ? -1 : said.indexOf(`${waiting.stage.title}: approve`);

package/dist/{telegram-mate.d.ts → telegram-lead.d.ts}

@@ -1,7 +1,7 @@
 import { type PhoneLink } from "./chat-channel.js";
-export { channelRepos as telegramConversationRepos, resolveChannelMate as resolveTelegramMate, tooLongText, whichTaskText, replyContextFor, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText, CHAT_ACTION_PARITY as TELEGRAM_ACTION_PARITY, parityGaps, type PhoneLink, type ResolvedMate, type ParitySupport } from "./chat-channel.js";
-import { type MateAsk, type Store, type TelegramBinding } from "./store.js";
-import type { SubscriptionMateRunner } from "./subscription-chat.js";
+export { channelRepos as telegramConversationRepos, resolveChannelLead as resolveTelegramLead, tooLongText, whichTaskText, replyContextFor, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText, CHAT_ACTION_PARITY as TELEGRAM_ACTION_PARITY, parityGaps, type PhoneLink, type ResolvedLead, type ParitySupport } from "./chat-channel.js";
+import { type LeadAsk, type Store, type TelegramBinding } from "./store.js";
+import type { SubscriptionLeadRunner } from "./subscription-chat.js";
 import type { TelegramTransport } from "./telegram.js";
 import { type TelegramCallbackButton, type TelegramUpdate } from "./contracts/telegram-callback.js";
 /** How long one claimed turn may go without a heartbeat before another poller may take it over. */
@@ -18,7 +18,7 @@ export type TelegramConversationOptions = {
     /** Where evidence lives — the same root the console and CLI read results from. */
     evidenceRoot: string;
     /** Injected by tests; production invokes the isolated local harness. */
-    subscriptionRunner?: SubscriptionMateRunner;
+    subscriptionRunner?: SubscriptionLeadRunner;
     /**
      * The https origin a phone link may open, read again on EVERY call (a
      * card is linked immediately before it is sent or edited, never from a
@@ -71,7 +71,7 @@ export declare function phoneLinkButton(origin: string | null, link: PhoneLink |
 /** One inline button: an opaque callback token (a real in-chat act) or a url (navigation, never authority). */
 /** The buttons under the lead's question: options two to a row, then "Something else". Each names the turn and the
  * option's place, nothing more; a tap re-proves that the question is still open and is the tapper's own. */
-export declare function askKeyboard(ask: MateAsk): CallbackKeyboard;
+export declare function askKeyboard(ask: LeadAsk): CallbackKeyboard;
 export type InlineButton = TelegramCallbackButton | {
     text: string;
     url: string;

package/dist/{telegram-mate.js → telegram-lead.js}

@@ -1,11 +1,11 @@
 import { CHAT_ACTIONS, sharedActionAllowsChallenge, sharedActionPayload } from "./chat-actions.js";
-import { taskInCeiling, mirrorToTaskChat, couldNotAnswerText, channelRepos as telegramConversationRepos, resolveChannelMate as resolveTelegramMate, tooLongText, whichTaskText, replyContextFor, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText } from "./chat-channel.js";
-export { channelRepos as telegramConversationRepos, resolveChannelMate as resolveTelegramMate, tooLongText, whichTaskText, replyContextFor, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText, CHAT_ACTION_PARITY as TELEGRAM_ACTION_PARITY, parityGaps } from "./chat-channel.js";
+import { taskInCeiling, mirrorToTaskChat, couldNotAnswerText, channelRepos as telegramConversationRepos, resolveChannelLead as resolveTelegramLead, tooLongText, whichTaskText, replyContextFor, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText } from "./chat-channel.js";
+export { channelRepos as telegramConversationRepos, resolveChannelLead as resolveTelegramLead, tooLongText, whichTaskText, replyContextFor, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText, CHAT_ACTION_PARITY as TELEGRAM_ACTION_PARITY, parityGaps } from "./chat-channel.js";
 /**
  * The paired phone as one more way to use the same assistant.
  *
- * Transport only. An ordinary private Telegram message becomes a mate turn
- * through `runMateTurn` — the same saved thread, proposal rows, confirm
+ * Transport only. An ordinary private Telegram message becomes a lead turn
+ * through `runLeadTurn` — the same saved thread, proposal rows, confirm
  * doors and result actions the console and `toolroll chat` use —
  * and every act is still a card the operator confirms. This module owns
  * what is specific to the wire: proving the pairing (chat AND immutable
@@ -23,10 +23,10 @@ export { channelRepos as telegramConversationRepos, resolveChannelMate as resolv
  * the console and CLI state), and the door re-proves everything again.
  */
 import { createHash, randomBytes } from "node:crypto";
-import { MATE_MESSAGE_MAX_CHARS, mateFailureText, runMateTurn } from "./mate.js";
-import { confirmMateProposal, dismissMateProposal } from "./mate-doors.js";
+import { LEAD_MESSAGE_MAX_CHARS, leadFailureText, runLeadTurn } from "./lead.js";
+import { confirmLeadProposal, dismissLeadProposal } from "./lead-doors.js";
 import { ceilingDigestOf, verifyApproverStanding } from "./principal.js";
-import { MATE_ASK_OTHER } from "./store.js";
+import { LEAD_ASK_OTHER } from "./store.js";
 import { phoneText } from "./telegram-status.js";
 import { shapeReplyParts, telegramReply } from "./reply-shape.js";
 import { WARM_EMOJI, warmTurn } from "./chat-warmth.js";
@@ -112,7 +112,7 @@ export function askKeyboard(ask) {
     const rows = [];
     for (let at = 0; at < ask.options.length; at += 2)
         rows.push(ask.options.slice(at, at + 2).map((label, offset) => telegramButton(label.slice(0, 60), `ask:${ask.turn}:${at + offset}`)));
-    rows.push([telegramButton(MATE_ASK_OTHER, `ask:${ask.turn}:x`)]);
+    rows.push([telegramButton(LEAD_ASK_OTHER, `ask:${ask.turn}:x`)]);
     return rows;
 }
 /** Mint the card's tokens before the send, so a tap can never name a token that does not exist. */
@@ -151,7 +151,7 @@ export function applyProposalTap(store, binding, token, message, repos, options,
         ack("that button is stale — send /status to see what still waits");
         return { effects, confirmed: false, ignored: true };
     }
-    const proposal = store.getMateProposal(action.proposal);
+    const proposal = store.getLeadProposal(action.proposal);
     if (proposal === null) {
         store.consumeTelegramProposalAction(token, now);
         ack("that card no longer exists");
@@ -209,10 +209,10 @@ export function applyProposalTap(store, binding, token, message, repos, options,
             ack("that button was already used");
             return { effects, confirmed: false, ignored: true };
         }
-        const done = dismissMateProposal(store, who, proposal.id, now);
+        const done = dismissLeadProposal(store, who, proposal.id, now);
         store.consumeTelegramProposalActions(proposal.id, now);
         ack(done ? "dismissed" : "that proposal was already acted on");
-        edit(done ? "Dismissed." : proposalOutcomeText(store.getMateProposal(proposal.id) ?? proposal));
+        edit(done ? "Dismissed." : proposalOutcomeText(store.getLeadProposal(proposal.id) ?? proposal));
         return { effects, confirmed: false, ignored: !done };
     }
     if (action.phase === "cancel") {
@@ -273,7 +273,7 @@ export function applyProposalTap(store, binding, token, message, repos, options,
         ack(action.phase === "yes" ? "that confirmation expired — start again from Confirm" : "that button was already used");
         return { effects, confirmed: false, ignored: true };
     }
-    const outcome = confirmMateProposal(store, who, proposal.id, now, {
+    const outcome = confirmLeadProposal(store, who, proposal.id, now, {
         via: "telegram",
         evidenceRoot: options.evidenceRoot,
         confirm: action.phase === "yes",
@@ -405,7 +405,7 @@ async function runTelegramConversation(row, args) {
     const deliver = async (outcomeWord) => {
         // The row as it is NOW: the session was bound after this claim read it.
         const bound = store.getTelegramConversation(row.id)?.session ?? null;
-        const session = bound === null ? null : store.getMateSession(bound);
+        const session = bound === null ? null : store.getLeadSession(bound);
         if (session === null) {
             await notify("This conversation was restarted before my reply went out, so it wasn't sent. Nothing was changed. Send your message again.");
             finish({ state: "failed", outcome: "unsent:no-session" });
@@ -421,7 +421,7 @@ async function runTelegramConversation(row, args) {
                 continue;
             const now = clock();
             if (part.kind === "card") {
-                const proposal = part.proposal === null ? null : store.getMateProposal(part.proposal);
+                const proposal = part.proposal === null ? null : store.getLeadProposal(part.proposal);
                 if (proposal === null || proposal.state !== "pending") {
                     // Confirmed or dismissed from the console or the terminal before the card went out: moot, not lost.
                     if (!store.dropTelegramConversationPart(row.id, part.ordinal, owner, proposal === null ? "the proposal is gone" : `the proposal was already ${proposal.state}`, now))
@@ -523,7 +523,7 @@ async function runTelegramConversation(row, args) {
                 // A card's link is minted NOW, from the persisted proposal and the
                 // origin configured at this moment: a retry after the setting changed
                 // or went away carries the current truth, never a stored URL.
-                const proposal = part.kind === "card" && part.proposal !== null ? store.getMateProposal(part.proposal) : null;
+                const proposal = part.kind === "card" && part.proposal !== null ? store.getLeadProposal(part.proposal) : null;
                 const origin = proposal === null ? null : options.phoneOrigin?.() ?? null;
                 const wanted = proposal === null ? null : proposalLink(store, proposal, repos);
                 const keyboard = keyboardWith(part.keyboard, phoneLinkButton(origin, wanted));
@@ -597,11 +597,11 @@ async function runTelegramConversation(row, args) {
                 const now = clock();
                 const parts = shapeReplyParts(reply, PART_CAP, { asked: row.text, appOrigin: options.phoneOrigin?.() ?? null }, shaped => telegramReply(shaped).text.length).map((text, index) => ({ kind: "reply", text, replyTo: index === 0 ? row.messageId : null }));
                 // The lead's question to its owner: one tap per option, then "Something else".
-                const ask = store.mateAsk(turn);
+                const ask = store.leadAsk(turn);
                 if (ask !== null)
                     parts.push({ kind: "reply", text: phoneText(ask.question, 1_000), keyboard: askKeyboard(ask) });
                 // Only a turn that answered may have its selection sent: a failed or revoked turn's rows were deleted with its drafts, and the state is read again here.
-                const selected = store.getMateTurn(turn)?.state === "answered" ? store.listMateTurnEvidence(turn) : [];
+                const selected = store.getLeadTurn(turn)?.state === "answered" ? store.listLeadTurnEvidence(turn) : [];
                 for (const image of selected)
                     parts.push({ kind: "image", text: image.caption, taskId: image.taskId, run: image.run, artifact: image.artifact, sha256: image.sha256 });
                 for (const proposal of proposals) {
@@ -625,8 +625,8 @@ async function runTelegramConversation(row, args) {
     const recover = async (session, turnId, repos) => {
         // A turn that died past its deadline is swept to failed first, so a
         // restart reports the truth instead of waiting on a ghost.
-        store.sweepStaleMateTurns(clock());
-        const turn = store.getMateTurn(turnId);
+        store.sweepStaleLeadTurns(clock());
+        const turn = store.getLeadTurn(turnId);
         if (turn === null) {
             finish({ state: "failed", outcome: "replayed:missing" });
             report.refused++;
@@ -638,13 +638,13 @@ async function runTelegramConversation(row, args) {
             return;
         }
         if (turn.state !== "answered") {
-            await notify(mateFailureText(turn.failureReason));
+            await notify(leadFailureText(turn.failureReason));
             finish({ state: "failed", outcome: `replayed:${turn.failureReason ?? "failed"}` });
             report.refused++;
             return;
         }
-        const reply = store.listMateMessages(turn.thread, 200).find(one => one.turn === turn.id && one.role === "assistant")?.text ?? "(the reply text is no longer in the thread)";
-        const proposals = store.listMateProposals(turn.thread, ["pending"]).filter(one => one.turn === turn.id);
+        const reply = store.listLeadMessages(turn.thread, 200).find(one => one.turn === turn.id && one.role === "assistant")?.text ?? "(the reply text is no longer in the thread)";
+        const proposals = store.listLeadProposals(turn.thread, ["pending"]).filter(one => one.turn === turn.id);
         if (!plan(session, turnId, reply, proposals, repos) && store.listTelegramConversationParts(row.id).length === 0)
             return;
         await sendOrHandOff("replayed");
@@ -676,14 +676,14 @@ async function runTelegramConversation(row, args) {
     // 4. A session bound before an earlier dispatch: the receipt lives there,
     // whatever session is live today.
     if (row.session !== null) {
-        const receipt = store.mateRequestReceipt(row.session, row.request);
+        const receipt = store.leadRequestReceipt(row.session, row.request);
         if (receipt !== null) {
             await recover(row.session, receipt.turn, repos);
             return;
         }
     }
     // 5. The session and thread — shared with the console and the CLI.
-    const resolved = resolveTelegramMate(store, binding, repos, clock());
+    const resolved = resolveTelegramLead(store, binding, repos, clock());
     if (!resolved.ok && resolved.reason === "busy") {
         await requeue("busy");
         return;
@@ -722,7 +722,7 @@ async function runTelegramConversation(row, args) {
     });
     let outcome;
     try {
-        outcome = await runMateTurn({
+        outcome = await runLeadTurn({
             store, who, session, thread, config, key: null, message: row.text, requestId: row.request,
             ...(row.context === null ? {} : { context: row.context }),
             ...(options.subscriptionRunner === undefined ? {} : { subscriptionRunner: options.subscriptionRunner }),
@@ -733,7 +733,7 @@ async function runTelegramConversation(row, args) {
         clearInterval(heartbeat);
         warm.stop();
     }
-    const receipt = store.mateRequestReceipt(session.id, row.request);
+    const receipt = store.leadRequestReceipt(session.id, row.request);
     if (receipt !== null)
         store.bindTelegramConversationTurn(row.id, owner, session.id, receipt.turn);
     if (!outcome.ok && "refused" in outcome) {
@@ -761,7 +761,7 @@ async function runTelegramConversation(row, args) {
     if (row.taskId !== null)
         mirrorToTaskChat(store, who, row.taskId, "Telegram", row.text, outcome.reply, clock());
     // 7. The reply and its cards: durable first, then sent.
-    const proposals = store.listMateProposals(thread.id, ["pending"]).filter(one => one.turn === outcome.turn);
+    const proposals = store.listLeadProposals(thread.id, ["pending"]).filter(one => one.turn === outcome.turn);
     if (!plan(session.id, outcome.turn, outcome.reply, proposals, who.repos) && store.listTelegramConversationParts(row.id).length === 0)
         return;
     await sendOrHandOff("answered");

package/dist/telegram-settings.d.ts

@@ -3,10 +3,11 @@
  * the settings page; this card only mints or revokes the signed-in person's
  * pairing, never anyone else's. */
 import type { Store } from "./store.js";
+import { type Html } from "./html.js";
 /** How long a written reply may wait to be sent before it shows here with a Retry. */
 export declare const UNSENT_REPLY_MS: number;
-export declare function telegramSettingsHtml(store: Store, botId: string | null, who: string, csrf: string, options?: {
+export declare function telegramSettingsHtml(store: Store, botId: string | null, who: string, options?: {
     code?: string;
     problem?: string;
     now?: Date;
-}): string;
+}): Html;

package/dist/telegram-settings.js

@@ -1,47 +1,36 @@
+import { html, joinHtml, postForm } from "./html.js";
 /** How long a written reply may wait to be sent before it shows here with a Retry. */
 export const UNSENT_REPLY_MS = 2 * 60_000;
-const escape = (text) => text
-    .replaceAll("&", "&")
-    .replaceAll("<", "&lt;")
-    .replaceAll(">", "&gt;")
-    .replaceAll('"', "&quot;")
-    .replaceAll("'", "&#39;");
-export function telegramSettingsHtml(store, botId, who, csrf, options = {}) {
-    const hidden = `<input type="hidden" name="csrf" value="${escape(csrf)}">`;
-    const password = '<label>Your Toolroll password<input style="min-height:44px" type="password" name="password" autocomplete="current-password" required></label>';
-    const post = (action, content) => `<form method="post" action="/settings/telegram/${action}" class="card">${hidden}${content}</form>`;
-    let content = "";
+export function telegramSettingsHtml(store, botId, who, options = {}) {
+    const password = html `<label>Your Toolroll password<input style="min-height:44px" type="password" name="password" autocomplete="current-password" required></label>`;
+    const post = (action, content) => postForm(`/settings/telegram/${action}`, content, { attrs: { class: "card" } });
+    let content;
     if (botId === null) {
-        content = '<p>No Telegram bot is connected yet. An installation approver saves the bot token on the <a href="/settings">settings page</a> first.</p>';
+        content = html `<p>No Telegram bot is connected yet. An installation approver saves the bot token on the <a href="/settings">settings page</a> first.</p>`;
     }
     else {
         const bindings = store.liveTelegramBindings(botId);
         const mine = bindings.filter(binding => binding.approver === who);
         const others = bindings.length - mine.length;
-        content = `<p><strong>${mine.length > 0 ? "Your phone is paired." : "Your phone is not paired."}</strong> ${others === 0 ? "No teammates are paired yet." : `${others} teammate${others === 1 ? " is" : "s are"} paired.`}</p>`;
+        const parts = [html `<p><strong>${mine.length > 0 ? "Your phone is paired." : "Your phone is not paired."}</strong> ${others === 0 ? "No teammates are paired yet." : `${others} teammate${others === 1 ? " is" : "s are"} paired.`}</p>`];
         // A reply the assistant wrote that has not reached this person's phone for two minutes.
         const unsent = store.unsentTelegramReplies(botId, who, new Date((options.now ?? new Date()).getTime() - UNSENT_REPLY_MS));
         if (unsent.length > 0) {
             const oldest = unsent[0];
-            content +=
-                `<div class="card" role="status" data-unsent-replies><p><strong>${unsent.length === 1 ? "A reply hasn't reached your phone" : `${unsent.length} replies haven't reached your phone`}</strong></p>` +
-                    `<p class="meta">Trying since ${escape(oldest.since.slice(11, 16))} UTC${oldest.error === null ? "" : `: ${escape(oldest.error)}`}</p>` +
-                    `<form method="post" action="/settings/telegram/retry">${hidden}<button type="submit">Retry</button></form></div>`;
+            parts.push(html `<div class="card" role="status" data-unsent-replies><p><strong>${unsent.length === 1 ? html `A reply hasn't reached your phone` : html `${unsent.length} replies haven't reached your phone`}</strong></p><p class="meta">Trying since ${oldest.since.slice(11, 16)} UTC${oldest.error === null ? "" : `: ${oldest.error}`}</p>${postForm("/settings/telegram/retry", html `<button type="submit">Retry</button>`)}</div>`);
         }
         if (options.code !== undefined) {
-            content +=
-                "<h2>Pair your phone</h2><p>Send this to the bot in a private Telegram chat within 10 minutes:</p>" +
-                    `<pre class="pairing-code">/pair ${escape(options.code)}</pre>` +
-                    '<p class="meta">The code works once. That chat then answers as you, so treat it like your sign-in.</p>';
+            parts.push(html `<h2>Pair your phone</h2><p>Send this to the bot in a private Telegram chat within 10 minutes:</p><pre class="pairing-code">/pair ${options.code}</pre><p class="meta">The code works once. That chat then answers as you, so treat it like your sign-in.</p>`);
         }
         else if (mine.length === 0) {
-            content += post("pair", password + '<button type="submit">Pair my phone</button>');
+            parts.push(post("pair", html `${password}<button type="submit">Pair my phone</button>`));
         }
         else {
-            content += post("unpair", password + '<p class="meta">This phone will lose access. Its existing Telegram buttons will stop working.</p><button type="submit" class="danger">Unpair my phone</button>');
+            parts.push(post("unpair", html `${password}<p class="meta">This phone will lose access. Its existing Telegram buttons will stop working.</p><button type="submit" class="danger">Unpair my phone</button>`));
         }
+        content = joinHtml(parts);
     }
     if (options.problem !== undefined)
-        content = `<p role="status">${escape(options.problem)}</p>` + content;
-    return `<h1>Telegram</h1>${content}<p class="meta">Each teammate pairs their own private chat. To connect a group, a conversation manager sends <code>/team</code> there and chooses a conversation. Everyone in the group can read its replies.</p>`;
+        content = html `<p role="status">${options.problem}</p>${content}`;
+    return html `<h1>Telegram</h1>${content}<p class="meta">Each teammate pairs their own private chat. To connect a group, a conversation manager sends <code>/team</code> there and chooses a conversation. Everyone in the group can read its replies.</p>`;
 }

package/dist/telegram-status.js

@@ -39,7 +39,7 @@ export const PHONE_HELP = [
     "/task <name or number> — the same, by a word from its name",
     "/lead — back to talking about everything",
     "/status — what's happening across your projects",
-    "/team — team conversations; /team <number> to talk in one, /team off to leave",
+    // D5: /team (the central team service's conversations) is deprecated: it still answers this release, unlisted.
     "/help — this message",
     "",
     "To answer an agent's question, tap its buttons; reply to the question to add a note. Approvals that need your password, cancelling and publishing finish in the Toolroll console, and a console button only takes you there. The computer must be awake and connected to reply.",

package/dist/telegram-team.d.ts

@@ -7,7 +7,7 @@
  * per-chat cursor read on every bridge cycle. No model runs here.
  */
 import type { Store } from "./store.js";
-import { type InlineButton } from "./telegram-mate.js";
+import { type InlineButton } from "./telegram-lead.js";
 import type { TelegramTransport } from "./telegram.js";
 import type { TelegramMessage } from "./contracts/telegram-callback.js";
 export type TeamCommand = {