toolroll 0.9.62 → 0.9.65

package/dist/contracts/route.d.ts

@@ -16,7 +16,7 @@ import { type ContractResult } from "./contract.js";
 export declare const ROUTE_PHASES: readonly ["plan", "build", "repair", "review"];
 /** provider.ts's provider ids, restated (provider.ts sits above phase-routing.ts in the module graph) and pinned to
  * them by the test suite. */
-export declare const ROUTE_PROVIDERS: readonly ["claude", "codex", "openrouter", "gemini"];
+export declare const ROUTE_PROVIDERS: readonly ["claude", "codex", "openrouter", "gemini", "opencode", "cursor", "cline", "qwen", "goose"];
 /** provider.ts's MODEL_ID, restated for the same reason: an exact model id is argv-safe — no leading dash, no
  * whitespace or control bytes. */
 export declare const MODEL_ID_SHAPE: RegExp;
@@ -49,9 +49,14 @@ export declare const routeOverrideSchema: z.ZodObject<{
     }>;
     provider: z.ZodEnum<{
         claude: "claude";
+        cline: "cline";
         codex: "codex";
+        cursor: "cursor";
         gemini: "gemini";
+        goose: "goose";
+        opencode: "opencode";
         openrouter: "openrouter";
+        qwen: "qwen";
     }>;
     model: z.ZodString;
     by: z.ZodString;
@@ -67,9 +72,14 @@ export declare const routeLegSchema: z.ZodObject<{
     }>;
     provider: z.ZodEnum<{
         claude: "claude";
+        cline: "cline";
         codex: "codex";
+        cursor: "cursor";
         gemini: "gemini";
+        goose: "goose";
+        opencode: "opencode";
         openrouter: "openrouter";
+        qwen: "qwen";
     }>;
     model: z.ZodString;
     tier: z.ZodEnum<{
@@ -85,9 +95,14 @@ export declare const routeLegSchema: z.ZodObject<{
     recommended: z.ZodObject<{
         provider: z.ZodEnum<{
             claude: "claude";
+            cline: "cline";
             codex: "codex";
+            cursor: "cursor";
             gemini: "gemini";
+            goose: "goose";
+            opencode: "opencode";
             openrouter: "openrouter";
+            qwen: "qwen";
         }>;
         model: z.ZodString;
         tier: z.ZodEnum<{
@@ -135,9 +150,14 @@ export declare const sealedRouteV1Schema: z.ZodObject<{
         }>;
         provider: z.ZodEnum<{
             claude: "claude";
+            cline: "cline";
             codex: "codex";
+            cursor: "cursor";
             gemini: "gemini";
+            goose: "goose";
+            opencode: "opencode";
             openrouter: "openrouter";
+            qwen: "qwen";
         }>;
         model: z.ZodString;
         tier: z.ZodEnum<{
@@ -152,9 +172,14 @@ export declare const sealedRouteV1Schema: z.ZodObject<{
         recommended: z.ZodObject<{
             provider: z.ZodEnum<{
                 claude: "claude";
+                cline: "cline";
                 codex: "codex";
+                cursor: "cursor";
                 gemini: "gemini";
+                goose: "goose";
+                opencode: "opencode";
                 openrouter: "openrouter";
+                qwen: "qwen";
             }>;
             model: z.ZodString;
             tier: z.ZodEnum<{
@@ -174,9 +199,14 @@ export declare const sealedRouteV1Schema: z.ZodObject<{
         }>;
         provider: z.ZodEnum<{
             claude: "claude";
+            cline: "cline";
             codex: "codex";
+            cursor: "cursor";
             gemini: "gemini";
+            goose: "goose";
+            opencode: "opencode";
             openrouter: "openrouter";
+            qwen: "qwen";
         }>;
         model: z.ZodString;
         by: z.ZodString;
@@ -219,9 +249,14 @@ export declare const sealedRouteV2Schema: z.ZodObject<{
         }>;
         provider: z.ZodEnum<{
             claude: "claude";
+            cline: "cline";
             codex: "codex";
+            cursor: "cursor";
             gemini: "gemini";
+            goose: "goose";
+            opencode: "opencode";
             openrouter: "openrouter";
+            qwen: "qwen";
         }>;
         model: z.ZodString;
         tier: z.ZodEnum<{
@@ -237,9 +272,14 @@ export declare const sealedRouteV2Schema: z.ZodObject<{
         recommended: z.ZodObject<{
             provider: z.ZodEnum<{
                 claude: "claude";
+                cline: "cline";
                 codex: "codex";
+                cursor: "cursor";
                 gemini: "gemini";
+                goose: "goose";
+                opencode: "opencode";
                 openrouter: "openrouter";
+                qwen: "qwen";
             }>;
             model: z.ZodString;
             tier: z.ZodEnum<{
@@ -260,9 +300,14 @@ export declare const sealedRouteV2Schema: z.ZodObject<{
         }>;
         provider: z.ZodEnum<{
             claude: "claude";
+            cline: "cline";
             codex: "codex";
+            cursor: "cursor";
             gemini: "gemini";
+            goose: "goose";
+            opencode: "opencode";
             openrouter: "openrouter";
+            qwen: "qwen";
         }>;
         model: z.ZodString;
         by: z.ZodString;
@@ -320,9 +365,14 @@ export declare const sealedRouteSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         }>;
         provider: z.ZodEnum<{
             claude: "claude";
+            cline: "cline";
             codex: "codex";
+            cursor: "cursor";
             gemini: "gemini";
+            goose: "goose";
+            opencode: "opencode";
             openrouter: "openrouter";
+            qwen: "qwen";
         }>;
         model: z.ZodString;
         tier: z.ZodEnum<{
@@ -337,9 +387,14 @@ export declare const sealedRouteSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         recommended: z.ZodObject<{
             provider: z.ZodEnum<{
                 claude: "claude";
+                cline: "cline";
                 codex: "codex";
+                cursor: "cursor";
                 gemini: "gemini";
+                goose: "goose";
+                opencode: "opencode";
                 openrouter: "openrouter";
+                qwen: "qwen";
             }>;
             model: z.ZodString;
             tier: z.ZodEnum<{
@@ -359,9 +414,14 @@ export declare const sealedRouteSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         }>;
         provider: z.ZodEnum<{
             claude: "claude";
+            cline: "cline";
             codex: "codex";
+            cursor: "cursor";
             gemini: "gemini";
+            goose: "goose";
+            opencode: "opencode";
             openrouter: "openrouter";
+            qwen: "qwen";
         }>;
         model: z.ZodString;
         by: z.ZodString;
@@ -403,9 +463,14 @@ export declare const sealedRouteSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         }>;
         provider: z.ZodEnum<{
             claude: "claude";
+            cline: "cline";
             codex: "codex";
+            cursor: "cursor";
             gemini: "gemini";
+            goose: "goose";
+            opencode: "opencode";
             openrouter: "openrouter";
+            qwen: "qwen";
         }>;
         model: z.ZodString;
         tier: z.ZodEnum<{
@@ -421,9 +486,14 @@ export declare const sealedRouteSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         recommended: z.ZodObject<{
             provider: z.ZodEnum<{
                 claude: "claude";
+                cline: "cline";
                 codex: "codex";
+                cursor: "cursor";
                 gemini: "gemini";
+                goose: "goose";
+                opencode: "opencode";
                 openrouter: "openrouter";
+                qwen: "qwen";
             }>;
             model: z.ZodString;
             tier: z.ZodEnum<{
@@ -444,9 +514,14 @@ export declare const sealedRouteSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         }>;
         provider: z.ZodEnum<{
             claude: "claude";
+            cline: "cline";
             codex: "codex";
+            cursor: "cursor";
             gemini: "gemini";
+            goose: "goose";
+            opencode: "opencode";
             openrouter: "openrouter";
+            qwen: "qwen";
         }>;
         model: z.ZodString;
         by: z.ZodString;

package/dist/contracts/route.js

@@ -17,7 +17,7 @@ import { limited, parseContract, versioned } from "./contract.js";
 export const ROUTE_PHASES = ["plan", "build", "repair", "review"];
 /** provider.ts's provider ids, restated (provider.ts sits above phase-routing.ts in the module graph) and pinned to
  * them by the test suite. */
-export const ROUTE_PROVIDERS = ["claude", "codex", "openrouter", "gemini"];
+export const ROUTE_PROVIDERS = ["claude", "codex", "openrouter", "gemini", "opencode", "cursor", "cline", "qwen", "goose"];
 /** provider.ts's MODEL_ID, restated for the same reason: an exact model id is argv-safe — no leading dash, no
  * whitespace or control bytes. */
 export const MODEL_ID_SHAPE = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/;

package/dist/contracts/store-json.d.ts

@@ -208,6 +208,8 @@ declare const STORE_COLUMN_VALUES: {
             subagent_state: "subagent_state";
             subagent_tools: "subagent_tools";
             subagent_undo: "subagent_undo";
+            sweep_cancel_rest: "sweep_cancel_rest";
+            sweep_file: "sweep_file";
             task_cancel: "task_cancel";
             task_resume: "task_resume";
             tool_add: "tool_add";

package/dist/control-setup.d.ts

@@ -19,7 +19,7 @@ export declare function previewSetup(store: Store, repo: string, inputs: SetupIn
     fingerprint: string;
     command: string;
     seconds: number;
-    provider: "claude" | "codex" | "gemini" | "openrouter";
+    provider: "claude" | "cline" | "codex" | "cursor" | "gemini" | "goose" | "opencode" | "openrouter" | "qwen";
     model: string;
 };
 export declare function approveSetup(store: Store, repo: string, inputs: SetupInputs, fingerprint: string, by: string, token: string, now: Date): {

package/dist/control-ui.js

@@ -1,5 +1,5 @@
 /** Shared setup views over the existing project configuration and approval doors. */
-import { html, joinHtml, postForm } from "./html.js";
+import { html, joinHtml, postForm, reauth } from "./html.js";
 import { ASSISTANTS } from "./setup-guide.js";
 import { openRouterPicker } from "./openrouter-models.js";
 export function connectionWords(connection) {
@@ -24,5 +24,5 @@ export function controlSetupHtml(data) {
 /** `fields` may still carry the session's csrf (a caller's habit): postForm writes the one CSRF field. */
 export function setupPreviewHtml(inputs, fields) {
     const { csrf: _csrf, ...rest } = fields;
-    return html `<h1>Approve project setup</h1><div class="card"><p>${fields.repo ?? ""}</p><p><strong>Builder:</strong> ${inputs.provider} · ${inputs.model}</p><p><strong>Preparation:</strong></p><pre class="recap">${inputs.command || "No preparation command"}</pre><p>Preparation timeout: ${inputs.seconds} seconds.</p><p>The builder default applies to new tasks. Preparation applies to subsequent runs, including already approved tasks. Existing signed task settings and verification rules remain in force.</p>${postForm("/control/setup-approve", html `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label><button>Approve project setup</button>`, { hidden: { ...rest, ...inputs } })}</div>`;
+    return html `<h1>Approve project setup</h1><div class="card"><p>${fields.repo ?? ""}</p><p><strong>Builder:</strong> ${inputs.provider} · ${inputs.model}</p><p><strong>Preparation:</strong></p><pre class="recap">${inputs.command || "No preparation command"}</pre><p>Preparation timeout: ${inputs.seconds} seconds.</p><p>The builder default applies to new tasks. Preparation applies to subsequent runs, including already approved tasks. Existing signed task settings and verification rules remain in force.</p>${postForm("/control/setup-approve", html `${reauth(html `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label>`)}<button>Approve project setup</button>`, { hidden: { ...rest, ...inputs } })}</div>`;
 }

package/dist/converse.d.ts

@@ -180,13 +180,24 @@ export type LeadToolCall = {
     args: Record<string, unknown>;
 };
 /** A provider answer with tool calls allowed: text, calls, usage. */
+/** `tokensIn` is ALL input tokens of the request; of them, `cacheWriteTokens` were written to the provider's prompt cache
+ * and `cacheReadTokens` read from it (absent: the provider reported none — never assumed zero for a cached request). */
 export type LeadProviderAnswer = {
     text: string;
     calls: LeadToolCall[];
     tokensIn: number;
     tokensOut: number;
     reportedCostMicrousd: number | null;
+    cacheWriteTokens?: number;
+    cacheReadTokens?: number;
 };
+/** Anthropic prices a cache write at 1.25x and a cache read at 0.1x the input price (5-minute cache). */
+export declare const CACHE_WRITE_RATIO = 1.25;
+export declare const CACHE_READ_RATIO = 0.1;
+/** The price a worst case reserves at while prompt caching is on: every input token as a cache write (the dearest). */
+export declare function cacheWorstPrice(price: ModelPrice): ModelPrice;
+/** A step's settlement with its cache categories: plain input, cache writes and cache reads each at their own rate. */
+export declare function settleWithCache(price: ModelPrice, answer: Pick<LeadProviderAnswer, "tokensIn" | "tokensOut" | "cacheWriteTokens" | "cacheReadTokens">): number;
 /** One message of the lead's own history, provider-neutral. */
 export type LeadHistoryMessage = {
     role: "operator";
@@ -224,6 +235,11 @@ export declare function composeLeadRequest(args: {
     dataDocument: string;
     history: readonly LeadHistoryMessage[];
     tools: readonly LeadToolSchema[];
+    /** Anthropic prompt caching: breakpoints after the first `coreTools` tools (stable across replies), on the system
+     * block, and on the DATA message (stable across the steps of one reply). Absent: no cache annotations. */
+    cache?: {
+        coreTools: number;
+    };
 }): {
     url: string;
     headers: Record<string, string>;

package/dist/converse.js

@@ -393,6 +393,20 @@ export function leadWorstCaseForPrice(price, baseBytes, caps = {}) {
 export function embeddedBytes(text) {
     return Buffer.byteLength(JSON.stringify(text), "utf8");
 }
+/** Anthropic prices a cache write at 1.25x and a cache read at 0.1x the input price (5-minute cache). */
+export const CACHE_WRITE_RATIO = 1.25;
+export const CACHE_READ_RATIO = 0.1;
+/** The price a worst case reserves at while prompt caching is on: every input token as a cache write (the dearest). */
+export function cacheWorstPrice(price) {
+    return { inMicrousd: Math.ceil(price.inMicrousd * CACHE_WRITE_RATIO), outMicrousd: price.outMicrousd };
+}
+/** A step's settlement with its cache categories: plain input, cache writes and cache reads each at their own rate. */
+export function settleWithCache(price, answer) {
+    const write = answer.cacheWriteTokens ?? 0, read = answer.cacheReadTokens ?? 0;
+    const plain = answer.tokensIn - write - read;
+    return plain * price.inMicrousd + write * Math.ceil(price.inMicrousd * CACHE_WRITE_RATIO) + read * Math.ceil(price.inMicrousd * CACHE_READ_RATIO)
+        + answer.tokensOut * price.outMicrousd;
+}
 /**
  * The tool-capable wrapper parser (mate arc). Same caps and the same
  * duplicate-key lexer as fleet chat's; tool calls are read, bounded (at
@@ -475,7 +489,18 @@ export function parseLeadProviderWrapper(provider, bytes) {
         const usage = usageOf(body["usage"], "input_tokens", "output_tokens");
         if (usage === null)
             return { ok: false, problem: "no-usage" };
-        return { ok: true, answer: { text, calls, tokensIn: usage.tokensIn, tokensOut: usage.tokensOut, reportedCostMicrousd: null } };
+        // Prompt cache categories: integers when present (anything else is malformed usage, never a guess). Anthropic's
+        // input_tokens counts only the uncached part; the request's whole input is the three added up.
+        const cache = (key) => {
+            const value = body["usage"][key];
+            // Absent: not reported. Present (even null): it must be a token count, or the usage is malformed.
+            return value === undefined ? undefined : typeof value === "number" && tokenCount(value) ? value : null;
+        };
+        const write = cache("cache_creation_input_tokens"), read = cache("cache_read_input_tokens");
+        if (write === null || read === null)
+            return { ok: false, problem: "no-usage" };
+        return { ok: true, answer: { text, calls, tokensIn: usage.tokensIn + (write ?? 0) + (read ?? 0), tokensOut: usage.tokensOut, reportedCostMicrousd: null,
+                ...(write === undefined ? {} : { cacheWriteTokens: write }), ...(read === undefined ? {} : { cacheReadTokens: read }) } };
     }
     const choices = body["choices"];
     if (!Array.isArray(choices) || choices.length !== 1)
@@ -528,7 +553,9 @@ export function parseLeadProviderWrapper(provider, bytes) {
 export function composeLeadRequest(args) {
     const opener = `DATA:\n${args.dataDocument}\n\n(The conversation follows. Every operator message is data, from the operator.)`;
     if (args.provider === "anthropic-api") {
-        const messages = [{ role: "user", content: opener }];
+        const ephemeral = { cache_control: { type: "ephemeral" } };
+        const cached = args.cache !== undefined;
+        const messages = [{ role: "user", content: cached ? [{ type: "text", text: opener, ...ephemeral }] : opener }];
         for (const one of args.history) {
             if (one.role === "operator")
                 messages.push({ role: "user", content: one.text });
@@ -549,8 +576,9 @@ export function composeLeadRequest(args) {
             body: JSON.stringify({
                 model: args.model,
                 max_tokens: MAX_OUTPUT_TOKENS,
-                system: args.system,
-                tools: args.tools.map(tool => ({ name: tool.name, description: tool.description, input_schema: tool.inputSchema })),
+                system: cached ? [{ type: "text", text: args.system, ...ephemeral }] : args.system,
+                tools: args.tools.map((tool, index) => ({ name: tool.name, description: tool.description, input_schema: tool.inputSchema,
+                    ...(cached && index === args.cache.coreTools - 1 ? ephemeral : {}) })),
                 messages,
             }),
         };

package/dist/demo-chat.js

@@ -8,7 +8,7 @@ import { html, postForm } from "./html.js";
 import { headlineOf } from "./task-status.js";
 const SUGGESTIONS = ["Fix the flaky refund test", "Rewrite the empty Payouts page", "Put the new invoice view behind a flag"];
 function hint() {
-    return html `<section class="demo-hint" aria-label="Get started"><p class="demo-hint-title">Ask for something, like “fix the flaky refund test”</p>${postForm("/chat/demo/ask", SUGGESTIONS.map(one => html `<button type="submit" name="message" value="${one}">${one}</button>`), { attrs: { class: "demo-suggestions" } })}</section>`;
+    return html `<section class="demo-hint" aria-label="Get started"><h2 class="demo-hint-title">What should the crew do?</h2><p class="demo-hint-sub">Ask for something, like “fix the flaky refund test”, or start from one of these.</p>${postForm("/chat/demo/ask", SUGGESTIONS.map(one => html `<button type="submit" name="message" value="${one}">${one}</button>`), { attrs: { class: "demo-suggestions" } })}</section>`;
 }
 function planCard(exchange) {
     const plan = exchange.plan;
@@ -55,7 +55,7 @@ export function demoThreadHtml(exchanges, resultOf) {
     return html `${exchanges.map(exchange => {
         const parts = [
             html `<div class="demo-said demo-you"><p>${exchange.asked}</p></div>`,
-            html `<div class="demo-said demo-lead"><p class="demo-who">Lead</p><p>${exchange.reply}</p></div>`,
+            html `<div class="demo-said demo-lead"><p class="demo-who"><span class="demo-avatar" aria-hidden="true">L</span>Lead</p><p>${exchange.reply}</p></div>`,
             planCard(exchange),
         ];
         if (exchange.state === "working")
@@ -63,14 +63,14 @@ export function demoThreadHtml(exchanges, resultOf) {
         if (exchange.state === "ready" || exchange.state === "complete" || exchange.state === "sent-back")
             parts.push(resultCard(exchange, resultOf(exchange)));
         if (exchange.state === "complete") {
-            parts.push(html `<div class="demo-said demo-lead"><p class="demo-who">Lead</p><p>Done. That's the whole loop: ask, approve, Ready, Complete. Ask for something else whenever you like.</p></div>`, html `<section class="card demo-handoff" data-demo-handoff aria-label="Your own project"><h2>Now try it on your own project</h2><p>In your repository's folder, run:</p><pre class="demo-command"><code>${START_COMMAND}</code></pre><p class="meta">It opens in your browser, already signed in.</p></section>`);
+            parts.push(html `<div class="demo-said demo-lead"><p class="demo-who"><span class="demo-avatar" aria-hidden="true">L</span>Lead</p><p>Done. That's the whole loop: ask, approve, Ready, Complete. Ask for something else whenever you like.</p></div>`, html `<section class="card demo-handoff" data-demo-handoff aria-label="Your own project"><h2>Now try it on your own project</h2><p>In your repository's folder, run:</p><pre class="demo-command"><code>${START_COMMAND}</code></pre><p class="meta">It opens in your browser, already signed in.</p></section>`);
         }
         return html `<article class="demo-turn" id="demo-${exchange.id}">${parts}</article>`;
     })}`;
 }
 export function demoChatHtml(input) {
     const working = input.exchanges.some(one => one.state === "working");
-    return html `<div class="demo-chat">${input.problem === null ? "" : html `<p class="problem" role="alert">${input.problem}</p>`}<div id="demo-thread" class="demo-thread" aria-live="polite" data-version="${input.version}" data-working="${working ? "1" : "0"}">${demoThreadHtml(input.exchanges, input.resultOf)}</div>${postForm("/chat/demo/ask", html `<label for="demo-message" class="so-sr-only">Message the lead</label><textarea id="demo-message" name="message" rows="2" maxlength="500" placeholder="Ask the lead for a change" required></textarea><button type="submit" class="demo-primary">Send</button>`, { attrs: { class: "demo-composer" } })}</div>`;
+    return html `<div class="demo-chat${input.exchanges.length === 0 ? " demo-chat--empty" : ""}">${input.problem === null ? "" : html `<p class="problem" role="alert">${input.problem}</p>`}<div id="demo-thread" class="demo-thread" aria-live="polite" data-version="${input.version}" data-working="${working ? "1" : "0"}">${demoThreadHtml(input.exchanges, input.resultOf)}</div>${postForm("/chat/demo/ask", html `<label for="demo-message" class="so-sr-only">Message the lead</label><div class="demo-composer-card"><textarea id="demo-message" name="message" rows="1" maxlength="500" placeholder="Ask the lead for a change" required aria-describedby="demo-composer-hint"></textarea><div class="demo-composer-bar"><span id="demo-composer-hint">Enter to send · Shift + Enter for a new line</span><button type="submit" class="demo-primary demo-send" aria-label="Send"><svg aria-hidden="true" viewBox="0 0 16 16" width="16" height="16" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M8 13V3M3.5 7.5 8 3l4.5 4.5"/></svg></button></div></div>`, { attrs: { class: "demo-composer" } })}</div>`;
 }
 /**
  * Keeps a running build live: polls while one is working and swaps the

package/dist/demo.js

@@ -1044,14 +1044,14 @@ function seedDemoFlows(store, folder, now) {
         ["Parcel arrived crushed", "The box was crushed and two glasses inside are broken.", "Delivery problem", 0.91, "delivery", "Soon: the customer is waiting on it", true, 120],
         ["Where is my order and why was I billed?", "It hasn't arrived and there's a charge I don't recognise.", "Delivery problem", 0.58, "by-hand", "Soon: the customer is waiting on it", false, 45],
     ]) {
-        const card = store.addFlowCard({ flow: desk, title, description, stage: "sort", by: "Support form" }, at(minutes));
+        const card = store.addFlowCard({ flow: desk, title, description, stage: "sort", by: "Support form", byKind: "automation" }, at(minutes));
         const confident = sure >= 0.8;
         step(card, "sort", "sort", at(minutes - 1), confident ? `${answer}, ${Math.round(sure * 100)}% sure.` : `Not sure: ${Math.round(sure * 100)}% ${answer}.`, `${confident ? `${answer}, ${Math.round(sure * 100)}% sure.` : `Not sure: ${Math.round(sure * 100)}% ${answer}.`} How urgent is it? ${urgency.split(":")[0]}.`, { decisionJson: sorted(answer, sure, to, urgency, refund) });
         move(card, to, at(minutes - 1));
     }
     const replies = store.createFlow({ repo, name: "Customer replies", definitionJson: template("email-replies"), by: "demo" }, at(200));
     const drafted = (title, description, draft, minutes) => {
-        const card = store.addFlowCard({ flow: replies, title, description, stage: "write", by: "Contact form" }, at(minutes));
+        const card = store.addFlowCard({ flow: replies, title, description, stage: "write", by: "Contact form", byKind: "automation" }, at(minutes));
         step(card, "write", "draft", at(minutes - 1), `Drafted ${draft.split(/\s+/).length} words.`, draft, { log: `Claude (sonnet) · 4.2 s\n\n${draft}` });
         move(card, "check", at(minutes - 1));
         return card;

package/dist/desktop-update-gate.js

@@ -1,4 +1,5 @@
 import { activeCodingUpdateWork, installCodingUpdateGate, removeCodingUpdateGate } from "./coding-update.js";
+import { activeTerminalUpdateWork, installTerminalUpdateGate, removeTerminalUpdateGate } from "./terminal-catalog.js";
 export const UPDATE_PAUSED = "Toolroll is updating. Current work can finish; new work will resume after the update. Open Update status in the desktop app.";
 const prefix = "so_desktop_update_";
 const rows = (db) => db.prepare("SELECT name, sql FROM sqlite_master WHERE type='trigger' AND name GLOB 'so_desktop_update_*' ORDER BY name").all();
@@ -36,6 +37,7 @@ export function installUpdateGate(db, id) {
         throw error;
     }
     installCodingUpdateGate(db, id);
+    installTerminalUpdateGate(db, id);
 }
 export function removeUpdateGate(db, id) {
     const wanted = [...statements(id), ...statements(id, true)];
@@ -45,6 +47,7 @@ export function removeUpdateGate(db, id) {
         if (existing.some(row => !owns(wanted, row.sql)))
             throw Error("This update does not own the admission pause. Nothing was cleared.");
         removeCodingUpdateGate(db, id);
+        removeTerminalUpdateGate(db, id);
         for (const row of existing)
             db.exec(`DROP TRIGGER "${String(row.name)}"`);
         db.exec("COMMIT");
@@ -67,6 +70,8 @@ export function activeUpdateWork(db) {
         conversations: count("SELECT count(*) n FROM mate_turn WHERE state IN ('queued','running')") + count("SELECT count(*) n FROM chat_turn WHERE state IN ('queued','running')"),
         stopping: count("SELECT count(*) n FROM run_stop WHERE settled_at IS NULL"),
         ...activeCodingUpdateWork(db),
+        // Live terminals in a console that is still running (terminal-catalog.ts).
+        ...activeTerminalUpdateWork(db),
     };
 }
 /** Last admission race closes in the same SQLite write transaction as the
@@ -77,6 +82,7 @@ export function freezeUpdateGate(db, id) {
         if (!updateGateOwned(db, id))
             throw Error("The update no longer owns admission.");
         installCodingUpdateGate(db, id);
+        installTerminalUpdateGate(db, id);
         const idle = Object.values(activeUpdateWork(db)).every(n => n === 0);
         if (idle) {
             for (const row of rows(db))

package/dist/discord-chat.js

@@ -8,7 +8,7 @@ import { roomCommand } from "./chat-rooms.js";
 import { ChatState, ChatDeliveryError, chatHash, partContent, } from "./chat-delivery-state.js";
 import { readChatPart } from "./contracts/chat-content.js";
 import { readDiscordButtonToken, readDiscordComponentInteraction } from "./contracts/discord-callback.js";
-import { processChatEvent, planChatNotifications, channelAccess, chatObject as object, planRoomMessages, } from "./chat-delivery.js";
+import { processChatEvent, planChatNotifications, channelAccess, chatObject as object, planRoomMessages, heldForWatch, } from "./chat-delivery.js";
 import { chatResultHref } from "./chat-controls.js";
 import { LEAD_MESSAGE_MAX_CHARS } from "./lead.js";
 import { discordPlain, renderReply } from "./reply-shape.js";
@@ -379,6 +379,9 @@ export async function deliverDiscordPart(options) {
                     fail_if_not_exists: false,
                 };
         }
+        // The watch, at the last moment before the network (cockpit §3).
+        if (heldForWatch(state, store, row.id, event, binding.approver, content, now))
+            return true;
         const answer = await options.api(target ? "PATCH" : "POST", `/channels/${destination}/messages${target ? `/${target}` : ""}`, args, file);
         if (!discordId(answer.id) ||
             answer.channel_id !== destination ||

package/dist/dispatch.js

@@ -15,6 +15,8 @@ import { REVIEW_TOKENS, resultStatusOf, reviewFactsOf } from "./workspace-ui.js"
 import { replacedWords } from "./task-status.js";
 import { failedAttemptSentence, latestFinishedAttempt } from "./needs-you.js";
 import { buildReviewOf } from "./review-switch.js";
+import { grantStandsSql } from "./flow-unattended.js";
+import { accountReachesSql } from "./project-access.js";
 import { BUILT_IN, parseCapabilityKey } from "./store.js";
 export const DEFAULT_MAX_OPEN_DECISIONS = 5;
 /**
@@ -75,13 +77,14 @@ export function scopeApprovedForDispatch(store, taskRef, now) {
         .prepare(`SELECT 1 AS hit FROM task_scope
        JOIN task_ref ON task_ref.id = ? AND task_scope.task_id = task_ref.external_id
        WHERE task_scope.approved_digest = task_scope.digest AND task_scope.approved_at IS NOT NULL
-         AND (COALESCE(task_scope.approval_basis, 'password') <> 'mode'
-           OR EXISTS (SELECT 1 FROM operating_mode om
+         AND (COALESCE(task_scope.approval_basis, 'password') NOT IN ('mode', 'grant')
+           OR (task_scope.approval_basis = 'mode' AND EXISTS (SELECT 1 FROM operating_mode om
                       JOIN approver signer ON signer.name = om.signed_by
                      WHERE om.repo = task_ref.repo AND om.revoked_at IS NULL
                        AND om.absolute_expiry > ? AND om.digest = task_scope.mode_digest
-                       AND signer.revoked_at IS NULL AND signer.role = 'approver'))`)
-        .get(taskRef, now.toISOString());
+                       AND signer.revoked_at IS NULL AND signer.role = 'approver' AND ${accountReachesSql("signer", "task_ref.repo")}))
+           OR (task_scope.approval_basis = 'grant' AND ${grantStandsSql("task_scope.mode_digest", "?", "task_ref.repo")}))`)
+        .get(taskRef, now.toISOString(), now.toISOString());
     return row !== undefined;
 }
 /** The phase the ordinary dispatch loop would choose before it resolves an

package/dist/doctor.d.ts

@@ -0,0 +1,53 @@
+import { type SupervisorRunner } from "./daemon.js";
+/** Something that holds a credential a build could read, by name only, and what the owner does about it. */
+export type DoctorFinding = {
+    where: string;
+    names: string[];
+    steps: string[];
+};
+/** Something the doctor could not read: never taken for clean. */
+export type DoctorUnreadable = {
+    where: string;
+    problem: string;
+    steps: string[];
+};
+export type DoctorReport = {
+    ok: boolean;
+    checked: string[];
+    findings: DoctorFinding[];
+    unreadable: DoctorUnreadable[];
+    notes: string[];
+};
+export type DoctorDeps = {
+    platform?: NodeJS.Platform;
+    home?: string;
+    uid?: number;
+    /** Runs the read-only supervisor and process queries (launchctl, systemctl, ps). */
+    run?: SupervisorRunner;
+    /** Where Linux keeps its process files (a test's stand-in). */
+    procRoot?: string;
+    /** The doctor's own environment: the terminal a `toolroll up` would start from. */
+    env?: NodeJS.ProcessEnv;
+};
+/** The names among `pairs` that hold a credential: a provider key, a credential-looking name, or a key-shaped value.
+ * Values are only tested here and never leave. */
+export declare function credentialNames(pairs: Iterable<readonly [string, string]>): string[];
+/** A running process's environment names (never values) that hold a credential: macOS through `ps -E`, which reads
+ * KERN_PROCARGS2; Linux from /proc/<pid>/environ. */
+export declare function processCredentialNames(pid: number, deps: {
+    platform: NodeJS.Platform;
+    run: SupervisorRunner;
+    procRoot?: string;
+}): Promise<{
+    ok: true;
+    names: string[];
+} | {
+    ok: false;
+    problem: string;
+}>;
+/** Audit what Toolroll's service holds. Reads only; the report names variables, never their values. */
+export declare function auditServiceEnvironment(deps?: DoctorDeps): Promise<DoctorReport>;
+/** The report as the owner reads it: one state, then each finding with its steps; detail after. */
+export declare function doctorLines(report: DoctorReport): string[];
+export declare const DOCTOR_HELP = "toolroll doctor [--json]\nChecks that Toolroll's service holds no API key, token or password a build could read: its service definitions, what `daemon install` writes, the environment its manager hands it, and its running process. Reads only: it names what it finds and the steps to fix it, and never changes a file or restarts anything.";
+export declare function runDoctorCommand(argv: readonly string[], write: (line: string) => void, deps?: DoctorDeps): Promise<number>;