toolroll 0.9.62 → 0.9.65

package/dist/server/settings.js

@@ -1,3 +1,6 @@
+import { PASSWORDLESS_TRADE, passwordlessSetting, setPasswordless } from "../passwordless.js";
+import { ACP_AGENTS, isKeyedProvider } from "../acp-agents.js";
+import { LIVE_VIEW_CONSENT, liveViewConsentDigest, setLiveCommands } from "../live-detail.js";
 import { CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
 import { galleryTemplateOf } from "../flow-gallery.js";
 import { finishGoogleConsent, GOOGLE_CALLBACK } from "../google-mail.js";
@@ -30,7 +33,7 @@ import { PACKAGE_VERSION } from "../version.js";
 import { handlersOf } from './handler-registry.js';
 import { refuse, screen } from "./chrome.js";
 import { HANDOFF_STYLE, redirect, respond, safeReturn, signInSpent, startedHere } from "./http.js";
-import { html, htmlString, joinHtml, postForm } from "../html.js";
+import { html, htmlString, joinHtml, postForm, reauth } from "../html.js";
 import { browserCaller } from "./session.js";
 /** settings handlers, moved without changing their route bodies. */
 import { DEFAULT_ACCENT, normalHex } from "../accent-colors.js";
@@ -76,13 +79,15 @@ import { openRouterPickerScript } from "../openrouter-models.js";
 import { policyHtml } from "../policy-ui.js";
 import { checkPolicy, parseList, policyParts } from "../policy.js";
 import { parseProjectConcurrency, saveProjectConcurrency } from "../project-concurrency.js";
+import { MAX_NETWORK_HOSTS, normalizeHost } from "../egress.js";
 import { projectDeleteConfirmHtml, projectSettingsHtml } from "../project-delete-ui.js";
 import { deleteProject, holdingsWords } from "../project-delete.js";
 import { applySavedKnowledge, changeKnowledge, knowledgeVersion, knowledgeView } from "../project-knowledge.js";
 import { changeLearning } from "../project-learning.js";
 import { listDecisions, recordDecision, retireDecision, searchMemory } from "../project-memory.js";
 import { changeSkills, githubSkill, importSkill, reviseSkillTest, skillsView, testSkill } from "../project-skills.js";
-import { addToolTo, catalogTool, localAppOf, removeToolFrom, setToolSecret, splitCommandLine, testToolOf } from "../project-tools.js";
+import { signedIn } from "../oauth-run-token.js";
+import { addToolTo, catalogTool, localAppOf, removeToolFrom, setToolSecret, splitCommandLine, testToolOf, toolSecretStorage } from "../project-tools.js";
 import { liftAuthPause } from "../provider-auth.js";
 import { isProviderId, PROVIDER_IDS, validateSpec, validModelId } from "../provider.js";
 import { checkPublishing, MERGE_METHODS, saveMergeSettings, savePublishing } from '../pull-request-flow.js';
@@ -121,7 +126,7 @@ import { personChip, ROLE_TITLES } from "./chrome.js";
 import { chatReturnWithSaid, goOutside } from "./http.js";
 import { latestReleaseFor, leadSettingsHtml, notificationProjects, SETTINGS_AUTOSAVE_SCRIPT, settingsPage, settingsWorkers, telegramDeliveryWords, telegramTrouble } from "./render-settings.js";
 export function createSettingsHandlers(runtime) {
-    const { store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, deletedRepos, recordSignIn, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, defaultProject, googleVisits } = runtime;
+    const { store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, authenticateCredential, deletedRepos, recordSignIn, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, defaultProject, googleVisits } = runtime;
     // v105: what agent work cost, by month, and the monthly budgets. An instance operator's page.
     async function spendPage(ctx) {
         const { url, who, response, now } = ctx;
@@ -350,7 +355,7 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         if (!options.configDir)
             return refuse(response, who, 403, "An installation approver sees integrations.", "/settings");
         const list = integrations.list();
-        return sendScreen(response, 200, screen("Integrations", html `<p><a href="/settings">Settings</a></p><h1>Integrations</h1>${(integrationsHtml(list, who.session.csrf, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem"), checking: integrations.checking }))}`, { chrome: chromeFor(project, "settings") }));
+        return sendScreen(response, 200, screen("Integrations", html `<p><a href="/settings">Settings</a></p><h1>Integrations</h1>${(integrationsHtml(list, who.session.csrf, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem"), checking: integrations.checking, secrets: toolSecretStorage() }))}`, { chrome: chromeFor(project, "settings") }));
     }
     // v104: Settings → Monitoring, where the audit stream and traces go. An instance operator's page.
     async function monitoringPage(ctx) {
@@ -460,6 +465,40 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const body = ssoSettingsHtml({ settings, redirect: origin === null ? null : `${origin}${SSO_CALLBACK}`, projects, linked: settings !== null && store.ssoIdentitiesOf(who.name).some(one => one.issuer.replace(/\/+$/, "") === settings.issuer) }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") });
         return sendScreen(response, 200, screen("Sign-in", html `<p><a href="/settings">Settings</a></p><h1>Sign-in</h1>${body}`, { chrome: chromeFor(project, "settings") }));
     }
+    /** Passwordless (docs/plans/passwordless.md): the switch, and the trade in plain words. */
+    async function passwordlessPage(ctx) {
+        const { url, response, project } = ctx;
+        browserCaller(ctx.who);
+        const setting = passwordlessSetting(store);
+        const said = url.searchParams.get("said"), problem = url.searchParams.get("problem");
+        const note = problem ? html `<p class="problem" role="alert">${problem}</p>` : said ? html `<p role="status">${said}</p>` : "";
+        const since = setting.at === null ? "" : html ` <span class="meta">(${setting.on ? "on" : "off"} since ${new Date(setting.at).toLocaleString("en-US", { dateStyle: "medium", timeStyle: "short" })}, by ${setting.setBy ?? "someone"})</span>`;
+        const control = setting.on
+            ? postForm("/settings/passwordless", html `<button class="secondary">Turn Passwordless off</button>`, { hidden: { action: "off" } })
+            : postForm("/settings/passwordless", html `<label>Your password<input type="password" name="password" autocomplete="current-password" required></label><button>Turn Passwordless on</button>`, { attrs: { class: "card approve-form" }, hidden: { action: "on" } });
+        return sendScreen(response, 200, screen("Passwordless", html `<p><a href="/settings">Settings</a></p><h1>Passwordless</h1>${note}\
+<p>When it's on, signing in is the only password: approvals, settings, budgets, signing a mode and starting a terminal no longer ask again — in the browser, on the phone, and in this computer's <code>toolroll</code> command (through its remembered login).</p>\
+<p class="meta">${PASSWORDLESS_TRADE}</p>\
+<p><strong>Passwordless is ${setting.on ? "on" : "off"}.</strong>${since}</p>${control}`, { chrome: chromeFor(project, "settings") }));
+    }
+    async function passwordlessSave(ctx) {
+        const { response, now, posted } = ctx;
+        const who = browserCaller(ctx.who);
+        const body = readForm(posted, CONSOLE_FORMS.passwordless);
+        const back = (key, words) => redirect(response, `/settings/passwordless?${key}=${encodeURIComponent(words)}`);
+        const action = body.get("action");
+        if (action === "off") {
+            setPasswordless(store, false, who.name, now);
+            return back("said", "Passwordless is off. Step-ups ask for your password again.");
+        }
+        if (action !== "on")
+            return back("problem", "Choose on or off.");
+        // Turning it on is a credential act: a password typed now (or a one-use provider re-check), never a session.
+        if (!authenticateCredential(who, body.get("password") ?? "").ok)
+            return back("problem", "Enter your Toolroll password to turn Passwordless on.");
+        setPasswordless(store, true, who.name, now);
+        return back("said", "Passwordless is on. Signing in is the only password now.");
+    }
     async function knowledgePage(ctx) {
         const { url, who, response, project } = ctx;
         const projects = consoleProjects();
@@ -599,13 +638,14 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         };
         const providerKeys = who.role !== "approver"
             ? null
-            : await Promise.all(PROVIDER_IDS.map(async (provider) => ({
+            // ACP agents sign in their own way; Toolroll keeps no key for them, so the key card lists only the others.
+            : await Promise.all(PROVIDER_IDS.filter(isKeyedProvider).map(async (provider) => ({
                 provider,
                 envName: PROVIDER_KEY_ENV[provider],
                 ...keyStatus(provider, providerHome),
                 connection: await connectionCheck(provider, url.searchParams.get("check-connection") === provider),
                 ambient: (process.env[PROVIDER_KEY_ENV[provider]] ?? "") !== "",
-                mode: readAuthMode(provider, providerHome),
+                mode: readAuthMode(provider, providerHome) === "api-key" ? "api-key" : "subscription",
                 subscriptionCapable: SUBSCRIPTION_CAPABLE[provider],
             })));
         const telegramConfigured = loadBotToken(process.env, options.telegramTokenFile) !== null;
@@ -624,7 +664,12 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         }, who.role === "approver" && csrf !== "" ? (() => {
             // v87: the mail server flows send email through; the password is never shown back.
             // v89: where Inbox triggers read it, and a connected Google account (its client secret is never shown back either).
-            const email = readEmailSettings(options.configDir ?? null), google = readGoogleMail(options.configDir ?? null), origin = consoleOrigin(request.headers.host);
+            const email = readEmailSettings(options.configDir ?? null), google = (() => { try {
+                return readGoogleMail(options.configDir ?? null);
+            }
+            catch {
+                return null;
+            } })(), origin = consoleOrigin(request.headers.host);
             const googleView = { connected: googleConnected(options.configDir ?? null)?.address ?? null, clientId: google?.clientId ?? "", redirect: origin === null ? null : `${origin}${GOOGLE_CALLBACK}` };
             return email === null ? { set: false, host: "", port: 587, secure: false, user: "", from: "", imapHost: "", imapPort: 993, google: googleView }
                 : { set: true, host: email.host, port: email.port, secure: email.secure, user: email.user, from: email.from, imapHost: email.imap?.host ?? "", imapPort: email.imap?.port ?? 993, google: googleView };
@@ -650,6 +695,18 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         return redirect(response, "/work");
     }
     // The update notice is dismissed per browser and per version: a newer release shows it again.
+    // Cockpit B2: Forget — nothing verified on this session before now counts as fresh (a CSRF-checked post, like every act).
+    async function forgetPassword(ctx) {
+        const { who, response, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.forgetPassword);
+        if (who.via === "cookie") {
+            who.session.freshFloor = Date.now();
+            delete who.session.passwordAt;
+            delete who.session.ssoReauthAt;
+            delete who.session.ssoNowAt;
+        }
+        return redirect(response, safeReturn(body.get("return") ?? "/"));
+    }
     async function updatesDismiss(ctx) {
         const { who, response, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.updatesDismiss);
@@ -802,6 +859,51 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         store.bumpWake();
         return back("said", changed.before === changed.after ? "Nothing changed." : `Saved. Up to ${n} at once.`);
     }
+    // Settings → Project → Live view (live-detail.ts): an approver for the project shows commands with their password,
+    // or hides them in one step; the ledger keeps each change. It applies from the next run.
+    async function projectLiveView(ctx) {
+        const { who, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.projectLiveView);
+        const repo = body.get("repo") ?? "";
+        if (!consoleProjects().includes(repo) || !visible(repo))
+            return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
+        if (who.via !== "cookie" || who.role !== "approver" || store.isDemo() || !store.accountCanAccess(who.name, repo))
+            return refuse(response, who, 403, "An approver for this project changes the live view.", "/settings/project");
+        const back = (key, words) => redirect(response, `/settings/project?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}`);
+        const act = body.get("act");
+        if (act === "off")
+            return back("said", setLiveCommands(store, { repo, commands: false, by: who.name, via: "the console" }, now).said);
+        if (act !== "on")
+            return back("problem", "That change isn't available.");
+        // Single use, for this person and exactly this change: a replayed or copied form changes nothing.
+        if (!consumeApprovalNonce(body.get("nonce") ?? "", who.name, LIVE_VIEW_CONSENT, liveViewConsentDigest(repo)))
+            return back("problem", "That form was already used or is out of date. Try again from this page.");
+        if (!authenticateApprover(who, body.get("password") ?? "", repo).ok)
+            return back("problem", "Enter your Toolroll password to show commands.");
+        return back("said", setLiveCommands(store, { repo, commands: true, by: who.name, via: "the console" }, now).said);
+    }
+    // Settings → Project → Network (egress.ts): what the project's builds may reach. An approver for the project changes it
+    // with their password typed now; the ledger keeps before → after. New scopes use it; approved ones keep theirs.
+    async function projectNetwork(ctx) {
+        const { who, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.projectNetwork);
+        const repo = body.get("repo") ?? "";
+        if (!consoleProjects().includes(repo) || !visible(repo))
+            return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
+        if (who.via !== "cookie" || who.role !== "approver" || store.isDemo() || !store.accountCanAccess(who.name, repo))
+            return refuse(response, who, 403, "An approver for this project changes what its builds may reach.", "/settings/project");
+        const back = (key, words) => redirect(response, `/settings/project?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}#network`);
+        const hosts = (body.get("hosts") ?? "").split(/[\s,]+/).filter(Boolean).map(normalizeHost);
+        if (hosts.some(one => one === null))
+            return back("problem", "A host is a name like api.stripe.com or *.stripe.com: no address, port or path. Nothing changed.");
+        if (hosts.length > MAX_NETWORK_HOSTS)
+            return back("problem", `A project lists at most ${MAX_NETWORK_HOSTS} hosts. Nothing changed.`);
+        if (!authenticateCredential(who, body.get("password") ?? "").ok)
+            return back("problem", "Enter your Toolroll password to change what builds may reach.");
+        const changed = store.setProjectNetwork(repo, { mode: body.get("mode") === "open" ? "open" : "allowlist", hosts: hosts, loopback: body.get("local") === "any" ? "any" : "proxy-only" }, who.name, now);
+        const same = JSON.stringify(changed.before) === JSON.stringify(changed.after);
+        return back("said", same ? "Nothing changed." : "Saved. Tasks scoped from now on use it; tasks already approved keep the network they were approved with.");
+    }
     // Delete a project, in two steps: its name, then what goes and the password. An instance operator; the ledger keeps who and what.
     async function projectDelete(ctx) {
         const { response, now, posted } = ctx;
@@ -911,7 +1013,8 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
             const found = await providerFor(before.issuer);
             return found.ok ? back("said", `${before.label} answers: it's ready for people to sign in.`) : back("problem", found.said);
         }
-        if (!authenticateApprover(who, body.get("password") ?? "").ok)
+        // Sign-in methods and the identity provider are the login itself: a credential act, a password typed now.
+        if (!authenticateCredential(who, body.get("password") ?? "").ok)
             return back("problem", "Enter your Toolroll password to change sign-in.");
         if (action === "remove") {
             removeSsoSettings(options.configDir);
@@ -1397,6 +1500,8 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
                 const secret = body.get("secret") ?? "";
                 if (!tool.spec.secrets.some(one => one.name === secret))
                     return back("problem", "Choose one of this tool's secrets.");
+                if (signedIn(tool.spec))
+                    return back("problem", `${name} is connected by signing in. Sign in again from Connect to renew it.`, `#tool-${name}`);
                 setToolSecret(repo, name, secret, body.get("value") ?? "", toolHome);
                 return back("said", `Saved ${secret} for ${name}. It is never shown again.`, `#tool-${name}`);
             }
@@ -1603,7 +1708,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
             const nonceKey = `project-instructions:${project}`;
             if (step === "preview") {
                 const nonce = mintApprovalNonce(who.name, nonceKey, preview.fingerprint);
-                return sendScreen(response, 200, screen("Review agent instructions", html `<h1>Review agent instructions</h1><p>${preview.plan.skillPath}</p><pre class="recap">${preview.content}</pre>${postForm("/control/instructions-approve", html `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label><button>Add these instructions</button>`, { hidden: { repo: project, nonce, fingerprint: preview.fingerprint } })}`, { chrome: chromeFor(project, "settings") }));
+                return sendScreen(response, 200, screen("Review agent instructions", html `<h1>Review agent instructions</h1><p>${preview.plan.skillPath}</p><pre class="recap">${preview.content}</pre>${postForm("/control/instructions-approve", html `${reauth(html `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label>`)}<button>Add these instructions</button>`, { hidden: { repo: project, nonce, fingerprint: preview.fingerprint } })}`, { chrome: chromeFor(project, "settings") }));
             }
             if (who.via === "cookie" && !consumeApprovalNonce(body.get("nonce") ?? "", who.name, nonceKey, body.get("fingerprint") ?? ""))
                 return refuse(response, who, 409, "This instruction preview expired. Review it again.", "/control");
@@ -1647,7 +1752,8 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
             savePrimary(dir, "slack");
             return redirect(response, "/settings/slack");
         }
-        if (!authenticateApprover(who, body.get("password") ?? "").ok)
+        // Connecting or pairing opens a way to act from Slack: a credential act. Unpairing or disconnecting only closes one.
+        if (!(action === "connect" || action === "pair" ? authenticateCredential(who, body.get("password") ?? "") : authenticateApprover(who, body.get("password") ?? "")).ok)
             return show("Enter your Toolroll password to change Slack access.", 403);
         const generation = store.accountOf(who.name).generation;
         if (action === "connect") {
@@ -1750,6 +1856,11 @@ ${postForm("/settings/chat-approval/save", html `\
             return show("Submit one value for each field.");
         if (botId === null)
             return show("Connect the Telegram bot first.", 409);
+        // Pairing a phone is a credential act (a typed password, always); unpairing only closes a way in.
+        if (op === "unpair" && authenticateApprover(who, body.get("password") ?? "").ok) {
+            store.unpairTelegram(botId, who.name, now);
+            return redirect(response, "/settings/telegram");
+        }
         const pairingIdentity = authenticateAccount(store, who.name, body.get("password") ?? "");
         if (!pairingIdentity.ok || pairingIdentity.role !== "approver" || pairingIdentity.generation !== who.session.generation)
             return show("Enter your Toolroll password to change your phone pairing.", 403);
@@ -1780,7 +1891,7 @@ ${postForm("/settings/chat-approval/save", html `\
             savePrimary(dir, "teams");
             return redirect(response, "/settings/teams");
         }
-        if (!authenticateApprover(who, body.get("password") ?? "").ok)
+        if (!(action === "connect" || action === "pair" ? authenticateCredential(who, body.get("password") ?? "") : authenticateApprover(who, body.get("password") ?? "")).ok)
             return show("Enter your Toolroll password to change Teams access.", 403);
         const generation = store.accountOf(who.name).generation;
         if (action === "connect") {
@@ -1837,7 +1948,7 @@ ${postForm("/settings/chat-approval/save", html `\
             savePrimary(dir, "discord");
             return redirect(response, "/settings/discord");
         }
-        if (!authenticateApprover(who, body.get("password") ?? "").ok)
+        if (!(action === "connect" || action === "pair" ? authenticateCredential(who, body.get("password") ?? "") : authenticateApprover(who, body.get("password") ?? "")).ok)
             return show("Enter your Toolroll password to change Discord access.", 403);
         const generation = store.accountOf(who.name).generation;
         if (action === "connect") {
@@ -1976,6 +2087,8 @@ ${postForm("/settings/chat-approval/save", html `\
         const provider = body.get("provider") ?? "";
         if (!isProviderId(provider))
             return refuse(response, who, 400, "unknown provider", "/settings");
+        if (!isKeyedProvider(provider))
+            return refuse(response, who, 400, `${ACP_AGENTS[provider].name} signs in its own way — Toolroll keeps no key for it`, "/settings");
         if (op === "clear") {
             const cleared = clearProviderKey(provider, providerHome);
             const clearedMode = readAuthMode(provider, providerHome);
@@ -2159,7 +2272,8 @@ ${modeWords(terms)
             return refuse(response, who, 409, "the terms moved while you were reading — read them again", "/mode");
         }
         const token = body.get("token") ?? "";
-        if (!authenticateApprover(who, token).ok) {
+        // A mode that lets a chat app approve opens a way to act: a credential act. Any other mode is an ordinary one.
+        if (!(body.get("chat-approve") === "1" ? authenticateCredential(who, token) : authenticateApprover(who, token)).ok) {
             return refuse(response, who, 403, "signing a mode takes your password, typed again", "/mode");
         }
         store.signMode({
@@ -2345,6 +2459,8 @@ ${modeWords(terms)
         "settings.backups": backupsPage,
         "settings.data": dataPage,
         "settings.sign-in": signInPage,
+        "settings.passwordless": passwordlessPage,
+        "settings.passwordless-send": passwordlessSave,
         "settings.lead": leadPage,
         "settings.teams": teamsPage,
         "settings.discord": discordPage,
@@ -2358,12 +2474,15 @@ ${modeWords(terms)
         "settings.page": settingsHome,
         "provider.resume": providerResume,
         "settings.updates-dismiss": updatesDismiss,
+        "session.forget-password": forgetPassword,
         "settings.updates-checks": updatesChecks,
         "settings.skills-revise": skillsRevise,
         "settings.skills-import": skillsAct("import"),
         "settings.skills-change": skillsAct("change"),
         "spend.budget": spendBudget,
         "settings.project-concurrency": projectConcurrency,
+        "settings.project-live-view": projectLiveView,
+        "settings.project-network": projectNetwork,
         "settings.project-delete": projectDelete,
         "settings.policy-send": policySave,
         "settings.approval-send": approvalSave,

package/dist/server/sweeps.d.ts

@@ -0,0 +1,4 @@
+import type { ServerRuntime } from "./runtime.js";
+export declare function createSweepHandlers(runtime: ServerRuntime): {
+    registrations: import("./handler-registry.js").Registration[];
+};

package/dist/server/sweeps.js

@@ -0,0 +1,58 @@
+/**
+ * A lead sweep's table (docs/plans/lead-fan-out.md): every child with its state, its verdict and its result, read from
+ * facts on each look (the page follows the console's live beat). The only sweep-wide act is "cancel the rest"; steer,
+ * cancel or retry one child is that task's own page.
+ */
+import { CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
+import { html, postForm } from "../html.js";
+import { cancelSweepRest, sweepLine, sweepOpen, sweepOpenDigest, sweepTable } from "../lead-sweep.js";
+import { refuse, screen } from "./chrome.js";
+import { handlersOf } from "./handler-registry.js";
+import { redirect } from "./http.js";
+const SWEEP_PATH = /^\/sweeps\/([1-9][0-9]{0,9})(?:\/cancel-rest)?$/;
+const STATE_WORDS = {
+    working: "Working", checking: "Checking", "needs-decision": "Needs you", "ready-to-check": "Ready", complete: "Complete", cancelled: "Cancelled", missing: "Gone",
+};
+export function createSweepHandlers(runtime) {
+    const { store, clock, sendScreen, chromeFor, evidenceRoot, consoleProjects, liveRefreshSeconds } = runtime;
+    const readable = () => runtime.workAccess().repos ?? consoleProjects();
+    async function page(ctx) {
+        const { url, who, response } = ctx;
+        const id = Number(SWEEP_PATH.exec(url.pathname)?.[1]);
+        const table = sweepTable(store, id, clock(), readable(), evidenceRoot);
+        if (table === null)
+            return refuse(response, who, 404, "There's no sweep at this address you can see.", "/chat");
+        const said = url.searchParams.get("said");
+        const rows = table.rows.map(row => html `<tr data-sweep-row="${row.ordinal}">
+      <td>${row.ordinal + 1}</td>
+      <td><a href="/t/${encodeURIComponent(row.task)}">${row.label}</a></td>
+      <td><span class="chip">${STATE_WORDS[row.state]}</span></td>
+      <td>${row.verdict === null ? html `<span class="meta">—</span>` : html `<strong>${row.verdict.verdict}</strong> <span class="meta">${row.verdict.why}</span>`}</td>
+      <td>${row.result === null ? "" : html `<a href="/t/${encodeURIComponent(row.result.taskId)}">Result →</a>`}</td>
+    </tr>`);
+        // The form names exactly what it would act on (each item's active task, state and attempt): a change is refused.
+        const open = sweepOpen(store, table, clock());
+        const running = open.filter(one => one.run !== null).length;
+        const cancel = who.role !== "approver" || open.length === 0 ? "" : html `<details class="card"><summary>Cancel the rest (${open.length})</summary>${postForm(`/sweeps/${id}/cancel-rest`, html `<p>Cancels ${open.length - running} unfinished item${open.length - running === 1 ? "" : "s"}${running === 0 ? "" : ` and stops ${running} running build${running === 1 ? "" : "s"}`}: ${open.map(one => one.label).join(", ")}. Finished results stay.</p><label class="arm"><input type="checkbox" name="confirm" value="yes" required> Cancel the rest</label><button class="danger">Cancel the rest</button>`, { hidden: { snapshot: sweepOpenDigest(open) } })}</details>`;
+        const body = html `<h1>${table.title}</h1>${said === null ? "" : html `<p role="status">${said}</p>`}
+      <p class="meta">${sweepLine(table)} · at most ${table.maxParallel} at once · each item is its own task in its own worktree</p>
+      <table class="sweep-table"><thead><tr><th>#</th><th>Item</th><th>State</th><th>Verdict</th><th></th></tr></thead><tbody>${rows}</tbody></table>${cancel}`;
+        return sendScreen(response, 200, screen(table.title, body, { chrome: chromeFor(table.repo, "work"), refreshSeconds: liveRefreshSeconds() }));
+    }
+    async function cancelRest(ctx) {
+        const { url, who, response, posted } = ctx;
+        const id = Number(SWEEP_PATH.exec(url.pathname)?.[1]);
+        const body = readForm(posted, CONSOLE_FORMS.sweep);
+        const table = sweepTable(store, id, clock(), readable(), evidenceRoot);
+        if (table === null)
+            return refuse(response, who, 404, "There's no sweep at this address you can see.", "/chat");
+        if (body.get("confirm") !== "yes")
+            return redirect(response, `/sweeps/${id}?said=${encodeURIComponent("Tick the box to cancel the rest.")}`);
+        const now = clock();
+        const open = sweepOpen(store, table, now);
+        if (body.get("snapshot") !== sweepOpenDigest(open))
+            return redirect(response, `/sweeps/${id}?said=${encodeURIComponent("The sweep changed while you were reading. Look again, then cancel.")}`);
+        return redirect(response, `/sweeps/${id}?said=${encodeURIComponent(cancelSweepRest(store, who.name, open, now, "web"))}`);
+    }
+    return { registrations: handlersOf("tasks", { "sweep.page": page, "sweep.cancel-rest": cancelRest }) };
+}

package/dist/server/task-views.d.ts

@@ -11,6 +11,7 @@ import { type ProjectPeek, type WorkRow } from "./render-pages.js";
 import { type CompletionReceiptView, type ResultDetail, type TaskPullRequest } from "./render-results.js";
 import { taskBody, type MilestoneProgressView, type PlanContractView, type PlanRevisionLedgerView, type RevisionDocView, type RevisionView, type RouteView } from "./render-tasks.js";
 import { type Who } from "./session.js";
+import type { TaskPageExtras } from "./runtime.js";
 import type { PlanRevision, TaskRef } from "../store.js";
 import { type Run, type Store, type Task, type TaskState } from "../store.js";
 import { type ReviewFacts } from "../workspace-ui.js";
@@ -74,7 +75,7 @@ export declare function createTaskViews(runtime: TaskViewsRuntime): {
         level: "quick" | "full";
         returnTo: string;
     } | null;
-    taskScreen: (response: ServerResponse, who: Who, taskId: string, problem: string | null, status: number, scopeDraft?: URLSearchParams, cancelDraft?: string, editPlan?: boolean) => void;
+    taskScreen: (response: ServerResponse, who: Who, taskId: string, problem: string | null, status: number, scopeDraft?: URLSearchParams, cancelDraft?: string, editPlan?: boolean, extras?: TaskPageExtras) => void;
     armTaskResume: (response: ServerResponse, who: Who, taskId: string, named: string, returnTo: "chat" | "task", now: Date) => void;
     planViewOf: (taskRef: number) => {
         document: string;

package/dist/server/task-views.js

@@ -1,6 +1,9 @@
+import { approvalProofOf, freshlyApprovable, freshnessFor, withFreshness } from "../scope.js";
+import { liveAttemptOf, steerControlsFor } from "../steer-controls.js";
+import { originOf } from "../task-source.js";
 import { taskBaseOf } from "../task-base.js";
 import { assignmentPresentationOf, historicalAssessmentReason } from '../assignment-presentation.js';
-import { html, joinHtml } from "../html.js";
+import { html, htmlString, joinHtml } from "../html.js";
 import { assignmentStatusOf, assignmentWithEvidence } from '../assignment-ui.js';
 import { assignmentOf } from '../assignment.js';
 import { knowledgeContextHtml } from "../knowledge-ui.js";
@@ -18,7 +21,7 @@ import { taskFingerprint } from "../task-live.js";
 import { pullRequestFactOf } from '../task-status.js';
 import { openWorkDecisionOf } from "../work-summary.js";
 import { learningHtml } from "../workspace-ui.js";
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import {} from "node:http";
 import { agentChoicesFor, routeOfTask } from "../agentconfig.js";
 import { rulesSummary } from "../approval-rules-ui.js";
@@ -41,6 +44,8 @@ import {} from "./render-pages.js";
 import { completionReceiptView, diffFileAnchor, evidenceLinksFor, followUpsFor, orderChangedFiles, parseReviewDiff, proofBundleView, receiptStatusOf, withinSignedTouches } from "./render-results.js";
 import { approvalFormDigest, consentDoorOf, nonceHashOf, publicationFactsOf, resumeCeremonyPage, resumeDigestOf, taskBody, taskPage } from "./render-tasks.js";
 import {} from "./session.js";
+import { RESULT_REVIEW_SCRIPT } from "../result-review.js";
+import { reviewEvidenceScript } from "./render-results.js";
 import { budgetHoldWords, budgetLabel, monthOf } from "../spend.js";
 import {} from "../store.js";
 import { taskControlOf } from "../task-control.js";
@@ -367,6 +372,8 @@ export function createTaskViews(runtime) {
             repairChain: completion !== null ? null : runtime.store.repairChainForDraft(taskId),
             repo: ref?.repo ?? null,
             filedVia: runtime.store.filedViaOf(taskId),
+            // v126: where the work came from (a flow, an outside event), from what was kept when it was filed.
+            origin: (() => { const repos = runtime.workAccess().repos; return originOf(runtime.store, taskId, repo => repos === null || repos.includes(repo)); })(),
             coordinator: (() => {
                 const who = runtime.store.coordinatorProvenanceOf(taskId);
                 if (who === null)
@@ -485,6 +492,31 @@ export function createTaskViews(runtime) {
             steering: ref === null ? [] : runtime.store.listSteerNotes(ref.id),
             base: taskBaseOf(runtime.store, taskId),
             steeringLive: ref !== null && runtime.store.steeringLiveBuild(ref.id, now) !== null,
+            steeringRun: ref === null ? null : runtime.store.steeringLiveBuild(ref.id, now),
+            approvalProof: (() => {
+                // The proof of the approval shown: its approver, its exact sealed digest (approvedDigest === digest when approved).
+                const scope = ref === null ? null : runtime.store.getScope(ref.externalId);
+                return scope === null || scope.approvedBy === null || scope.approvedDigest === null ? null
+                    : approvalProofOf(runtime.store, ref.externalId, scope.approvedBy, scope.approvedDigest);
+            })(),
+            // Cockpit B2: whether this person's remembered password may approve these exact terms (the same rule approve()
+            // applies), and since when.
+            approvalFresh: (() => {
+                const scope = ref === null ? null : runtime.store.getScope(ref.externalId);
+                if (scope === null || who?.via !== "cookie")
+                    return null;
+                const fresh = withFreshness("approve-standard", () => freshnessFor(who.name, Date.now(), true));
+                if (fresh === null)
+                    return null;
+                const gate = runtime.store.approvalGate(ref.externalId, who.name, "person");
+                return freshlyApprovable(runtime.store, ref.externalId, scope, gate.verdict === "seal" && !gate.protectedWork) ? new Date(fresh.at).toISOString() : null;
+            })(),
+            steerRecent: ref === null ? [] : runtime.store.runsFor(ref.id).filter(one => one.outcome !== null).map(one => one.id).sort((a, b) => b - a).slice(0, 5),
+            // The running attempt's composer, for an approver on a browser session (steer-controls.ts).
+            steerComposer: (() => {
+                const run = ref === null ? null : liveAttemptOf(runtime.store, ref.id, now);
+                return run === null ? null : steerControlsFor(runtime.store, ref.externalId, run, now, who?.role === "approver");
+            })(),
             // "publishes as" reads ONLY publicationGrantFor(repo) — the grant
             // the publisher would act under — never listGrants(), which is
             // dispatch authority (slice 1c).
@@ -584,6 +616,7 @@ export function createTaskViews(runtime) {
                     deliverable: view.deliverable ?? "branch",
                     revision: view.revision ?? null,
                     coordinator: view.coordinator ?? null,
+                    origin: view.origin ?? null,
                     repairChain: view.repairChain ?? null,
                 },
             decisions: (view?.decisions ?? runtime.store.decisionsForTask(ref.id))
@@ -690,7 +723,53 @@ export function createTaskViews(runtime) {
             return null;
         return { action: `/r/${runId}/checks`, level: followUps.full ? "full" : "quick", returnTo };
     }
-    function taskScreen(response, who, taskId, problem, status, scopeDraft, cancelDraft, editPlan = false) {
+    /**
+     * One page per task (docs/plans/one-page-task-and-agent.md): the tab the address named, the Result tab's result with
+     * every result attempt to pick from, and every link that would open a result page of this family (its /review deep
+     * link, a build's /r/<n>) pointed at this page's Result tab instead — the person stays on the task.
+     */
+    function onePageView(view, family, runs, extras) {
+        const root = family?.root.id ?? view.id;
+        const current = family?.current.id ?? view.id;
+        const versions = new Set(family?.versions.map(one => one.id) ?? [view.id]);
+        const results = new Map(runs.filter(run => runIsTaskResult(run) && (extras.admissible === undefined || extras.admissible.has(run.id))).map(run => [run.id, run.taskId]));
+        const tabHref = (taskId, run, section, hash) => `${taskHref(root)}?${taskId !== current ? `version=${encodeURIComponent(taskId)}&` : ""}tab=result${run === null ? "" : `&run=${run}`}${section === null || section === "summary" ? "" : `&section=${section}`}${hash}`;
+        const toTab = (href) => {
+            const review = /^\/review\?result=([A-Za-z0-9._~%-]{1,200})(?:&run=([0-9]{1,15}))?(?:&tab=(summary|changes|checks))?(#[A-Za-z0-9_-]{1,120})?$/.exec(href);
+            if (review !== null) {
+                const taskId = decodeURIComponent(review[1]);
+                if (versions.has(taskId))
+                    return tabHref(taskId, review[2] === undefined ? null : Number(review[2]), review[3] ?? null, review[4] ?? "");
+            }
+            const record = /^\/r\/([0-9]{1,15})$/.exec(href);
+            if (record !== null && results.has(Number(record[1])))
+                return tabHref(results.get(Number(record[1])), Number(record[1]), null, "");
+            return href;
+        };
+        const link = (one) => one === null ? null : { ...one, href: one.href === null ? null : toTab(one.href) };
+        const status = view.status === null ? null : { ...view.status, action: view.status.action === null ? null : link(view.status.action),
+            status: { ...view.status.status, details: view.status.status.details.map(one => ({ ...one, href: one.href === null ? null : toTab(one.href), action: one.action === null ? null : link(one.action) })) } };
+        const selected = extras.result?.selected ?? null;
+        const attempts = [...results.entries()].sort((a, b) => b[0] - a[0]).map(([id, taskId]) => {
+            const run = runs.find(one => one.id === id);
+            const outcome = run.outcome === "built" ? "result" : run.outcome === "no-change" ? "no change" : run.outcome === null ? "never finished" : run.outcome;
+            return { label: `${run.role === "scout" ? "Report" : "Build"} #${id} · ${outcome}`, href: tabHref(taskId, id, null, ""), current: selected?.build === id };
+        });
+        return {
+            ...view,
+            status,
+            ...(view.failure == null ? {} : { failure: { ...view.failure, link: link(view.failure.link) } }),
+            ...(view.earlier == null ? {} : { earlier: { ...view.earlier, attempts: view.earlier.attempts.map(one => ({ ...one, href: toTab(one.href) })) } }),
+            ...(view.thread === undefined ? {} : { thread: view.thread.map(one => ({ ...one, link: link(one.link) })) }),
+            // The previous result's fold moves to the Result tab when there is one.
+            sections: selected === null ? view.sections : view.sections.filter(one => one.id !== "result"),
+            tab: extras.tab ?? "activity",
+            result: selected === null ? null : { selected, current: extras.result.current, attempts,
+                // Fresh per-render request tokens (32 hex) are not what it shows: left out, so an unchanged result keeps its stamp.
+                revision: createHash("sha256").update(JSON.stringify(selected).replace(/\b[a-f0-9]{32}\b/g, "")).digest("hex").slice(0, 16) },
+        };
+    }
+    function taskScreen(response, who, taskId, problem, status, scopeDraft, cancelDraft, editPlan = false, extras = {}) {
         const admittedFamily = runtime.familyOf(taskId);
         if (admittedFamily?.problem != null)
             return runtime.sendScreen(response, status, screen(admittedFamily.root.title, html `<h1>${admittedFamily.root.title}</h1><p>${admittedFamily.current.state}</p><p class="problem" data-history-problem>${admittedFamily.problem}</p>`, { chrome: runtime.chromeFor(admittedFamily.root.repo, "tasks") }));
@@ -738,10 +817,21 @@ export function createTaskViews(runtime) {
                     catch {
                         return null;
                     } })() } } : {}) } : page.workspace?.view;
+        // A refusal that keeps a draft (a scope edit, an armed cancel) or asks for the plan editor reopens on Plan, where the
+        // draft and its error are; anything else on Activity unless the address named a tab.
+        const tab = extras.tab ?? (scopeDraft !== undefined || cancelDraft !== undefined || editPlan ? "plan" : "activity");
+        const oneTaskView = taskView?.kind === "task" ? onePageView(taskView, family, presentedData.family?.runs ?? data.runs.map(run => ({ ...run, taskId: data.task.id })), { ...extras, tab }) : taskView;
+        // The Result tab's no-script page, under the task's own (the same HTML its result page serves), and its script.
+        if (extras.result != null) {
+            page.body = html `${page.body}<section class="task-result-tab" id="task-result" aria-label="Result">${extras.result.html}</section>`;
+            // The result's own script, as its result page ships it (a password form there keeps it too: Request changes and
+            // the line notes need it).
+            page.functional = { script: `${page.functional?.script ?? ""}${reviewEvidenceScript()}${RESULT_REVIEW_SCRIPT}`, fetches: page.functional?.fetches ?? false };
+        }
         if (docked !== null)
-            page.workspace = { ...page.workspace, ...(taskView === undefined ? {} : { view: taskView }), conversation: docked, pageHtml: page.body };
-        else if (taskView !== undefined && page.workspace !== undefined)
-            page.workspace = { ...page.workspace, view: taskView };
+            page.workspace = { ...page.workspace, ...(oneTaskView === undefined ? {} : { view: oneTaskView }), conversation: docked, pageHtml: page.body };
+        else if (oneTaskView !== undefined && page.workspace !== undefined)
+            page.workspace = { ...page.workspace, view: oneTaskView };
         page.refreshSeconds = runtime.liveRefreshSeconds();
         return runtime.sendScreen(response, status, page);
     }