toolroll 0.9.63 → 0.9.65

package/dist/server/pages.js

@@ -1,5 +1,8 @@
+import { steerControlsFor } from "../steer-controls.js";
+import { canReveal, cdCommandOf, localCheckoutOf } from "../checkout-proof.js";
+import { instanceHttpAnswer } from "../console-instance.js";
 import { handlersOf } from './handler-registry.js';
-import { html, joinHtml, postForm } from "../html.js";
+import { html, joinHtml, postForm, reauth } from "../html.js";
 /** pages handlers, moved without changing their route bodies. */
 import { createHmac, randomBytes } from "node:crypto";
 import { existsSync, opendirSync, readdirSync, realpathSync } from "node:fs";
@@ -21,7 +24,7 @@ import { run as execRun } from "../exec.js";
 import { computeGaps } from "../gaps.js";
 import { LEDGER_CSV_HEADER, ledgerCsvRows } from "../ledger-csv.js";
 import { ledgerBody } from "../ledger-view.js";
-import { agentRowOf, agentsBoardOf, agentFactsFor, sealedDiffOf } from "../agents-board.js";
+import { agentLanesOf, agentRowOf, agentsBoardOf, agentFactsFor, laneWindowOf, sealedDiffOf } from "../agents-board.js";
 import { markAgentSeen } from "../agent-board.js";
 import { prometheusMetrics } from "../metrics.js";
 import { readMonitoring } from "../monitoring-settings.js";
@@ -37,12 +40,14 @@ import { serveInstallAsset } from "./pages-assets.js";
 import { healthz } from "./remote-hooks.js";
 import { projectChip, refuse, regionScript, relativeAge, screen, settingsRows, transcriptScript, WORKSPACE_STYLE, workToolRows } from "./chrome.js";
 import { redirect, respond, safeReturn, SAFETY, taskHref } from "./http.js";
+import { assignmentOf } from "../assignment.js";
+import { assignmentTaskStatusOf } from "../assignment-presentation.js";
 import { browsePage, fleetBody, fleetScript, githubIdentityOf, githubReposPage, homePage, originUrlOf, portfolioOverview, projectsPage, systemPage, workbenchRail } from "./render-pages.js";
 import { capsPage } from "./render-settings.js";
 import { decisionAnswerScript, taskBody } from "./render-tasks.js";
 import {} from "./session.js";
 export function createPagesHandlers(runtime) {
-    const { clock, store, visible, consoleProjects, restricted, ceiling, options, projectFamilyPeek, sendScreen, chromeFor, unscopedMode, admissionList, taskRepoOf, taskViewData, runVisible, evidenceRoot, workAccess, identify, liveCeiling, sessions, deletedRepos, authenticateApprover, projectOf, lookupSession } = runtime;
+    const { clock, store, visible, consoleProjects, restricted, ceiling, options, projectFamilyPeek, sendScreen, chromeFor, unscopedMode, admissionList, taskRepoOf, taskViewData, runVisible, evidenceRoot, workAccess, identify, liveCeiling, sessions, deletedRepos, authenticateApprover, authenticateCredential, projectOf, lookupSession } = runtime;
     // The filesystem browser (operator request): pick a project folder by
     // looking, not typing. CONFINED to exactly what opening allows —
     // explicit --repo mode has an enumerable list and gets no browser at
@@ -382,11 +387,57 @@ export function createPagesHandlers(runtime) {
     /** What the board says after a Reply or a steer, in fixed words (never text from the address). */
     const AGENT_SAID = {
         replied: { tone: "info", text: "Reply sent. The agent reads it at its next check." },
-        steered: { tone: "info", text: "Note sent. The agent reads it at its next check." },
+        steered: { tone: "info", text: "Note sent. It shows in the conversation with whether the agent has read it." },
+        "steer-ended": { tone: "error", text: "That attempt ended before your note, so nothing was sent. Your note is kept below." },
+        "steered-next": { tone: "info", text: "Note sent. The task's next attempt reads it before starting." },
+        "steer-next-finished": { tone: "error", text: "This task is finished, so there's no next attempt to send it to. Your note is kept below." },
+        "steer-invalid": { tone: "error", text: "That note will not store. Your note is still in the box." },
+        "steer-stale": { tone: "error", text: "That form was already used. Your note is still in the box — send it again." },
         "reply-closed": { tone: "error", text: "That question was already answered." },
         "reply-stale": { tone: "error", text: "This attempt ended before your reply, so nothing was sent." },
         "reply-invalid": { tone: "error", text: "Write a reply of up to 1,500 characters." },
+        "steer-no-notes": { tone: "error", text: "This agent takes no notes right now, so nothing was sent. Stop it to change its course." },
+        stopping: { tone: "info", text: "Stopping. The work so far is kept." },
+        pausing: { tone: "info", text: "Pausing. It stops at the end of its current step." },
+        "pausing-with-note": { tone: "info", text: "Pausing. Your note goes to it as soon as it stops." },
+        "pause-note-stale": { tone: "error", text: "That form was already used, so your note was not sent. It is still in the box — send it again." },
+        resuming: { tone: "info", text: "Resuming. It carries on where it stopped." },
+        revealed: { tone: "info", text: "Shown in Finder." },
+        "reveal-refused": { tone: "error", text: "That checkout couldn't be shown: it isn't this attempt's running checkout on this computer any more." },
+        "reveal-mac-only": { tone: "error", text: "Show in Finder works on a Mac. Copy the command instead." },
+        "reveal-failed": { tone: "error", text: "Finder didn't show it. The path is above; copy the command instead." },
     };
+    /**
+     * The opened agent's head (docs/plans/one-page-task-and-agent.md): its task's status in the task page's own words and
+     * that status's one action as a link to the task page tab holding its form, and where this run opens there — a
+     * result (the shared predicate: a finished builder or scout run) on the Result tab at this run, a plan on the Plan
+     * tab, anything else on its record.
+     */
+    function agentTaskHeadOf(taskId, runId, live, access, now) {
+        const family = store.taskFamilyOf(taskId, access.repos, access.includeUnplaced);
+        const root = family?.root.id ?? taskId;
+        const versionOf = (id) => family !== null && id !== family.current.id ? `version=${encodeURIComponent(id)}&` : "";
+        const run = store.getRun(runId);
+        const open = live || run === null ? null
+            : run.finishedAt !== null && (run.role === "builder" || run.role === "scout") ? { label: run.role === "scout" ? "Report" : "Result", href: `${taskHref(root)}?${versionOf(taskId)}tab=result&run=${runId}` }
+                : run.role === "planner" ? { label: "Plan", href: `${taskHref(root)}?${versionOf(taskId)}tab=plan` }
+                    : { label: "Record", href: `/r/${runId}?record=1` };
+        let task = null;
+        try {
+            const assignment = family === null ? null : assignmentOf(store, family.current.id, now, access, evidenceRoot);
+            if (assignment !== null) {
+                const words = assignmentTaskStatusOf(assignment);
+                const wants = words.primaryAction?.href ?? "";
+                // A result to review is on the Result tab; everything else the task page heads with (the approval, a retry…).
+                const href = /^\/review\?result=|[?&]result=/.test(wants) ? `${taskHref(root)}?tab=result` : taskHref(root);
+                task = { headline: words.headline, sentence: words.sentence, tone: words.tone, action: { label: words.primaryAction?.label ?? "Open task", href } };
+            }
+        }
+        catch {
+            task = null;
+        }
+        return { task, open };
+    }
     // The Agents board (one place to check on running agents): rows by state, and the opened agent's live view.
     async function agentsPage(ctx) {
         const { url, who, response, project } = ctx;
@@ -402,29 +453,43 @@ export function createPagesHandlers(runtime) {
                 if (facts.outcome !== null && markAgentSeen(store, who.name, facts.runId, now))
                     facts.seen = true;
                 const live = facts.outcome === null;
+                const composer = live ? steerControlsFor(store, facts.taskId, facts.runId, now, who.role === "approver") : null;
                 const sealed = live ? null : sealedDiffOf(store, evidenceRoot, facts.runId);
                 // A reply's own word first; otherwise the note that the agent asked past the questions cap.
                 const said = AGENT_SAID[url.searchParams.get("said") ?? ""] ?? (facts.questionNote === null ? null : { tone: "info", text: facts.questionNote });
                 selected = {
                     ...agentRowOf(store, facts, now, evidenceRoot), live,
                     question: live && facts.question !== null ? { ...facts.question, action: `${taskHref(facts.taskId)}/reply` } : null,
-                    transcript: options.localRunner === undefined ? null : `/r/${facts.runId}?fragment=transcript`,
-                    // The live look at its checkout needs this machine's runner and pool, as the run page's does.
-                    peek: live && options.localRunner !== undefined && options.poolRoot !== undefined ? `/r/${facts.runId}?fragment=peek` : null,
+                    // The conversation's window: its notes answer anywhere; its transcript only from the machine that runs it (the window says so).
+                    transcript: `/r/${facts.runId}?fragment=transcript&shape=records`,
+                    // The live look at its checkout needs this machine's runner — the one running it — and pool, as the run page's does.
+                    peek: live && options.localRunner !== undefined && run.runner === options.localRunner && options.poolRoot !== undefined ? `/r/${facts.runId}?fragment=peek` : null,
                     files: (sealed?.files ?? []).slice(0, 30).map(one => ({ path: one.path, added: one.additions, removed: one.deletions })),
                     filesMore: Math.max(0, (sealed?.fileCount ?? 0) - 30),
-                    steer: live ? { action: `${taskHref(facts.taskId)}/steer`, run: facts.runId } : null,
+                    // A note goes only to an attempt that reads notes (steer-controls.ts); the composer says what it takes.
+                    steer: composer?.steer ?? null,
+                    controls: composer?.controls ?? null,
+                    checkout: (() => {
+                        if (!live || who.role !== "approver" || store.isDemo())
+                            return null;
+                        const proof = localCheckoutOf(store, facts.runId, { runner: options.localRunner, poolRoot: options.poolRoot }, now);
+                        // Show in Finder only where it can work (a Mac); elsewhere the path and the command stand alone.
+                        return proof.ok ? { path: proof.path, cd: cdCommandOf(proof.path), reveal: canReveal(options.revealPath !== undefined) ? `/r/${facts.runId}/reveal` : null } : null;
+                    })(),
                     canAct: who.role === "approver" && !store.isDemo(),
                     taskHref: taskHref(facts.taskId),
                     // The run's own address: a finished result opens on its result page, anything else on its record.
                     resultHref: live ? null : `/r/${facts.runId}`,
+                    ...agentTaskHeadOf(facts.taskId, facts.runId, live, access, now),
                     room: `agent:${facts.runId}`, said,
                 };
             }
         }
         const groups = agentsBoardOf(store, now, access, who.name, evidenceRoot);
-        const view = { kind: "agents", groups, selected,
-            empty: groups.length === 0 ? "No agents in the last day. They show here the moment one starts." : null };
+        const lanes = selected === null ? agentLanesOf(store, now, access, who.name, laneWindowOf(url.searchParams.get("window"))) : null;
+        const view = { kind: "agents", groups, selected, lanes,
+            // Empty only when nothing ran at all: a planner or review on the timeline is activity too.
+            empty: groups.length === 0 && (lanes === null || lanes === undefined) ? "No agents in the last day. They show here the moment one starts." : null };
         const fallback = joinHtml([
             html `<h1>Agents</h1>`,
             groups.length === 0 ? html `<p class="meta">${view.empty ?? ""}</p>` : joinHtml(groups.map(group => joinHtml([
@@ -456,7 +521,7 @@ export function createPagesHandlers(runtime) {
             html `<p class="meta" id="fleet-region-stamp"></p>`,
             html `<h2>Register a worker</h2>`,
             postForm("/fleet/runner/register", html `<label>Name<input type="text" name="name" placeholder="builder-2" maxlength="60" required></label><label>Capacity<input type="text" name="capacity" inputmode="numeric" value="1" aria-label="capacity"></label><label>Your password, typed again<input type="password" name="token" autocomplete="current-password" required></label><button type="submit">Register — its token is shown once</button>`, { attrs: { class: "card" } }),
-            html `<details class="arm-danger"><summary>Retire a worker</summary>${postForm("/fleet/runner/retire", html `<label>Which worker<input type="text" name="name" placeholder="builder-1" required></label><label>Your password, typed again<input type="password" name="token" autocomplete="current-password" required></label><button type="submit" class="danger">Retire it</button>`, { attrs: { class: "card" } })}</details>`,
+            html `<details class="arm-danger"><summary>Retire a worker</summary>${postForm("/fleet/runner/retire", html `<label>Which worker<input type="text" name="name" placeholder="builder-1" required></label>${reauth(html `<label>Your password, typed again<input type="password" name="token" autocomplete="current-password" required></label>`)}<button type="submit" class="danger">Retire it</button>`, { attrs: { class: "card" } })}</details>`,
         ], "\n"), 
         // The password fields make this screen sensitive: sendScreen strips
         // the chrome additions and keeps the reorder poller — the named
@@ -649,7 +714,8 @@ export function createPagesHandlers(runtime) {
         if (who.via !== "cookie")
             return refuse(response, who, 403, "runner registration is a browser surface");
         const token = body.get("token") ?? "";
-        if (!authenticateApprover(who, token).ok) {
+        // A worker credential is minted here: a credential act, a password typed now even with Passwordless on.
+        if (!authenticateCredential(who, token).ok) {
             return refuse(response, who, 403, "registering a worker takes your password, typed again", "/fleet");
         }
         const name = (body.get("name") ?? "").trim();
@@ -769,7 +835,7 @@ export function createPagesHandlers(runtime) {
         // (finding 22/33) — the record is consumed from the RETURNED live
         // session, synchronously, before the first await.
         const password = body.get("token") ?? "";
-        if (password === "" || !authenticateApprover(who, password).ok) {
+        if (!authenticateApprover(who, password).ok) {
             return projectsScreen(response, who, "cloning takes your password, typed again", 403);
         }
         const cookieId = /(?:^|;\s*)standing-orders_session=([0-9a-f]{64})/.exec(request.headers.cookie ?? "")?.[1];
@@ -879,6 +945,16 @@ export function createPagesHandlers(runtime) {
             peeks[path] = peekOf(path);
         return sendScreen(response, status, projectsPage(chromeFor(open, "projects"), recent, [...candidates], open, problem, !restricted() && unscopedMode, !restricted() && (ceiling.roots.length > 0 || unscopedMode), onboardState, peeks, returnTo, who.via === "cookie" ? (path) => publishingOf(store, path).on : undefined, who.via === "cookie" ? (path) => projectCheckLevel(store, path).level : undefined));
     }
+    async function instanceEdge(ctx) {
+        const { request, response, url } = ctx;
+        const secret = options.instanceSecret?.() ?? null;
+        if (secret === null)
+            return respond(response, 404, "application/json; charset=utf-8", JSON.stringify({ error: "not-up" }));
+        // Bound to what THIS console saw as the receiving end of this very connection — never the Host header.
+        const answer = instanceHttpAnswer(secret, url.searchParams.getAll("c").length === 1 ? url.searchParams.get("c") : null, { address: request.socket.localAddress, port: request.socket.localPort });
+        response.setHeader("Cache-Control", "no-store");
+        return respond(response, answer.status, "application/json; charset=utf-8", answer.body);
+    }
     async function healthzEdge(ctx) {
         const { response, method } = ctx;
         return healthz(store, response, method === 'HEAD');
@@ -941,6 +1017,7 @@ export function createPagesHandlers(runtime) {
         "projects.onboard-confirm": onboardConfirm,
     }, {
         "edge.healthz": healthzEdge,
+        "edge.instance": instanceEdge,
         "edge.browser-asset": browserAsset,
         "edge.workspace-style": workspaceStyle,
         "edge.install-asset": installAsset,

package/dist/server/people-tokens.d.ts

@@ -1,6 +1,9 @@
 import type { ServerRuntime } from './runtime.js';
 import { type IncomingMessage, type ServerResponse } from "node:http";
 import { type FormView } from "../contracts/console-api.js";
+/** When the provider checked the person, in ms, if its auth_time is a check made for this visit: present, no earlier
+ * than the second the visit began, and not in the future beyond the skew. Null otherwise. */
+export declare function sameVisitCheck(authTime: number | null, startedAt: number, now: number): number | null;
 export declare function createPeopleHandlers(runtime: ServerRuntime): {
     registrations: import("./handler-registry.js").Registration[];
     takeJoinAttempt: (source: string) => boolean;

package/dist/server/people-tokens.js

@@ -3,7 +3,7 @@ import { adapterPolicy } from "./route-policy.js";
 /** settings handlers, moved without changing their route bodies. */
 import { mintApiToken, TOKEN_DAYS } from "../api-tokens.js";
 import { CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
-import { html, htmlString, joinHtml, postForm } from "../html.js";
+import { html, htmlString, joinHtml, postForm, reauth } from "../html.js";
 import { credentialsHtml, tokenShownHtml } from "../credentials-ui.js";
 import { projectName } from "../project.js";
 import { requestLimitsHtml, tokenLimitWords } from "../request-budget-ui.js";
@@ -21,12 +21,26 @@ import { logEvent } from "../log.js";
 import { accessFromGroups, accountNameFor, exchangeOidcCode, newOidcVisit, oidcAuthorizeUrl, verifyIdToken } from "../oidc.js";
 import { personAuditHtml, personHref } from "../people-audit-ui.js";
 import { cursorOf as auditCursorOf, remoteAudit } from "../remote-audit.js";
-import { hashPassword } from "../scope.js";
+import { credentialProof, hashPassword, proveAccountNow } from "../scope.js";
 import { form, HANDOFF_STYLE, loginHref, loginReturn, page, SIGN_IN_COOKIE, signInSpent, startedHere } from "./http.js";
 import { joinDeadPage, joinFormPage, loginPage, signupPage } from "./render-people.js";
 import { SESSION_COOKIE, SIGN_IN_LINK_PATH } from "./session.js";
+/** Clock skew allowed between the provider and this server when reading auth_time — forward only (a provider clock
+ * running ahead). auth_time is in whole seconds, so a check made in the visit's own second is floored below startedAt:
+ * the one allowance backward is that rounding, never a check made before the visit began. */
+const AUTH_TIME_SKEW_MS = 60_000;
+/** When the provider checked the person, in ms, if its auth_time is a check made for this visit: present, no earlier
+ * than the second the visit began, and not in the future beyond the skew. Null otherwise. */
+export function sameVisitCheck(authTime, startedAt, now) {
+    if (authTime === null || !Number.isFinite(authTime))
+        return null;
+    const at = authTime * 1000;
+    if (at < Math.floor(startedAt / 1000) * 1000 || at > now + AUTH_TIME_SKEW_MS)
+        return null;
+    return Math.min(Math.max(at, startedAt), now);
+}
 export function createPeopleHandlers(runtime) {
-    const { settingsUpdates, joinBySource, ssoOffer, ssoVisits, ssoSettings, options, clock, ssoHandoffs, managedRepos, store, visible, admissionList, sendScreen, chromeFor, restricted, sessions, consoleProjects, authenticateApprover, bustBadge, projectOf, signInLinks, linkKey, fromThisComputer, recordSignIn, passwordAllowed, arrival, defaultProject, cookieSecure, consoleOrigin, providerFor, joinSourceOf, signInBudget, signInActor, minutesWords } = runtime;
+    const { settingsUpdates, joinBySource, ssoOffer, ssoVisits, ssoSettings, options, clock, ssoHandoffs, managedRepos, store, visible, admissionList, sendScreen, chromeFor, restricted, sessions, consoleProjects, authenticateApprover, authenticateCredential, bustBadge, projectOf, signInLinks, linkKey, fromThisComputer, recordSignIn, passwordAllowed, arrival, defaultProject, cookieSecure, consoleOrigin, providerFor, joinSourceOf, signInBudget, signInActor, minutesWords } = runtime;
     // v101: Settings → Sessions & tokens: where you're signed in, and your API tokens. An instance operator can see everyone's.
     async function sessionsPage(ctx) {
         const { url, who, response, project } = ctx;
@@ -95,7 +109,7 @@ export function createPeopleHandlers(runtime) {
                     : joinHtml(acts.map(act => html `<p class="row meta">${act.kind} ${act.subject} \u00b7 ${act.at.slice(0, 16).replace("T", " ")}</p>`), "\n"),
                 approverView && one.revokedAt === null && one.name !== who.name
                     ? postForm("/people/revoke", html `\
-<label>Your password<input type="password" name="token" autocomplete="current-password"></label>\
+${reauth(html `<label>Your password<input type="password" name="token" autocomplete="current-password"></label>`)}\
 <button type="submit">Remove ${one.name}'s sign-in</button>\
 <span class="meta">ends their access and everything it signed \u2014 history stays</span>`, { attrs: { class: "row" }, hidden: { name: one.name } })
                     : "",
@@ -105,7 +119,7 @@ export function createPeopleHandlers(runtime) {
         const invites = approverView ? store.openInvites(now) : [];
         const inviteRows = invites.map(one => html `<p class="row">${one.role} invite · ${one.projects === null ? "all projects" : one.projects.map(repo => projectName(repo)).join(", ")} \u00b7 from ${personChip(one.mintedBy)} \u00b7 expires ${one.expiresAt.slice(0, 16).replace("T", " ")}${one.attempts > 0 ? ` \u00b7 ${one.attempts} failed attempt${one.attempts === 1 ? "" : "s"}` : ""}\
  ${postForm("/people/invite-revoke", html `\
-<label>Password <input type="password" name="token" autocomplete="current-password" style="width:8rem"></label>\
+${reauth(html `<label>Password <input type="password" name="token" autocomplete="current-password" style="width:8rem"></label>`)}\
 <button type="submit">Cancel it</button>`, { attrs: { style: "display:inline" }, hidden: { id: one.id } })}</p>`);
         const inviteCard = !approverView
             ? ""
@@ -193,10 +207,13 @@ export function createPeopleHandlers(runtime) {
                 return back("problem", "Choose when it expires.");
             if (access === "act" && who.role !== "approver")
                 return back("problem", "A viewer's token can only read.");
-            // A token is a credential: made with the person's password (or their identity provider's check from moments ago), counted once.
+            // A token is a credential: made with the person's password typed now (or an explicit identity-provider re-check,
+            // spent by it), counted once. Never a remembered password: this act is outside every freshness allowlist.
             const typed = body.get("password") ?? "";
-            const confirmed = who.role === "approver" ? authenticateApprover(who, typed).ok
-                : typed === "" ? requestContext.getStore()?.sso?.fresh === true : authenticateAccount(store, who.name, typed).ok;
+            // Passwordless never covers it (docs/plans/passwordless.md: a credential act).
+            const viewerProof = who.role === "approver" || who.via !== "cookie" ? null : proveAccountNow(store, who.name, typed, { credential: true });
+            const confirmed = who.role === "approver" ? authenticateCredential(who, typed).ok
+                : viewerProof !== null && viewerProof.ok && credentialProof(viewerProof.method);
             if (!confirmed)
                 return back("problem", "Enter your Toolroll password to make a token.");
             const minted = mintApiToken();
@@ -210,7 +227,8 @@ export function createPeopleHandlers(runtime) {
     async function peopleProjects(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.peopleProjects);
-        if (!authenticateApprover(who, body.get("token") ?? "", null).ok)
+        // Widening access (up to instance operator) is a credential act: a password typed now, Passwordless or not.
+        if (!authenticateCredential(who, body.get("token") ?? "", null).ok)
             return refuse(response, who, 403, "Saving access requires your password.", "/people");
         const access = readAccessForm(body);
         if (!access.ok)
@@ -229,7 +247,7 @@ export function createPeopleHandlers(runtime) {
         const token = body.get("token") ?? "";
         // RAISING authority is a password ceremony (the doctrine): adding a
         // person to the instance is exactly that.
-        if (!authenticateApprover(who, token).ok) {
+        if (!authenticateCredential(who, token).ok) {
             return refuse(response, who, 403, "making an invite takes your password, typed again", "/people");
         }
         const role = body.get("role") === "approver" ? "approver" : "viewer";
@@ -346,7 +364,9 @@ export function createPeopleHandlers(runtime) {
         // Bounded: anyone may start a sign-in, so the oldest waiting ones give way.
         while (ssoVisits.size >= 1000)
             ssoVisits.delete(ssoVisits.keys().next().value);
-        ssoVisits.set(visit.state, { visit, provider: found.provider, redirect: redirectUri, intent, returnTo, expires: Date.now() + 15 * 60_000 });
+        const asker = intent === "sign-in" || who?.via !== "cookie" ? null : sessions.hashOf(who.session);
+        ssoVisits.set(visit.state, { visit, provider: found.provider, redirect: redirectUri, intent, returnTo, expires: Date.now() + 15 * 60_000, startedAt: Date.now(),
+            session: asker === null || who?.via !== "cookie" ? null : { hash: asker, generation: who.session.generation } });
         response.writeHead(302, { location: oidcAuthorizeUrl(found.provider, settings, visit, redirectUri, intent === "reauth"), "cache-control": "no-store", "referrer-policy": "no-referrer",
             "set-cookie": `${SIGN_IN_COOKIE}=${visit.state}; Path=${SSO_CALLBACK}; Max-Age=900; HttpOnly; SameSite=Lax${origin.startsWith("https:") ? "; Secure" : ""}` });
         response.end();
@@ -371,18 +391,28 @@ export function createPeopleHandlers(runtime) {
         if (handoff.intent === "link" || handoff.intent === "reauth") {
             if (who?.via !== "cookie")
                 return redirect(response, loginHref(handoff.returnTo));
+            // Only the session that asked: same kept session, same credential generation.
+            if (handoff.session === null || sessions.hashOf(who.session) !== handoff.session.hash || who.session.generation !== handoff.session.generation) {
+                return page(response, 403, loginPage(`That ${settings.label} check was started by another sign-in. Start it again from this page.`, handoff.returnTo, ssoOffer()));
+            }
             if (handoff.intent === "link") {
                 const linked = store.linkSsoIdentity(who.name, identity, clock());
                 if (!linked.ok)
                     return redirect(response, `/settings/sign-in?problem=${encodeURIComponent(`That ${settings.label} account signs in as someone else here.`)}`);
-                who.session.sso = { at: Date.now() };
+                who.session.sso = { at: handoff.checkedAt ?? 0 };
                 sessions.persist(who.session);
                 return redirect(response, `/settings/sign-in?said=${encodeURIComponent(`This account signs in with ${settings.label} now.`)}`);
             }
             // A step-up: the provider checked the same person again.
             if (store.ssoAccount(identity.issuer, identity.subject) !== who.name)
                 return page(response, 403, loginPage(`That ${settings.label} account isn't the one signed in here.`, handoff.returnTo, ssoOffer()));
-            who.session.sso = { at: Date.now() };
+            who.session.sso = { at: handoff.checkedAt ?? 0 };
+            // An explicit re-check on request: the one identity-provider event that stands in for a password typed now (for ONE
+            // step-up, spent by it) and may start a freshness window (B2). Kept in memory only: a restart forgets it.
+            if (handoff.checkedAt !== null) {
+                who.session.ssoReauthAt = handoff.checkedAt;
+                who.session.ssoNowAt = handoff.checkedAt;
+            }
             sessions.persist(who.session);
             recordSignIn(who.name, "confirmed", settings.label);
             return redirect(response, handoff.returnTo);
@@ -397,7 +427,7 @@ export function createPeopleHandlers(runtime) {
         const account = store.accountOf(signedIn.account);
         const id = randomBytes(32).toString("hex");
         sessions.set(id, { ...arrival(request), name: signedIn.account, csrf: randomBytes(32).toString("hex"), role: account.role, generation: account.generation, createdAt: Date.now(), sawBoardAt: null, lastSeen: Date.now(),
-            project: defaultProject, projectRevision: 1, sso: { at: Date.now() } });
+            project: defaultProject, projectRevision: 1, sso: { at: handoff.checkedAt ?? 0 } });
         recordSignIn(signedIn.account, "signed in", settings.label);
         response.setHeader("Set-Cookie", [signInSpent("/login/sso/finish"), `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`]);
         return redirect(response, handoff.returnTo);
@@ -447,6 +477,8 @@ export function createPeopleHandlers(runtime) {
             lastSeen: Date.now(),
             project: defaultProject,
             projectRevision: 1,
+            // A password typed on this computer starts this session's freshness window (cockpit B2); from anywhere else, never.
+            ...(fromThisComputer(request) ? { passwordAt: Date.now() } : {}),
         });
         response.setHeader("Set-Cookie", `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`);
         return redirect(response, "/");
@@ -496,6 +528,9 @@ export function createPeopleHandlers(runtime) {
             lastSeen: Date.now(),
             project: defaultProject,
             projectRevision: 1,
+            // A password typed to sign in on this computer starts this session's freshness window (cockpit B2); from anywhere
+            // else (a phone, a proxy) it signs in and proves nothing more.
+            ...(fromThisComputer(request) ? { passwordAt: Date.now() } : {}),
         });
         response.setHeader("Set-Cookie", `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`);
         return redirect(response, returnTo);
@@ -641,8 +676,11 @@ export function createPeopleHandlers(runtime) {
             logEvent("warn", "sso.refused", { reason: verified.said });
             return back(verified.said);
         }
-        // A step-up must be a check made just now, not a remembered one.
-        if (held.intent === "reauth" && verified.claims.authTime !== null && Date.now() / 1000 - verified.claims.authTime > 300)
+        // When the provider checked the person (its auth_time), proved against this visit (cockpit B2, N18): no earlier than
+        // this visit began, and not in the future beyond a minute of clock skew. A step-up must carry one that holds — a
+        // check made for this request, never a remembered one; any other sign-in without one signs in, but is never fresh.
+        const checkedAt = sameVisitCheck(verified.claims.authTime, held.startedAt, Date.now());
+        if (held.intent === "reauth" && checkedAt === null)
             return back(`${settings.label} didn't check you again. Try once more.`);
         const key = randomBytes(24).toString("base64url");
         for (const [one, value] of ssoHandoffs)
@@ -650,7 +688,7 @@ export function createPeopleHandlers(runtime) {
                 ssoHandoffs.delete(one);
         while (ssoHandoffs.size >= 1000)
             ssoHandoffs.delete(ssoHandoffs.keys().next().value);
-        ssoHandoffs.set(key, { claims: verified.claims, issuer: held.provider.issuer, intent: held.intent, returnTo: held.returnTo, expires: Date.now() + 60_000 });
+        ssoHandoffs.set(key, { claims: verified.claims, issuer: held.provider.issuer, intent: held.intent, returnTo: held.returnTo, expires: Date.now() + 60_000, checkedAt, session: held.session });
         const to = `/login/sso/finish?h=${key}`;
         response.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "x-frame-options": "DENY",
             // The hand-off key is this browser's alone, like the visit's state: its cookie rides to /login/sso/finish.

package/dist/server/remote-hooks.js

@@ -1,5 +1,5 @@
 import { adapterPolicy } from "./route-policy.js";
-import { flowFormPage, FORM_PATH, HOOK_PATH, receiveFlowForm, receiveFlowHook } from "../flow-triggers.js";
+import { flowFormPage, FORM_PATH, HOOK_PATH, hookRefusedUnread, receiveFlowForm, receiveFlowHook } from "../flow-triggers.js";
 import { keepPushedUpdate, loadBotToken, pushedByTelegram, telegramHookSecret } from "../telegram.js";
 /** Flow webhooks (v82): the one road a public relay may expose. The secret
  * address proves nothing about the sender on its own for GitHub and Linear:
@@ -48,15 +48,21 @@ export async function telegramHook(ctx, request, response) {
 }
 export async function flowHook(ctx, request, response, url) {
     const { store, options, clock } = ctx;
-    const reply = (status, said) => { response.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" }); response.end(JSON.stringify({ said })); request.resume(); };
+    const reply = (status, said, retryAfter) => {
+        response.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store", ...(retryAfter === undefined ? {} : { "retry-after": String(retryAfter) }) });
+        response.end(JSON.stringify({ said }));
+        request.resume();
+    };
     if (url.pathname.startsWith(FORM_PATH))
         return flowForm(ctx, request, response, url);
     if (options.configDir === undefined || !url.pathname.startsWith(HOOK_PATH))
         return reply(404, "No such address.");
     if (request.method !== "POST")
         return reply(405, "Send a POST.");
+    // Refused before it is read (v126): it still counts toward its address's minute, as anything unproven does.
+    const refused = (status, said) => { const over = hookRefusedUnread(store, url.pathname.slice(HOOK_PATH.length), clock()); return over === null ? reply(status, said) : reply(over.status, over.said, over.retryAfter); };
     if (Number(request.headers["content-length"] ?? 0) > 1_000_000)
-        return reply(413, "Too large.");
+        return refused(413, "Too large.");
     const chunks = [];
     try {
         await new Promise((resolve, reject) => {
@@ -70,11 +76,11 @@ export async function flowHook(ctx, request, response, url) {
         });
     }
     catch (error) {
-        return reply(error instanceof Error && error.message === "too-large" ? 413 : 400, "Couldn't read that.");
+        return refused(error instanceof Error && error.message === "too-large" ? 413 : 400, "Couldn't read that.");
     }
     try {
-        const answer = receiveFlowHook(store, url.pathname.slice(HOOK_PATH.length), { headers: request.headers, body: Buffer.concat(chunks) }, options.configDir, clock());
-        return reply(answer.status, answer.said);
+        const answer = receiveFlowHook(store, url.pathname.slice(HOOK_PATH.length), { headers: request.headersDistinct, body: Buffer.concat(chunks) }, options.configDir, clock());
+        return reply(answer.status, answer.said, answer.retryAfter);
     }
     catch {
         return reply(500, "Not saved.");

package/dist/server/remote.d.ts

@@ -1,3 +1,4 @@
+import { type FreshFacts } from "../scope.js";
 /** tasks handlers, moved without changing their route bodies. */
 import { type IncomingMessage } from "node:http";
 import { CodingWorkspace } from '../coding-workspace.js';
@@ -45,11 +46,11 @@ export interface RemoteRuntime {
     managedRepos: () => string[];
     joinSourceOf: (request: IncomingMessage) => string;
     ssoSettings: () => import("../oidc.js").OidcSettings | null;
-    SSO_FRESH_MS: number;
     oauthTokenBudget: SourceAdmission;
     hookContext: RemoteHookContext;
     teamsSourceBudget: SourceAdmission;
     teamsTenantBudget: SourceAdmission;
+    freshFactsOf: (request: IncomingMessage, who: Who | null) => FreshFacts | null;
 }
 export declare function createRemoteHandlers(runtime: RemoteRuntime): {
     registrations: import("./handler-registry.js").Registration[];

package/dist/server/remote.js

@@ -1,3 +1,4 @@
+import { credentialProof, freshFacts, proveAccountNow, ssoNowAvailable } from "../scope.js";
 import { handlersOf } from './handler-registry.js';
 /** tasks handlers, moved without changing their route bodies. */
 import {} from "node:http";
@@ -8,7 +9,6 @@ import { createOAuthHttp, resourceMetadataUrl } from "../mcp-oauth.js";
 import { reproveRemote } from "../operate-remote.js";
 import { rowVisible } from "../project.js";
 import { RequestBudget, SourceAdmission } from "../request-budget.js";
-import { authenticateAccount } from "../scope.js";
 import { createSessionRunner } from '../session-remote.js';
 import {} from "../store.js";
 import { handleTeamHttp, TEAM_PASSWORD_REVERIFY_MS } from '../team-http.js';
@@ -17,7 +17,7 @@ import { flowHook, telegramHook } from "./remote-hooks.js";
 import { respond } from "./http.js";
 import {} from "./session.js";
 export function createRemoteHandlers(runtime) {
-    const { identify, store, admitPasswordSource, admitBearer, allowedHost, team, teamBrowserReply, requestBudget, options, coding, codingProjects, liveCeiling, clock, evidenceRoot, consoleOrigin, managedRepos, joinSourceOf, ssoSettings, SSO_FRESH_MS, oauthTokenBudget, hookContext, teamsSourceBudget, teamsTenantBudget } = runtime;
+    const { identify, store, admitPasswordSource, admitBearer, allowedHost, team, teamBrowserReply, requestBudget, options, coding, codingProjects, liveCeiling, clock, evidenceRoot, consoleOrigin, managedRepos, joinSourceOf, ssoSettings, oauthTokenBudget, hookContext, teamsSourceBudget, teamsTenantBudget } = runtime;
     /**
      * The full principal a live `so_` API token stands for: its person and their generation, the token's own read/act
      * scope, its project limit narrowed by the person's current access, and its id. Every route that accepts an API token
@@ -119,8 +119,9 @@ export function createRemoteHandlers(runtime) {
             const who = identify(request, false);
             if (who === null || who.via !== "cookie")
                 return null;
-            return { name: who.name, role: who.role, csrf: who.session.csrf,
-                sso: who.session.sso === undefined ? null : { label: ssoSettings()?.label ?? "your identity provider", fresh: Date.now() - who.session.sso.at < SSO_FRESH_MS } };
+            return { name: who.name, role: who.role, csrf: who.session.csrf, generation: who.session.generation,
+                sso: who.session.sso === undefined ? null : { label: ssoSettings()?.label ?? "your identity provider",
+                    fresh: freshFacts.run(runtime.freshFactsOf(request, who), () => ssoNowAvailable(who.name)) } };
         },
         sameSite: request => {
             const origin = request.headers.origin, referer = request.headers.referer;
@@ -129,7 +130,15 @@ export function createRemoteHandlers(runtime) {
         },
         // The step-up for a credential: the person's password, or (empty) a fresh identity-provider check. What they may
         // grant (their role, their projects) is checked beside it.
-        confirm: (session, typed) => typed === "" ? session.sso?.fresh === true : authenticateAccount(store, session.name, typed).ok,
+        // Proved on this request's live session at the moment of consent (signed in here still, same generation), through
+        // the one account step-up: a password typed now, or an explicit re-check (spent). Never a remembered password.
+        confirm: (request, session, typed) => {
+            const who = identify(request, false);
+            if (who === null || who.via !== "cookie" || who.name !== session.name || who.session.generation !== session.generation)
+                return false;
+            // Connecting an outside app is a credential act: never a session (Passwordless) or a remembered password.
+            return freshFacts.run(runtime.freshFactsOf(request, who), () => { const proved = proveAccountNow(store, who.name, typed, { credential: true }); return proved.ok && credentialProof(proved.method); });
+        },
         projectsFor: account => store.knownRepos().filter(repo => store.accountCanAccess(account, repo)).sort(),
         admitToken: request => oauthTokenBudget.admit(joinSourceOf(request)),
     });

package/dist/server/render-chat.d.ts

@@ -1,3 +1,5 @@
+/** The conversation: chat and lead pages, proposal cards and the task chat. */
+import type { TaskOrigin } from "../task-source.js";
 import { type AssignmentSnapshot } from "../assignment.js";
 import { type BrowserActionCard } from "../browser-workspace.js";
 import { type ChatDraft } from "../converse.js";
@@ -10,6 +12,7 @@ import { type TaskControlView } from "../task-control.js";
 import { type TeamChatProviderResolver } from "../team-chat-authorization.js";
 import { type TeamSnapshot } from "../team-contract.js";
 import { type DisplayStatus } from "../workspace-ui.js";
+import type { LeadQueueRow } from "../lead-queue.js";
 import { type Html } from "../html.js";
 import { type Chrome, type Screen } from "./chrome.js";
 import { type ProjectPeek } from "./render-pages.js";
@@ -77,6 +80,8 @@ export type TaskChatFocus = {
             label: string;
             filedAgo: string | null;
         } | null;
+        /** v126: where the work came from (an outside event's line of context). */
+        origin?: TaskOrigin | null;
         /** The repair chain row when this task is a machine-drafted repair. */
         repairChain: RepairChainRow | null;
     } | null;
@@ -214,7 +219,7 @@ export declare function chatPage(chrome: Chrome, data: {
     /** Chat's first run is on the page: it already says what to do while there is no lead. */
     firstRunShown?: boolean;
 }): Screen;
-export declare function chatAckPage(chrome: Chrome, turn: ChatTurn, nonce: string): Screen;
+export declare function chatAckPage(chrome: Chrome, turn: ChatTurn, nonce: string, reply?: LeadTurn | null): Screen;
 /** The card that starts a conversation: the one password ceremony (mate arc §1). */
 export declare function leadMintCard(enabled: {
     billing: "metered" | "subscription";
@@ -301,19 +306,23 @@ export type LeadThreadRows = {
     focusTask: TaskChatFocus | null;
     /** The lead's open question to this reader, drawn as buttons under its reply. */
     ask?: LeadAsk | null;
+    /** The turn whose question the task has moved past: shown without buttons, marked out of date. */
+    staleAsk?: number | null;
     /** Every question the lead asked in these messages, by turn: answered ones show their words without buttons. */
     asks?: Map<number, LeadAsk>;
+    /** The person's lead queue rows for these messages, by message id (docs/plans/lead-message-queue.md). */
+    queue?: Map<number, LeadQueueRow>;
 };
 /** The lead's question as buttons: each option sends itself as the next message (the same POST as a typed one);
  * "Something else" moves to the composer. Nothing shows while a reply is running. */
 export declare function leadAskHtml(ask: LeadAsk, target: {
     task: string | null;
     project: string | null;
-}, composer: string, open?: boolean): Html;
+}, composer: string, open?: boolean, stale?: boolean): Html;
 /** The thread's messages as the React conversation renders them, each
  * with the proposal cards its turn produced; `back` is where a card's
  * confirm or dismiss returns. */
-export declare function leadBrowserMessages(rows: Pick<LeadThreadRows, "messages" | "proposals" | "decisions" | "pending" | "ask" | "asks">, back: string | null, target?: {
+export declare function leadBrowserMessages(rows: Pick<LeadThreadRows, "messages" | "proposals" | "decisions" | "pending" | "ask" | "staleAsk" | "asks" | "queue">, back: string | null, target?: {
     task: string | null;
     project: string | null;
 }): import("../browser-workspace.js").BrowserMessage[];