toolroll 0.9.63 → 0.9.65

package/dist/live.d.ts

@@ -13,6 +13,7 @@
  * Fail-soft everywhere: a live view that cannot be written must never
  * break, slow, or reclassify a build.
  */
+import { type KeyState, type LiveActivityKind, type LiveRecord, type LiveRecorderOptions } from "./live-records.js";
 export declare const LIVE_LINE_CAP: number;
 export declare const LIVE_FILE_CAP: number;
 export declare const LIVE_CAP_MARKER = "[the live view stopped at its size cap \u2014 the run record continues]";
@@ -23,29 +24,18 @@ export declare const LIVE_RETAIN_MS: number;
 export declare const LIVE_FILE_BOUND = 500;
 export declare function liveDir(root: string): string;
 /** The exact filename, from the numeric id and nothing else — no user
- * input is ever parsed into this path. */
+ * input is ever parsed into this path. Records (`.jsonl`) are what every
+ * run writes now; the name is the format. */
 export declare function liveLogPath(root: string, runId: number): string;
-/**
- * The fixed tool vocabulary. Known harness tools map to OUR kinds and
- * phrases; anything unrecognized gets the generic one. The tool's own
- * name, arguments, and metadata never reach the file: a tool named after
- * a secret stays unspoken.
- */
-export type LiveActivityKind = "session" | "message" | "edit" | "command" | "read" | "search" | "lookup" | "plan" | "delegate" | "tool";
-export declare const LIVE_ACTIVITY_KINDS: readonly LiveActivityKind[];
+/** The plain-text file runs wrote before the live conversation; read until it ages out. */
+export declare function legacyLiveLogPath(root: string, runId: number): string;
+export { LIVE_ACTIVITY_KINDS, type LiveActivityKind } from "./live-records.js";
 /**
  * What one stream event says the agent just did, as one fixed kind: the
  * last-activity line's only input. Never text, names or arguments; an
  * event that says nothing (results, deltas, subagent chatter) is null.
  */
 export declare function liveActivityKind(event: Record<string, unknown>): LiveActivityKind | null;
-/**
- * One stream event → zero or more display lines, in the fixed vocabulary.
- * Assistant TEXT is the agent's own words (sanitized below); tool use is a
- * headline; everything else — tool results, deltas, results, subagent
- * chatter — renders nothing in v1.
- */
-export declare function renderTranscriptLines(event: Record<string, unknown>): string[];
 /** Sanitize one display line: strip controls and bidi overrides, redact whole on any secret hit, cap. */
 export declare function sanitizeTranscriptLine(line: string): string;
 export type LiveLog = {
@@ -53,31 +43,52 @@ export type LiveLog = {
     close(): void;
 };
 /**
- * Open the run's live file for appending. The directory is 0700, the file
- * 0600 and CREATED HERE (O_EXCL: a name that already exists — whatever put
- * it there — is refused, not appended to), opened O_NOFOLLOW with the
- * descriptor retained for the run's whole duration. Returns null on any
- * failure: no live view is ever worth a build.
+ * Open the run's live file for appending records. The directory is 0700,
+ * the file 0600 and CREATED HERE (O_EXCL: a name that already exists —
+ * whatever put it there — is refused, not appended to), opened O_NOFOLLOW
+ * with the descriptor retained for the run's whole duration. `options` is
+ * the run's trusted context: its checkout, and whether its project shows
+ * commands (read once, here). Returns null on any failure: no live view is
+ * ever worth a build.
  */
-export declare function openLiveLog(root: string, runId: number): LiveLog | null;
+export declare function openLiveLog(root: string, runId: number, options?: Partial<LiveRecorderOptions>): LiveLog | null;
+export type LiveFormat = "records" | "text";
 export type LiveWindowRead = {
     ok: true;
+    /** Complete lines read from `from`: records (JSON lines) or legacy text. */
     text: string;
     nextOffset: number;
     eof: boolean;
+    format: LiveFormat;
+    /** Which file this offset belongs to: a client holding another resets. */
+    gen: string;
 } | {
     ok: false;
     reason: "missing" | "replaced" | "unreadable";
 };
 /**
  * Read the live file from a byte offset, returning only COMPLETE lines
- * (through the last LF in the window). The descriptor is the authority:
- * opened O_NOFOLLOW, proved a regular file, measured and read through
- * itself. A file smaller than the offset was replaced — the caller resets,
- * visibly, never silently duplicating (arc 1 §4). `allowTail` (the final
- * drain) returns the unterminated tail after finalization.
+ * (through the last LF in the window). The records file is read when it
+ * exists, else the legacy text file. The descriptor is the authority:
+ * opened O_NOFOLLOW | O_NONBLOCK inside a real live directory, proved a
+ * regular file, measured and read through itself. A file smaller than the
+ * offset was replaced — the caller resets, visibly, and `gen` names the file
+ * so an offset is never reused against another one. A line longer than the
+ * whole window is skipped through its end, so a reader never stalls.
+ * `allowTail` (the final drain) returns the unterminated tail after
+ * finalization. Legacy text is cleaned again on the way out.
  */
 export declare function readLiveWindow(root: string, runId: number, from: number, allowTail?: boolean): LiveWindowRead;
+/** A window's complete lines as the plain words the run page and `toolroll peek` show, whatever its format. */
+export declare function liveWindowLines(read: {
+    text: string;
+    format: LiveFormat;
+}, keys?: KeyState): string[];
+/** A window as records, whatever its format: an older plain file's lines become the agent's words. */
+export declare function liveWindowRecords(read: {
+    text: string;
+    format: LiveFormat;
+}, keys?: KeyState): LiveRecord[];
 export type LiveSweepVerdict = {
     /** run id, or null when the name is not a run's file. */
     runId: number | null;

package/dist/live.js

@@ -13,12 +13,13 @@
  * Fail-soft everywhere: a live view that cannot be written must never
  * break, slow, or reclassify a build.
  */
-import { closeSync, constants, fstatSync, mkdirSync, openSync, readSync, readdirSync, statSync, unlinkSync, writeSync } from "node:fs";
+import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { join } from "node:path";
 import { scanForSecrets } from "./evidence.js";
+import { createLiveRecorder, LIVE_CAP_WORDS, parseLiveRecords, redactLiveLines, projectLiveText, serializeLiveRecord } from "./live-records.js";
 export const LIVE_LINE_CAP = 2 * 1024;
-export const LIVE_FILE_CAP = 2 * 1024 * 1024;
-export const LIVE_CAP_MARKER = "[the live view stopped at its size cap — the run record continues]";
+export const LIVE_FILE_CAP = 4 * 1024 * 1024;
+export const LIVE_CAP_MARKER = LIVE_CAP_WORDS;
 export const LIVE_REDACTED_LINE = "[a credential-shaped line was redacted]";
 /** Finalized runs keep their live file this long for the final drain. */
 export const LIVE_RETAIN_MS = 24 * 60 * 60 * 1000;
@@ -28,11 +29,17 @@ export function liveDir(root) {
     return join(root, "live");
 }
 /** The exact filename, from the numeric id and nothing else — no user
- * input is ever parsed into this path. */
+ * input is ever parsed into this path. Records (`.jsonl`) are what every
+ * run writes now; the name is the format. */
 export function liveLogPath(root, runId) {
+    return join(liveDir(root), `${Math.trunc(runId)}.jsonl`);
+}
+/** The plain-text file runs wrote before the live conversation; read until it ages out. */
+export function legacyLiveLogPath(root, runId) {
     return join(liveDir(root), `${Math.trunc(runId)}.log`);
 }
-export const LIVE_ACTIVITY_KINDS = ["session", "message", "edit", "command", "read", "search", "lookup", "plan", "delegate", "tool"];
+export { LIVE_ACTIVITY_KINDS } from "./live-records.js";
+/** The activity line's kinds for known Claude tools (task-activity.ts). */
 const TOOL_KINDS = new Map([
     ["Edit", "edit"],
     ["Write", "edit"],
@@ -48,18 +55,6 @@ const TOOL_KINDS = new Map([
     ["TodoWrite", "plan"],
     ["Task", "delegate"],
 ]);
-const KIND_HEADLINES = {
-    session: "the agent session started",
-    message: "",
-    edit: "→ editing files",
-    command: "→ running a command",
-    read: "→ reading the code",
-    search: "→ searching the code",
-    lookup: "→ looking something up",
-    plan: "→ organizing its plan",
-    delegate: "→ delegating to a helper",
-    tool: "→ using a tool",
-};
 const toolKind = (name) => TOOL_KINDS.get(typeof name === "string" ? name : "") ?? "tool";
 /**
  * What one stream event says the agent just did, as one fixed kind: the
@@ -119,77 +114,6 @@ function capBytes(text, cap) {
     // A cut mid-character decodes with a trailing replacement char — drop it.
     return decoded.endsWith("�") ? decoded.slice(0, -1) : decoded;
 }
-/**
- * One stream event → zero or more display lines, in the fixed vocabulary.
- * Assistant TEXT is the agent's own words (sanitized below); tool use is a
- * headline; everything else — tool results, deltas, results, subagent
- * chatter — renders nothing in v1.
- */
-export function renderTranscriptLines(event) {
-    const type = String(event["type"] ?? "");
-    if (type === "system" && String(event["subtype"] ?? "") === "init") {
-        return ["the agent session started"];
-    }
-    // Codex-shaped streams (peek): a thread starts, items complete.
-    if (type === "thread.started")
-        return ["the agent session started"];
-    if (type === "item.completed") {
-        const item = event["item"];
-        const kind = item === undefined ? "" : String(item["type"] ?? "");
-        if (kind === "agent_message") {
-            const text = item?.["text"];
-            return typeof text === "string" ? text.split("\n").filter(one => one.trim() !== "") : [];
-        }
-        if (kind === "command_execution")
-            return ["→ running a command"];
-        if (kind === "file_change")
-            return ["→ editing files"];
-        if (kind === "web_search")
-            return ["→ looking something up"];
-        return [];
-    }
-    // Gemini-shaped streams (peek): whole assistant messages, never deltas.
-    if (type === "init")
-        return ["the agent session started"];
-    if (type === "message" && String(event["role"] ?? "") === "assistant" && event["delta"] !== true) {
-        const content = event["content"];
-        return typeof content === "string" ? content.split("\n").filter(one => one.trim() !== "") : [];
-    }
-    if (type === "tool_call" || type === "tool_use") {
-        const name = event["name"] ?? event["tool"]?.["name"];
-        return [KIND_HEADLINES[toolKind(name)]];
-    }
-    if (type !== "assistant")
-        return [];
-    // Top-level only: a subagent's words are not this run's transcript.
-    const parent = event["parent_tool_use_id"];
-    if (parent !== undefined && parent !== null)
-        return [];
-    const message = event["message"];
-    const content = message?.["content"];
-    if (!Array.isArray(content))
-        return [];
-    const lines = [];
-    for (const block of content) {
-        if (block === null || typeof block !== "object")
-            continue;
-        const kind = String(block["type"] ?? "");
-        if (kind === "text") {
-            const text = block["text"];
-            if (typeof text === "string" && text.trim() !== "") {
-                for (const one of text.split("\n")) {
-                    if (one.trim() !== "")
-                        lines.push(one);
-                }
-            }
-        }
-        else if (kind === "tool_use") {
-            const name = block["name"];
-            lines.push(KIND_HEADLINES[toolKind(name)]);
-        }
-    }
-    return lines;
-}
 /** Bidirectional overrides and isolates (U+202A–U+202E, U+2066–U+2069): they can make shown text read differently from what was written. */
 const BIDI_CONTROLS = /[\u202a-\u202e\u2066-\u2069]/g;
 /** Sanitize one display line: strip controls and bidi overrides, redact whole on any secret hit, cap. */
@@ -200,13 +124,15 @@ export function sanitizeTranscriptLine(line) {
     return capBytes(stripped, LIVE_LINE_CAP);
 }
 /**
- * Open the run's live file for appending. The directory is 0700, the file
- * 0600 and CREATED HERE (O_EXCL: a name that already exists — whatever put
- * it there — is refused, not appended to), opened O_NOFOLLOW with the
- * descriptor retained for the run's whole duration. Returns null on any
- * failure: no live view is ever worth a build.
+ * Open the run's live file for appending records. The directory is 0700,
+ * the file 0600 and CREATED HERE (O_EXCL: a name that already exists —
+ * whatever put it there — is refused, not appended to), opened O_NOFOLLOW
+ * with the descriptor retained for the run's whole duration. `options` is
+ * the run's trusted context: its checkout, and whether its project shows
+ * commands (read once, here). Returns null on any failure: no live view is
+ * ever worth a build.
  */
-export function openLiveLog(root, runId) {
+export function openLiveLog(root, runId, options = {}) {
     let fd;
     try {
         mkdirSync(liveDir(root), { recursive: true, mode: 0o700 });
@@ -215,19 +141,20 @@ export function openLiveLog(root, runId) {
     catch {
         return null;
     }
+    const recorder = createLiveRecorder({ base: options.base ?? null, commands: options.commands === true, ...(options.clock === undefined ? {} : { clock: options.clock }) });
     let written = 0;
     let capped = false;
     let closed = false;
-    const append = (line) => {
+    const append = (record) => {
         if (closed || capped)
             return;
-        const payload = Buffer.from(`${line}\n`, "utf8");
-        // The marker is RESERVED inside the cap: whatever remains must still fit it.
-        const markerBytes = Buffer.byteLength(`${LIVE_CAP_MARKER}\n`, "utf8");
-        if (written + payload.length + markerBytes > LIVE_FILE_CAP) {
+        const payload = Buffer.from(`${serializeLiveRecord(record)}\n`, "utf8");
+        // The cap record is RESERVED inside the cap: whatever remains must still fit it.
+        const capLine = `${serializeLiveRecord({ k: "cap", at: record.at })}\n`;
+        if (written + payload.length + Buffer.byteLength(capLine, "utf8") > LIVE_FILE_CAP) {
             capped = true;
             try {
-                writeSync(fd, `${LIVE_CAP_MARKER}\n`);
+                writeSync(fd, capLine);
             }
             catch {
                 // Nothing to do: the file simply ends early.
@@ -248,20 +175,27 @@ export function openLiveLog(root, runId) {
             }
         }
     };
+    append({ k: "open", at: (options.clock ?? (() => new Date()))().toISOString(), detail: options.commands === true ? "commands" : "base" });
     return {
         observe(event) {
             try {
-                for (const line of renderTranscriptLines(event)) {
-                    append(sanitizeTranscriptLine(line));
-                }
+                for (const record of recorder.observe(event))
+                    append(record);
             }
             catch {
-                // Rendering is observational; a malformed event renders nothing.
+                // Recording is observational; a malformed event records nothing.
             }
         },
         close() {
             if (closed)
                 return;
+            try {
+                for (const record of recorder.end())
+                    append(record);
+            }
+            catch {
+                // the steps simply stay open in the file
+            }
             closed = true;
             try {
                 closeSync(fd);
@@ -274,28 +208,64 @@ export function openLiveLog(root, runId) {
 }
 const READ_WINDOW = 64 * 1024;
 const READ_LOOKAHEAD = 2 * 1024;
+/** How far past an over-long line one read looks for its end; past it, the line is skipped up to there. */
+const SKIP_SCAN = 64 * 1024 * 1024;
+/** The live directory itself: a real directory, never a link to one. */
+function liveDirIsReal(root) {
+    try {
+        const stat = lstatSync(liveDir(root));
+        return stat.isDirectory() && !stat.isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+function openForRead(path) {
+    try {
+        return { fd: openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK) };
+    }
+    catch (error) {
+        return error.code === "ENOENT" ? { missing: true } : { unreadable: true };
+    }
+}
+/** The line that stands in for one too long to read, in the file's own format. */
+function cutLine(format) {
+    return format === "records" ? `${serializeLiveRecord({ k: "cut", at: "" })}\n` : "[a line was too long to show]\n";
+}
 /**
  * Read the live file from a byte offset, returning only COMPLETE lines
- * (through the last LF in the window). The descriptor is the authority:
- * opened O_NOFOLLOW, proved a regular file, measured and read through
- * itself. A file smaller than the offset was replaced — the caller resets,
- * visibly, never silently duplicating (arc 1 §4). `allowTail` (the final
- * drain) returns the unterminated tail after finalization.
+ * (through the last LF in the window). The records file is read when it
+ * exists, else the legacy text file. The descriptor is the authority:
+ * opened O_NOFOLLOW | O_NONBLOCK inside a real live directory, proved a
+ * regular file, measured and read through itself. A file smaller than the
+ * offset was replaced — the caller resets, visibly, and `gen` names the file
+ * so an offset is never reused against another one. A line longer than the
+ * whole window is skipped through its end, so a reader never stalls.
+ * `allowTail` (the final drain) returns the unterminated tail after
+ * finalization. Legacy text is cleaned again on the way out.
  */
 export function readLiveWindow(root, runId, from, allowTail = false) {
     if (!Number.isSafeInteger(from) || from < 0)
         return { ok: false, reason: "unreadable" };
-    let fd;
-    try {
-        fd = openSync(liveLogPath(root, runId), constants.O_RDONLY | constants.O_NOFOLLOW);
-    }
-    catch (error) {
-        return { ok: false, reason: error.code === "ENOENT" ? "missing" : "unreadable" };
+    if (!liveDirIsReal(root))
+        return { ok: false, reason: "missing" };
+    let format = "records";
+    let opened = openForRead(liveLogPath(root, runId));
+    if ("missing" in opened) {
+        format = "text";
+        opened = openForRead(legacyLiveLogPath(root, runId));
     }
+    if ("missing" in opened)
+        return { ok: false, reason: "missing" };
+    if ("unreadable" in opened)
+        return { ok: false, reason: "unreadable" };
+    const fd = opened.fd;
     try {
-        const stat = fstatSync(fd);
+        const stat = fstatSync(fd, { bigint: true });
         if (!stat.isFile())
             return { ok: false, reason: "unreadable" };
+        // Linux hands a removed file's inode straight to the next one made, so the birth time (ns) tells them apart too.
+        const gen = `${format}:${stat.dev}:${stat.ino}:${stat.birthtimeNs}`;
         const size = Number(stat.size);
         if (size < from)
             return { ok: false, reason: "replaced" };
@@ -311,17 +281,44 @@ export function readLiveWindow(root, runId, from, allowTail = false) {
         const chunk = buffer.subarray(0, offset);
         const lastLf = chunk.lastIndexOf(0x0a);
         const eofReached = from + offset >= size;
+        const out = (text, next, eof) => ({
+            ok: true,
+            // Raw: every reader cleans and redacts through liveWindowLines / liveWindowRecords, carrying the key state.
+            text,
+            nextOffset: next,
+            eof,
+            format,
+            gen,
+        });
         if (lastLf === -1) {
-            if (allowTail && eofReached && offset > 0) {
-                return { ok: true, text: chunk.toString("utf8"), nextOffset: from + offset, eof: true };
+            if (allowTail && eofReached && offset > 0)
+                return out(chunk.toString("utf8"), from + offset, true);
+            // A whole window without an end of line: skip through its end (bounded), never stall on it.
+            if (offset === READ_WINDOW + READ_LOOKAHEAD) {
+                const scan = Buffer.alloc(64 * 1024);
+                const limit = Math.min(size, from + SKIP_SCAN);
+                let at = from + offset;
+                while (at < limit) {
+                    const read = readSync(fd, scan, 0, Math.min(scan.length, limit - at), at);
+                    if (read <= 0)
+                        break;
+                    const lf = scan.subarray(0, read).indexOf(0x0a);
+                    if (lf !== -1)
+                        return { ok: true, text: cutLine(format), nextOffset: at + lf + 1, eof: at + lf + 1 >= size, format, gen };
+                    at += read;
+                }
+                // No end within reach. A finished run's drain, or a line longer than any read looks, is cut where the
+                // look stopped, so reading always moves on; a live run's line may still be being written, so it waits.
+                if (allowTail || at >= from + SKIP_SCAN)
+                    return { ok: true, text: cutLine(format), nextOffset: at, eof: at >= size, format, gen };
+                return { ok: true, text: "", nextOffset: from, eof: false, format, gen };
             }
-            return { ok: true, text: "", nextOffset: from, eof: eofReached && offset === 0 };
-        }
-        if (allowTail && eofReached && lastLf + 1 < offset) {
-            return { ok: true, text: chunk.toString("utf8"), nextOffset: from + offset, eof: true };
+            return out("", from, eofReached && offset === 0);
         }
+        if (allowTail && eofReached && lastLf + 1 < offset)
+            return out(chunk.toString("utf8"), from + offset, true);
         const complete = chunk.subarray(0, lastLf + 1);
-        return { ok: true, text: complete.toString("utf8"), nextOffset: from + lastLf + 1, eof: from + lastLf + 1 >= size };
+        return out(complete.toString("utf8"), from + lastLf + 1, from + lastLf + 1 >= size);
     }
     catch {
         return { ok: false, reason: "unreadable" };
@@ -330,6 +327,27 @@ export function readLiveWindow(root, runId, from, allowTail = false) {
         closeSync(fd);
     }
 }
+/** A window's complete lines as the plain words the run page and `toolroll peek` show, whatever its format. */
+export function liveWindowLines(read, keys = { inKey: false }) {
+    if (read.format === "records")
+        return projectLiveText(parseLiveRecords(read.text, keys));
+    return cleanLegacy(read.text, keys).split("\n").filter(one => one !== "");
+}
+/** A window as records, whatever its format: an older plain file's lines become the agent's words. */
+export function liveWindowRecords(read, keys = { inKey: false }) {
+    if (read.format === "records")
+        return parseLiveRecords(read.text, keys);
+    return cleanLegacy(read.text, keys).split("\n").filter(one => one !== "").map(line => ({ k: "say", at: "", t: [line] }));
+}
+/** Legacy text lines, cleaned again on read: the file may have been altered after it was written. */
+function cleanLegacy(text, keys) {
+    const lines = text.split("\n");
+    const ended = lines.length > 0 && lines[lines.length - 1] === "";
+    if (ended)
+        lines.pop();
+    const shown = redactLiveLines(lines, keys);
+    return ended ? `${shown.join("\n")}\n` : shown.join("\n");
+}
 /**
  * Enumerate the live directory for the reconcile sweep. Pure listing — the
  * CALLER decides which runs are finalized and when; this module only
@@ -353,7 +371,7 @@ export function listLiveFiles(root) {
         catch {
             continue;
         }
-        const match = /^(\d{1,15})\.log$/.exec(name);
+        const match = /^(\d{1,15})\.(?:jsonl|log)$/.exec(name);
         out.push({ runId: match === null ? null : Number(match[1]), fileName: name, mtimeMs });
     }
     return out;

package/dist/mcp-oauth.d.ts

@@ -51,7 +51,9 @@ export type OAuthSession = {
     name: string;
     role: "approver" | "viewer";
     csrf: string;
-    /** Signed in with an identity provider: its name, and whether it checked the person in the last ten minutes. */
+    /** The account's credential generation this session signed in under: a code is never issued under another. */
+    generation: number;
+    /** Signed in with an identity provider: its name, and whether an explicit re-check made on request awaits one step-up. */
     sso: {
         label: string;
         fresh: boolean;
@@ -68,8 +70,9 @@ export type OAuthHttpOptions = {
     session: (request: IncomingMessage) => OAuthSession | null;
     /** A posted form came from a page of this console (its Origin, or Referer, names an allowed host). */
     sameSite: (request: IncomingMessage) => boolean;
-    /** The step-up: the person's password, or (empty) a fresh identity-provider check. */
-    confirm: (session: OAuthSession, typed: string) => boolean;
+    /** The step-up, proved at the moment of consent on this request's live session: the person's password, or (empty)
+     * an explicit identity-provider re-check, spent by this consent. */
+    confirm: (request: IncomingMessage, session: OAuthSession, typed: string) => boolean;
     /** The projects this person may choose: each a project the server knows that they can use now. */
     projectsFor: (account: string) => string[];
     /** The token exchange's budget by source (request-budget.ts): charged once per request, before its body is read or any code or refresh secret is spent. */

package/dist/mcp-oauth.js

@@ -308,8 +308,8 @@ export function createOAuthHttp(options) {
             return backToClient(response, origin, one.redirectUri, one.state, { error: "access_denied", error_description: "the person declined" }, "Cancelled. Returning to your MCP client…");
         }
         const account = store.accountOf(session.name);
-        if (account === null || account.revokedAt !== null)
-            return problemPage(response, 403, "Sign in first", "Your account can't sign in. Nothing was allowed.");
+        if (account === null || account.revokedAt !== null || account.generation !== session.generation)
+            return problemPage(response, 403, "Sign in first", "Your access changed. Sign in again; nothing was allowed.");
         const access = form.get("access") === "act" ? "act" : "read";
         const chosen = [...new Set(form.getAll("project"))];
         const again = (status, problem) => page(response, status, consentHtml(session, id, one, problem, { access, projects: chosen }));
@@ -323,11 +323,15 @@ export function createOAuthHttp(options) {
             return again(403, "Choose from your own projects.");
         if (!adapterPolicy({ caller: "cookie", capability: account.role === "approver" ? "act" : "read", viewer: account.role === "viewer" }, "step-up", source => source === "none" && chosen.every(path => mine.includes(path))).ok)
             return again(403, "Choose from your own projects.");
-        if (!options.confirm(session, form.get("password") ?? ""))
+        if (!options.confirm(request, session, form.get("password") ?? ""))
             return again(403, "Enter your Toolroll password to allow access.");
+        // Re-proved after the step-up: the code carries the generation the person consented under, never a newer one.
+        const current = store.accountOf(session.name);
+        if (current === null || current.revokedAt !== null || current.generation !== session.generation)
+            return problemPage(response, 403, "Sign in first", "Your access changed. Sign in again; nothing was allowed.");
         waiting.delete(id);
         const code = randomBytes(32).toString("base64url");
-        store.saveOAuthCode(sha256(code), { client: client.id, account: session.name, generation: account.generation, access, projects: chosen, redirectUri: one.redirectUri, resource: one.resource,
+        store.saveOAuthCode(sha256(code), { client: client.id, account: session.name, generation: session.generation, access, projects: chosen, redirectUri: one.redirectUri, resource: one.resource,
             challenge: one.challenge, expiresAt: new Date(now.getTime() + OAUTH_TIMES.codeMs).toISOString() });
         return backToClient(response, origin, one.redirectUri, one.state, { code }, "Allowed. Returning to your MCP client…");
     }

package/dist/memory-pass.js

@@ -138,11 +138,11 @@ function fileSources(repo, kind, home) {
 /** The plane's own sessions: lead threads that touched the project, and finished crew runs with their handoff and check output. */
 function planeSources(store, repo, evidenceRoot) {
     const out = [];
-    const threads = store.handle.prepare(`SELECT c.thread AS thread, c.id AS conversation, MAX(m.id) AS last, MAX(m.created_at) AS at FROM team_conversation c JOIN lead_message m ON m.thread=c.thread
+    const threads = store.handle.prepare(`SELECT c.thread AS thread, c.id AS conversation, MAX(m.id) AS last, MAX(m.created_at) AS at FROM team_conversation c JOIN lead_message m ON m.thread=c.thread AND m.pending=0
     WHERE EXISTS (SELECT 1 FROM json_each(c.projects_json) WHERE value=?) GROUP BY c.thread`).all(repo);
     for (const row of threads) {
         const thread = Number(row['thread']);
-        out.push({ id: `lead:${thread}:${Number(row['last'])}`, repo, kind: 'lead', source: `conversation:${String(row['conversation'])}`, at: String(row['at']), trace: () => redact(store.handle.prepare('SELECT role,text FROM lead_message WHERE thread=? ORDER BY id LIMIT 400').all(thread).map(m => `${m['role']}: ${clip(String(m['text']), 4000)}`).join('\n')) });
+        out.push({ id: `lead:${thread}:${Number(row['last'])}`, repo, kind: 'lead', source: `conversation:${String(row['conversation'])}`, at: String(row['at']), trace: () => redact(store.handle.prepare('SELECT role,text FROM lead_message WHERE thread=? AND pending=0 ORDER BY id LIMIT 400').all(thread).map(m => `${m['role']}: ${clip(String(m['text']), 4000)}`).join('\n')) });
     }
     const runs = store.handle.prepare(`SELECT r.id, r.role, r.finished_at, r.handoff, t.external_id FROM run r JOIN task_ref t ON t.id=r.task_ref WHERE t.repo=? AND r.role IN ('builder','repair') AND r.outcome IS NOT NULL ORDER BY r.id DESC LIMIT 100`).all(repo);
     for (const row of runs) {

package/dist/mobile-viewport.d.ts

@@ -1,3 +1,7 @@
 /** Presentation only: no fields are read, no requests are sent, and no
- * keyboard events are captured. A focused input alone is NOT a keyboard. */
+ * keyboard events are captured. A focused input alone is NOT a keyboard.
+ *
+ * It publishes the visible area (--viewport-height, --viewport-top): a phone's
+ * keyboard shrinks only the visual viewport on iOS (100dvh never moves), so a
+ * full-height app shell sized to it is what keeps the composer above the keys. */
 export declare const MOBILE_VIEWPORT_SCRIPT: string;

package/dist/mobile-viewport.js

@@ -1,10 +1,14 @@
 /** Presentation only: no fields are read, no requests are sent, and no
- * keyboard events are captured. A focused input alone is NOT a keyboard. */
+ * keyboard events are captured. A focused input alone is NOT a keyboard.
+ *
+ * It publishes the visible area (--viewport-height, --viewport-top): a phone's
+ * keyboard shrinks only the visual viewport on iOS (100dvh never moves), so a
+ * full-height app shell sized to it is what keeps the composer above the keys. */
 export const MOBILE_VIEWPORT_SCRIPT = String.raw `
 (function(){
   var root=document.documentElement,viewport=window.visualViewport;
   if(!viewport)return;
-  var phone=window.matchMedia('(max-width: 760px)'),baseline=window.innerHeight,frame=0;
+  var phone=window.matchMedia('(max-width: 900px)'),baseline=window.innerHeight,frame=0;
   function update(){
     frame=0;
     var active=document.activeElement;
@@ -18,8 +22,20 @@ export const MOBILE_VIEWPORT_SCRIPT = String.raw `
     var opening=open&&!root.hasAttribute('data-mobile-keyboard');
     var atEnd=opening&&window.innerHeight+window.scrollY>=root.scrollHeight-120;
     root.toggleAttribute('data-mobile-keyboard',Boolean(open));
+    // A pinch zoom shrinks the visual viewport too, and then a keyboard can't be told from the zoom: zoomed, the shell
+    // is the whole screen (the reader pans to the field), so a keyboard closed while zoomed never leaves it short.
+    if(Math.abs(viewport.scale-1)<0.01){
+      root.style.setProperty('--viewport-height',Math.round(viewport.height)+'px');
+      root.style.setProperty('--viewport-top',Math.max(0,Math.round(viewport.offsetTop))+'px');
+    }else{
+      root.style.removeProperty('--viewport-height');
+      root.style.removeProperty('--viewport-top');
+    }
     root.style.setProperty('--keyboard-inset',open?Math.round(gap)+'px':'0px');
     if(atEnd)window.scrollTo({top:root.scrollHeight,behavior:'instant'});
+    // In the app shell the field sits in its own scrolling panel, which the shell's new size just cut short:
+    // bring it back into that panel's view once the smaller layout is in.
+    if(opening&&active.closest('.so-workspace'))requestAnimationFrame(function(){active.scrollIntoView({block:'nearest',behavior:'instant'});});
   }
   function schedule(){if(!frame)frame=requestAnimationFrame(update);}
   viewport.addEventListener('resize',schedule);

package/dist/model-catalog.js

@@ -6,6 +6,7 @@
  * installed CLIs are current. Everything lands in orders.db so pickers,
  * spend pins and "new model" notices read one saved snapshot.
  */
+import { isAcpProvider } from "./acp-agents.js";
 import { execFile } from "node:child_process";
 import { accessSync, constants, lstatSync, readFileSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
@@ -197,6 +198,9 @@ export function modelOptions(store, provider, now, home = homedir()) {
     }
     if (provider === "gemini")
         return seenModels(store, "gemini").slice(0, 20).map(option);
+    // An ACP agent offers only the models its check recorded, on the runner that checked it — read there, never guessed.
+    if (isAcpProvider(provider))
+        return [];
     return seenModels(store, "openrouter").filter(model => model.tools).sort((a, b) => a.name.localeCompare(b.name)).map(option);
 }
 /** Chat reserves worst-case spend: price per token in whole micro-dollars,