toolroll 0.9.6 → 0.9.7

package/dist/browser-workspace.d.ts

@@ -9,7 +9,7 @@ import type { WorkSummaryAccess } from './work-summary.js';
 import type { StatusTone } from './workspace-ui.js';
 import type { AssignmentCard } from './assignment-ui.js';
 import type { TaskStatus } from './task-status.js';
-import type { FirstRunStep, FirstTaskSuggestion } from './first-run.js';
+import type { FirstRunStep, FirstTaskSuggestion, JourneyStep } from './first-run.js';
 export type BrowserProject = {
     name: string;
     path: string;
@@ -206,6 +206,12 @@ export type BrowserSettingsView = {
     chat?: {
         mode: 'quiet' | 'all';
         digestAt: string | null;
+        /** Each project this person can see; a muted one sends no pings but stays in Tasks and the digest. */
+        projects?: {
+            repo: string;
+            name: string;
+            muted: boolean;
+        }[];
     } | null;
     digest: {
         every: string;
@@ -285,12 +291,39 @@ export type BrowserTaskSection = {
     open: boolean;
     count: number | null;
 };
+/** `at`: a moment, shown in the reader's own time ("16:39", "Yesterday 16:39", "Sep 28"). */
 export type BrowserTaskFact = {
     label: string;
     parts: (string | BrowserLink | {
         seal: string;
+    } | {
+        at: string;
     })[];
 };
+/** One entry in a task's thread, in time order beside the task's own
+ * conversation: the plan, the agent's progress notes and results, its
+ * questions, and the person's replies. `html` is the server's own card (same
+ * forms and ids) when the entry carries one. */
+export type BrowserTaskThreadItem = {
+    key: string;
+    at: string;
+    kind: 'filed' | 'plan' | 'progress' | 'result' | 'question' | 'reply';
+    who: 'agent' | 'person';
+    author: string;
+    title: string;
+    text: string | null;
+    link: BrowserLink | null;
+    html: string;
+    more: {
+        summary: string;
+        html: string;
+    } | null;
+};
+/** The task's metadata, grouped for the Details panel (desk) or sheet (phone). */
+export type BrowserTaskDetailGroup = {
+    title: 'Work' | 'Links' | 'Review' | 'About';
+    facts: BrowserTaskFact[];
+};
 export type BrowserTaskView = {
     kind: 'task';
     id: string;
@@ -328,6 +361,13 @@ export type BrowserTaskView = {
         href: string;
         starter: string;
     } | null;
+    /** Until the first Ready result: Plan → You approve → Build → Checks → Ready, filled in as it moves. */
+    journey?: JourneyStep[] | null;
+    /** The thread's server-side entries; the conversation's messages join them in time order. */
+    thread?: BrowserTaskThreadItem[];
+    details?: BrowserTaskDetailGroup[];
+    /** Where to message the agent when this page carries no conversation (null: messaging isn't available here). */
+    chatHref?: string | null;
 };
 /** One project on the Projects page; opening it is a POST to /projects/open. */
 export type BrowserProjectRow = {
@@ -343,6 +383,11 @@ export type BrowserProjectRow = {
         href: string;
         on: boolean;
     };
+    /** Settings → Projects → Checks for this project, and its level in words. */
+    checks?: {
+        href: string;
+        level: string;
+    };
     /** What waits, runs, queues or finished today; null when not scanned. */
     peek: {
         label: string;
@@ -752,6 +797,8 @@ export type BrowserFlowView = {
         usedHere: string[];
         language: "shell" | "python" | "node";
         file: string | null;
+        /** It came with an imported flow and waits for a person's approval before it runs. */
+        held: boolean;
     }[];
     start: string;
     stages: BrowserFlowStage[];
@@ -811,12 +858,80 @@ export type BrowserWorkspace = {
     update?: BrowserUpdateNotice;
     /** Chat's first run, until the first Ready result: the three steps and first tasks to try. */
     firstRun?: BrowserFirstRun;
+    /** Chat, after the first Ready result until put away: use it from the phone. */
+    phone?: BrowserPhoneCard;
+    /** The Chat landing's live view: who is working now, four counts, and Catch up in tabs. */
+    home?: BrowserHome | null;
+};
+/** One agent at work now: its task and the machine's own phase, in words. */
+export type BrowserHomeAgent = {
+    runId: number;
+    taskId: string;
+    title: string;
+    href: string;
+    agent: string;
+    phase: string;
+    project: string | null;
+    since: string;
+};
+export type BrowserHomeCount = {
+    key: 'working' | 'waiting' | 'ready' | 'done';
+    label: string;
+    value: number;
+    href: string;
 };
-/** `sandbox`: the demo command, offered beside the sign-in command while no agent is signed in. */
+export type BrowserCatchUpTab = 'needs-you' | 'ready' | 'running' | 'all';
+export type BrowserCatchUpItem = {
+    id: string;
+    title: string;
+    href: string;
+    project: string | null;
+    tab: Exclude<BrowserCatchUpTab, 'all'> | 'finished';
+    label: string;
+    tone: StatusTone;
+    detail: string;
+    at: string;
+};
+/** Plan-window use stands in for spend: subscriptions don't bill per run. */
+export type BrowserHome = {
+    agents: BrowserHomeAgent[];
+    counts: BrowserHomeCount[];
+    planUse: {
+        name: string;
+        window: string;
+        percent: number;
+        detail: string;
+        tone: 'neutral' | 'warning' | 'danger';
+    }[];
+    catchUp: BrowserCatchUpItem[];
+    allHref: string;
+};
+/** `sandbox`: the demo command, offered beside the sign-in command while no agent is signed in. `intro`: how it works,
+ * once, above the composer with the suggestions. `lead`: the one line saying what runs the lead, and where to change it.
+ * `recheck`: while no agent is signed in, where the page asks again on its own. */
 export type BrowserFirstRun = {
     steps: FirstRunStep[];
     suggestions: FirstTaskSuggestion[];
     sandbox: string | null;
+    intro?: string;
+    lead?: {
+        words: string;
+        href: string;
+    } | null;
+    recheck?: string | null;
+};
+/** After the first Ready result: the phone, through a chat app or the console over Tailscale. `tailnet.restart`: the
+ * command that makes the console listen beyond this computer, when it doesn't yet. */
+export type BrowserPhoneCard = {
+    chatApps: {
+        label: string;
+        href: string;
+    }[];
+    tailnet: {
+        address: string;
+        restart: string | null;
+    } | null;
+    dismissHref: string;
 };
 /** The console's update notice: neutral, never the accent — an update does not need a person. */
 export type BrowserUpdateNotice = {

package/dist/builder.d.ts

@@ -368,6 +368,7 @@ export declare const NO_HANDOFF_WORDS = "The agent stopped before handing off; i
 export declare const WIP_COMMIT_WORDS = "Work in progress: the agent stopped before handing off. Kept so the next attempt continues from it.";
 /** The short turn a stopped agent's own session is resumed with. */
 export declare function handoffResumePrompt(done: string): string;
+export declare const SERVICE_STOP_WORDS = "Toolroll stopped while this task was building.";
 /**
  * What a non-zero agent exit means, in words a person can act on: the
  * harness's own result line names the ending (a turn ceiling, an error

package/dist/builder.js

@@ -1,4 +1,5 @@
 import { OBSERVATION_MAILBOX, observationBrief, parseObservationCases, collectObservations } from "./observations.js";
+import { checkCommandFor, effectiveCheckLevel, recordRunCheckLevel } from "./check-levels.js";
 import { skillsContext } from "./project-skills.js";
 import { failedVerificationEvidence, sealVerificationReceipt, verificationEvidence, reuseObservationVerification } from "./verification-evidence.js";
 import { learningContext } from "./project-learning.js";
@@ -1469,11 +1470,7 @@ export async function settleProviderOutcome(captured, result) {
     // own words.
     if (stopRequestedFor(store, request.runId, request.shouldStop)) {
         quarantineMailboxes(worktree, root, request.runId);
-        return {
-            ok: false,
-            reason: "stopped",
-            message: stopWords(store, request.runId, worktree, `the operator stopped this watch while the agent ran — the work is preserved uncommitted in ${worktree}`),
-        };
+        return { ok: false, reason: "stopped", message: await stoppedWords(captured) };
     }
     if (result.timedOut) {
         // A mailbox cut down mid-write is quarantined, never ingested: whatever
@@ -1782,11 +1779,7 @@ export async function settleProviderOutcome(captured, result) {
     // (audit IV-1): an operator's stop beats an agent's finish. The work
     // stays in the worktree, uncommitted, preserved for the successor.
     if (stopRequestedFor(store, request.runId, request.shouldStop)) {
-        return {
-            ok: false,
-            reason: "stopped",
-            message: stopWords(store, request.runId, worktree, `the operator stopped this watch while the agent ran — the work is preserved uncommitted in ${worktree}`),
-        };
+        return { ok: false, reason: "stopped", message: await stoppedWords(captured) };
     }
     store.setRunPhase(request.runId, "committing");
     // Kept work that is already complete is already committed: the attempt's
@@ -2145,7 +2138,14 @@ async function settleProof(captured, statArtifactId, sealedHead) {
     // re-proved before every authorized spawn, and tracked post-commit changes
     // stop recovery rather than being silently certified.
     const repo = store.getWorktree(worktree)?.repo ?? null;
-    const configured = repo === null ? null : store.liveVerifyCommand(repo);
+    // The check level (check-levels.ts): the task's own choice, else the
+    // project's. Quick runs its own approved command (or the full one when it
+    // has none); Off runs nothing. The level that ran is recorded either way.
+    const checkChoice = effectiveCheckLevel(store, repo, request.taskId);
+    const chosenCheck = repo === null ? null : checkCommandFor(store, repo, checkChoice.level);
+    const configured = chosenCheck?.command ?? null;
+    if (repo !== null && chosenCheck !== null)
+        recordRunCheckLevel(store, { id: runId, taskId: request.taskId, repo }, chosenCheck.level, checkChoice.from, now());
     let verifyCommand;
     const checkLog = [];
     const checkOutcomes = [];
@@ -2238,7 +2238,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
             const liveRecoverySetup = () => {
                 if (repo === null || recoveryDigest === null)
                     return null;
-                const liveVerify = store.liveVerifyCommand(repo);
+                const liveVerify = store.liveVerifyCommand(configured.repo);
                 const liveSetup = store.liveWorktreeSetup(repo);
                 return liveVerify !== null &&
                     liveVerify.digest === configured.digest &&
@@ -2374,7 +2374,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
             : checkSuites.some(one => one.status === "failed") ? "failed"
                 : "not-run";
     const suites = checkSuites.length > 0 ? checkSuites : verifyCommand.configured === false ? [] : [{
-            name: reused === null ? "Project check" : "Project check (reused)",
+            name: reused === null ? chosenCheck?.level === "quick" ? "Quick check" : "Project check" : "Project check (reused)",
             status: checkStatus,
             exitCode: "ran" in verifyCommand && verifyCommand.ran ? verifyCommand.exitCode : null,
         }];
@@ -2589,6 +2589,26 @@ async function resumeUnhandedWork(captured, sessionId) {
     }
     return null;
 }
+/**
+ * The words for an attempt a stop ended after its agent ran. A task stop
+ * names who asked. A SERVICE stop (the builder stopping or restarting) also
+ * saves the work as a patch in the run's evidence before saying so: the
+ * changes stay uncommitted in the checkout, and the requeued task resumes
+ * from them on the builder's next pass.
+ */
+async function stoppedWords(captured) {
+    const { store, request, git, worktree, root } = captured;
+    if (store.applicableStopFor(request.runId) !== null) {
+        return stopWords(store, request.runId, worktree, `stopped while the agent ran — the work is preserved uncommitted in ${worktree}`);
+    }
+    const changes = await unhandedChanges(git, worktree);
+    const saved = changes === null || changes.length === 0 ? null
+        : await saveWorkPatch(git, worktree, join(root, String(request.runId), "service-stop-work.patch"), `# work in ${worktree} when Toolroll stopped\n# kept ${captured.clock().toISOString()}\n`);
+    const kept = changes !== null && changes.length === 0 ? "It had not changed any files yet"
+        : saved !== null && saved.ok ? `Its work is kept in ${worktree} and saved as ${saved.file}` : `Its work is kept uncommitted in ${worktree}`;
+    return `${SERVICE_STOP_WORDS} ${kept}; the task is back in the queue and resumes from it when the builder runs again.`;
+}
+export const SERVICE_STOP_WORDS = "Toolroll stopped while this task was building.";
 /**
  * The attempt ended without a handoff, even after any resumed turn. When it
  * left changes, they are never discarded: first saved as a patch in this

package/dist/chat-actions.js

@@ -1,5 +1,6 @@
 /** Shared, exact-state actions. Models may prepare; only the existing human
  * confirmation door executes. Protected actions use a one-use review receipt. */
+import { withActor } from "./actor.js";
 import { publicChatText } from "./chat-display.js";
 import { gateWords } from "./approval-policy.js";
 import { createHash, randomBytes } from "node:crypto";
@@ -1102,7 +1103,7 @@ export function executeSharedAction(store, who, id, payload, now, options) {
                     throw Error(completed.message);
             }
             else if (payload.operation === "task_cancel") {
-                const result = store.cancelTask(task, now);
+                const result = withActor({ account: who.name, lead: false }, () => store.cancelTask(task, now));
                 if (!result.ok)
                     throw Error(`Task was not cancelled: ${result.reason}.`);
             }

package/dist/chat-delivery.js

@@ -627,6 +627,8 @@ export async function planChatNotifications(options) {
                 const personal = notification.recipient !== null;
                 if (notification.createdAt >= binding.created &&
                     notification.resolvedAt === null &&
+                    // Pings follow responsibility: the lead's work, this person's own act and a muted project stay in the console.
+                    store.pingAllowed(notification, binding.approver) &&
                     // A flow decision for "anyone who approves" reaches every approver who can see the project.
                     // A notification addressed to this person reaches them whatever project
                     // their channel follows (a sign-in pause is the installation's, v108).

package/dist/chat-quiet.js

@@ -7,7 +7,7 @@
 import { assignmentOf } from "./assignment.js";
 import { chatControlHref } from "./chat-controls.js";
 import { telegramProgressCard } from "./telegram-progress.js";
-import { assignmentStatusFacts, headlineEmoji, taskStatusOf } from "./task-status.js";
+import { assignmentStatusFacts, headlineEmoji, replacedWords, taskStatusOf } from "./task-status.js";
 import { phoneText, projectLabel } from "./telegram-status.js";
 import { isLifecycleNotification } from "./store.js";
 /** What always makes a new message, even in quiet mode: a question or approval waiting, a failure or other
@@ -55,6 +55,16 @@ function taskLine(store, taskRef, now, root) {
         return null;
     const task = store.getTask(ref.externalId);
     const title = phoneText(task?.title ?? ref.externalId, 88);
+    // Replaced, never "Cancelled": the card names its successor and links to it.
+    const successor = task?.state === "cancelled" ? store.replacementOf(ref.externalId) : null;
+    if (successor !== null) {
+        const heading = `${headlineEmoji("Stopped")} ${replacedWords(successor)}`;
+        const text = [title, heading, "", `${projectLabel(ref.repo)} · ${ref.externalId}`].join("\n");
+        return { title, icon: headlineEmoji("Stopped"), status: replacedWords(successor), project: ref.repo, view: {
+                text, entities: [{ type: "bold", offset: 0, length: title.length }, { type: "bold", offset: title.length + 1, length: heading.length }],
+                link: { label: `Open ${phoneText(successor, 40)}`, path: chatControlHref("task", successor) },
+            } };
+    }
     const run = cardRun(store, taskRef);
     if (run !== null) {
         const view = telegramProgressCard(store, run, ref.externalId, ref.repo, now, root);

package/dist/chat-task-actions.d.ts

@@ -26,6 +26,18 @@ export declare const CHAT_TASK_ACTIONS: {
         readonly label: "Remove dependency";
         readonly detail: "Stops waiting for the selected task. Other requirements still apply.";
     };
+    readonly run_checks: {
+        readonly label: "Run checks";
+        readonly detail: "Runs the project's quick check on this result's exact commit. A pass upgrades its status; a failure stays visible.";
+    };
+    readonly run_full_checks: {
+        readonly label: "Run full checks";
+        readonly detail: "Runs the project's full check on this result's exact commit. A pass upgrades its status; a failure stays visible.";
+    };
+    readonly add_tests: {
+        readonly label: "Add tests";
+        readonly detail: "Files a small task to write tests for this change. Nothing runs until it is approved.";
+    };
 };
 export declare function isChatTaskAction(value: unknown): value is keyof typeof CHAT_TASK_ACTIONS;
 /** Bind cards to a specific execution and its current state, not the family's moving pointer. */
@@ -34,6 +46,7 @@ export declare function chatTaskStamp(store: Store, who: VerifiedApprover, task:
 export declare function chatTaskRun(store: Store, task: string, operation: "stop" | "resume", now: Date): number | null;
 export declare function applyChatTaskAction(store: Store, who: VerifiedApprover, payload: Record<string, unknown>, now: Date, web: boolean, controls?: Pick<StopRequest, "held" | "deferSignal"> & {
     via?: StopRequest["via"];
+    evidenceRoot?: string;
 }): {
     ok: true;
     taskId: string;

package/dist/chat-task-actions.js

@@ -1,6 +1,7 @@
 import { verifiedAuthor } from "./store.js";
 import { requestTaskStop, taskControlOf } from "./task-control.js";
 import { authorizePlanUnderMode } from "./plan-auto.js";
+import { fileAddTestsTask, requestFollowUpChecks } from "./result-follow-ups.js";
 export const CHAT_TASK_ACTIONS = {
     // Build #1604 feedback: one short consequence that still says saved work
     // remains, other tasks continue, and the pause waits for acknowledgement.
@@ -10,6 +11,10 @@ export const CHAT_TASK_ACTIONS = {
     plan: { label: "Plan first", detail: "Requests a plan. Building still requires approval." },
     wait_for: { label: "Add dependency", detail: "Waits for the selected task to finish." },
     stop_waiting: { label: "Remove dependency", detail: "Stops waiting for the selected task. Other requirements still apply." },
+    // Follow-ups on a result (result-follow-ups.ts): the same actions as the result page.
+    run_checks: { label: "Run checks", detail: "Runs the project's quick check on this result's exact commit. A pass upgrades its status; a failure stays visible." },
+    run_full_checks: { label: "Run full checks", detail: "Runs the project's full check on this result's exact commit. A pass upgrades its status; a failure stays visible." },
+    add_tests: { label: "Add tests", detail: "Files a small task to write tests for this change. Nothing runs until it is approved." },
 };
 export function isChatTaskAction(value) {
     return typeof value === "string" && Object.hasOwn(CHAT_TASK_ACTIONS, value);
@@ -52,7 +57,7 @@ export function applyChatTaskAction(store, who, payload, now, web, controls = {}
         // Resume remains the existing nonce + password ceremony. A proposal only opens it.
         if (operation === "resume")
             return { ok: true, taskId: task, said: `Resume review requested for ${task}. Complete the password confirmation on the task to resume.` };
-        const { via, ...rest } = controls;
+        const { via, evidenceRoot: _root, ...rest } = controls;
         const result = requestTaskStop(store, { taskId: task, runId: run, by: verifiedAuthor(who.name), via: via ?? (web ? "web" : "cli"), ...rest }, now);
         return result.ok ? { ok: true, taskId: task, said: `Stop requested for ${task}, run #${run}.` }
             : { ok: false, message: result.detail };
@@ -61,6 +66,19 @@ export function applyChatTaskAction(store, who, payload, now, web, controls = {}
         const result = store.requeueTask(task, who.name, now);
         return result.ok ? { ok: true, taskId: task, said: "Task queued again." } : { ok: false, message: result.reason === "claimed" ? "This task is already running." : result.reason === "not-stalled" ? "This task does not need another attempt." : "That task is no longer available." };
     }
+    if (operation === "run_checks" || operation === "run_full_checks" || operation === "add_tests") {
+        const result = store.runsFor(ref.id).find(one => one.role === "builder" && one.finishedAt !== null && one.headRevision !== null) ?? null;
+        if (result === null)
+            return { ok: false, message: "This task has no finished result yet." };
+        if (operation === "add_tests") {
+            const filed = fileAddTestsTask(store, controls.evidenceRoot ?? null, { runId: result.id, actor: who.name, filedVia: web ? "console" : "cli", admittedRepos: who.repos }, now);
+            return filed.ok ? { ok: true, taskId: filed.id, said: filed.existing ? `Tests are already filed as ${filed.id}.` : `Filed ${filed.id} to add tests. Review and approve it to start.` }
+                : { ok: false, message: filed.message };
+        }
+        const asked = requestFollowUpChecks(store, { runId: result.id, level: operation === "run_full_checks" ? "full" : "quick", actor: who.name }, now);
+        return asked.ok ? { ok: true, taskId: task, said: `${asked.level === "full" ? "Full" : "Quick"} checks ${asked.existing ? "are already" : "are"} queued on this result's commit.` }
+            : { ok: false, message: asked.message };
+    }
     if (operation === "plan") {
         const result = store.requestPlan(ref.id, now);
         if (!result.ok)

package/dist/check-levels-ui.d.ts

@@ -0,0 +1,21 @@
+/** Settings → Projects → Checks: how much checks after each build, in plain
+ * words. One choice (Quick, Full, Off) and the quick command beside the full
+ * one. Every change takes the password and lands in the ledger; approving a
+ * command restates exactly what will run, unattended, before the yes. */
+import { type CheckLevel } from "./check-levels.js";
+import type { VerifyCommand } from "./store.js";
+export type CheckSettingsView = {
+    repo: string;
+    name: string;
+    csrf: string;
+    canChange: boolean;
+    level: CheckLevel;
+    full: VerifyCommand | null;
+    quick: VerifyCommand | null;
+    /** A starting point for the quick command, from the project's scripts. */
+    suggestion: string | null;
+    said: string | null;
+    problem: string | null;
+};
+export declare function checkSettingsHtml(view: CheckSettingsView): string;
+export declare const CHECK_SETTINGS_CSS = "\n  .check-settings { display: grid; gap: .6rem; max-width: 40rem; }\n  .check-settings p, .check-settings h2 { margin: 0; }\n  .check-settings h2 { font-size: 1rem; }\n  .check-settings fieldset { border: 0; margin: 0; padding: 0; display: grid; gap: .25rem; }\n  .check-settings legend { font-weight: 600; margin-bottom: .25rem; }\n  .check-settings label { display: grid; gap: .25rem; }\n  .check-settings .check-choice { display: flex; align-items: flex-start; gap: .6rem; min-height: 44px; padding: .35rem 0; cursor: pointer; }\n  .check-settings .check-choice > span { display: grid; gap: .1rem; }\n  .check-settings .check-choice input { margin-top: .2rem; }\n  .check-settings input[type=password], .check-settings input[type=number], .check-settings textarea { min-height: 44px; box-sizing: border-box; width: 100%; }\n  .check-settings button { min-height: 44px; justify-self: start; }\n  .check-settings .check-command { overflow-wrap: anywhere; }\n  .check-terms { margin: 0; padding-left: 1.1rem; display: grid; gap: .25rem; }\n  @media (max-width: 480px) { .check-settings button { justify-self: stretch; } }\n  .follow-ups .follow-up-list { margin: .4rem 0; padding-left: 1.1rem; display: grid; gap: .25rem; }\n  .follow-ups .follow-up-acts, .follow-ups .follow-up-act { display: flex; flex-wrap: wrap; gap: .5rem; margin: .5rem 0 0; }\n  .follow-ups .follow-up-act { margin: 0; }\n  .follow-ups button { min-height: 44px; }\n  @media (max-width: 480px) { .follow-ups .follow-up-acts, .follow-ups .follow-up-act { display: grid; } .follow-ups .follow-up-act button { width: 100%; } }\n";

package/dist/check-levels-ui.js

@@ -0,0 +1,70 @@
+/** Settings → Projects → Checks: how much checks after each build, in plain
+ * words. One choice (Quick, Full, Off) and the quick command beside the full
+ * one. Every change takes the password and lands in the ledger; approving a
+ * command restates exactly what will run, unattended, before the yes. */
+import { CHECK_LEVELS, CHECK_LEVEL_HINTS, CHECK_LEVEL_WORDS } from "./check-levels.js";
+const escape = (text) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+export function checkSettingsHtml(view) {
+    const hidden = (act) => `<input type="hidden" name="csrf" value="${escape(view.csrf)}"><input type="hidden" name="repo" value="${escape(view.repo)}"><input type="hidden" name="act" value="${act}">`;
+    const password = `<label>Password<input type="password" name="password" autocomplete="current-password" required></label>`;
+    const notes = [
+        view.said === null ? "" : `<p class="notice" role="status">${escape(view.said)}</p>`,
+        view.problem === null ? "" : `<p class="problem" role="alert">${escape(view.problem)}</p>`,
+    ].join("");
+    const head = `<p class="meta">${escape(view.name)} · <span class="mono">${escape(view.repo)}</span></p>${notes}`;
+    const command = (one) => `<p class="mono check-command">${escape(one.command)}</p><p class="meta">Up to ${Math.round(one.timeoutMs / 1000)}s · approved by ${escape(one.approvedBy)}</p>`;
+    // Quick with no quick command runs the full check; say so where the choice is made.
+    const fallsBack = view.level === "quick" && view.quick === null;
+    const current = `<p><strong>${CHECK_LEVEL_WORDS[view.level]}</strong> · ${escape(CHECK_LEVEL_HINTS[view.level])}</p>` +
+        (fallsBack ? `<p class="meta">No quick command yet, so builds run the full check.</p>` : "") +
+        (view.level !== "full" && view.full !== null ? `<p class="meta">The full check still runs when a pull request opens, and Merge waits for it.</p>` : "");
+    if (!view.canChange) {
+        return head + `<section class="card check-settings">${current}</section>` +
+            `<section class="card check-settings"><h2>Quick check</h2>${view.quick === null ? `<p class="meta">None yet.</p>` : command(view.quick)}</section>` +
+            `<section class="card check-settings"><h2>Full check</h2>${view.full === null ? `<p class="meta">None yet.</p>` : command(view.full)}</section>`;
+    }
+    const choices = CHECK_LEVELS.map(level => `<label class="check-choice"><input type="radio" name="level" value="${level}"${level === view.level ? " checked" : ""}>` +
+        `<span><strong>${CHECK_LEVEL_WORDS[level]}</strong><span class="meta">${escape(CHECK_LEVEL_HINTS[level])}</span></span></label>`).join("");
+    const levelForm = `<form method="post" action="/settings/checks" class="card check-settings">${hidden("level")}` +
+        `<fieldset><legend>After each build</legend>${choices}</fieldset>` +
+        (fallsBack ? `<p class="meta">No quick command yet, so Quick runs the full check.</p>` : "") +
+        `<p class="meta">A task can choose its own checks when it's filed. With Quick or Off, the full check runs when a pull request opens, and Merge waits for it unless you merge anyway.</p>` +
+        `${password}<button type="submit">Save</button></form>`;
+    const quickTerms = `<ul class="check-terms"><li>Runs unattended right after every Quick build, in that build's checkout.</li><li>Plain environment: no credentials.</li><li>A failure shows on the result; nothing is blocked.</li></ul>`;
+    const quickForm = (value, submit) => `<form method="post" action="/settings/checks" class="check-settings">${hidden("quick")}` +
+        `<label>Command<textarea name="command" rows="2" maxlength="2000" spellcheck="false" class="mono" required>${escape(value)}</textarea></label>` +
+        `<label>Time limit (seconds)<input type="number" name="timeout" min="1" max="3600" value="${view.quick === null ? 180 : Math.round(view.quick.timeoutMs / 1000)}" required></label>` +
+        `${quickTerms}${password}<button type="submit">${submit}</button></form>`;
+    const quick = view.quick === null
+        ? `<section class="card check-settings"><h2>Quick check</h2>` +
+            (view.suggestion === null ? `<p class="meta">Typecheck and the tests near the change, ideally under 2 minutes.</p>` : `<p class="meta">Suggested from the project's scripts. Edit it before approving.</p>`) +
+            quickForm(view.suggestion ?? "", "Approve quick check") + `</section>`
+        : `<section class="card check-settings"><h2>Quick check</h2>${command(view.quick)}` +
+            `<details class="settings-more"><summary>Change quick check</summary>${quickForm(view.quick.command, "Approve change")}</details>` +
+            `<details class="settings-more"><summary>Remove quick check</summary><form method="post" action="/settings/checks" class="check-settings">${hidden("quick-clear")}` +
+            `<p class="meta">Quick builds run the full check instead.</p>${password}<button type="submit" class="danger">Remove</button></form></details></section>`;
+    const full = `<details class="settings-more"><summary>Full check</summary><section class="card check-settings">` +
+        (view.full === null ? `<p class="meta">None yet. Approve one with <span class="mono">toolroll verify set --repo … --command "…"</span>.</p>` : command(view.full)) + `</section></details>`;
+    return head + levelForm + quick + full;
+}
+export const CHECK_SETTINGS_CSS = `
+  .check-settings { display: grid; gap: .6rem; max-width: 40rem; }
+  .check-settings p, .check-settings h2 { margin: 0; }
+  .check-settings h2 { font-size: 1rem; }
+  .check-settings fieldset { border: 0; margin: 0; padding: 0; display: grid; gap: .25rem; }
+  .check-settings legend { font-weight: 600; margin-bottom: .25rem; }
+  .check-settings label { display: grid; gap: .25rem; }
+  .check-settings .check-choice { display: flex; align-items: flex-start; gap: .6rem; min-height: 44px; padding: .35rem 0; cursor: pointer; }
+  .check-settings .check-choice > span { display: grid; gap: .1rem; }
+  .check-settings .check-choice input { margin-top: .2rem; }
+  .check-settings input[type=password], .check-settings input[type=number], .check-settings textarea { min-height: 44px; box-sizing: border-box; width: 100%; }
+  .check-settings button { min-height: 44px; justify-self: start; }
+  .check-settings .check-command { overflow-wrap: anywhere; }
+  .check-terms { margin: 0; padding-left: 1.1rem; display: grid; gap: .25rem; }
+  @media (max-width: 480px) { .check-settings button { justify-self: stretch; } }
+  .follow-ups .follow-up-list { margin: .4rem 0; padding-left: 1.1rem; display: grid; gap: .25rem; }
+  .follow-ups .follow-up-acts, .follow-ups .follow-up-act { display: flex; flex-wrap: wrap; gap: .5rem; margin: .5rem 0 0; }
+  .follow-ups .follow-up-act { margin: 0; }
+  .follow-ups button { min-height: 44px; }
+  @media (max-width: 480px) { .follow-ups .follow-up-acts, .follow-ups .follow-up-act { display: grid; } .follow-ups .follow-up-act button { width: 100%; } }
+`;

package/dist/check-levels.d.ts

@@ -0,0 +1,67 @@
+import type { Store, VerifyCommand } from "./store.js";
+export declare const CHECK_LEVELS: readonly ["quick", "full", "off"];
+export type CheckLevel = (typeof CHECK_LEVELS)[number];
+export declare const isCheckLevel: (value: unknown) => value is CheckLevel;
+export declare const CHECK_LEVEL_WORDS: Readonly<Record<CheckLevel, string>>;
+export declare const CHECK_LEVEL_HINTS: Readonly<Record<CheckLevel, string>>;
+/** Ledger actions. The ledger is append-only, so the newest entry is the setting. */
+export declare const PROJECT_LEVEL_ACTION = "check level changed";
+export declare const TASK_LEVEL_ACTION = "task checks chosen";
+export declare const RUN_LEVEL_ACTION = "checks used";
+/** The quick command's grant lives beside the full one under its own key. */
+export declare const quickVerifyKey: (repo: string) => string;
+export declare function liveQuickCommand(store: Store, repo: string): VerifyCommand | null;
+/** Ledger reads go through the repo index: `repo = ?` (or IS NULL for unplaced work). */
+export declare const repoClause: (repo: string | null) => [string, string[]];
+export declare function repoOfRun(store: Store, runId: number): string | null;
+export type ProjectCheckLevel = {
+    level: CheckLevel;
+    setBy: string | null;
+    at: string | null;
+};
+/** A project's level. With nothing recorded it is Full: a project that existed
+ * before levels keeps exactly the check it had. New projects are stamped Quick
+ * when they are added (stampNewProjectLevel). */
+export declare function projectCheckLevel(store: Store, repo: string): ProjectCheckLevel;
+/** An approver's act: set the project's level. The ledger keeps before → after. */
+export declare function setProjectCheckLevel(store: Store, repo: string, level: CheckLevel, by: string, now: Date): {
+    changed: boolean;
+    before: CheckLevel;
+};
+/** A project added from now on starts on Quick. One that already has a level,
+ * or an approved check from before levels existed, is left exactly as it is. */
+export declare function stampNewProjectLevel(store: Store, repo: string, now: Date): boolean;
+/** A task's own choice, if it made one; a revision inherits the task it revises. */
+export declare function taskCheckLevel(store: Store, taskId: string): CheckLevel | null;
+/** A filing choice: this task's checks, overriding the project. Fixed once its
+ * plan is approved, so what the approver saw is what runs. */
+export declare function setTaskCheckLevel(store: Store, taskId: string, level: CheckLevel, by: string, now: Date): {
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+};
+export type EffectiveCheckLevel = {
+    level: CheckLevel;
+    from: "task" | "project";
+};
+export declare function effectiveCheckLevel(store: Store, repo: string | null, taskId: string | null): EffectiveCheckLevel;
+/** The command a level runs. Quick without its own command runs the full one
+ * (and says so: the level that ran is Full). Off runs nothing. */
+export declare function checkCommandFor(store: Store, repo: string, level: CheckLevel): {
+    level: CheckLevel;
+    command: VerifyCommand | null;
+};
+/** The builder records which level a run used, so its result says it honestly. */
+export declare function recordRunCheckLevel(store: Store, run: {
+    id: number;
+    taskId: string;
+    repo: string | null;
+}, level: CheckLevel, from: EffectiveCheckLevel["from"], now: Date): void;
+/** The level a finished run's checks used; null for a run from before levels. */
+export declare function runCheckLevel(store: Store, runId: number): CheckLevel | null;
+/** A starting point for the quick command, from the project's own scripts.
+ * It is only a suggestion: a person approves the exact command. */
+export declare function suggestQuickCommand(repo: string): string | null;
+/** "skip the tests", "run the full checks": a filing request in chat, as a level. */
+export declare function checkLevelFromWords(text: string): CheckLevel | null;