toolroll 0.9.62 → 0.9.65

package/dist/serve.js

@@ -1,6 +1,16 @@
+import { taskMovedSince } from "./chat-ask.js";
+import { LIVE_VIEW_CONSENT, liveCommandsShown, liveViewConsentDigest } from "./live-detail.js";
 import { html, htmlString, jsonScript, textHtml } from "./html.js";
 import { browserAssetsAvailable, browserWorkspaceDocument } from './browser-shell.js';
-import { browserCrewFromIndex, browserCrewOf, browserNavigationOf, browserProjectsOf, needsYouLabelOf } from './browser-workspace.js';
+import { NO_COUNTS, projectStates, STATE_WORDS } from './agent-state.js';
+import { usageChipOf } from './limits-ui.js';
+/** Tasks the rail lists under a project; the rest are a count that links to the project's tasks. */
+const RAIL_TASKS = 6;
+/** Any header a proxy adds: a request carrying one is never "from this computer" (password freshness, one-time links). */
+const PROXY_HEADER = /^(forwarded|via|x-forwarded-.+|x-real-ip|x-client-ip|x-original-.+|x-cluster-client-ip|true-client-ip|cf-connecting-ip|fastly-client-ip|x-proxyuser-ip)$/i;
+/** Asks a project names for the chime (its count is complete beyond them). */
+const ASKS_PER_PROJECT = 100;
+import { boundProjectSummary, browserCrewFromIndex, browserCrewOf, browserNavigationOf, browserProjectsOf, needsYouLabelOf } from './browser-workspace.js';
 import { sharedActionPayload } from './chat-actions.js';
 import { prepareCodingContext } from './coding-context.js';
 import { CodingWorkspace } from './coding-workspace.js';
@@ -14,7 +24,7 @@ import { startMaintenance } from './maintenance.js';
 import { connectionsOf, localConnectOf, oneClickOf } from "./mcp-connect.js";
 import { MOBILE_VIEWPORT_SCRIPT } from "./mobile-viewport.js";
 import { projectAuthority } from "./project-access.js";
-import { discoverTools, projectToolsOf, secretsSetFor, TOOL_CATALOG, toolStanding } from "./project-tools.js";
+import { discoverTools, projectToolsOf, secretsSetFor, TOOL_CATALOG, toolSecretStorage, toolStanding } from "./project-tools.js";
 import { toolRefusal } from "./policy.js";
 import { isEdgeAddress, refuseEdge } from "./server/edge-refusal.js";
 import { announcePasswordBearer, isPasswordBearer, PASSWORD_BEARER_REFUSED, passwordBearerAccepted } from "./password-bearer.js";
@@ -28,8 +38,9 @@ import { createTaskViews } from "./server/task-views.js";
 import { runActivityOf } from "./task-activity.js";
 import { createTaskRooms, taskFingerprint } from "./task-live.js";
 import { createTeamRuntime } from './team-runtime.js';
+import { createPersonalQueueRuntime } from './lead-queue-runtime.js';
 import {} from "./tools-ui.js";
-import { workCountsByProject } from "./work-index.js";
+import { WORK_INDEX_MAX_LIMIT, workCountsByProject, workIndexPage } from "./work-index.js";
 import { WORKSPACE_MOTION_SCRIPT } from "./workspace-motion.js";
 import { prepareWorkspaceRevision, WorkspaceValidatorCache } from "./workspace-revision.js";
 /**
@@ -111,10 +122,13 @@ import { limitWords, FLUSH_MS as REQUEST_BUDGET_FLUSH_MS, RequestBudget, SOURCE_
 import { REQUEST_TOKEN, RESULT_REVIEW_SCRIPT } from "./result-review.js";
 import { buildReviewOf } from "./review-switch.js";
 import { isAlive as runnerAlive } from "./runner.js";
-import { freshIdentitySignIn } from "./scope.js";
+import { FRESH_WINDOW_MS, freshFacts, ssoNowAvailable } from "./scope.js";
 import { instrumentRequest } from "./server-telemetry.js";
 import { createChatHandlers } from './server/chat.js';
 import { createLiveHandlers } from './server/live.js';
+import { createTerminalHandlers, terminalHostFor } from './server/terminals.js';
+import { passwordlessOn } from './passwordless.js';
+import { createSweepHandlers } from './server/sweeps.js';
 import { createFlowsHandlers } from './server/flows.js';
 import { createPagesHandlers } from './server/pages.js';
 import { createPeopleHandlers } from './server/people-tokens.js';
@@ -122,10 +136,10 @@ import { createSettingsHandlers } from './server/settings.js';
 import { requestContext } from "./server/request-context.js";
 import { chromeScript, DEMO_BANNER, DEMO_BANNER_SHORT, focusDocument, KBD_HELP, pinnedTheme, QUEUE_VIEW, refuse, screen, SENSITIVE_INPUT, shell, sidebarScript } from "./server/chrome.js";
 import { BODY_CAP, form, loginHref, matchTaskPath, page, projectChatHref, redactedPath, redirect, respond, safeReturn, SHUTDOWN_WAIT_MS, taskChatHref } from "./server/http.js";
-import { decisionsFor, LEAD_BY_DEFAULT_FACT, leadBrowserMessages, leadChatVersion, teamProposalCardParts } from "./server/render-chat.js";
+import { decisionsFor, LEAD_BY_DEFAULT_FACT, leadBrowserMessages, leadChatVersion, TASK_COMPOSER_MODES, teamProposalCardParts } from "./server/render-chat.js";
 import {} from "./server/render-pages.js";
 import { ssoStepUps, wrongHostPage } from "./server/render-people.js";
-import { NO_PROJECT, NO_TOUCH_FRAGMENTS, NONCE_CAP, NONCE_TTL_MS, PersistentSessions, SESSION_ABSOLUTE_MS, SESSION_IDLE_MS, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH } from "./server/session.js";
+import { NO_PROJECT, NO_TOUCH_FRAGMENTS, NONCE_CAP, NONCE_TTL_MS, PersistentSessions, SESSION_ABSOLUTE_MS, SESSION_IDLE_MS, sessionWithinLifetime, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH } from "./server/session.js";
 import { createTasksHandlers } from './server/tasks.js';
 import { DEFAULT_GUARD_POLICY, passwordGuardOf, provenPasswordAccount, SourceBudget, withPasswordSource } from "./sign-in-guard.js";
 import { sourceKey } from "./source-key.js";
@@ -156,7 +170,7 @@ export function createDecisionServer(options) {
         get dockedConversation() { return dockedConversation; },
         get liveRefreshSeconds() { return liveRefreshSeconds; },
     });
-    const { authenticateApprover, authorizeMutation, projectOf, resolveRouteProject, projectRequestAllowed, identify, lookupSession, restricted, visible, admissionList, codingActorAllowed, codingProjectAllowed, workAccess, familyOf, taskRepoOf, runVisible } = createSharedGuards({
+    const { authenticateApprover, authenticateCredential, authorizeMutation, projectOf, resolveRouteProject, projectRequestAllowed, identify, lookupSession, restricted, visible, admissionList, codingActorAllowed, codingProjectAllowed, workAccess, familyOf, taskRepoOf, runVisible } = createSharedGuards({
         get store() { return store; },
         get liveCeiling() { return liveCeiling; },
         get codingProjects() { return codingProjects; },
@@ -186,6 +200,8 @@ export function createDecisionServer(options) {
             }
         }
     }
+    // Live terminals (docs/plans/live-terminal.md): on a machine that runs agents, when this install has a pty library.
+    const terminals = terminalHostFor(store, options);
     const clock = options.clock ?? (() => new Date());
     // Heavy reads (the work index behind `task list`) run on read-only worker connections, off the request loop.
     const readFile = store.isDemo() ? null : store.databaseFile();
@@ -286,13 +302,14 @@ export function createDecisionServer(options) {
     /** That source as every per-source budget counts it: a native IPv6 caller by its /64 (source-key.ts). */
     function joinSourceOf(request) { return sourceKey(forwardedSourceOf(request)); }
     const signInBudget = new SourceBudget();
+    // A re-check or a link is the session that started it: its kept hash and credential generation ride the visit and the
+    // hand-off, and finish refuses any other session (a sign-out and a new sign-in in between never inherit it).
     const ssoVisits = new Map();
     const ssoHandoffs = new Map();
     let ssoProvider = null;
     const ssoSettings = () => readSsoSettings(options.configDir);
     const ssoOffer = () => { const settings = ssoSettings(); return settings === null ? null : { label: settings.label, operatorsOnly: settings.passwords === "operators" }; };
     /** A step-up within this long of the provider checking someone needs no password. */
-    const SSO_FRESH_MS = 10 * 60_000;
     // The one-time sign-in link `up` opens in the browser: single use, ten minutes, from this computer only. Only a hash
     // of the code is kept, in memory; the code itself is never written to a log or the ledger.
     const signInLinks = new Map();
@@ -310,13 +327,50 @@ export function createDecisionServer(options) {
         signInLinks.set(linkKey(code), { account, expires: Date.now() + SIGN_IN_LINK_MS });
         return `${SIGN_IN_LINK_PATH}${code}`;
     }
-    /** This computer, and nothing in front of it: a loopback peer that names a loopback address, with no forwarding proxy. */
+    /** This computer, and nothing in front of it: a loopback peer that names a loopback address, with no sign of a proxy —
+     * any forwarding header at all (Forwarded, X-Forwarded-*, X-Real-IP, Via, …) disqualifies the request. */
     const fromThisComputer = (request) => {
         const peer = request.socket.remoteAddress ?? "";
-        const loopback = LOOPBACK_PEERS.has(peer);
-        return loopback && request.headers["x-forwarded-for"] === undefined && request.headers["forwarded"] === undefined
-            && /^(localhost|127\.0\.0\.1|\[::1\]):[0-9]{1,5}$/.test(request.headers.host ?? "");
+        if (!LOOPBACK_PEERS.has(peer))
+            return false;
+        for (const name of Object.keys(request.headers))
+            if (PROXY_HEADER.test(name))
+                return false;
+        return /^(localhost|127\.0\.0\.1|\[::1\]):[0-9]{1,5}$/.test(request.headers.host ?? "");
     };
+    /**
+     * Cockpit B2: a request's password-freshness facts — the one place they are made (scope.ts honours them). Every
+     * reader looks at the session as it is at the moment of the act, never a snapshot taken before the body arrived:
+     * still signed in here, under the account's current credential generation, after any Forget.
+     */
+    function freshFactsOf(request, who, allowlisted = false) {
+        if (who?.via !== 'cookie')
+            return null;
+        const session = who.session, local = fromThisComputer(request);
+        // The same validity lookupSession applies, read again at the act: held here, within its idle and absolute
+        // lifetimes, under the account's current credential generation, not revoked.
+        const live = () => {
+            const now = Date.now(), account = store.accountOf(who.name);
+            return sessions.holds(session) && sessions.savedNow(session) && sessionWithinLifetime(session, now)
+                && account !== null && account.revokedAt === null && account.generation === session.generation;
+        };
+        return { actor: who.name, local, allowlisted, live,
+            passwordAt: () => session.passwordAt ?? null, ssoReauthAt: () => session.ssoReauthAt ?? null,
+            ssoNow: () => session.ssoNowAt ?? null,
+            consumeSsoNow: () => {
+                const was = session.ssoNowAt;
+                delete session.ssoNowAt;
+                // A refund puts back only what this spend took, once, and only if nothing newer arrived (Forget still floors it).
+                let refunded = false;
+                return () => { if (refunded)
+                    return; refunded = true; if (was !== undefined && session.ssoNowAt === undefined)
+                    session.ssoNowAt = was; };
+            },
+            floor: () => session.freshFloor ?? 0,
+            // Only a direct local request may start a password window (a typed password elsewhere proves now, nothing more).
+            stamp: at => { if (local && live())
+                session.passwordAt = at; } };
+    }
     async function providerFor(issuer) {
         if (ssoProvider !== null && ssoProvider.issuer === issuer && Date.now() - ssoProvider.at < 10 * 60_000)
             return { ok: true, provider: ssoProvider.provider };
@@ -392,6 +446,13 @@ export function createDecisionServer(options) {
         canDelete: who.via === "cookie" && store.isInstanceOperator(who.name),
         builds: projectBuildsOf(repo, who),
         access: projectAccessOf(repo),
+        network: { setting: store.projectNetwork(repo), canChange: who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo) },
+        liveView: (() => {
+            const commands = liveCommandsShown(store, repo);
+            const canChange = who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo);
+            // Showing commands is consent to one exact change: a single-use nonce for this person, project and terms.
+            return { commands, canChange, ...(canChange && !commands ? { nonce: mintApprovalNonce(who.name, LIVE_VIEW_CONSENT, liveViewConsentDigest(repo)) } : {}) };
+        })(),
     });
     /** Settings → Project → Build access: the project's named tools and whether each loads for its builds. */
     const projectAccessOf = (repo) => {
@@ -434,17 +495,25 @@ export function createDecisionServer(options) {
         }
     };
     /** One project's Tools page: its tools with which secrets are set (never values), the common tools not yet added, and what this computer already has. */
-    const toolHome = options.toolHome ?? homedir();
+    // A test's own folder for tool secrets and found tools; Toolroll's own (beside its database, and this home) otherwise.
+    const toolHome = options.toolHome;
     const toolsViewOf = (repo, codex, kit = null, wanted = null) => {
         const tools = projectToolsOf(store, repo);
         const names = new Set(tools.map(one => one.name));
         return {
             repo, project: repo.split(/[\\/]/).filter(Boolean).at(-1) ?? repo,
-            tools: tools.map(tool => ({ tool, secretsSet: secretsSetFor(repo, tool.spec, toolHome) })),
+            // Secrets that can't be read (a refused folder, a locked keychain) read as none set: the page says why once (storage).
+            tools: tools.map(tool => { let secretsSet = []; try {
+                secretsSet = secretsSetFor(repo, tool.spec, toolHome);
+            }
+            catch {
+                secretsSet = [];
+            } return { tool, secretsSet }; }),
             // A service that connects by signing in (or an app's own Connect) is offered only that way.
             catalog: TOOL_CATALOG.filter(one => !names.has(one.name) && oneClickOf(one.name) === null && localConnectOf(one.name) === null),
             connections: connectionsOf(store, repo, toolHome), kit, wanted,
             found: discoverTools(repo, codex, toolHome).filter(one => !names.has(one.spec.name)),
+            storage: toolSecretStorage(),
         };
     };
     const codingProjects = () => [...new Set([...managedRepos(), ...store.listProjects().map(project => project.path)])].filter(repo => rowVisible(liveCeiling(), repo));
@@ -466,6 +535,32 @@ export function createDecisionServer(options) {
         provider: teamChatProvider,
         ...(options.subscriptionChatRunner ? { subscriptionRunner: options.subscriptionChatRunner } : {}),
     });
+    // The personal lead queue (docs/plans/lead-message-queue.md). Projects and a message's task are re-proved AS the
+    // person (never from a live request's context), and its live reply display is the console's own (chat handlers below,
+    // reached only once the server is listening).
+    const asActor = (account, work) => requestContext.run({ csrf: "", returnTo: "/", actor: account }, work);
+    const admittedReposFor = (account) => asActor(account, () => managedRepos());
+    const personalQueue = createPersonalQueueRuntime({
+        store, evidenceRoot, clock, provider: teamChatProvider, admittedReposFor,
+        contextStands: (account, context) => asActor(account, () => {
+            const admitted = managedRepos();
+            if (context.project !== undefined && !admitted.includes(context.project))
+                return false;
+            if (context.task === undefined)
+                return true;
+            const family = store.taskFamilyOf(context.task, admitted, false);
+            if (family === null)
+                return false;
+            if (context.result === undefined)
+                return true;
+            const run = store.getRun(context.result);
+            return run !== null && family.versions.some(one => one.refId === run.taskRef);
+        }),
+        names: { project: projectName, modes: TASK_COMPOSER_MODES },
+        live: { begin: thread => chatHandlers.beginLiveTurn(thread), end: (thread, ok, progress) => chatHandlers.endLiveTurn(thread, ok, progress) },
+        ...(options.chatFetcher ? { fetcher: options.chatFetcher } : {}),
+        ...(options.subscriptionChatRunner ? { subscriptionRunner: options.subscriptionChatRunner } : {}),
+    });
     // Only browser sessions receive HTML cards. The CLI keeps its summary contract.
     const teamBrowserReply = (reply, actor, csrf) => {
         const snapshot = reply.snapshot;
@@ -668,7 +763,7 @@ export function createDecisionServer(options) {
         // Passive polls authenticate without extending the browser session.
         const fragmentName = url.searchParams.get("fragment");
         const workspaceRead = method === "GET" && url.searchParams.get('format') === 'workspace';
-        const touch = !(method === "GET" && (edgeRoute?.domain === 'live' || workspaceRead || (fragmentName !== null && NO_TOUCH_FRAGMENTS.has(fragmentName)) || /^\/code\/[a-f0-9]{32}\/state$/.test(url.pathname)));
+        const touch = !(method === "GET" && (edgeRoute?.domain === 'live' || workspaceRead || (fragmentName !== null && NO_TOUCH_FRAGMENTS.has(fragmentName)) || /^\/code\/[a-f0-9]{32}\/state$/.test(url.pathname) || url.pathname === '/term/state'));
         const refuseBudget = (admitted) => {
             if (admitted.ok)
                 return false;
@@ -694,8 +789,9 @@ export function createDecisionServer(options) {
         if (who?.via === "bearer" && refuseBudget(admitBearer(request, who)))
             return;
         const passwordProof = who?.via === 'cookie' ? { name: who.name, generation: who.session.generation } : null;
+        const fresh = freshFactsOf(request, who, matchedRoute?.freshness === 'allowlist');
         if (edgeRoute?.domain === 'people')
-            return provenPasswordAccount.run(passwordProof, () => dispatchEdge(edgeRoute, { url, who, request, response, method }));
+            return freshFacts.run(fresh, () => provenPasswordAccount.run(passwordProof, () => dispatchEdge(edgeRoute, { url, who, request, response, method })));
         if (who === null) {
             // A password on a request that did not sign in is a machine's refusal, never a login page.
             if (isPasswordBearer(request.headers.authorization))
@@ -717,15 +813,18 @@ export function createDecisionServer(options) {
             appOrigins: [consoleOrigin(request.headers.host), publicOrigin?.origin ?? null, options.configDir === undefined ? null : loadConsoleUrl(process.env, options.configDir)],
             // Every signed-in page shares the workspace shell; pages showing a one-time secret opt out (forceSensitive).
             browser: who.via === 'cookie',
+            // Passwordless (read once for rendering; every act proves it again at the act): ceremony fields render as nothing.
+            passwordless: who.via === 'cookie' && passwordlessOn(store),
             // v100: signed in with the identity provider: its label, and whether it checked them recently enough to stand in for a password.
-            sso: who.via === 'cookie' && who.session.sso !== undefined ? { label: ssoSettings()?.label ?? "your identity provider", fresh: Date.now() - who.session.sso.at < SSO_FRESH_MS } : undefined,
+            // Cockpit B2: "fresh" is an explicit re-check made on request and not yet spent (read live; one step-up uses it).
+            sso: who.via === 'cookie' && who.session.sso !== undefined ? { label: ssoSettings()?.label ?? "your identity provider",
+                get fresh() { return freshFacts.getStore() != null && ssoNowAvailable(who.name); } } : undefined,
             refusal: (answer, status, body) => sendScreen(answer, status, screen(status === 404 ? "Not found" : "Request refused", body, { chrome: chromeFor(who.via === "cookie" ? who.session.project : null, "work") })),
             workspaceRead,
             workspaceRequest: url.searchParams.get('request'),
         };
-        // An empty password stands for a fresh identity-provider sign-in, for this person only (v100).
         if (method === "GET" || method === "POST")
-            return freshIdentitySignIn.run({ actor: requestFacts.sso?.fresh === true ? who.name : null }, () => provenPasswordAccount.run(passwordProof, () => requestContext.run(requestFacts, async () => {
+            return freshFacts.run(fresh, () => provenPasswordAccount.run(passwordProof, () => requestContext.run(requestFacts, async () => {
                 if (edgeRoute?.domain === 'live')
                     return dispatchEdge(edgeRoute, { url, who, request, response, method });
                 const body = method === "POST" ? await form(request, (matchedRoute?.stage === "console" ? matchedRoute.bodyCap : undefined) ?? BODY_CAP) : null;
@@ -847,7 +946,7 @@ export function createDecisionServer(options) {
             const ref = run === null ? null : store.refForId(run.taskRef);
             return { repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId, action: `${resource[1] === "d" ? "decision" : resource[1] === "i" ? "incident" : "run"} ${resource[3] ?? "view"}` };
         }
-        const known = new Set(["/recipes/prepare", "/recipes/preview", "/recipes/import", "/recipes/save", "/recipes/launch", "/tasks/add", "/queue/move", "/queue/note", "/people/invite", "/people/invite-revoke", "/people/revoke", "/people/projects", "/projects/select", "/projects/open", "/mode/confirm", "/mode/sign", "/mode/revoke", "/settings/chat-approval/save", "/settings/chat-approval/off"]);
+        const known = new Set(["/recipes/prepare", "/recipes/preview", "/recipes/import", "/recipes/save", "/recipes/launch", "/tasks/add", "/queue/move", "/queue/note", "/people/invite", "/people/invite-revoke", "/people/revoke", "/people/projects", "/projects/select", "/projects/open", "/mode/confirm", "/mode/sign", "/mode/revoke", "/settings/chat-approval/save", "/settings/chat-approval/off", "/settings/project/live-view"]);
         const placed = url.pathname === "/tasks/add" ? body?.get("repo")?.trim() : null;
         return { repo: url.pathname.startsWith("/people/") ? null : placed ? canonicalProject(placed) ?? placed : projectOf(who, request) ?? null, taskId: null, runId: null,
             action: known.has(url.pathname) ? url.pathname.slice(1).replaceAll("/", " ") : "console request" };
@@ -1036,9 +1135,15 @@ export function createDecisionServer(options) {
         const messages = store.listLeadMessages(opened.thread.id, 40);
         // The lead's question with buttons, while its reply is the last word in the thread.
         const last = messages.at(-1);
-        const ask = last?.role === "assistant" && last.turn !== null && store.getLeadTurn(last.turn)?.approver === who.name ? store.leadAskOpen(last.turn, now) : null;
+        const asking = last?.role === "assistant" && last.turn !== null && store.getLeadTurn(last.turn)?.approver === who.name ? store.leadAskOpen(last.turn, now) : null;
+        // A question about this task loses its buttons once the version shown moved after it was asked (its plan
+        // rewritten or approved, a new attempt started): its options answered a state that is gone. Its words stay, marked so.
+        const staleAsk = asking !== null && focusTask !== null && taskMovedSince(store, focusTask.executionId, asking.createdAt) ? asking.turn : null;
+        const ask = staleAsk === null ? asking : null;
         // Answered questions stay readable above the answer; only their buttons go.
         const asks = new Map(messages.flatMap(one => { const asked = one.role === "assistant" && one.turn !== null ? store.leadAsk(one.turn) : null; return asked === null ? [] : [[asked.turn, asked]]; }));
+        // The person's queued messages in this thread: each shows waiting (with Remove) or why it was not sent.
+        const queue = new Map(personalQueue.queue.forThread(opened.thread.id).map(row => [row.message, row]));
         // The thread a ceiling change replaced (ruling 9): read after the open, display only.
         const replaced = store.replacedLeadThread(opened.thread);
         const previousProposals = replaced === null ? [] : store.listLeadProposals(replaced.id);
@@ -1046,7 +1151,9 @@ export function createDecisionServer(options) {
             previous: replaced === null ? null : { messages: store.listLeadMessages(replaced.id, 40), proposals: previousProposals, decisions: decisionsFor(store, previousProposals) },
             messages,
             ask,
+            staleAsk,
             asks,
+            queue,
             proposals,
             decisions: decisionsFor(store, [...proposals, ...coordinatorProposals]),
             coordinatorProposals,
@@ -1262,6 +1369,12 @@ export function createDecisionServer(options) {
      * are what sensitivity strips.
      */
     function sendScreen(response, status, s) {
+        // Sensitivity is the page as authored (cockpit §2, R14): its own explicit word, else a password field it was written
+        // with — judged before an identity-provider sign-in replaces that field, so an SSO step-up page stays sensitive.
+        const authored = s.sensitive ?? (s.forceSensitive === true ||
+            SENSITIVE_INPUT.test(htmlString(s.body)) ||
+            (s.workspace?.pageHtml != null && SENSITIVE_INPUT.test(htmlString(s.workspace.pageHtml))) ||
+            (s.chrome?.listPane !== undefined && SENSITIVE_INPUT.test(htmlString(s.chrome.listPane))));
         // v100: signed in with the identity provider, a step-up's password field is that sign-in instead.
         const ssoFacts = requestContext.getStore()?.sso;
         if (ssoFacts !== undefined) {
@@ -1271,9 +1384,7 @@ export function createDecisionServer(options) {
                 s = { ...s, workspace: { ...s.workspace, view: { ...s.workspace.view, stepUp: { label: ssoFacts.label, fresh: ssoFacts.fresh, confirmHref: `/login/sso?reauth=1&return=${encodeURIComponent(back)}` } } } };
         }
         // D5: team chat (the central team service) is deprecated; /chat?team=1 still opens this release, but nothing links to it.
-        const sensitive = s.forceSensitive === true ||
-            SENSITIVE_INPUT.test(htmlString(s.body)) ||
-            (s.chrome?.listPane !== undefined && SENSITIVE_INPUT.test(htmlString(s.chrome.listPane)));
+        const sensitive = authored || s.forceSensitive === true;
         const requestFacts = requestContext.getStore();
         if (requestFacts?.browser && s.chrome && !s.forceSensitive && (requestFacts.workspaceRead || browserAssetsAvailable())) {
             const path = new URL(requestFacts.returnTo, 'http://standing-orders.local');
@@ -1344,11 +1455,44 @@ export function createDecisionServer(options) {
             const request = requestFacts.workspaceRequest;
             const workspace = {
                 version: 1, path: currentPath, title: s.title, user: requestFacts.actor ?? '', csrf: requestFacts.csrf, sensitive,
+                ...(requestFacts.passwordless === true ? { passwordless: true } : {}),
                 ...(requestFacts.actor ? { leadName: leadNameOf(store, requestFacts.actor) } : {}),
                 refreshUrl: path.pathname + path.search,
                 receipt: conversation !== null && request && REQUEST_TOKEN.test(request)
-                    ? { request, received: store.leadRequestReceipt(conversation.sessionId, request) !== null } : null,
+                    ? { request, received: store.leadRequestReceived(conversation.sessionId, request) } : null,
                 projects: browserProjectsOf(s.chrome.projects ?? []), ...crew,
+                // The sidebar's project states: never on a sensitive page (no rail, no summary stream there).
+                ...(() => { if (sensitive)
+                    return {}; try {
+                    return { projectStates: projectSummary() };
+                }
+                catch {
+                    return {};
+                } })(),
+                // Cockpit B2: the remembered password's chip, only where it could be used (a direct local request).
+                ...(() => {
+                    const facts = freshFacts.getStore();
+                    if (sensitive || facts == null || !facts.local || !facts.live())
+                        return {};
+                    const at = facts.passwordAt();
+                    if (at === null || at <= facts.floor())
+                        return {};
+                    const left = FRESH_WINDOW_MS - (Date.now() - at);
+                    return left <= 0 ? {} : { fresh: { minutes: Math.max(1, Math.ceil(left / 60_000)), forget: '/session/forget-password' } };
+                })(),
+                // The usage chip: the Limits view's own audience (an operator on a browser session), never a sensitive page.
+                ...(() => {
+                    const actor = requestFacts.actor;
+                    if (sensitive || !actor || requestFacts.csrf === '' || !store.isInstanceOperator(actor))
+                        return {};
+                    try {
+                        const usage = usageChipOf(store.providerLimits(), clock());
+                        return usage === null ? {} : { usage };
+                    }
+                    catch {
+                        return {};
+                    }
+                })(),
                 conversation, ...(extras.team ? { team: extras.team } : {}), focus: extras.focus ?? null, result: extras.result ?? null,
                 catchUpHtml: extras.catchUpHtml === undefined ? '' : htmlString(extras.catchUpHtml), controlsHtml: extras.controlsHtml === undefined ? '' : htmlString(extras.controlsHtml), notices, view: extras.view ?? null,
                 ...(s.chrome.demo ? { demo: { text: DEMO_BANNER, short: DEMO_BANNER_SHORT } } : {}),
@@ -1413,6 +1557,77 @@ export function createDecisionServer(options) {
     const bustBadge = () => {
         paletteCache.clear();
     };
+    /** Enrolled projects first (most recently opened), then the repos this server was told to serve that nobody has
+     * opened yet — the switcher lists every project it is allowed to show, each exactly once. */
+    function sidebarProjects() {
+        const seen = new Set();
+        const rows = [];
+        for (const one of [
+            ...store.listProjects().map(one => ({ path: one.path, name: one.name })),
+            ...managedRepos().map(path => ({ path, name: projectName(path) })),
+        ]) {
+            if (seen.has(one.path) || !visible(one.path) || goneRepos().has(one.path))
+                continue;
+            seen.add(one.path);
+            rows.push(one);
+        }
+        return rows;
+    }
+    /** The sidebar's projects with their states (agent-state.ts), for the request's own reader: the page's first read
+     * and the summary room's snapshots are this one function, so the two never disagree. Never marks anything seen.
+     * Work with no project yet is its own entry when this reader may see it and something counts there. */
+    function projectSummary() {
+        const projects = sidebarProjects();
+        const actor = requestContext.getStore()?.actor ?? '';
+        const states = new Map(projectStates(store, workAccess(), actor, clock(), evidenceRoot, projects.map(one => one.path)).map(one => [one.repo, one]));
+        // A row that needs a person or failed says what the Tasks list says it needs (its own next step); a row at work says
+        // what its agent did last; a finished one says Done.
+        const asking = [...states.values()].flatMap(one => one.families.slice(0, RAIL_TASKS)).filter(one => one.state === 'needs-you' || one.state === 'failed').map(one => one.rootId);
+        const needWords = new Map();
+        if (asking.length > 0) {
+            try {
+                // Every row the rail may list, in pages the index allows.
+                for (let at = 0; at < asking.length; at += WORK_INDEX_MAX_LIMIT)
+                    for (const item of workIndexPage(store, clock(), workAccess(), { roots: asking.slice(at, at + WORK_INDEX_MAX_LIMIT), limit: WORK_INDEX_MAX_LIMIT, root: evidenceRoot }).items)
+                        needWords.set(item.rootId, item.status.detail !== '' ? item.status.detail : item.status.label);
+            }
+            catch { /* the rows keep their state's words */ }
+        }
+        // The chime's subjects: an opaque key per obligation and version, scoped to this reader (no words, no ids in it).
+        const keyOf = (...parts) => createHash('sha256').update([actor, ...parts].join('\u0000')).digest('base64url').slice(0, 22);
+        // Newest first, so a new ask always has a key however many older ones wait (those were heard when they were new).
+        const asksOf = (state) => [
+            ...(state?.families ?? []).flatMap(one => one.ask === undefined ? [] : [{ at: one.ask.at, ask: { key: keyOf('task', one.rootId, one.ask.version), task: one.rootId, run: one.ask.run, at: one.ask.at } }]),
+            ...(state?.flowAsks ?? []).map(one => ({ at: one.at, ask: { key: keyOf('flow', one.card, one.stage, one.entry), task: null, run: null, at: one.at } })),
+        ].sort((a, b) => b.at.localeCompare(a.at)).slice(0, ASKS_PER_PROJECT).map(one => one.ask);
+        const railOf = (state) => {
+            const families = state?.families ?? [];
+            const tasks = families.slice(0, RAIL_TASKS).flatMap((one) => {
+                const task = store.getTask(one.rootId);
+                const line = one.state === 'needs-you' || one.state === 'failed' ? needWords.get(one.rootId) ?? null : one.line;
+                return task === null ? [] : [{ id: one.rootId, title: task.title, href: `/t/${encodeURIComponent(one.rootId)}`, state: one.state, line: line ?? STATE_WORDS[one.state] }];
+            });
+            return { tasks, more: Math.max(0, families.length - RAIL_TASKS), asks: asksOf(state) };
+        };
+        const rows = projects.map(one => {
+            const state = states.get(one.path);
+            return { path: one.path, name: one.name, href: `/work?project=${encodeURIComponent(one.path)}`, state: state?.state ?? 'idle', counts: state?.counts ?? { ...NO_COUNTS }, ...railOf(state) };
+        });
+        const unplaced = states.get(null);
+        if (unplaced !== undefined && unplaced.state !== 'idle')
+            rows.push({ path: null, name: 'No project', href: '/work', state: unplaced.state, counts: unplaced.counts, ...railOf(unplaced) });
+        return boundProjectSummary(rows);
+    }
+    /** What one account may see now, as the summary room keys it: a narrowed ceiling or grant is a different key, so a
+     * snapshot read for the wider scope never reaches it. Null: no such account. */
+    const projectScopeFor = (account) => store.accountOf(account) === null ? null : requestContext.run({ csrf: '', returnTo: '/', actor: account }, () => {
+        // Canonical: what may be seen, never the order it was last opened in.
+        const access = workAccess();
+        return JSON.stringify({ projects: sidebarProjects().map(one => one.path).sort(), access: { ...access, repos: access.repos === null ? null : [...access.repos].sort() } });
+    });
+    /** One account's summary snapshot, read as that account for this exact scope (the summary room's fingerprint): null
+     * when the account is gone or its scope moved. */
+    const projectSummaryFor = (account, scope) => projectScopeFor(account) !== scope ? null : requestContext.run({ csrf: '', returnTo: '/', actor: account }, () => JSON.stringify(projectSummary()));
     /** The sidebar's facts for this request. */
     function chromeFor(project, active, listPane, scope) {
         if (restricted() && !visible(project))
@@ -1446,20 +1661,7 @@ export function createDecisionServer(options) {
             // Enrolled projects first (most recently opened), then the repos this
             // server was told to serve that nobody has opened yet — the switcher
             // lists every project it is allowed to show, each exactly once.
-            projects: (() => {
-                const seen = new Set();
-                const rows = [];
-                for (const one of [
-                    ...store.listProjects().map(one => ({ path: one.path, name: one.name })),
-                    ...managedRepos().map(path => ({ path, name: projectName(path) })),
-                ]) {
-                    if (seen.has(one.path) || !visible(one.path) || goneRepos().has(one.path))
-                        continue;
-                    seen.add(one.path);
-                    rows.push(one);
-                }
-                return rows;
-            })(),
+            projects: sidebarProjects(),
             ...(facts === undefined ? {} : { csrf: facts.csrf, returnTo: facts.returnTo }),
             inboxCount: badge.count,
             inboxSaturated: badge.saturated,
@@ -1495,6 +1697,8 @@ export function createDecisionServer(options) {
                     },
                 }),
             ...(!restricted() && !unscopedMode && managedRepos().length > 0 ? { chat: true } : {}),
+            // Live terminals: offered to an installation-wide operator (the routes prove it again).
+            ...(actor !== undefined && !store.isDemo() && store.isInstanceOperator(actor) ? { code: true } : {}),
             ...(listPane === undefined ? {} : { listPane }),
             ...(scope === undefined ? {} : { scope }),
         };
@@ -1584,6 +1788,7 @@ export function createDecisionServer(options) {
     let leadClosing = false;
     server.once('listening', () => {
         team.start();
+        personalQueue.start();
         leadMaintenance = startMaintenance({ intervalMs: 5_000, shouldStop: () => leadClosing,
             run: () => runLeadFollowPass({ store, repos: managedRepos, evidenceRoot, clock,
                 provider: () => { const enabled = chatEnablement(); return enabled.ok ? { config: enabled.config, key: enabled.key } : null; },
@@ -1597,6 +1802,8 @@ export function createDecisionServer(options) {
     // it closes at once and never waits behind a model turn: a stop must release
     // the owner record well inside the service's exit window (Oct 2: deploys
     // over 0.9.11 found it still held by a killed process).
+    /** Set once the terminal handlers exist (below): drops every socket and ends every program. */
+    const terminalClosing = {};
     let codingClosing = null;
     const closeCoding = () => {
         leadClosing = true;
@@ -1618,7 +1825,9 @@ export function createDecisionServer(options) {
         liveHandlers.close();
         detachReads();
         liveFollower.close();
-        void Promise.all([closeCoding(), bounded(team.close()), bounded(leadMaintenance?.stop()), bounded(reads?.close())]).then(() => closeServer(callback)).catch(error => {
+        void Promise.all([closeCoding(), terminalClosing.close?.().then(problem => { terminalClosing.problem = problem; }), bounded(team.close()), bounded(personalQueue.close()), bounded(leadMaintenance?.stop()), bounded(reads?.close())])
+            // The server always closes; a terminal whose processes couldn't be proved stopped is the close's error.
+            .then(() => closeServer(error => callback?.(error ?? terminalClosing.problem ?? undefined))).catch(error => {
             if (callback)
                 callback(error instanceof Error ? error : Error('Coding session shutdown failed.'));
             else
@@ -1678,6 +1887,7 @@ export function createDecisionServer(options) {
         get chatScopeOf() { return chatScopeOf; },
         get liveTurns() { return liveTurns; },
         get liveTurnStarted() { return liveTurnStarted; },
+        get personalQueue() { return personalQueue; },
         get leadConversationRows() { return leadConversationRows; },
         get demoLeadHere() { return demoLeadHere; },
         get teamBrowserReply() { return teamBrowserReply; },
@@ -1736,6 +1946,7 @@ export function createDecisionServer(options) {
         get signInLinks() { return signInLinks; },
         get linkKey() { return linkKey; },
         get fromThisComputer() { return fromThisComputer; },
+        get freshFactsOf() { return freshFactsOf; },
         get passwordAllowed() { return passwordAllowed; },
         get arrival() { return arrival; },
         get cookieSecure() { return cookieSecure; },
@@ -1768,6 +1979,7 @@ export function createDecisionServer(options) {
         get revisionViewOf() { return revisionViewOf; },
         get revisionLedgerOf() { return revisionLedgerOf; },
         get firstTasks() { return firstTasks; },
+        get authenticateCredential() { return authenticateCredential; },
     };
     const tasksHandlers = createTasksHandlers(handlerRuntime);
     const pagesHandlers = createPagesHandlers(handlerRuntime);
@@ -1777,6 +1989,7 @@ export function createDecisionServer(options) {
     const peopleHandlers = createPeopleHandlers(handlerRuntime);
     const remoteRuntime = {
         get identify() { return identify; },
+        get freshFactsOf() { return freshFactsOf; },
         get store() { return store; },
         get admitPasswordSource() { return admitPasswordSource; },
         get admitBearer() { return admitBearer; },
@@ -1794,19 +2007,21 @@ export function createDecisionServer(options) {
         get managedRepos() { return managedRepos; },
         get joinSourceOf() { return joinSourceOf; },
         get ssoSettings() { return ssoSettings; },
-        get SSO_FRESH_MS() { return SSO_FRESH_MS; },
         get oauthTokenBudget() { return oauthTokenBudget; },
         get hookContext() { return hookContext; },
         get teamsSourceBudget() { return teamsSourceBudget; },
         get teamsTenantBudget() { return teamsTenantBudget; },
     };
-    const liveHandlers = createLiveHandlers(handlerRuntime, { bus: liveBus, workspaceRevision, chatProjectOf: chatHandlers.chatProjectOf });
+    const liveHandlers = createLiveHandlers(handlerRuntime, { bus: liveBus, workspaceRevision, chatProjectOf: chatHandlers.chatProjectOf, projectSummaryFor, projectScopeFor });
     liveTurnStarted = liveHandlers.turnStarted;
+    // The one upgrade this server takes is a terminal's socket (terminals.ts listens); anything else is dropped.
+    const terminalHandlers = createTerminalHandlers(handlerRuntime, { ...terminals, bus: liveBus, allowedHost, publicOrigin, forwardedSourceOf, server });
+    terminalClosing.close = terminalHandlers.close;
     const remoteHandlers = createRemoteHandlers(remoteRuntime);
     const registry = createHandlerRegistry([
         ...tasksHandlers.registrations, ...flowsHandlers.registrations, ...chatHandlers.registrations,
         ...settingsHandlers.registrations, ...peopleHandlers.registrations, ...pagesHandlers.registrations,
-        ...remoteHandlers.registrations, ...liveHandlers.registrations,
+        ...remoteHandlers.registrations, ...liveHandlers.registrations, ...terminalHandlers.registrations, ...createSweepHandlers(handlerRuntime).registrations,
     ]);
     /** The row's role, after admission and before its one handler. */
     function dispatchConsole(route, ctx) {

package/dist/server/chat.d.ts

@@ -15,7 +15,7 @@ export declare function createChatHandlers(runtime: ServerRuntime): {
     }, now: Date) => BrowserPhoneCard | undefined;
     chatProjectOf: (values: string[]) => string | null | undefined;
     beginLiveTurn: (thread: number) => (event: LeadProgress) => void;
-    endLiveTurn: (thread: number, ok: boolean) => void;
+    endLiveTurn: (thread: number, ok: boolean, progress?: (event: LeadProgress) => void) => void;
     noteLead: (csrf: string, turn: number | null, message: string) => void;
     takeLeadNote: (csrf: string, liveSession: number | null) => string | null;
     demoResultView: (exchange: DemoExchange) => DemoResultView | null;