toolroll 0.9.62 → 0.9.65

package/dist/server/render-tasks.d.ts

@@ -1,10 +1,9 @@
-/** Task pages: approval, agents, plans, controls, decisions and the task body. */
 import { type Html } from "../html.js";
 import { type RunActivity } from "../activity-line.js";
 import { type AgentChoice } from "../agentconfig.js";
 import { type AssignmentSnapshot } from "../assignment.js";
 import { type TaskBaseView } from "../task-base.js";
-import { type BrowserTaskView } from "../browser-workspace.js";
+import { type BrowserAgentControls, type BrowserTaskView } from "../browser-workspace.js";
 import { type FormView } from "../contracts/console-api.js";
 import { type DispatchDiagnosis } from "../dispatch.js";
 import { type ReportView } from "../evidence.js";
@@ -23,6 +22,7 @@ import { type DisplayStatus, type PublicationFacts, type ReviewFacts, type WorkS
 import { type Chrome, type Screen } from "./chrome.js";
 import { type CompletionReceiptView, type EvidenceLinkMap, type TaskPullRequest } from "./render-results.js";
 import { type Who } from "./session.js";
+import { type TaskOrigin } from "../task-source.js";
 /** What the task and approval views show about a drafted plan's contract
  * (contract handoff, task 1). A problem is a named problem, never a blank. */
 export type PlanContractView = {
@@ -74,14 +74,6 @@ export declare function revisionSentence(revision: Extract<RevisionView, {
 /** A planner's amendment, said plainly and kept in view: approving binds
  * the amended terms, so this is never folded away. */
 export declare function approvalAmendmentHtml(view: PlanContractView | null | undefined): Html;
-/**
- * The approval sheet (approval critique, Oct 2): the plan open, in plain
- * rows — Goal, Changes, Won't touch, Done when — one line of who builds,
- * one Approve & start beside the password, and every remaining signed
- * term (lineage, routing, runtime limits, the seal) in one Details fold.
- * Presentation only: the same hidden fields, nonce, digest and password
- * post to the same route, and the task page and chat card share it.
- */
 export declare function approvalSheetHtml(input: {
     surface: "task" | "chat";
     action: string;
@@ -103,7 +95,11 @@ export declare function approvalSheetHtml(input: {
         label: string;
         filedAgo: string | null;
     } | null;
+    /** v126: where the work came from: an outside event's one line of context (never a term the approval agrees to). */
+    origin?: TaskOrigin | null;
     deliverable: "branch" | "report";
+    /** The plan was rewritten after this build: the yes builds again to it (the approve POST requeues). */
+    rebuild?: number | null;
     editHref: string;
     notNowHref: string;
     sticky: boolean;
@@ -121,6 +117,8 @@ export declare function approvalSheetHtml(input: {
         open: boolean;
         stepsHref: string | null;
     } | null;
+    /** Cockpit B2: this person's password is remembered (when, ISO) and these terms may stand on it. */
+    freshSince?: string | null;
 }): Html;
 /** Earlier versions of a task still in flight, in plain words: queued
  * while they only wait, running once one has started; null when none. */
@@ -233,6 +231,11 @@ export declare function agentsStripHtml(view: RouteView | null, taskId: string):
 /** A ceremony nonce as stored: the sha256 hex of the value the form carried. */
 export declare function nonceHashOf(value: string): string;
 /** The approve POST's refusal, in words a person can act on. */
+/** " (password remembered from 10:42)" when the approval stood on a remembered password or sign-in; nothing otherwise. */
+export declare function approvalProofWords(proof: {
+    method: string;
+    at: string;
+} | null | undefined): string;
 export declare function approveRefusalWords(reason: string): string;
 /** The browser's one-click approval binds not only the signed scope but the
  * exact advisory plan revision shown beside it. The scope digest remains the
@@ -473,6 +476,8 @@ export declare function taskBodyParts(data: {
     /** Immutable filing provenance (v12) — the approver sees which door
      * filed this (console, cli, intake, template:<name>) at the yes. */
     filedVia?: string | null;
+    /** v126: where the work came from — the flow and the outside event — in words; null for everything else. */
+    origin?: TaskOrigin | null;
     /** Coordinator provenance when an agent filed this; null otherwise. */
     coordinator?: {
         label: string;
@@ -500,6 +505,23 @@ export declare function taskBodyParts(data: {
     activity?: RunActivity | null;
     /** Live steering: the Claude build that takes Pause right now, and its latest pause (null: none, or it continued). */
     livePause?: LivePauseFact | null;
+    /** The running attempt's composer facts (steer-controls.ts), for this reader. */
+    steerComposer?: {
+        controls: BrowserAgentControls;
+        steer: {
+            action: string;
+            run: number;
+        } | null;
+    } | null;
+    /** This task's latest attempts, newest first (a tab's unsent draft for one that ended is offered on). */
+    steerRecent?: number[];
+    /** Cockpit B2: when this person's remembered password was given, when it may approve these terms. */
+    approvalFresh?: string | null;
+    /** Cockpit B2: how the current approval's person was proved (approval proved ledger), when it was a remembered one. */
+    approvalProof?: {
+        method: string;
+        at: string;
+    } | null;
     /** Workers that are both alive and authorized for this task's project. */
     worker?: {
         answering: number;
@@ -583,6 +605,9 @@ export declare function taskBodyParts(data: {
     steering?: SteerNote[];
     /** A build's agent is running now and reads new notes when it next checks for them (v120). */
     steeringLive?: boolean;
+    /** The running build a note from this page is bound to (cockpit §4): the exact attempt, so a stale page's note is
+     * refused rather than filed for whatever runs later. Null: no build reads notes now (the note waits for the next). */
+    steeringRun?: number | null;
     /** The publication grant the publisher would act under — from
      * publicationGrantFor(repo) only; null when none, or no project. */
     grant?: PublicationGrant | null;

package/dist/server/render-tasks.js

@@ -1,5 +1,7 @@
 /** Task pages: approval, agents, plans, controls, decisions and the task body. */
-import { html, htmlString, joinHtml, postForm, replaceMarkup } from "../html.js";
+import { networkWords } from "../egress.js";
+import { ACP_AGENTS, isAcpProfile } from "../acp-agents.js";
+import { html, htmlString, joinHtml, postForm, replaceMarkup, reauth } from "../html.js";
 import { closedQuestionReason, closedQuestionWords } from "../decision.js";
 import {} from "../activity-line.js";
 import {} from "../agentconfig.js";
@@ -43,6 +45,7 @@ import { reviewHref, taskChatHref, taskHref } from "./http.js";
 import { coordinatorProposalsSection } from "./render-chat.js";
 import { completionReceiptCard, criterionMatrixHtml, evidenceWords, homePhaseWords, incidentWords, needsCheck, pullRequestCardHtml, reasonWords, receiptStatusOf, repairChainHtml, reportItemsHtml, reviewRetryPanel, runNoun, runOutcomeBadge, semanticCoverageHtml, terminalDiffCard, verificationExplanation, verificationRecovered } from "./render-results.js";
 import {} from "./session.js";
+import { linkWords, originNote } from "../task-source.js";
 export function contractChangeHtml(change) {
     const tag = html `<span class="contract-change-kind contract-change-${change.kind}">${change.kind}</span>`;
     switch (change.field) {
@@ -147,7 +150,8 @@ export function permissionWordsOf(profile) {
         ? profile.permissionArgv === "bypassPermissions" ? "Full access" : "Auto permissions"
         : profile.provider === "gemini"
             ? profile.approvalArgv === "yolo" ? "Full access" : "Auto permissions"
-            : profile.sandboxMode === "danger-full-access" ? "Full access" : "Workspace sandbox";
+            : isAcpProfile(profile) ? "Full access"
+                : profile.sandboxMode === "danger-full-access" ? "Full access" : "Workspace sandbox";
 }
 /** One plain sentence for a revision (approval critique, Oct 2):
  * "Fixes what build #9 missed: <criterion>." The notes, paths and lineage
@@ -200,6 +204,28 @@ const fragmentString = (fragment) => fragment === "" ? "" : htmlString(fragment)
  * Presentation only: the same hidden fields, nonce, digest and password
  * post to the same route, and the task page and chat card share it.
  */
+/** v126: a task's origin as a line of words (the identity line). */
+function originWords(origin) {
+    const flow = origin.flow === null ? null : origin.flow === "hidden" ? "from a flow" : origin.flow === "removed" ? "from a flow (removed)" : `from flow “${origin.flow.name}”`;
+    const source = origin.source === null ? null : `${origin.source.label} (${origin.source.proved})`;
+    return [flow, source].filter(one => one !== null).join(" · ");
+}
+/** v126: a task's origin as a fact: the flow, linked for those who may open it, and the outside event, linked to where
+ * it lives, with that link's host always shown. */
+function originParts(origin) {
+    const parts = [];
+    if (origin.flow !== null)
+        parts.push(origin.flow === "hidden" ? "A flow" : origin.flow === "removed" ? "A flow (removed)" : { label: `Flow “${origin.flow.name}”`, href: origin.flow.href });
+    if (origin.source !== null) {
+        if (parts.length > 0)
+            parts.push(" · ");
+        // The link shows where it goes (host and path), beside what it is.
+        parts.push(origin.source.label, ` (${origin.source.proved})`);
+        if (origin.source.url !== null)
+            parts.push(" · ", { label: linkWords(origin.source.url), href: origin.source.url });
+    }
+    return parts;
+}
 export function approvalSheetHtml(input) {
     const { scope, route } = input;
     // A machine-drafted repair appends its brief to the signed goal; the row
@@ -261,10 +287,13 @@ export function approvalSheetHtml(input) {
         allowing.length === 0 ? "" : html `<p class="approval-allowing" data-approval-allowing>You’re allowing: ${allowing.join(" · ")}</p>`,
         yoursToCheck.length === 0 ? "" : html `<p class="approval-you-check" data-approval-you-check>You’ll check: ${yoursToCheck.join("; ")}</p>`,
     ]);
-    const after = input.deliverable === "report"
-        ? html `An agent investigates without changing the repository. You'll hear when its report is ready.`
-        : html `An agent starts in its own branch. You'll hear when it's ready to review.`;
-    const submit = html `Approve & start`;
+    const rebuild = input.rebuild ?? null;
+    const after = rebuild !== null
+        ? html `Build #${rebuild} was made to the earlier plan. Approving builds it again to this one.`
+        : input.deliverable === "report"
+            ? html `An agent investigates without changing the repository. You'll hear when its report is ready.`
+            : html `An agent starts in its own branch. You'll hear when it's ready to review.`;
+    const submit = rebuild !== null ? html `Approve & build again` : html `Approve & start`;
     // Everything else the digest binds, one tap away.
     const detail = (title, body, attrs = html ``) => isEmptyHtml(body) ? html `` : html `<section class="approval-detail"${attrs}><h3>${title}</h3>${body}</section>`;
     const revisionDetail = input.revision === null ? "" : detail("Earlier build", joinHtml([
@@ -366,6 +395,7 @@ export function approvalSheetHtml(input) {
             sentence === null ? "" : html `<p class="approval-revision">${sentence}</p>`,
             input.coordinator === null ? "" : html `<p class="approval-note">An agent filed this: <span class="mono">${input.coordinator.label}</span>${input.coordinator.filedAgo === null ? "" : html `, ${input.coordinator.filedAgo}`}. Nothing runs until you approve, and approving runs its request.</p>`,
             input.deliverable === "report" ? html `<p class="approval-note">Read-only: it reports back and changes nothing in the repository.</p>` : "",
+            originNote(input.origin) === null ? "" : html `<p class="approval-note" data-approval-origin>${originNote(input.origin)}</p>`,
             html `<dl class="approval-rows">`,
             row("Goal", html `<p class="approval-goal">${goalShown}</p>`),
             row("Changes", changes),
@@ -378,15 +408,16 @@ export function approvalSheetHtml(input) {
             who.length === 0 ? "" : html `<p class="approval-who">${who.join(" · ")}</p>`,
             consent,
             html `<div class="approval-act" id="${input.surface === "task" ? "approval-confirm" : "chat-approval-confirm"}">`,
-            html `<label class="approval-password"><span class="visually-hidden">Your password</span><input type="password" name="token" autocomplete="current-password" placeholder="Your password" aria-describedby="${passwordNote}"></label>`,
-            html `<p class="approval-password-note" id="${passwordNote}">Your password signs this approval.</p>`,
+            html `${reauth(html `<label class="approval-password"><span class="visually-hidden">Your password</span><input type="password" name="token" autocomplete="current-password" placeholder="Your password" aria-describedby="${passwordNote}"></label>`)}`,
+            input.freshSince == null ? html `<p class="approval-password-note" id="${passwordNote}">Your password signs this approval.</p>`
+                : html `<p class="approval-password-note" id="${passwordNote}" data-approval-fresh>Your password from ${whenTime(input.freshSince)} is remembered on this computer — leave this blank to approve with it, or type it again.</p>`,
             html `<button type="submit" data-primary-action>${submit}</button></div>`,
             html `<p class="approval-after">${after}</p>`,
             html `<div class="approval-secondary">${editor ?? html `<a class="approval-link" href="${input.editHref}">Edit plan</a>`}<a class="approval-link" href="${input.notNowHref}">Not now</a></div>`,
             details,
         ]), {
             attrs: { class: "approve-form approval-sheet", id: input.surface === "task" ? "approve" : null, "data-sticky": input.sticky },
-            hidden: { nonce: input.nonce, digest: input.digest },
+            hidden: { nonce: input.nonce, digest: input.digest, ...(rebuild === null ? {} : { rebuild: String(rebuild) }) },
             returnTo: input.returnTo,
         }),
         editorForm,
@@ -413,7 +444,8 @@ export function permissionModeOfProfile(profile) {
         ? profile.permissionArgv === "bypassPermissions" ? "bypassPermissions" : "auto"
         : profile.provider === "gemini"
             ? profile.approvalArgv === "yolo" ? "bypassPermissions" : "auto"
-            : profile.sandboxMode === "danger-full-access" ? "bypassPermissions" : "auto";
+            : isAcpProfile(profile) ? "bypassPermissions"
+                : profile.sandboxMode === "danger-full-access" ? "bypassPermissions" : "auto";
 }
 /** Done when, from the in-place editor: each line keeps its requirement's
  * id by position, and its evidence and guidance while its words stand; a
@@ -505,8 +537,11 @@ export function profileWords(scope) {
                 : "legacy acceptEdits; edits proceed, commands that ask are denied unattended"}, stops after ${profile.maxTurns} turns, ${Math.round(profile.timeoutSeconds / 60)} min ${profile.timeoutKind === "idle" ? "without progress" : "per attempt"}; repairs on ${repair}, ${profile.repairMaxTurns} turns / ${Math.round(profile.repairTimeoutSeconds / 60)} min</p>`
         : profile.provider === "gemini"
             ? html `<p class="meta">Runs on <span class="mono">gemini · ${profile.model}</span> — ${profile.approvalArgv === "yolo" ? "Full access via --approval-mode yolo; every tool auto-approved" : "Auto via --approval-mode auto_edit; edits auto-approved, other tools refused"}, no turn limit (${Math.round(profile.timeoutSeconds / 60)} min ${profile.timeoutKind === "idle" ? "without progress" : "per attempt"}), spend reported in tokens only; repairs on ${repair}, ${Math.round(profile.repairTimeoutSeconds / 60)} min</p>`
-            : html `<p class="meta">Runs on <span class="mono">${profile.provider} · ${profile.model}</span> — ${profile.sandboxMode === "danger-full-access" ? "FULL permissions via --dangerously-bypass-approvals-and-sandbox; nothing asks" : "workspace-write sandbox"}, no turn limit (${Math.round(profile.timeoutSeconds / 60)} min ${profile.timeoutKind === "idle" ? "without progress" : "per attempt"}); repairs on ${repair}, ${Math.round(profile.repairTimeoutSeconds / 60)} min</p>`;
-    return base;
+            : isAcpProfile(profile)
+                ? html `<p class="meta">Runs on <span class="mono">${ACP_AGENTS[profile.provider].name} (via ACP) · ${profile.model}</span> — full access inside the OS fence; the agent runs any tool it chooses and nothing asks. No turn limit: stops after ${Math.round(profile.timeoutSeconds / 60)} min, or ${Math.round(profile.idleTimeoutSeconds / 60)} min silent; repairs on ${repair}, ${Math.round(profile.repairTimeoutSeconds / 60)} min, or ${Math.round(profile.repairIdleTimeoutSeconds / 60)} min silent.</p>`
+                : html `<p class="meta">Runs on <span class="mono">${profile.provider} · ${profile.model}</span> — ${profile.sandboxMode === "danger-full-access" ? "FULL permissions via --dangerously-bypass-approvals-and-sandbox; nothing asks" : "workspace-write sandbox"}, no turn limit (${Math.round(profile.timeoutSeconds / 60)} min ${profile.timeoutKind === "idle" ? "without progress" : "per attempt"}); repairs on ${repair}, ${Math.round(profile.repairTimeoutSeconds / 60)} min</p>`;
+    // What the build may reach is part of what is approved (egress.ts): said on every approval form.
+    return html `${base}<p class="meta" data-scope-network>${networkWords(profile.network ?? null)}</p>`;
 }
 export const ROLE_NOUN = { plan: "Planner", build: "Builder", repair: "Repair", review: "Reviewer" };
 export function agentsStandingWords(view) {
@@ -706,6 +741,21 @@ export function nonceHashOf(value) {
     return createHash("sha256").update(value).digest("hex");
 }
 /** The approve POST's refusal, in words a person can act on. */
+/** " (password remembered from 10:42)" when the approval stood on a remembered password or sign-in; nothing otherwise. */
+export function approvalProofWords(proof) {
+    if (proof == null)
+        return "";
+    if (proof.method === "fresh-password")
+        return ` (password remembered from ${whenText(proof.at)})`;
+    if (proof.method === "fresh-sso")
+        return ` (sign-in remembered from ${whenText(proof.at)})`;
+    if (proof.method === "session")
+        return " (passwordless: your signed-in session)";
+    if (proof.method === "cli-login")
+        return " (passwordless: this computer's remembered login)";
+    return "";
+}
+const whenText = (iso) => new Intl.DateTimeFormat("en-US", { hour: "numeric", minute: "2-digit" }).format(new Date(iso));
 export function approveRefusalWords(reason) {
     if (reason === "requester" || reason === "person-required")
         return gateWords({ verdict: "refuse", reason });
@@ -713,6 +763,8 @@ export function approveRefusalWords(reason) {
         return "not approved: this scope predates agent routing and its old approval no longer stands — edit and re-file the scope so it is routed under today’s agents, then approve it";
     if (reason === "profile-unresolved")
         return "not approved: the scope cannot name an exact agent for every role — fix the agent setup and re-file it";
+    if (reason === "password-now")
+        return "not approved: this needs your password typed now — protected work, raised permissions, or a plan an agent wrote can't use a remembered one";
     return `not approved: ${reason}`;
 }
 /** The browser's one-click approval binds not only the signed scope but the
@@ -897,7 +949,7 @@ export function resumeCeremonyPage(chrome, data) {
         data.gate === null ? "" : html `<p class="row"><strong>Before work starts:</strong> ${data.gate.summary} — ${data.gate.detail}</p>`,
         html `</div>`,
         postForm(`${taskHref(data.taskId)}/resume`, joinHtml([
-            html `<label>Confirm with your password<input type="password" name="token" autocomplete="current-password"></label>`,
+            html `${reauth(html `<label>Confirm with your password<input type="password" name="token" autocomplete="current-password"></label>`)}`,
             html `<button type="submit">Resume task</button>`,
         ], "\n"), { attrs: { class: "card resume-form" }, returnTo: data.returnTo, hidden: { nonce: data.nonceValue, run: control.run } }),
         back,
@@ -1067,7 +1119,7 @@ export function planRevisionLedgerHtml(ledger, taskId, csrf) {
                 : joinHtml([
                     postForm(`${taskHref(taskId)}/accept-revision`, joinHtml([
                         pendingRevision.authorityKind === "authority-change"
-                            ? html `<input type="password" name="token" placeholder="approval password" required autocomplete="current-password">`
+                            ? html `${reauth(html `<input type="password" name="token" placeholder="approval password" required autocomplete="current-password">`)}`
                             : "",
                         html `<button type="submit">${pendingRevision.authorityKind === "authority-change" ? html `Approve changes &amp; continue` : html `Use revised plan &amp; continue`}</button>`,
                     ]), { attrs: { class: "inline" }, hidden: { "revision-id": pendingRevision.id } }),
@@ -1399,7 +1451,7 @@ export function taskBodyParts(data) {
     const steerForm = data.csrf === "" || task.state === "done" || task.state === "cancelled"
         ? ""
         : joinHtml([
-            postForm(`${taskHref(task.id)}/steer`, html `<input type="text" name="note" placeholder="guidance for the agent" aria-label="steering note" style="width:100%;max-width:28rem"><button type="submit">Steer</button>`, { attrs: { class: "row" } }),
+            postForm(`${taskHref(task.id)}/steer`, html `<input type="text" name="note" placeholder="guidance for the agent" aria-label="steering note" style="width:100%;max-width:28rem">${data.steeringRun == null ? "" : html `<input type="hidden" name="run" value="${String(data.steeringRun)}"><input type="hidden" name="key" value="${randomUUID()}"><input type="hidden" name="return" value="task">`}<button type="submit">${data.steeringRun == null ? "Save for the next attempt" : "Steer"}</button>`, { attrs: { class: "row" } }),
             html `<p class="meta">${steerDestinationWords(steeringLive)} A note can't widen the approved scope.</p>`,
         ]);
     const steeringCard = steerRows === "" && steerForm === "" ? "" : html `<h2>Steering</h2>${steerRows}${steerForm}`;
@@ -1425,7 +1477,7 @@ export function taskBodyParts(data) {
             html `<p><strong>Quality</strong> ${qualityModeTitle(scope.qualityMode ?? "default")}</p>`,
             acceptanceCeremonyHtml(scope.acceptance),
             approval.approved
-                ? html `<p class="meta scope-seal">Approved by ${approval.by} · ${whenTime(approval.at)} · <span class="seal">signs ${shortDigest(scope.digest)}</span><span class="so-sr-only"> — approval binds to this exact wording</span></p>`
+                ? html `<p class="meta scope-seal">Approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)} · <span class="seal">signs ${shortDigest(scope.digest)}</span><span class="so-sr-only"> — approval binds to this exact wording</span></p>`
                 : html `<p class="meta"><span class="seal">signs ${shortDigest(scope.digest)}</span> — approval binds to this exact wording</p><p class="meta">Not approved${approval.reason === "changed" ? " — approved once, then rewritten" : ""}</p>`,
             html `</div>`,
         ], "\n");
@@ -1533,6 +1585,10 @@ export function taskBodyParts(data) {
     const revisionInApproval = scope !== null && !approval.approved && data.plan !== "requested" &&
         scope.profileState !== "unresolved" && consentDoor.open && data.dispatch?.action !== "repair-dependency" &&
         (data.revision == null || !("problem" in data.revision));
+    // The approval is the next step when dispatch waits on it, or when the plan was rewritten after a build (the
+    // assignment's one action): then it is shown open under the status, never folded.
+    const approvalLeads = data.dispatch?.action === "approve-scope" ||
+        (data.assignment?.primaryAction?.code === "approve-scope" && data.assignment.primaryAction.target.taskId === task.id);
     const approveForm = scope === null || approval.approved || data.plan === "requested"
         ? ""
         : data.revision !== null && data.revision !== undefined && "problem" in data.revision
@@ -1547,6 +1603,7 @@ export function taskBodyParts(data) {
                         csrf: data.csrf,
                         nonce: data.nonce,
                         digest: data.approvalDigest ?? scope.digest,
+                        freshSince: data.approvalFresh ?? null,
                         returnTo: null,
                         scope,
                         planDocument: data.plan === "drafted" ? data.planDocument : null,
@@ -1556,10 +1613,12 @@ export function taskBodyParts(data) {
                         repairChain: data.repairChain ?? null,
                         route: data.route,
                         coordinator: data.coordinator ?? null,
+                        origin: data.origin ?? null,
                         deliverable: data.deliverable ?? "branch",
+                        rebuild: data.assignment?.need != null && "key" in data.assignment.need && data.assignment.need.key === "replan" ? data.assignment.need.build : null,
                         editHref: data.csrf !== "" && data.planSha != null && data.planDocument !== null ? "#plan-edit" : "#scope",
                         notNowHref: "/work",
-                        sticky: data.dispatch?.action === "approve-scope",
+                        sticky: approvalLeads,
                         earlier: { active: data.assignment?.earlierActive ?? 0, running: data.assignment?.earlierRunning ?? 0 },
                         edit: data.csrf === "" ? null
                             : { action: `${taskHref(task.id)}/scope`, draft: inlineScopeDraft ? data.scopeDraft ?? null : null, problem: inlineScopeDraft ? data.problem : null,
@@ -1711,7 +1770,7 @@ export function taskBodyParts(data) {
     const scopeRow = scope === null
         ? prop("scope", "none yet")
         : approval.approved
-            ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by} · ${whenTime(approval.at)}`)
+            ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)}`)
             : prop("scope", approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved");
     const strikesRow = data.strikes > 0 ? prop("strikes", `${data.strikes} failed attempt(s)`) : "";
     const propsCard = html `<div class="card props">${workerRow}${queueRow}${scopeRow}${publishesRow}${economics}${strikesRow}</div>`;
@@ -1727,7 +1786,7 @@ export function taskBodyParts(data) {
         facts.push({ label: "Queue", parts: [`${data.position.position} of ${data.position.total}${data.position.column === null ? " in the shared queue" : ` in ${data.position.column}'s queue`} · `, { label: "Reorder", href: "/board?view=order" }] });
     }
     facts.push(scope === null ? { label: "Scope", parts: ["none yet"] }
-        : approval.approved ? { label: "Approved scope", parts: [{ seal: `signs ${scope.digest.length <= 12 ? scope.digest : `${scope.digest.slice(0, 12)}…`}` }, ` · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}`, ...(approval.at === null ? [] : [" · ", { at: approval.at }])] }
+        : approval.approved ? { label: "Approved scope", parts: [{ seal: `signs ${scope.digest.length <= 12 ? scope.digest : `${scope.digest.slice(0, 12)}…`}` }, ` · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)}`, ...(approval.at === null ? [] : [" · ", { at: approval.at }])] }
             : { label: "Scope", parts: [approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved"] });
     facts.push({ label: "Publishes as", parts: [publishesAs] });
     // v102: who asked for it, and what the project's approval rules need.
@@ -1893,20 +1952,22 @@ export function taskBodyParts(data) {
     // status and property rail, and approval provenance stays in the ceremony.
     const identity = html `<p class="meta task-identity">Task ID <span class="mono">${task.id}</span>${data.rootTitle !== undefined && data.rootTitle !== task.title ? ` · Execution: ${task.title}` : ""}${data.repo === null ? "" : ` · ${projectName(data.repo)}`}${data.coordinator !== null && data.coordinator !== undefined
         ? html ` · filed by <span class="mono">${data.coordinator.label}</span>${data.coordinator.filedAgo === null ? "" : ` ${data.coordinator.filedAgo}`}`
-        : data.filedVia === null || data.filedVia === undefined
-            ? ""
-            : ` · filed via ${data.filedVia}`}${data.deliverable === "report" ? html ` · <span class="badge">Scout</span>` : ""}</p>`;
+        : data.origin != null
+            ? ` · ${originWords(data.origin)}`
+            : data.filedVia === null || data.filedVia === undefined
+                ? ""
+                : ` · filed via ${data.filedVia}`}${data.deliverable === "report" ? html ` · <span class="badge">Scout</span>` : ""}</p>`;
     // A pull request that can be merged (or opened) owns the one primary action; the result stays in its section.
     const pullRequestActs = data.csrf !== "" && (data.pullRequest?.view?.canMerge === true || (data.pullRequest?.view == null && data.pullRequest?.offer != null));
     const pullRequestFact = data.pullRequest?.fact != null && data.pullRequest.view?.runId === data.assignment?.receipt?.runId ? data.pullRequest.fact : undefined;
-    const assignmentOptions = data.assignment == null ? null : { workStatus: status, hideAction: (approveForm !== "" && data.dispatch?.action === "approve-scope") || pullRequestActs, problem: status.tone === "problem",
+    const assignmentOptions = data.assignment == null ? null : { workStatus: status, hideAction: (approveForm !== "" && approvalLeads) || pullRequestActs, problem: status.tone === "problem",
         planning: data.dispatch?.code === "running" && data.dispatch.role === "planner", ...(pullRequestFact === undefined ? {} : { pullRequest: pullRequestFact }),
         diagnostics: [...(status.diagnostics ?? []), ...(status.tone === "problem" && status.detail !== data.assignment.detail ? [status] : [])] };
     // Say it once: a pull request that couldn't open, or merged, is the status
     // card's own row (its reason or merge commit under Details), not a second card.
     const pullRequestCard = data.pullRequest == null || (pullRequestFact !== undefined && (data.pullRequest.view?.state === "failed" || data.pullRequest.view?.state === "merged")) ? "" : pullRequestCardHtml(data.pullRequest, data.csrf);
     // The result takes over from the task status as soon as it is ready.
-    const statusHtml = html `${data.assignment != null && assignmentOptions !== null ? assignmentSummaryHtml(data.assignment, assignmentOptions) : receiptLeads ? completionReceiptCard(data.completion.receipt, task.id, "task", status) : taskStatusCard(status, task.id, data.dispatch ?? null, liveRunId, approveForm !== "" && data.dispatch?.action === "approve-scope")}${checkProgressHtml(data.checkProgress ?? null)}`;
+    const statusHtml = html `${data.assignment != null && assignmentOptions !== null ? assignmentSummaryHtml(data.assignment, assignmentOptions) : receiptLeads ? completionReceiptCard(data.completion.receipt, task.id, "task", status) : taskStatusCard(status, task.id, data.dispatch ?? null, liveRunId, approveForm !== "" && approvalLeads)}${checkProgressHtml(data.checkProgress ?? null)}`;
     // The exact-run control (v52), directly under the scheduler's answer:
     // the one place a person stops or resumes THIS attempt.
     const controlHtml = taskControlDetailsHtml(data.control ?? { kind: "none" }, task.id, data.csrf, "task", false, false, data.livePause ?? null);
@@ -1939,7 +2000,7 @@ export function taskBodyParts(data) {
         return joinHtml([
             html `<div class="card"><p><strong>External work</strong> <span class="meta">${link} · ${state}</span></p>`,
             reopenable
-                ? postForm(`${taskHref(task.id)}/reopen`, html `<input type="password" name="token" placeholder="your password" aria-label="your password" autocomplete="current-password"><button type="submit">Reopen — the approved scope stands</button>`, { attrs: { class: "row" } })
+                ? postForm(`${taskHref(task.id)}/reopen`, html `${reauth(html `<input type="password" name="token" placeholder="your password" aria-label="your password" autocomplete="current-password">`)}<button type="submit">Reopen — the approved scope stands</button>`, { attrs: { class: "row" } })
                 : "",
             html `</div>`,
         ]);
@@ -1956,7 +2017,7 @@ export function taskBodyParts(data) {
             ? html `<div class="card"><p><strong>This task is waiting on you: an agent filed it, and it has no scope.</strong></p><p class="meta">Filed by <span class="mono">${data.coordinator.label}</span> — nothing plans, claims, or runs until you write a scope below and sign it. Your signature runs their request.</p></div>`
             : html `<div class="card task-scope-needed"><p><strong>No approved scope yet</strong></p><p class="meta"><strong>Plan first</strong> drafts it from the repository, or <a href="#scope">write it yourself</a>.</p></div>`
         : "";
-    const approvalHtml = dependencyChoiceNeeded || approveForm === "" ? "" : data.dispatch?.action === "approve-scope"
+    const approvalHtml = dependencyChoiceNeeded || approveForm === "" ? "" : approvalLeads
         ? html `<section class="task-plan-review" aria-label="Approve the plan">${approveForm}</section>`
         : html `<details class="task-secondary-approval"><summary>Updated approval terms</summary>${approveForm}</details>`;
     const optionsHtml = html `${identity}${dispatchStatus}${dependencyChoiceNeeded ? "" : actsBar}`;
@@ -2145,7 +2206,10 @@ export function taskBodyParts(data) {
     review.push({ label: "Publishes as", parts: [publishesAs] });
     const about = [];
     const filedFact = facts.find(one => one.label === "Filed by");
-    about.push(filedFact ?? { label: "Filed by", parts: [filedBy ?? (data.filedVia == null ? "Not recorded" : `via ${data.filedVia}`)] });
+    about.push(filedFact ?? { label: "Filed by", parts: [filedBy ?? (data.origin != null ? "An automation" : data.filedVia == null ? "Not recorded" : `via ${data.filedVia}`)] });
+    // v126: where it came from — the flow (linked only for those who can see it) and the outside event, with its host.
+    if (data.origin != null)
+        about.push({ label: "From", parts: originParts(data.origin) });
     about.push({ label: "Filed", parts: [{ at: rootFiled }] });
     about.push({ label: "Updated", parts: [{ at: task.updatedAt }] });
     for (const label of ["Audit", "This attempt", "Task total"]) {
@@ -2204,6 +2268,21 @@ export function taskBodyParts(data) {
         attempts: [...earlierStopped].sort((a, b) => a.id - b.id).map(run => ({ label: `${runNoun(run)[0].toUpperCase()}${runNoun(run).slice(1)} #${run.id}`, href: `/r/${run.id}`,
             text: run.outcome === null ? "Never finished." : run.outcome === "failed" ? failedAttemptSentence(run.reason) : run.reason === null ? null : (words => `${words.charAt(0).toUpperCase()}${words.slice(1)}.`)(reasonWords(run.reason)) })),
     };
+    // ⋯ More actions (docs/plans/one-page-task-and-agent.md): each secondary act once, in one place — Work, Share & reuse,
+    // then Danger last. A ceremony is never cloned here: its item goes to the tab that holds its one form.
+    const sectionIds = new Set(sectionParts.map(one => one.id));
+    const rootOf = data.rootId ?? task.id;
+    const more = [
+        ...(runChecks !== null && data.csrf !== "" ? [{ group: "work", label: "Run checks", kind: "post", action: runChecks.action, fields: { level: runChecks.level, return: runChecks.returnTo } }] : []),
+        ...(sectionIds.has("scope") && data.csrf !== "" ? [{ group: "work", label: approval.approved || finished ? "Plan and agents" : "Edit plan", kind: "goto", tab: "plan", target: "scope" }] : []),
+        ...(sectionIds.has("waits-for") ? [{ group: "work", label: "Dependencies", kind: "goto", tab: "plan", target: "waits-for" }] : []),
+        ...(sectionIds.has("holds") ? [{ group: "work", label: "Holds", kind: "goto", tab: "plan", target: "holds" }] : []),
+        ...(data.csrf !== "" ? [{ group: "work", label: "Task options", kind: "goto", tab: "plan", target: "task-diagnostics" }] : []),
+        { group: "share", label: "Copy link", kind: "copy" },
+        ...(facts.some(one => one.label === "Audit") ? [{ group: "share", label: "Evidence pack", kind: "link", href: `${taskHref(rootOf)}/evidence` }] : []),
+        ...(data.repo !== null && data.scope !== null ? [{ group: "share", label: "Reuse as recipe", kind: "link", href: `/recipes/from-task?task=${encodeURIComponent(task.id)}` }] : []),
+        ...(cancelForm !== "" ? [{ group: "danger", label: "Cancel task", kind: "goto", tab: "plan", target: "cancel-task" }] : []),
+    ];
     const view = {
         kind: "task",
         id: task.id,
@@ -2227,9 +2306,13 @@ export function taskBodyParts(data) {
         activity: liveRun === undefined ? null : data.activity ?? null,
         stop,
         pause,
+        steering: data.csrf !== "" ? data.steerComposer ?? null : null,
+        ...(data.csrf !== "" && (data.steerRecent?.length ?? 0) > 0 ? { steerRecent: data.steerRecent } : {}),
         record,
         earlier,
         approval: fragmentString(approvalHtml),
+        approvalPlacement: approvalLeads ? "lead" : "plan",
+        more,
         confirmStopped: data.csrf !== "" && data.assignment?.primaryAction?.code === "confirm-stopped" && data.assignment.primaryAction.target.runId !== null
             ? { action: `${taskHref(data.assignment.rootId)}/confirm-stopped`, run: data.assignment.primaryAction.target.runId, checked: needsCheck(data.assignment) } : null,
         rebuild,

package/dist/server/request-context.d.ts

@@ -33,6 +33,8 @@ export type RequestFacts = {
         expiresAt: number;
         etag: string;
     };
+    /** Passwordless is on and this is a signed-in browser: ceremony password fields render as nothing (html.ts reauth). */
+    passwordless?: boolean;
 };
 /**
  * The request's own session facts, readable from anywhere below the

package/dist/server/request-context.js

@@ -1,6 +1,6 @@
 /** What one console request knows about itself, readable anywhere below its handler. */
 import { AsyncLocalStorage } from "node:async_hooks";
-import { provideFormToken } from "../html.js";
+import { provideFormToken, providePasswordless } from "../html.js";
 /**
  * The request's own session facts, readable from anywhere below the
  * dispatcher without threading them through forty call sites: the csrf
@@ -10,6 +10,7 @@ import { provideFormToken } from "../html.js";
  */
 export const requestContext = new AsyncLocalStorage();
 provideFormToken(() => requestContext.getStore()?.csrf);
+providePasswordless(() => requestContext.getStore()?.passwordless === true);
 /** Run a render outside a live request (a test, a background render) as if a browser session with this token asked. */
 export function withFormToken(csrf, render) {
     const facts = requestContext.getStore();

package/dist/server/route-table.d.ts

@@ -83,6 +83,9 @@ export interface RouteDeclaration {
     readonly roleRefusal?: RouteRefusal;
     /** The largest form body a POST here reads (else the console's default). */
     readonly bodyCap?: number;
+    /** Cockpit B2: whether a password remembered on this session may stand in here (`allowlist`), or never. Only the
+     * allowlisted acts run their check inside `withFreshness` (scope.ts); every other step-up is `never`. */
+    readonly freshness: "never" | "allowlist";
 }
 /** The sole route table, in match order. */
 export declare const ROUTES: readonly RouteDeclaration[];