toolroll 0.9.63 → 0.9.65

package/dist/agent-state-words.js

@@ -0,0 +1,20 @@
+/**
+ * The agent states' words, tones and counts (docs/plans/agents-cockpit.md §1), with nothing the browser can't load:
+ * agent-state.ts derives the states; the console's pages and the sidebar say them with these.
+ */
+/** The display states, strongest first: a roll-up takes the first one any member has. */
+export const DISPLAY_STATES = ["needs-you", "failed", "stuck", "paused", "working", "waiting", "done", "idle"];
+export const STATE_WORDS = {
+    "needs-you": "Needs you", failed: "Failed", stuck: "Stuck", paused: "Paused", working: "Working", waiting: "Waiting", done: "Done", idle: "Idle",
+};
+/** For someone who may not act on it: the obligation is still there, and still counts. */
+export const NEEDS_SOMEONE = "Needs someone";
+/** Each state's tone, for the console's one palette (attention, problem, live, ready, done, muted). */
+export const STATE_TONE = {
+    "needs-you": "attention", failed: "problem", stuck: "problem", paused: "muted", working: "live", waiting: "muted", done: "ready", idle: "muted",
+};
+export const NO_COUNTS = Object.freeze({ "needs-you": 0, failed: 0, stuck: 0, paused: 0, working: 0, waiting: 0, done: 0, idle: 0 });
+/** The strongest state among counts, and the counts themselves. Nothing counted is idle. */
+export function rollUp(counts) {
+    return { state: DISPLAY_STATES.find(state => state !== "idle" && counts[state] > 0) ?? "idle", counts };
+}

package/dist/agent-state.d.ts

@@ -0,0 +1,65 @@
+/**
+ * One set of agent states (docs/plans/agents-cockpit.md §1): what a person sees at a glance for an attempt, a task, a
+ * flow or a project. A display state is derived from four separate facts — what the agent is doing, how it ended, what
+ * someone must do, and whether this person has seen it — and never stored as one. Looking clears only `done`: a failure,
+ * an approval or a result to accept stays until it is dealt with. The words and colours of each state live here only.
+ */
+import { type AgentFacts } from "./agents-board.js";
+import type { Store } from "./store.js";
+import type { WorkSummaryAccess } from "./work-summary.js";
+import { type DisplayState, type StateCounts } from "./agent-state-words.js";
+export { DISPLAY_STATES, NEEDS_SOMEONE, NO_COUNTS, rollUp, STATE_TONE, STATE_WORDS, type DisplayState, type StateCounts } from "./agent-state-words.js";
+/** What an attempt is doing. */
+export type Activity = "queued" | "waiting" | "running" | "stuck" | "pausing" | "paused" | "stopping" | "stopped" | "finished";
+/** How it ended (checks-failed: built, but the project's checks failed on its result). */
+export type Outcome = "none" | "built" | "no-change" | "failed" | "checks-failed";
+export type StateFacts = {
+    activity: Activity;
+    outcome: Outcome;
+    /** Someone must act: a question, a plan or scope to approve, a decision, a result to accept, a sign-in. */
+    obligation: boolean;
+    /** This person hasn't seen its finished version. */
+    unread: boolean;
+    /** A newer attempt of the same task is running: an older failure no longer leads. */
+    newerRunning?: boolean;
+};
+/** The one glance a set of facts gives. */
+export declare function displayStateOf(facts: StateFacts): DisplayState;
+/** The four facts of one build attempt, from what the Agents board reads (agents-board.ts): its own record only — a
+ * stopped or cancelled attempt is not a failure, a parked one is a decision only while it is unanswered and its task is open, and one being
+ * repaired is at work, not stuck. */
+export declare function factsOfAttempt(facts: AgentFacts, activityAt: string | null, paused: boolean, now: Date, decisionOpen?: boolean): StateFacts;
+/** One task family's strongest state in a project, and its one line when an agent is at work on it. */
+export type FamilyState = {
+    rootId: string;
+    state: DisplayState;
+    line: string | null;
+    /** What it needs a person for, as an identity (task, question, hold, result…), and the agent it is about. */
+    ask?: {
+        version: string;
+        run: number | null;
+        at: string;
+    };
+};
+export type ProjectState = {
+    repo: string | null;
+    state: DisplayState;
+    counts: StateCounts;
+    /** Each family that counted, strongest first (flow cards count without one). */
+    families: FamilyState[];
+    /** Flow cards waiting at a person's decision, by identity (newest first, at most FLOW_ASKS per flow). */
+    flowAsks: {
+        card: number;
+        stage: string;
+        entry: number;
+        at: string;
+    }[];
+};
+/**
+ * A project's states for one person: complete counts over every task family they may see, with the Tasks list's own
+ * admission (never a page or the board's rows). Each family counts once for what it needs or how it ended; each live
+ * attempt counts once for what it is doing (working, stuck, paused); an attempt that itself needs a person (crashed,
+ * asking) counts there unless its family already does. Flow cards at a person's decision count too. Every visible
+ * project is present, idle when nothing counts. Its cost is the Tasks list's own read, plus open runs.
+ */
+export declare function projectStates(store: Store, access: WorkSummaryAccess, account: string, now: Date, root?: string, flowRepos?: readonly string[]): ProjectState[];

package/dist/agent-state.js

@@ -0,0 +1,229 @@
+/**
+ * One set of agent states (docs/plans/agents-cockpit.md §1): what a person sees at a glance for an attempt, a task, a
+ * flow or a project. A display state is derived from four separate facts — what the agent is doing, how it ended, what
+ * someone must do, and whether this person has seen it — and never stored as one. Looking clears only `done`: a failure,
+ * an approval or a result to accept stays until it is dealt with. The words and colours of each state live here only.
+ */
+import { agentFactsFor, agentGroupOf } from "./agents-board.js";
+import { stuckSince } from "./agent-board.js";
+import { flowDefinitionOf } from "./flow-engine.js";
+import { runActivityOf } from "./task-activity.js";
+import { workStateRows } from "./work-index.js";
+import { assignmentChecksForRun } from "./assignment.js";
+import { DISPLAY_STATES, NO_COUNTS, rollUp } from "./agent-state-words.js";
+export { DISPLAY_STATES, NEEDS_SOMEONE, NO_COUNTS, rollUp, STATE_TONE, STATE_WORDS } from "./agent-state-words.js";
+/** The one glance a set of facts gives. */
+export function displayStateOf(facts) {
+    if (facts.obligation)
+        return "needs-you";
+    // A failure leads until it is dealt with (a retry, a revision, a stop, a cancel): looking never clears it.
+    if ((facts.outcome === "failed" || facts.outcome === "checks-failed") && facts.activity === "finished" && facts.newerRunning !== true)
+        return "failed";
+    if (facts.activity === "stuck")
+        return "stuck";
+    if (facts.activity === "paused")
+        return "paused";
+    if (facts.activity === "running" || facts.activity === "pausing" || facts.activity === "stopping")
+        return "working";
+    if (facts.activity === "queued" || facts.activity === "waiting")
+        return "waiting";
+    // Only a good finish is news to be read; looking clears it, and nothing else does.
+    if (facts.activity === "finished" && (facts.outcome === "built" || facts.outcome === "no-change") && facts.unread)
+        return "done";
+    return "idle";
+}
+/** The four facts of one build attempt, from what the Agents board reads (agents-board.ts): its own record only — a
+ * stopped or cancelled attempt is not a failure, a parked one is a decision only while it is unanswered and its task is open, and one being
+ * repaired is at work, not stuck. */
+export function factsOfAttempt(facts, activityAt, paused, now, decisionOpen) {
+    const settled = facts.taskState === "done" || facts.taskState === "cancelled";
+    if (facts.outcome === null) {
+        const { group } = agentGroupOf(facts, activityAt, now);
+        const stuck = !facts.repairing && facts.turn === "busy"
+            && stuckSince({ state: "busy", stateAt: facts.stateAt ?? facts.startedAt, transcriptAt: facts.transcriptAt ?? facts.startedAt, toolAt: facts.toolAt }, activityAt, now) !== null;
+        // An open run asking, crashed or blocked is an obligation (the board's "needs you"), whatever else it is doing.
+        return { activity: paused ? "paused" : stuck ? "stuck" : "running", outcome: "none", obligation: group === "needs-you", unread: false };
+    }
+    const unread = !(facts.seen || facts.legacy);
+    if (facts.outcome === "built" || facts.outcome === "no-change")
+        return { activity: "finished", outcome: facts.outcome, obligation: false, unread };
+    // Stopped by a person or a restart, in either spelling (a legacy outcome, or a failure whose reason is the interruption).
+    if (facts.outcome === "interrupted" || facts.outcome === "refused" || (facts.outcome === "failed" && facts.reason === "interrupted"))
+        return { activity: "stopped", outcome: "none", obligation: false, unread };
+    // A parked attempt asks only while its decision is unanswered (when known) and its task is open.
+    if (facts.outcome === "parked")
+        return { activity: "finished", outcome: "none", obligation: !settled && decisionOpen !== false, unread };
+    // A failure on a task since settled (done another way, or cancelled) no longer leads.
+    return { activity: "finished", outcome: settled ? "none" : "failed", obligation: false, unread };
+}
+/** A family's display state from the Tasks list's own classification (work-index.ts): failures that lead, what waits
+ * on a person (a result to accept included), work waiting its turn; a complete result is news only until this person
+ * has seen it. Running work is counted by its attempts instead. The Tasks list's rules are the rules here — where it
+ * says a task waits on a person, so does this — so the two never disagree. */
+const WAITING_CODES = new Set(["queued", "planning-ready", "scouting-ready", "updating", "retry-scheduled", "waiting-dependency", "worker-at-capacity"]);
+/** Codes whose family is at work: its attempts say how. */
+const AT_WORK = new Set(["running", "stopping"]);
+/** Flow cards named per flow in a project's asks; the count stays complete beyond them. */
+const FLOW_ASKS = 50;
+/**
+ * A project's states for one person: complete counts over every task family they may see, with the Tasks list's own
+ * admission (never a page or the board's rows). Each family counts once for what it needs or how it ended; each live
+ * attempt counts once for what it is doing (working, stuck, paused); an attempt that itself needs a person (crashed,
+ * asking) counts there unless its family already does. Flow cards at a person's decision count too. Every visible
+ * project is present, idle when nothing counts. Its cost is the Tasks list's own read, plus open runs.
+ */
+export function projectStates(store, access, account, now, root, flowRepos) {
+    const counts = new Map();
+    const strongest = new Map();
+    const asked = new Map();
+    const flowAsks = new Map();
+    const bump = (repo, state, rootId, line = null) => {
+        const current = counts.get(repo) ?? { ...NO_COUNTS };
+        current[state] += 1;
+        counts.set(repo, current);
+        if (rootId === undefined || state === "waiting" || state === "idle")
+            return;
+        const before = strongest.get(rootId);
+        if (before === undefined || DISPLAY_STATES.indexOf(state) < DISPLAY_STATES.indexOf(before.state))
+            strongest.set(rootId, { repo, rootId, state, line: line ?? before?.line ?? null });
+        else if (before.line === null && line !== null)
+            before.line = line;
+    };
+    for (const repo of access.repos ?? store.listProjects().map(one => one.path))
+        counts.set(repo, { ...NO_COUNTS });
+    const families = workStateRows(store, now, access);
+    const refs = families.flatMap(row => row.members);
+    // Every live attempt of these families, every role, in one read.
+    const open = refs.length === 0 ? [] : store.handle.prepare(`SELECT r.id, r.task_ref, r.role, r.runner, r.started_at FROM run r
+      WHERE r.outcome IS NULL AND r.role IN ('planner','builder','scout','reviewer','repair') AND r.task_ref IN (SELECT value FROM json_each(?))`).all(JSON.stringify(refs));
+    const paused = new Set(open.length === 0 ? [] : store.handle.prepare(`SELECT run FROM run_pause WHERE run IN (SELECT value FROM json_each(?))
+      AND paused_at IS NOT NULL AND resumed_at IS NULL AND ended_at IS NULL`).all(JSON.stringify(open.map(row => Number(row["id"])))).map(row => Number(row["run"])));
+    // Complete results that are news to this person: recorded since seeing was (a keyed attempt), and not yet seen.
+    const completed = JSON.stringify(families.flatMap(row => row.code === "complete" && row.resultRun !== null ? [row.resultRun] : []));
+    const unseen = new Set(store.handle.prepare(`SELECT r.id FROM run r WHERE r.id IN (SELECT value FROM json_each(?)) AND r.attempt_key IS NOT NULL
+      AND NOT EXISTS (SELECT 1 FROM agent_seen s WHERE s.account = ? AND s.run = r.id)`).all(completed, account).map(row => Number(row["id"])));
+    // A result's outcome and its recorded check, for the families whose result is waiting on a person.
+    const resultFacts = new Map(store.handle.prepare(`SELECT r.id, r.outcome, (SELECT c.status FROM run_check c WHERE c.run = r.id) AS recorded FROM run r
+      WHERE r.id IN (SELECT value FROM json_each(?))`).all(JSON.stringify(families.flatMap(row => row.resultRun ?? []))).map(row => [Number(row["id"]), row]));
+    // The result's checks as the result reads them (follow-up checks included); the recorded check only when nothing
+    // else was read, so a passing follow-up clears an earlier failure.
+    const checksFailed = (run) => {
+        const status = assignmentChecksForRun(store, root, run, now).status;
+        if (status === "failed" || status === "passed")
+            return status === "failed";
+        return resultFacts.get(run)?.["recorded"] === "failed";
+    };
+    const familyOf = new Map();
+    for (const row of families)
+        for (const ref of row.members)
+            familyOf.set(ref, row);
+    const attempting = new Set(open.map(run => familyOf.get(Number(run["task_ref"]))?.rootId));
+    const needing = new Set();
+    for (const row of families) {
+        // At work: its attempts are counted below; a stop whose run has ended but whose process is not yet confirmed gone
+        // is still at work.
+        if (AT_WORK.has(row.code)) {
+            if (!attempting.has(row.rootId))
+                bump(row.repo, "working", row.rootId);
+            continue;
+        }
+        const result = row.resultRun === null ? null : resultFacts.get(row.resultRun);
+        if (row.code === "failed" || row.code === "vanished-run") {
+            bump(row.repo, "failed", row.rootId);
+            continue;
+        }
+        // Waiting its turn, as the Tasks list ranks it: confirmations another computer owes included.
+        if (row.waits) {
+            bump(row.repo, "waiting", row.rootId);
+            continue;
+        }
+        // A result waiting on a person is a failure when it failed or its checks failed (as its headline reads).
+        const asks = row.code === "ready-to-check" || row.code === "result-needs-attention";
+        if (asks && (result?.["outcome"] === "failed" || (row.resultRun !== null && checksFailed(row.resultRun)))) {
+            bump(row.repo, "failed", row.rootId);
+            continue;
+        }
+        // A family the person's lead has taken on waits on nobody (the Tasks list's rule); a failure still leads, above.
+        if (row.leadClaim) {
+            bump(row.repo, "waiting", row.rootId);
+            continue;
+        }
+        if (asks || row.personNeed) {
+            bump(row.repo, "needs-you", row.rootId);
+            needing.add(row.rootId);
+            asked.set(row.rootId, { version: row.version, run: row.askRun, at: row.at });
+            continue;
+        }
+        if (WAITING_CODES.has(row.code)) {
+            bump(row.repo, "waiting", row.rootId);
+            continue;
+        }
+        if (row.code === "complete" && row.resultRun !== null && unseen.has(row.resultRun))
+            bump(row.repo, "done", row.rootId);
+    }
+    // Each live attempt: paused, stuck or at work; one that needs a person counts there, unless its family already does.
+    for (const run of open) {
+        const family = familyOf.get(Number(run["task_ref"]));
+        if (family === undefined)
+            continue;
+        const id = Number(run["id"]);
+        // What the agent did last, in the task page's own words: the rail's line for this family.
+        const activity = runActivityOf(store, { id, runner: String(run["runner"]), startedAt: String(run["started_at"]) }, now);
+        const line = activity.what === "" ? null : activity.what;
+        if (paused.has(id)) {
+            bump(family.repo, "paused", family.rootId, line);
+            continue;
+        }
+        if (run["role"] !== "builder") {
+            bump(family.repo, "working", family.rootId, line);
+            continue;
+        } // only builds are watched for quiet
+        const facts = agentFactsFor(store, id, { repos: null }, account);
+        if (facts === null || facts.outcome !== null) {
+            bump(family.repo, "working", family.rootId, line);
+            continue;
+        }
+        const at = activity.at;
+        const state = displayStateOf(factsOfAttempt(facts, at, false, now));
+        if (state === "needs-you") {
+            if (!needing.has(family.rootId)) {
+                bump(family.repo, "needs-you", family.rootId, line);
+                needing.add(family.rootId);
+                asked.set(family.rootId, { version: `${family.version}|agent:${id}:${facts.question?.id ?? facts.turn ?? ""}`, run: id, at: family.at });
+            }
+            else
+                bump(family.repo, "working", family.rootId, line);
+            continue;
+        }
+        bump(family.repo, state === "stuck" ? "stuck" : "working", family.rootId, line);
+    }
+    // Flow cards waiting at a person's decision (an approval or a choice), in the flows this person may see: one uncapped
+    // count per flow over its deciding zones.
+    const repos = flowRepos ?? (access.repos ?? store.listProjects().map(one => one.path));
+    const deciding = store.handle.prepare("SELECT COUNT(*) AS n FROM flow_card WHERE flow = ? AND state = 'active' AND stage IN (SELECT value FROM json_each(?))");
+    // A card's visit began when it entered its stage (its newest arrival there): fixed for the visit, unlike updated_at.
+    const namedCards = store.handle.prepare(`SELECT c.id, c.stage, c.entry, COALESCE((SELECT MAX(e.at) FROM flow_event e WHERE e.card = c.id AND e.to_stage = c.stage), c.created_at) AS entered_at
+    FROM flow_card c WHERE c.flow = ? AND c.state = 'active' AND c.stage IN (SELECT value FROM json_each(?)) ORDER BY entered_at DESC, c.id DESC LIMIT ?`);
+    for (const flow of store.listFlows(repos)) {
+        const definition = flowDefinitionOf(flow);
+        if (definition === null)
+            continue;
+        const zones = definition.stages.filter(one => one.kind === "approval" || one.kind === "choose").map(one => one.id);
+        if (zones.length === 0)
+            continue;
+        const n = Number(deciding.get(flow.id, JSON.stringify(zones))?.["n"] ?? 0);
+        for (let i = 0; i < n; i++)
+            bump(flow.repo, "needs-you");
+        if (n > 0)
+            flowAsks.set(flow.repo, [...(flowAsks.get(flow.repo) ?? []), ...namedCards.all(flow.id, JSON.stringify(zones), FLOW_ASKS)
+                    .map(row => ({ card: Number(row["id"]), stage: String(row["stage"]), entry: Number(row["entry"]), at: String(row["entered_at"]) }))]);
+    }
+    const rank = (one) => DISPLAY_STATES.indexOf(one.state);
+    return [...counts.entries()].map(([repo, value]) => ({ repo, ...rollUp(value),
+        families: [...strongest.values()].filter(one => one.repo === repo).map(({ rootId, state, line }) => {
+            const ask = state === "needs-you" ? asked.get(rootId) : undefined;
+            return { rootId, state, line, ...(ask === undefined ? {} : { ask }) };
+        }).sort((a, b) => rank(a) - rank(b)),
+        flowAsks: flowAsks.get(repo) ?? [] }))
+        .sort((a, b) => (a.repo ?? "").localeCompare(b.repo ?? ""));
+}

package/dist/agentconfig.js

@@ -19,8 +19,10 @@
  * The resolved pair is validated before anything is claimed or spent, and
  * the caller snapshots it into the run row.
  */
+import { PROJECT_NETWORK_DEFAULT, repositoryEcosystems, resolveNetwork } from "./egress.js";
 import { isProviderId, validateSpec } from "./provider.js";
-import { CLAUDE_LIMITS, CODEX_SHAPED_LIMITS, GEMINI_LIMITS } from "./scope.js";
+import { ACP_LIMITS, CLAUDE_LIMITS, CODEX_SHAPED_LIMITS, GEMINI_LIMITS } from "./scope.js";
+import { ACP_AGENTS, isAcpProvider } from "./acp-agents.js";
 import { exactModelId, legOf, PHASES, recommendRoute, routeFromJson, routeProblems, sameSpec } from "./phase-routing.js";
 export const INSTALLATION_SCOPE = "installation";
 /**
@@ -32,6 +34,10 @@ export const INSTALLATION_SCOPE = "installation";
  * resolved: pinned, flagged, or configured.
  */
 function reviewEligible(phase, spec) {
+    // An ACP agent works with full access inside the fence: it builds and repairs, and never reviews or plans.
+    if ((phase === "review" || phase === "plan") && isAcpProvider(spec.provider)) {
+        return `${ACP_AGENTS[spec.provider].name} builds and repairs only — pin ${phase === "review" ? "review" : "planning"} to claude or codex`;
+    }
     return phase === "review" && spec.provider === "gemini"
         ? "gemini has no isolation posture for the review phase yet (its own config can load hooks and MCP servers) — pin review to claude or codex"
         : null;
@@ -162,18 +168,35 @@ export function resolveScopeProfile(store, repo, ref, flags) {
                 repairTimeoutSeconds: GEMINI_LIMITS.repairTimeoutSeconds,
                 repairModel,
             }
-            : {
-                provider,
-                model,
-                sandboxMode: permissionMode === "bypassPermissions" ? "danger-full-access" : "workspace-write",
-                maxTurns: "unsupported",
-                repairMaxTurns: "unsupported",
-                timeoutSeconds: CODEX_SHAPED_LIMITS.timeoutSeconds,
-                timeoutKind: "idle",
-                repairTimeoutSeconds: CODEX_SHAPED_LIMITS.repairTimeoutSeconds,
-                repairModel,
-            };
-    return { ok: true, profile, provenance: { resolvedFrom: build.source, repairFrom } };
+            : isAcpProvider(provider)
+                ? {
+                    provider,
+                    model,
+                    // Full access inside the OS fence is the only posture an ACP agent has (scope.ts AcpProfile).
+                    permission: "full",
+                    maxTurns: "unsupported",
+                    repairMaxTurns: "unsupported",
+                    timeoutSeconds: ACP_LIMITS.timeoutSeconds,
+                    idleTimeoutSeconds: ACP_LIMITS.idleTimeoutSeconds,
+                    repairTimeoutSeconds: ACP_LIMITS.repairTimeoutSeconds,
+                    repairIdleTimeoutSeconds: ACP_LIMITS.repairIdleTimeoutSeconds,
+                    repairModel,
+                }
+                : {
+                    provider,
+                    model,
+                    sandboxMode: permissionMode === "bypassPermissions" ? "danger-full-access" : "workspace-write",
+                    maxTurns: "unsupported",
+                    repairMaxTurns: "unsupported",
+                    timeoutSeconds: CODEX_SHAPED_LIMITS.timeoutSeconds,
+                    timeoutKind: "idle",
+                    repairTimeoutSeconds: CODEX_SHAPED_LIMITS.repairTimeoutSeconds,
+                    repairModel,
+                };
+    // What the build may reach (egress.ts): resolved now, from the project's setting, the provider's own hosts and the
+    // registries the repository's own HEAD names, and sealed with the rest of the profile.
+    const network = resolveNetwork(provider, repo === null ? PROJECT_NETWORK_DEFAULT : store.projectNetwork(repo), repo === null ? [] : repositoryEcosystems(repo));
+    return { ok: true, profile: { ...profile, network }, provenance: { resolvedFrom: build.source, repairFrom } };
 }
 const PHASE_NOUN = { plan: "planner", build: "builder", repair: "repair", review: "reviewer" };
 export function resolveRouteCandidates(store, repo, pins = {}) {

package/dist/agents-board.d.ts

@@ -8,7 +8,7 @@
  * stats); nothing here verifies evidence or grants an action.
  */
 import { type AgentTurn, type ToolKind } from "./agent-board.js";
-import type { AgentGroupKey, BrowserAgentRow } from "./browser-workspace.js";
+import type { AgentGroupKey, AgentLaneWindow, BrowserAgentLanes, BrowserAgentRow } from "./browser-workspace.js";
 import type { Store } from "./store.js";
 export declare const AGENT_GROUPS: readonly {
     key: AgentGroupKey;
@@ -62,7 +62,6 @@ export declare function agentFacts(store: Store, now: Date, access: {
 }, account: string): AgentFacts[];
 /** The board's query, exported for its query-plan test. */
 export declare function agentFactsSql(): string;
-/** One exact build attempt, whatever its age (the opened row), in the admitted projects: a repair opens as its parent. */
 export declare function agentFactsFor(store: Store, run: number, access: {
     repos: readonly string[] | null;
 }, account: string): AgentFacts | null;
@@ -98,4 +97,37 @@ export declare function agentsBoardOf(store: Store, now: Date, access: {
 }[];
 /** A board fingerprint for one exact build: what its open view shows moved, its repairs included. */
 export declare function agentRunFingerprint(store: Store, run: number): string | null;
+/** The timeline's windows, all rolling (so no server time zone decides what "today" means); two hours by default. */
+export declare const LANE_WINDOWS: readonly {
+    key: AgentLaneWindow;
+    label: string;
+}[];
+/** Rows the timeline shows: twenty running tasks read as twelve rows and a count, not a wall. */
+export declare const LANE_ROWS = 12;
+export declare function laneWindowOf(value: string | null): AgentLaneWindow;
+export declare function laneSinceOf(window: AgentLaneWindow, now: Date): Date;
+/** The window's tasks, one row each with whether a run is live and when it was last active, newest activity first,
+ * and the total and running counts over all of them. The candidates come from bounded index ranges (run_started;
+ * work_unfinished and agent_board_recent, named so SQLite never walks every run) and drive the join (CROSS JOIN), so no
+ * task's history is walked; the admitted projects only. */
+export declare function agentLanesSql(): string;
+/** Segments one row keeps: its newest runs, so a task retried all day stays one readable row. */
+export declare const LANE_SEGMENTS = 40;
+/** One chosen task's live runs: all of them, through work_unfinished, so no cap can hide one. */
+export declare function laneLiveRunsSql(): string;
+/** Rows one task's lookups read at most, newest first: a task with thousands of runs costs the same as one with a few. */
+export declare const LANE_TASK_READ = 2000;
+/** One chosen task's runs that finished in the window: a seek on its own runs from its first finished run in the
+ * window (lead_status_task_run), reading at most LANE_TASK_READ of its newest runs; the newest LANE_SEGMENTS. */
+export declare function laneRunsSql(): string;
+/** A task's newest build, whenever it ran, among its newest 500 runs: the row's state comes from it even when it
+ * finished before the window. A task with more runs than that since its last build reads as planning or idle. */
+export declare function laneNewestBuildSql(): string;
+/** The timeline: one row per task that ran in the window, running ones first, then the most recently active, the
+ * first LANE_ROWS of them; the counts cover every task in the window. A row's state is worked out from its own
+ * newest build as the board would (planning while only a planner runs, otherwise idle). With nothing in the window but something in the last day,
+ * the timeline stays (empty) so its window choice does too; with nothing in a day it is null. */
+export declare function agentLanesOf(store: Store, now: Date, access: {
+    repos: readonly string[] | null;
+}, account: string, window: AgentLaneWindow, path?: string): BrowserAgentLanes | null;
 export {};

package/dist/agents-board.js

@@ -83,8 +83,11 @@ export function agentFactsSql() {
     ORDER BY r.id DESC LIMIT ${BOARD_LIMIT}`;
 }
 /** One exact build attempt, whatever its age (the opened row), in the admitted projects: a repair opens as its parent. */
+/** One attempt opened by its run: a build (a protocol repair opens as its build), or a planner, scout or reviewer —
+ * the board lists builds, but any running agent can be opened to see it and what it takes (cockpit §4). */
+const OPENED_FACTS = FACTS.replace("WHERE r.role = 'builder'", "WHERE r.role IN ('builder', 'planner', 'scout', 'reviewer')");
 export function agentFactsFor(store, run, access, account) {
-    const row = store.handle.prepare(`${FACTS} AND r.id = (SELECT CASE WHEN role = 'repair' AND parent_run IS NOT NULL THEN parent_run ELSE id END FROM run WHERE id = $run) AND ($all = 1 OR tr.repo IN (SELECT value FROM json_each($repos)))`)
+    const row = store.handle.prepare(`${OPENED_FACTS} AND r.id = (SELECT CASE WHEN role = 'repair' AND parent_run IS NOT NULL THEN parent_run ELSE id END FROM run WHERE id = $run) AND ($all = 1 OR tr.repo IN (SELECT value FROM json_each($repos)))`)
         .get({ $account: account, $run: run, $all: access.repos === null ? 1 : 0, $repos: JSON.stringify(access.repos ?? []) });
     return row === undefined ? null : readFacts(row);
 }
@@ -223,3 +226,109 @@ export function agentRunFingerprint(store, run) {
     FROM run r LEFT JOIN agent_now n ON n.run = r.id AND n.attempt_key = r.attempt_key WHERE r.id = ?`).get(run);
     return row === undefined ? null : Object.values(row).map(value => String(value)).join("|");
 }
+/** The timeline's windows, all rolling (so no server time zone decides what "today" means); two hours by default. */
+export const LANE_WINDOWS = [{ key: "30m", label: "30m" }, { key: "2h", label: "2h" }, { key: "24h", label: "24h" }];
+/** Rows the timeline shows: twenty running tasks read as twelve rows and a count, not a wall. */
+export const LANE_ROWS = 12;
+/** Runs are found by their start back this far; a builder that finished in the window is also found by its finish
+ * (agent_board_recent), however long it ran. A planner, review, scout or repair run that lasted over a day and ended
+ * in the window is the one case left out: finding it would need a finish-time index over every role. */
+const LANE_LOOKBACK_MS = 24 * 60 * 60_000;
+const WINDOW_MS = { "30m": 30 * 60_000, "2h": 2 * 60 * 60_000, "24h": 24 * 60 * 60_000 };
+const LANE_ROLES = "('planner', 'builder', 'repair', 'reviewer', 'scout')";
+export function laneWindowOf(value) {
+    return value === "30m" || value === "24h" ? value : "2h";
+}
+export function laneSinceOf(window, now) {
+    return new Date(now.getTime() - WINDOW_MS[window]);
+}
+/** The window's tasks, one row each with whether a run is live and when it was last active, newest activity first,
+ * and the total and running counts over all of them. The candidates come from bounded index ranges (run_started;
+ * work_unfinished and agent_board_recent, named so SQLite never walks every run) and drive the join (CROSS JOIN), so no
+ * task's history is walked; the admitted projects only. */
+export function agentLanesSql() {
+    return `WITH candidate AS (
+      SELECT DISTINCT id FROM (
+        SELECT id FROM run WHERE started_at >= $lookback
+        UNION ALL SELECT id FROM run INDEXED BY work_unfinished WHERE outcome IS NULL
+        UNION ALL SELECT id FROM run INDEXED BY agent_board_recent WHERE role = 'builder' AND outcome IS NOT NULL AND finished_at >= $since
+      )
+    ), active AS (
+      SELECT r.task_ref, tr.external_id AS task_id, tr.repo, t.title,
+        MAX(r.outcome IS NULL) AS live, MAX(coalesce(r.finished_at, $now)) AS last_at, MAX(r.id) AS last_run, MIN(CASE WHEN r.outcome IS NOT NULL THEN r.id END) AS first_done
+      FROM candidate c CROSS JOIN run r ON r.id = c.id
+      CROSS JOIN task_ref tr ON tr.id = r.task_ref AND tr.backend = 'built-in' AND tr.repo IS NOT NULL
+      CROSS JOIN task t ON t.id = tr.external_id
+      WHERE r.role IN ${LANE_ROLES} AND (r.outcome IS NULL OR r.finished_at >= $since)
+        AND ($all = 1 OR tr.repo IN (SELECT value FROM json_each($repos)))
+      GROUP BY r.task_ref
+    )
+    SELECT a.*, (SELECT count(*) FROM active) AS total, (SELECT coalesce(sum(live), 0) FROM active) AS running
+    FROM active a ORDER BY a.live DESC, a.last_at DESC, a.last_run DESC LIMIT $rows`;
+}
+/** Segments one row keeps: its newest runs, so a task retried all day stays one readable row. */
+export const LANE_SEGMENTS = 40;
+/** One chosen task's live runs: all of them, through work_unfinished, so no cap can hide one. */
+export function laneLiveRunsSql() {
+    return `SELECT id, role, provider, outcome, started_at, finished_at FROM run INDEXED BY work_unfinished
+    WHERE task_ref = $ref AND outcome IS NULL AND role IN ${LANE_ROLES}`;
+}
+/** Rows one task's lookups read at most, newest first: a task with thousands of runs costs the same as one with a few. */
+export const LANE_TASK_READ = 2000;
+/** One chosen task's runs that finished in the window: a seek on its own runs from its first finished run in the
+ * window (lead_status_task_run), reading at most LANE_TASK_READ of its newest runs; the newest LANE_SEGMENTS. */
+export function laneRunsSql() {
+    return `SELECT id, role, provider, outcome, started_at, finished_at FROM (
+      SELECT id, role, provider, outcome, started_at, finished_at FROM run WHERE task_ref = $ref AND id >= $from ORDER BY id DESC LIMIT ${LANE_TASK_READ}
+    ) WHERE outcome IS NOT NULL AND finished_at >= $since AND role IN ${LANE_ROLES}
+    ORDER BY id DESC LIMIT ${LANE_SEGMENTS}`;
+}
+/** A task's newest build, whenever it ran, among its newest 500 runs: the row's state comes from it even when it
+ * finished before the window. A task with more runs than that since its last build reads as planning or idle. */
+export function laneNewestBuildSql() {
+    return `SELECT id FROM (SELECT id, role FROM run WHERE task_ref = $ref ORDER BY id DESC LIMIT 500) WHERE role = 'builder' LIMIT 1`;
+}
+/** The timeline: one row per task that ran in the window, running ones first, then the most recently active, the
+ * first LANE_ROWS of them; the counts cover every task in the window. A row's state is worked out from its own
+ * newest build as the board would (planning while only a planner runs, otherwise idle). With nothing in the window but something in the last day,
+ * the timeline stays (empty) so its window choice does too; with nothing in a day it is null. */
+export function agentLanesOf(store, now, access, account, window, path = "/agents") {
+    const read = (since, rows) => store.handle.prepare(agentLanesSql()).all({
+        $lookback: new Date(since.getTime() - LANE_LOOKBACK_MS).toISOString(), $since: since.toISOString(), $now: now.toISOString(),
+        $all: access.repos === null ? 1 : 0, $repos: JSON.stringify(access.repos ?? []), $rows: rows,
+    });
+    const since = laneSinceOf(window, now);
+    const tasks = read(since, LANE_ROWS);
+    if (tasks.length === 0 && (window === "24h" || read(laneSinceOf("24h", now), 1).length === 0))
+        return null;
+    const doneOf = store.handle.prepare(laneRunsSql()), liveOf = store.handle.prepare(laneLiveRunsSql()), newestBuildOf = store.handle.prepare(laneNewestBuildSql());
+    const lanes = tasks.map(row => {
+        const ref = Number(row["task_ref"]);
+        const taskId = String(row["task_id"]);
+        const done = row["first_done"] == null ? [] : doneOf.all({ $ref: ref, $from: Number(row["first_done"]), $since: since.toISOString() });
+        const runs = [...liveOf.all({ $ref: ref }), ...done].sort((a, b) => Number(a["id"]) - Number(b["id"]));
+        const segments = runs.map(run => {
+            const role = String(run["role"]);
+            return {
+                runId: Number(run["id"]), role: role === "repair" ? "builder" : role, agent: providerName(String(run["provider"] ?? "claude")),
+                startedAt: String(run["started_at"]), endedAt: str(run, "finished_at"), outcome: str(run, "outcome"),
+                // Every role opens in the agent view (planners, scouts and reviewers too): what it is doing and what it takes.
+                href: `/agents?run=${Number(run["id"])}`,
+            };
+        });
+        // The row's state from the task's own newest build, as the board would place it (never the board's capped list),
+        // even when that build finished before the window.
+        const build = newestBuildOf.get({ $ref: ref });
+        const facts = build === undefined ? null : agentFactsFor(store, Number(build["id"]), access, account);
+        const group = facts !== null ? agentGroupOf(facts, facts.outcome === null ? runActivityOf(store, { id: facts.runId, runner: facts.runner, startedAt: facts.startedAt }, now).at : null, now).group
+            : segments.some(one => one.role === "planner" && one.endedAt === null) ? "planning" : "idle";
+        return { taskId, title: String(row["title"]), project: str(row, "repo") === null ? null : projectName(str(row, "repo")), href: `/t/${encodeURIComponent(taskId)}`, group, segments };
+    });
+    const total = tasks.length === 0 ? 0 : Number(tasks[0]["total"]);
+    return {
+        since: since.toISOString(), now: now.toISOString(),
+        windows: LANE_WINDOWS.map(one => ({ ...one, href: `${path}?window=${one.key}`, active: one.key === window })),
+        lanes, more: Math.max(0, total - lanes.length),
+        running: tasks.length === 0 ? 0 : Number(tasks[0]["running"]),
+    };
+}

package/dist/approval-rules-ui.js

@@ -4,7 +4,7 @@
  * the identity provider); everyone else reads them. Every change is in the
  * ledger, before → after.
  */
-import { html, postForm } from "./html.js";
+import { html, postForm, reauth } from "./html.js";
 export const APPROVAL_RULES_CSS = `.approval-rules{max-width:720px;min-width:0}.approval-rules fieldset{border:0;padding:0;margin:18px 0 0;min-width:0}` +
     `.approval-rules legend{font-weight:600;font-size:.875rem;margin-bottom:8px}.approval-rules .choice{display:grid;grid-template-columns:auto minmax(0,1fr);gap:10px;align-items:start;margin:0 0 10px;font-weight:400}` +
     `.approval-rules .choice input{margin:.2rem 0 0}.approval-rules .choice strong{display:block;font-size:.875rem;font-weight:500}.approval-rules .choice small{display:block;color:var(--muted-foreground);font-size:.8125rem;margin-top:2px}` +
@@ -30,5 +30,5 @@ export function approvalRulesHtml(view, notice) {
     const protect = view.rules.protectProject ? "project" : view.rules.protectedPaths.length > 0 ? "paths" : "none";
     const radio = (value, title, hint) => html `<label class="choice"><input type="radio" name="protect" value="${value}"${protect === value ? html ` checked` : ""}><span><strong>${title}</strong><small>${hint}</small></span></label>`;
     const few = view.approvers < 2 ? html `<p class="meta">Only ${view.approvers === 1 ? "one person" : "no one"} can approve on this project, so protected work would wait for a second approver. Add one in People first.</p>` : "";
-    return html `<section class="approval-rules">${note}${current}${postForm("/settings/approval", html `<fieldset><legend>Who approves</legend><label class="choice"><input type="checkbox" name="not_requester" value="1"${view.rules.notRequester ? html ` checked` : ""}><span><strong>Someone other than the requester</strong><small>The person who filed a task, or asked for a revision, can't approve it. Operating modes stop approving their signer's own filings here.</small></span></label></fieldset><fieldset><legend>Protected work</legend>${radio("none", "Nothing protected", html `One approval is enough.`)}${radio("project", "The whole project", html `Every task needs two different people to approve the same scope.`)}${radio("paths", "Only these paths", html `Tasks that touch them, or don't say what they touch, need two people.`)}<div class="paths"><label>Protected paths, one per line<textarea name="paths" spellcheck="false" placeholder="infra/**&#10;migrations/**">${view.rules.protectedPaths.join("\n")}</textarea></label></div>${few}</fieldset><div class="step-up"><label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label></div><button type="submit">Save rules</button>`, { hidden: { repo: view.repo } })}</section>`;
+    return html `<section class="approval-rules">${note}${current}${postForm("/settings/approval", html `<fieldset><legend>Who approves</legend><label class="choice"><input type="checkbox" name="not_requester" value="1"${view.rules.notRequester ? html ` checked` : ""}><span><strong>Someone other than the requester</strong><small>The person who filed a task, or asked for a revision, can't approve it. Operating modes stop approving their signer's own filings here.</small></span></label></fieldset><fieldset><legend>Protected work</legend>${radio("none", "Nothing protected", html `One approval is enough.`)}${radio("project", "The whole project", html `Every task needs two different people to approve the same scope.`)}${radio("paths", "Only these paths", html `Tasks that touch them, or don't say what they touch, need two people.`)}<div class="paths"><label>Protected paths, one per line<textarea name="paths" spellcheck="false" placeholder="infra/**&#10;migrations/**">${view.rules.protectedPaths.join("\n")}</textarea></label></div>${few}</fieldset><div class="step-up">${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label>`)}</div><button type="submit">Save rules</button>`, { hidden: { repo: view.repo } })}</section>`;
 }

package/dist/assignment-delivery.d.ts

@@ -47,6 +47,20 @@ export declare function assignmentInbox(store: Store, owner: AssignmentOwner, qu
     consumer: string;
     limit?: number;
 }, now: Date): AssignmentInboxResult;
+/**
+ * What the lead's follow inbox would hand over next, without issuing anything (lead sweeps, docs/plans/lead-fan-out.md):
+ * whether a page is already issued (it always replays at once — never held), and the unread events' tasks.
+ */
+export declare function leadFollowUnread(store: Store, grant: {
+    id: number;
+    repos: readonly string[];
+}, consumer: string): {
+    issued: boolean;
+    events: {
+        task: string;
+        state: string;
+    }[];
+};
 /** The built-in lead's inbox: the same page, replay and acknowledgment as a coordinator's, over its follow grant. */
 export declare function leadFollowInbox(store: Store, grant: {
     id: number;

package/dist/assignment-delivery.js

@@ -97,6 +97,19 @@ function pendingBatch(store, reader, key) {
 export function assignmentInbox(store, owner, query, now) {
     return inbox(store, coordinatorReader(store, owner), query, now);
 }
+/**
+ * What the lead's follow inbox would hand over next, without issuing anything (lead sweeps, docs/plans/lead-fan-out.md):
+ * whether a page is already issued (it always replays at once — never held), and the unread events' tasks.
+ */
+export function leadFollowUnread(store, grant, consumer) {
+    const reader = followReader(grant), key = reader.key(consumer);
+    if (pendingBatch(store, reader, key) !== null)
+        return { issued: true, events: [] };
+    const after = store.serviceCursor(`assignment-inbox:${key}:acked`);
+    const rows = store.handle.prepare("SELECT task_id, json_extract(outcome, '$.assignment.state') AS state FROM action_ledger WHERE id > ? AND actor = ? AND action = ? AND source = 'work' ORDER BY id LIMIT 100")
+        .all(after, reader.actor, ASSIGNMENT_STATUS_ACTION);
+    return { issued: false, events: rows.map(row => ({ task: String(row["task_id"]), state: String(row["state"] ?? "") })) };
+}
 /** The built-in lead's inbox: the same page, replay and acknowledgment as a coordinator's, over its follow grant. */
 export function leadFollowInbox(store, grant, query, now) {
     return inbox(store, followReader(grant), query, now);