toolroll 0.9.63 → 0.9.67

package/dist/chat-actions.js

@@ -1,5 +1,9 @@
 /** Shared, exact-state actions. Models may prepare; only the existing human
  * confirmation door executes. Protected actions use a one-use review receipt. */
+import { fileTaskProposal } from "./proposal.js";
+import { heuristicSizing } from "./task-sizing.js";
+import { cancelSweepRest, sweepOpen, sweepTable, VERDICT_RULE } from "./lead-sweep.js";
+import { isAcpProfile } from "./acp-agents.js";
 import { withActor } from "./actor.js";
 import { TEXT_LIMITS } from "./text-limits.js";
 import { publicChatText } from "./chat-display.js";
@@ -9,7 +13,7 @@ import { leadTurnKeepsProposals, verifiedAuthor } from "./store.js";
 import { isVerifiedApprover, reproveApprover, } from "./principal.js";
 import { changeSkills, importSkill, skillsView, skillsVersion, testSkill, validateSkill, } from "./project-skills.js";
 import { changeKnowledge, knowledgeVersion, knowledgeView, } from "./project-knowledge.js";
-import { approve, authenticateApprover, describeScope, scopeAuthorityOf, } from "./scope.js";
+import { passwordlessSessionFor, approve, authenticateApprover, describeScope, scopeAuthorityOf, freshnessFor, spendingOnlyOnSuccess, ssoNowAvailable, withFreshness, } from "./scope.js";
 import { readVerifiedArtifact, scanForSecrets } from "./evidence.js";
 import { readAuthModeStrict } from "./keys.js";
 import { parseProof } from "./proof.js";
@@ -86,6 +90,11 @@ export const CHAT_ACTIONS = {
     flow_create: { label: "Create flow", protected: false, password: false },
     // A starter flow: its zones and its trigger, switched on with one yes (flow-starters.ts).
     flow_starter: { label: "Switch on", protected: false, password: false },
+    // Lead fan-out (docs/plans/lead-fan-out.md): files N tasks under one brief and approves each one's scope — the
+    // person's ceremony (protected, with the password), N ordinary approvals of exactly the scopes shown.
+    sweep_file: { label: "Start sweep", protected: true, password: true },
+    // Stops every item of a sweep not yet ready; finished results stay. An ordinary act, like cancelling a task.
+    sweep_cancel_rest: { label: "Cancel the rest", protected: false, password: false },
     flow_edit: { label: "Save flow", protected: false, password: false },
     flow_card_add: { label: "Add card", protected: false, password: false },
     flow_card_move: { label: "Move card", protected: false, password: false },
@@ -175,10 +184,12 @@ function runtimeTerms(profile) {
             ? profile.approvalArgv === "yolo"
                 ? "Full access: every tool is approved automatically (--approval-mode yolo)."
                 : "Edits are approved automatically; other tools are refused."
-            : profile.sandboxMode === "danger-full-access"
-                ? "Full access: approvals and sandbox are bypassed (--dangerously-bypass-approvals-and-sandbox)."
-                : "Commands use the workspace-write sandbox.";
-    return `${profile.provider} · ${profile.model}\n${permission}\n${profile.timeoutSeconds} seconds ${profile.timeoutKind === "idle" ? "without progress" : "per attempt"}${profile.provider === "claude" ? `; at most ${profile.maxTurns} turns` : ""}. Repairs: ${profile.repairModel}, ${profile.repairTimeoutSeconds} seconds${profile.provider === "claude" ? `, at most ${profile.repairMaxTurns} turns` : ""}.`;
+            : isAcpProfile(profile)
+                ? "Full access inside the OS fence: the agent runs any tool it chooses, and nothing outside the fence is reachable."
+                : profile.sandboxMode === "danger-full-access"
+                    ? "Full access: approvals and sandbox are bypassed (--dangerously-bypass-approvals-and-sandbox)."
+                    : "Commands use the workspace-write sandbox.";
+    return `${profile.provider} · ${profile.model}\n${permission}\n${isAcpProfile(profile) ? `${profile.timeoutSeconds} seconds per attempt, or ${profile.idleTimeoutSeconds} seconds silent` : `${profile.timeoutSeconds} seconds ${profile.timeoutKind === "idle" ? "without progress" : "per attempt"}`}${profile.provider === "claude" ? `; at most ${profile.maxTurns} turns` : ""}. Repairs: ${profile.repairModel}, ${profile.repairTimeoutSeconds} seconds${profile.provider === "claude" ? `, at most ${profile.repairMaxTurns} turns` : ""}.`;
 }
 function resultOf(store, task, run, repo) {
     const ref = store.lookupRef(task);
@@ -263,7 +274,7 @@ export function prepareSharedAction(store, who, operation, input, root, now = ne
         const stamp = hash({ operation, request, repo: "", state, terms, actor: who.name, generation: who.generation, ceiling: who.ceilingDigest });
         return { version: SHARED_ACTION_VERSION, operation, request, repo: "", title, terms, stamp, state };
     }
-    const task = operation.startsWith("skill_") || operation.startsWith("knowledge_") || operation.startsWith("decision_") || operation.startsWith("tool_") || operation.startsWith("flow_") || operation.startsWith("subagent_") || operation.startsWith("kit_")
+    const task = operation.startsWith("skill_") || operation.startsWith("knowledge_") || operation.startsWith("decision_") || operation.startsWith("tool_") || operation.startsWith("flow_") || operation.startsWith("subagent_") || operation.startsWith("kit_") || operation.startsWith("sweep_")
         ? null
         : text(input, "task", 64);
     const flowTarget = operation.startsWith("flow_") && operation !== "flow_create" && operation !== "flow_script_save" && operation !== "flow_starter" ? flowTargetOf(store, input) : null;
@@ -275,7 +286,8 @@ export function prepareSharedAction(store, who, operation, input, root, now = ne
     const questionFlow = questionTarget === null ? null : store.getFlow(store.getFlowCard(questionTarget.card)?.flow ?? -1);
     if (operation === "subagent_answer" && (questionTarget === null || questionFlow === null))
         throw Error("That question isn't open any more.");
-    const repo = flowTarget !== null ? flowTarget.flow.repo : subagentTarget !== null ? subagentTarget.repo : questionFlow !== null ? questionFlow.repo : task === null ? text(input, "repo", 4096) : store.lookupRef(task)?.repo;
+    const repo = operation === "sweep_cancel_rest" ? store.getSweep(integer(input, "sweep"))?.repo
+        : flowTarget !== null ? flowTarget.flow.repo : subagentTarget !== null ? subagentTarget.repo : questionFlow !== null ? questionFlow.repo : task === null ? text(input, "repo", 4096) : store.lookupRef(task)?.repo;
     if (!repo)
         throw Error("Choose an available project.");
     requireActor(store, who, repo);
@@ -554,6 +566,50 @@ export function prepareSharedAction(store, who, operation, input, root, now = ne
             terms.push(question.question, `Your answer: ${[choice?.label, said].filter(Boolean).join(" — ")}`);
         }
     }
+    else if (operation === "sweep_cancel_rest") {
+        // Exactly the items open now: if any settles or starts in between, the card is stale and a fresh one is needed.
+        const table = sweepTable(store, integer(input, "sweep"), now, who.repos);
+        if (table === null || table.repo !== repo)
+            throw Error("That sweep isn't one of yours.");
+        // Exactly the items as they stand now — each one's active task (a revision, after one), state, running attempt and
+        // last change: any change makes this card stale, so nothing is acted on that wasn't shown.
+        const open = sweepOpen(store, table, now);
+        if (open.length === 0)
+            throw Error("Nothing in that sweep is still unfinished.");
+        state = { open };
+        title = `Cancel the rest of ${table.title}`;
+        const running = open.filter(one => one.run !== null);
+        terms.push(`Cancels ${open.length - running.length} unfinished item${open.length - running.length === 1 ? "" : "s"}${running.length === 0 ? "" : ` and stops ${running.length} running build${running.length === 1 ? "" : "s"}`}: ${open.map(one => `${one.label} (${one.task})`).join(", ")}.`, "Finished results stay.");
+    }
+    else if (operation === "sweep_file") {
+        // Everything the person approves is on this screen: the shared rules, every item, the one success test, the
+        // limit. Confirming files exactly these and approves exactly these scopes; anything changed is a new card.
+        const sweepTitle = text(input, "title", 200).trim(), brief = text(input, "brief", 8000).trim();
+        const items = Array.isArray(input["items"]) ? input["items"] : [];
+        if (items.length < 2 || items.length > 20)
+            throw Error("A sweep is 2 to 20 items. For one, propose a task.");
+        const cleaned = items.map((one, index) => ({ title: text(one, "title", 200).trim(), item: text(one, "item", 4000).trim(), index }));
+        const maxParallel = integer(input, "maxParallel");
+        if (maxParallel < 1 || maxParallel > 8)
+            throw Error("Run 1 to 8 at once.");
+        request["title"] = sweepTitle;
+        request["brief"] = brief;
+        request["items"] = cleaned.map(({ title, item }) => ({ title, item }));
+        const project = repo.split(/[\\/]/).filter(Boolean).at(-1) ?? repo;
+        title = `Start a sweep in ${project}: ${sweepTitle}`;
+        // Every word each child's scope will hold is shown here (the security review: nothing approved off-screen): its
+        // goal is the shared rules, then its item, then the verdict line; its success test is the shared acceptance.
+        const acceptance = Array.isArray(input["acceptance"]) ? input["acceptance"] : [];
+        if (acceptance.length === 0)
+            throw Error("A sweep needs a success test every item shares.");
+        // Every child's scope exactly as filing would make it — its words AND its agent's permissions, limits and route —
+        // found by filing them in a savepoint that is always rolled back (prepare writes nothing). They are on this card and
+        // in its state: if a project default changes before confirm, the card is stale and nothing is filed or approved.
+        const children = sweepChildScopes(store, who, repo, brief, cleaned.map(({ title, item }) => ({ title, item })), input["acceptance"], now);
+        state = { children: children.map(one => one.fingerprint) };
+        const tests = acceptance.map((one, index) => `Success test ${index + 1}${typeof one["id"] === "string" ? ` (${one["id"]})` : ""}: ${String(one["statement"] ?? "")}${Array.isArray(one["evidence"]) ? ` — shown by ${one["evidence"].map(String).join(", ")}` : ""}`);
+        terms.push(`${cleaned.length} tasks, each in its own worktree on its own branch, at most ${maxParallel} running at once, built directly (no separate planning step).`, `Shared rules for every item: ${brief}`, ...cleaned.map(one => `Item ${one.index + 1} — ${one.title}: ${one.item}`), `Each item's goal is the shared rules, then its own item, then: ${VERDICT_RULE}`, ...tests.map(line => `Every item — ${line}`), ...(children.every(one => one.runtime === children[0].runtime) ? [`Every item — ${children[0].runtime}`] : children.map((one, index) => `Item ${index + 1} — ${one.runtime}`)), "Confirming files all of them and approves each one's scope exactly as shown. An item that needs a second person, or that the project's rules keep from its requester, is filed and waits for its own approval.", "Each ends with a verdict (fixed, not reproducible, blocked or done) and the sweep's table shows them as they land.");
+    }
     else if (operation.startsWith("flow_")) {
         const project = repo.split(/[\\/]/).filter(Boolean).at(-1) ?? repo;
         if (operation === "flow_create") {
@@ -985,10 +1041,28 @@ function savedActionContext(store, who, id, state) {
     requireActor(store, who, payload.repo, payload.operation);
     return payload;
 }
+/** An action's terms alone, without whose proposal it was (actor, generation, ceiling). */
+const termsStampOf = (action) => hash({ operation: action.operation, request: action.request, repo: action.repo, state: action.state, terms: action.terms });
+/**
+ * Whether the live action is the saved one: the exact stamp; or, for a scope approval already holding another
+ * approver's yes on these exact terms (awaiting the second), the same terms — each reviewer's own nonce and authority
+ * are still bound to them individually.
+ */
+function sameSharedAction(store, who, live, saved) {
+    if (live.stamp === saved.stamp)
+        return true;
+    if (saved.operation !== "scope_approve" || termsStampOf(live) !== termsStampOf(saved))
+        return false;
+    const task = typeof saved.request["task"] === "string" ? saved.request["task"] : null;
+    const scope = task === null ? null : store.getScope(task);
+    if (scope === null)
+        return false;
+    return store.handle.prepare("SELECT 1 FROM scope_approval_vote WHERE task_id = ? AND digest = ? AND approver <> ? LIMIT 1").get(task, scope.digest, who.name) !== undefined;
+}
 export function mintSharedActionReview(store, who, id, root, now) {
     const payload = savedActionContext(store, who, id, "pending");
     const live = prepareSharedAction(store, who, payload.operation, payload.request, root, now);
-    if (live.stamp !== payload.stamp)
+    if (!sameSharedAction(store, who, live, payload))
         throw Error("This action changed. Ask for a fresh proposal.");
     const nonce = randomBytes(24).toString("hex");
     if (!store.mintCeremonyNonce({
@@ -1014,7 +1088,7 @@ export function executeSharedAction(store, who, id, payload, now, options) {
         if (hash(saved) !== hash(payload))
             return refuse("refused", "This action does not match the saved proposal.");
         live = prepareSharedAction(store, who, saved.operation, saved.request, options.root, now);
-        if (live.stamp !== saved.stamp)
+        if (!sameSharedAction(store, who, live, saved))
             return refuse("stale", "This action changed. Ask for a fresh proposal.");
     }
     catch (error) {
@@ -1022,6 +1096,8 @@ export function executeSharedAction(store, who, id, payload, now, options) {
             ? error.message
             : "This action is no longer available.");
     }
+    // The review nonce was minted against the saved proposal's stamp: it is checked against that, whoever reviews.
+    const savedStamp = payload.stamp;
     payload = live;
     const config = CHAT_ACTIONS[live.operation], req = live.request;
     const challenged = options.via !== "web" &&
@@ -1031,14 +1107,21 @@ export function executeSharedAction(store, who, id, payload, now, options) {
     if (sharedActionNeedsReview(payload) && !challenged) {
         if (options.via !== "web" || !options.review || options.confirm !== true)
             return refuse("needs-confirm", "Review the complete action in the secure confirmation screen.");
-        if (!store.consumeCeremonyNonce(nonceHash(options.review.nonce), who.name, "chat-action", id, payload.stamp, now))
+        if (!store.consumeCeremonyNonce(nonceHash(options.review.nonce), who.name, "chat-action", id, savedStamp, now))
             return refuse("needs-confirm", "This confirmation expired or was already used. Open the review again.");
+        // A scope approval proves its person inside approve() (one transaction with the seal, under the same freshness
+        // rule as the task page); here an empty field is only looked at, never spent (an explicit re-check is one-use).
+        const emptyApproval = payload.operation === "scope_approve" && options.review.password === "";
         if (config.password &&
-            !authenticateApprover(store, who.name, options.review.password, payload.repo).ok)
+            (emptyApproval
+                ? !passwordlessSessionFor(store, who.name) && !ssoNowAvailable(who.name) && withFreshness("approve-standard", () => freshnessFor(who.name)) === null
+                : !authenticateApprover(store, who.name, options.review.password, payload.repo).ok))
             return refuse("needs-confirm", "Confirm with your password in the secure screen.");
     }
     try {
-        return store.savepoint(() => {
+        // A scope approval's re-check (sso-now) is spent only if it happens: a refusal or a rolled-back savepoint puts it
+        // back (its every effect is in this transaction). Other actions spend it whatever comes of them.
+        const act = () => store.savepoint(() => {
             const task = typeof req["task"] === "string" ? req["task"] : null, repo = payload.repo, actor = who.name;
             let taskId = task;
             if (payload.operation === "lead_about_you") {
@@ -1076,6 +1159,14 @@ export function executeSharedAction(store, who, id, payload, now, options) {
                 const done = runFlowAction(store, payload, actor, who.repos, options.root, now);
                 return { ok: true, taskId: null, said: done.said, href: done.href };
             }
+            else if (payload.operation === "sweep_cancel_rest") {
+                const said = cancelSweepRest(store, who.name, payload.state["open"], now, "web");
+                return { ok: true, taskId: null, said, href: `/sweeps/${Number(req["sweep"])}` };
+            }
+            else if (payload.operation === "sweep_file") {
+                const done = fileSweep(store, who, id, payload, options.review?.password ?? "", now);
+                return { ok: true, taskId: null, said: done.said, href: done.href };
+            }
             else if (payload.operation === "kit_setup") {
                 const kit = kitOf(String(req["kit"]));
                 const made = setUpKitNow(store, kit, repo, actor, now, null, true);
@@ -1117,11 +1208,14 @@ export function executeSharedAction(store, who, id, payload, now, options) {
                 }, now);
             else if (payload.operation === "scope_approve") {
                 const scope = store.getScope(task);
-                const result = approve(store, task, actor, now, scope.digest, options.review.password);
+                // Cockpit B2: classified by the act, not the road — the same standard-approval freshness as /t/:id/approve.
+                const result = withFreshness("approve-standard", () => approve(store, task, actor, now, scope.digest, options.review.password));
                 if (!result.ok) {
-                    // v102: the project's approval rules speak for themselves.
+                    // A first yes on protected work is kept, with how its person was proved: committed, never rolled back.
+                    // The card stays open (`awaiting`) for the second approver; the same person again changes nothing.
                     if (result.reason === "second-approver")
-                        throw Error(gateWords({ verdict: "vote", have: result.have, need: 2, already: result.already }));
+                        return { ok: true, taskId, awaiting: true, ...(result.already ? { already: true } : {}), said: gateWords({ verdict: "vote", have: result.have, need: 2, already: result.already }) };
+                    // v102: the project's approval rules speak for themselves.
                     if (result.reason === "requester" || result.reason === "person-required")
                         throw Error(gateWords({ verdict: "refuse", reason: result.reason }));
                     if (result.reason === "policy")
@@ -1187,6 +1281,7 @@ export function executeSharedAction(store, who, id, payload, now, options) {
                                                                     : "Project knowledge saved.";
             return { ok: true, taskId, said };
         });
+        return payload.operation === "scope_approve" ? spendingOnlyOnSuccess(act, result => !result.ok || ("already" in result && result.already === true)) : act();
     }
     catch (error) {
         return refuse("refused", error instanceof Error
@@ -1195,6 +1290,93 @@ export function executeSharedAction(store, who, id, payload, now, options) {
     }
 }
 /** A confirmed subagent action (v92), through the same helpers the Subagents pages use. */
+/**
+ * Lead fan-out: file every item (all of them or none — any refusal throws and the savepoint takes the whole sweep
+ * back), link them to one sweep record, then approve each one's scope through the ordinary approval (its own digest,
+ * its own rules). A child the approval refuses stays filed and unapproved; it is named, never retried.
+ */
+/** One child as filing makes it (the shared brief, its item, the verdict rule; the shared acceptance; built directly). */
+function fileSweepChild(store, who, repo, brief, one, acceptance, now) {
+    const goal = `${brief}\n\nThis item:\n${one.item}\n\n${VERDICT_RULE}`;
+    return fileTaskProposal(store, {
+        title: one.title, repo, goal, acceptance, planning: "skip",
+        // Sized now, by the same heuristic filing would use: no background classifier is started — the card's dry run must
+        // leave nothing running after its rollback, and the approved scope must be the one shown (Codex sweep r2).
+        sizing: heuristicSizing({ title: one.title, goal, outOfScope: null }),
+        filedVia: "mate", filedBy: { name: who.name, kind: "person" }, proposedVia: "mate", admittedRepos: [...who.repos],
+    }, now);
+}
+/** A filed child's scope in the words an approval agrees to (no identity lines), its runtime terms, and their digest. */
+function sweepChildScopeOf(store, taskId) {
+    const scope = store.getScope(taskId);
+    if (scope === null)
+        throw Error("A sweep item has no scope to show.");
+    const authority = scopeAuthorityOf(scope, { authMode: readAuthModeStrict });
+    if (!authority.ok)
+        throw Error(authority.problem);
+    const words = describeScope(scope).filter(line => !/^\s*(reference|approved)\s/.test(line)).map(line => line.trim());
+    const runtime = `Agent permissions and limits: ${runtimeTerms(authority.profile)} ${authority.authMode === "api-key" ? "Uses your API key; spend is charged to that account." : authority.authMode === "subscription" ? "Uses your subscription login." : ""}`.trim();
+    // The fingerprint covers the scope's every field, not only what is rendered (a profile setting no sentence names, such
+    // as an agent's idle timeout, still makes the card stale): its exact terms with only identity left out.
+    const { taskId: _task, digest: _digest, approvedDigest: _approved, approvedBy: _by, approvedAt: _at, proposedAt: _proposed, approvalBasis: _basis, modeDigest: _mode, approvedProfile: _approvedProfile, approvedProfileJson: _approvedProfileJson, approvedChainJson: _approvedChain, ...terms } = scope;
+    return { fingerprint: hash({ words, runtime, authMode: authority.authMode, profile: authority.profile, terms }), runtime, words };
+}
+/** Every child as filing would make it, found in a savepoint that is always rolled back: prepare never writes. */
+function sweepChildScopes(store, who, repo, brief, items, acceptance, now) {
+    const dryRun = new Error("sweep dry run");
+    let found = [];
+    // Inside one transaction (filing opens its own; transact flattens), a savepoint that always rolls back.
+    store.transact(() => {
+        try {
+            store.savepoint(() => {
+                found = items.map((one, index) => {
+                    const made = fileSweepChild(store, who, repo, brief, one, acceptance, now);
+                    if (!made.ok)
+                        throw Error(`Item ${index + 1} (${one.title}) can't be filed: ${made.message}`);
+                    return sweepChildScopeOf(store, made.id);
+                });
+                throw dryRun;
+            });
+        }
+        catch (error) {
+            if (error !== dryRun)
+                throw error;
+        }
+    });
+    return found;
+}
+function fileSweep(store, who, proposal, payload, password, now) {
+    const req = payload.request;
+    const already = store.sweepOfProposal(proposal);
+    if (already !== null)
+        return { said: "This sweep was already started.", href: `/sweeps/${already}` };
+    const items = req["items"];
+    const brief = String(req["brief"]);
+    const sweep = store.createSweep({ owner: who.name, thread: store.getLeadProposal(proposal)?.thread ?? null, repo: payload.repo, title: String(req["title"]), brief,
+        maxParallel: Number(req["maxParallel"]), proposal }, now);
+    const filed = [];
+    for (const [index, one] of items.entries()) {
+        const made = fileSweepChild(store, who, payload.repo, brief, one, req["acceptance"], now);
+        if (!made.ok)
+            throw Error(`Item ${index + 1} (${one.title}) couldn't be filed: ${made.message}. Nothing was filed.`);
+        // Each filed scope must be exactly the one the card showed (words, permissions, limits, route); else nothing is filed.
+        if (sweepChildScopeOf(store, made.id).fingerprint !== payload.state["children"]?.[index])
+            throw Error(`Item ${index + 1} (${one.title}) no longer matches what you reviewed (a project default changed). Nothing was filed; ask for a fresh card.`);
+        store.addSweepTask(sweep, made.id, index, one.title);
+        filed.push({ id: made.id, title: one.title });
+    }
+    const waiting = [];
+    for (const one of filed) {
+        const scope = store.getScope(one.id);
+        const approved = scope === null ? null : withFreshness("approve-standard", () => approve(store, one.id, who.name, now, scope.digest, password));
+        if (approved === null || !approved.ok)
+            waiting.push(one.title);
+    }
+    const said = waiting.length === 0
+        ? `Started: ${filed.length} tasks, at most ${Number(req["maxParallel"])} at once.`
+        : `Started: ${filed.length - waiting.length} of ${filed.length} approved; ${waiting.length} wait for their own approval (${waiting.join(", ")}).`;
+    return { said, href: `/sweeps/${sweep}` };
+}
 function runSubagentAction(store, payload, actor, now) {
     const req = payload.request;
     if (payload.operation === "subagent_create") {

package/dist/chat-ask.d.ts

@@ -12,6 +12,10 @@
  */
 import type { ChatBinding, ChatEvent, ChatState } from "./chat-delivery-state.js";
 import { type LeadAsk, type Store } from "./store.js";
+/** Whether a task (the execution shown, never only its family's root) moved past a lead's question asked at `since`:
+ * its plan was rewritten or approved, or a new attempt of it started. The options answered a state that is gone. A run
+ * that merely finishes, or a review beside it, answers nothing, so it never takes the question's buttons. */
+export declare function taskMovedSince(store: Store, taskId: string, since: string): boolean;
 /** The question as text with its options, where no buttons are drawn. */
 export declare function chatAskText(ask: Pick<LeadAsk, "question" | "options">): string;
 /** The live buttons on one part, in the order they were minted: the options, then "Something else". None when the part

package/dist/chat-ask.js

@@ -1,5 +1,19 @@
 import { chatHash, partContent, savedChatPart } from "./chat-delivery-state.js";
 import { LEAD_ASK_OTHER } from "./store.js";
+/** Whether a task (the execution shown, never only its family's root) moved past a lead's question asked at `since`:
+ * its plan was rewritten or approved, or a new attempt of it started. The options answered a state that is gone. A run
+ * that merely finishes, or a review beside it, answers nothing, so it never takes the question's buttons. */
+export function taskMovedSince(store, taskId, since) {
+    const at = new Date(since).getTime();
+    if (Number.isNaN(at))
+        return false;
+    const after = (iso) => iso != null && new Date(iso).getTime() > at;
+    const scope = store.getScope(taskId);
+    if (scope !== null && (after(scope.proposedAt) || after(scope.approvedAt)))
+        return true;
+    const ref = store.lookupRef(taskId);
+    return ref !== null && store.runsFor(ref.id).some(run => run.role !== "reviewer" && after(run.startedAt));
+}
 /** The question as text with its options, where no buttons are drawn. */
 export function chatAskText(ask) {
     return [ask.question, ...ask.options.map(one => `• ${one}`), `• ${LEAD_ASK_OTHER}: say it in your own words`].join("\n");

package/dist/chat-channel.js

@@ -509,6 +509,11 @@ export const CHAT_ACTION_PARITY = {
         how: "Read by the model during a phone turn over the enrolled ceiling.",
         gap: null,
     },
+    find_tools: {
+        support: "direct",
+        how: "Searches the lead's own other tools by what it wants to do; what it finds is offered to it from its next step in the same reply. Same on every channel: the shared engine runs it.",
+        gap: null,
+    },
     list_repos: {
         support: "direct",
         how: "Read during a turn; projects are r1..rN in enrollment order, as on the console.",
@@ -583,6 +588,21 @@ export const CHAT_ACTION_PARITY = {
         how: "Card with Confirm/Dismiss through confirmLeadProposal (filed as a lead proposal, via telegram). The confirmed card links Review & start for the filed task while its scope waits; under a signed automatic mode it says the scope is approved and links the task.",
         gap: "Under manual approval the password step happens in the console, reached from the card's button.",
     },
+    propose_sweep: {
+        support: "direct",
+        how: "A protected shared action (sweep_file): the card lists every item, the shared rules and the success test; confirming files them all and approves each scope.",
+        gap: "Starting a sweep approves work, so it opens the secure review in the console (the password, or Passwordless).",
+    },
+    get_sweep: {
+        support: "direct",
+        how: "Reads a sweep's table (each item's state, verdict and result) from the local database through the shared engine.",
+        gap: null,
+    },
+    propose_sweep_cancel: {
+        support: "direct",
+        how: "An ordinary shared action (sweep_cancel_rest): Confirm cancels every item not yet ready; finished results stay.",
+        gap: null,
+    },
     propose_scope: {
         support: "direct",
         how: "Confirm rewrites the scope through the shared door; the confirmed card links Review & start for the exact task.",

package/dist/chat-continuity.js

@@ -63,7 +63,7 @@ export const CHAT_CONTINUITY_SCRIPT = String.raw `
     var carry=JSON.parse(sessionStorage.getItem(carryKey)||'null');sessionStorage.removeItem(carryKey);
     if(!draft&&carry&&user&&carry.owner===user&&carry.task===task&&typeof carry.text==='string'&&carry.text.length<=2000&&typeof carry.at==='number'&&carry.at>Date.now()-86400000){box.value=carry.text;draft={text:carry.text,request:request.value,submitted:false,at:Date.now()};save();}
   }catch(e){storage=false;}
-  function buttons(){document.querySelectorAll('form[action="/chat"] button[type="submit"]').forEach(function(button){button.disabled=busy||sending||stale||offline;});}
+  function buttons(){document.querySelectorAll('form[action="/chat"] button[type="submit"]').forEach(function(button){button.disabled=sending||stale||offline;});}
   function showReconnect(on){if(reconnect)reconnect.hidden=!on;}
   function lostAuthority(){stale=true;buttons();showReconnect(true);say('Sign in again to reconnect. Your draft stays in this tab.');}
   function changed(){stale=true;buttons();showReconnect(true);say('This conversation changed or ended. Your draft stays in this tab; reconnect to continue.');}
@@ -97,7 +97,8 @@ export const CHAT_CONTINUITY_SCRIPT = String.raw `
     if(!(one instanceof HTMLFormElement))return;
     var action=one.getAttribute('action')||'';
     if(action==='/chat'){
-      if(busy||sending||stale||offline){event.preventDefault();return;}
+      // A reply in progress no longer holds the composer: a message sent now waits its turn (the lead queue).
+      if(sending||stale||offline){event.preventDefault();return;}
       bind(one);
       if(one===form){
         if(!box.value.trim()){event.preventDefault();return;}
@@ -125,7 +126,7 @@ export const CHAT_CONTINUITY_SCRIPT = String.raw `
         var data=got.data||{};
         if(data.ok===true){
           if(String(data.session)!==session){changed();return;}
-          say('Sent. Waiting for the reply…');later(300);return;
+          say(data.queued===true?'Queued. It goes to the lead after the reply in progress.':'Sent. Waiting for the reply…');later(300);return;
         }
         // Refused, so nothing was received: the draft stays, editable and
         // resendable under its own key; the words are the server's.
@@ -302,7 +303,7 @@ export const CHAT_CONTINUITY_SCRIPT = String.raw `
       }
       settleLive();
       busy=data.pending;buttons();
-      say(busy?'Reply in progress. You can draft your next message or come back later.':sent?'Message not confirmed. Check the conversation before retrying.':'');
+      say(busy?'Reply in progress. A message you send now waits its turn.':sent?'Message not confirmed. Check the conversation before retrying.':'');
       later(busy?2500:5000);
     }catch(e){say('Connection lost. Reconnecting… Your existing work is not cancelled.');later(10000);}
     finally{polling=false;}

package/dist/chat-decide.d.ts

@@ -1,17 +1,3 @@
-/** Decisions finish in the chat app. A pushed card about a result, a failed task, a plan waiting for approval or a
- * pull request ready to merge carries buttons that act in place: Accept and finish, Request changes, Retry,
- * Approve & start, Merge. Every act that changes something asks twice ("Accept and finish 'X'? [Yes] [Cancel]"),
- * and each button is one opaque token bound to the exact result, receipt, plan or commit the card showed: a card a
- * newer result, a finished task or a changed plan has overtaken says so and acts on nothing.
- *
- * Approving a plan or merging needs the password, which never goes in chat, so they act in chat only where the owner
- * turned approving from chat on (their lasting setting, chat-approval.ts, or a signed mode's chatApprove term), for
- * their own chat; otherwise, and for a plan that widens permissions, exceeds the limit or touches protected paths, the
- * card keeps its link.
- *
- * The same in every chat app: Telegram's bridge and the shared engine Slack, Discord and Teams run on (chat-delivery.ts)
- * offer, mint and answer these through the same tokens (the `channel` column). Every act runs through the door the
- * console uses. */
 import { DECIDE_ACTS } from "./contracts/chat-callback-rows.js";
 import { type ChatApprovalLimits } from "./chat-approval.js";
 import { type VerifiedApprover } from "./principal.js";

package/dist/chat-decide.js

@@ -12,6 +12,7 @@
  * The same in every chat app: Telegram's bridge and the shared engine Slack, Discord and Teams run on (chat-delivery.ts)
  * offer, mint and answer these through the same tokens (the `channel` column). Every act runs through the door the
  * console uses. */
+import { isAcpProfile } from "./acp-agents.js";
 import { DECIDE_ACTS, readDecideActionRow } from "./contracts/chat-callback-rows.js";
 import { createHash, randomBytes } from "node:crypto";
 import { acceptAndCompleteAsOperator, assignmentOf, owedAcceptance } from "./assignment.js";
@@ -81,13 +82,15 @@ export function permissionPlainWords(profile) {
     }
     if (profile.provider === "gemini")
         return profile.approvalArgv === "yolo" ? full : "file edits only; other tools are refused";
+    if (isAcpProfile(profile))
+        return "full access inside the OS fence, nothing asks first";
     return profile.sandboxMode === "danger-full-access" ? full : "file edits and commands inside the project only";
 }
 function fullAccess(profile) {
     if (profile === null || profile === undefined)
         return false;
     return profile.provider === "claude" ? profile.permissionArgv === "bypassPermissions"
-        : profile.provider === "gemini" ? profile.approvalArgv === "yolo" : profile.sandboxMode === "danger-full-access";
+        : profile.provider === "gemini" ? profile.approvalArgv === "yolo" : isAcpProfile(profile) ? true : profile.sandboxMode === "danger-full-access";
 }
 const money = (micro) => `$${(micro / 1_000_000).toFixed(2)}`;
 /** A plan this person's chat may approve now: the term, the plan's exact bytes, and none of the reasons it must open

package/dist/chat-delivery.d.ts

@@ -3,6 +3,15 @@ import { ChatState, type ChatBinding, type ChatContent, type ChatEvent, type Cha
 import { type Store } from "./store.js";
 import type { SubscriptionLeadRunner } from "./subscription-chat.js";
 import { type ChatMerge } from "./chat-decide.js";
+/**
+ * The watch at a chat app's final fence (cockpit §3, R11), right before the network: a notice about an agent its
+ * person has open now waits, as a held part, until the watch ends; then it is delivered as usual. The subject is the
+ * part's own run, or its task's live build. Only a part planned with `watch` (never a security alert or the digest)
+ * can be held. True: held, so nothing is sent now.
+ */
+export declare function heldForWatch(state: ChatState, store: Store, part: number, event: {
+    kind: string;
+}, approver: string, content: ChatContent, now: Date): boolean;
 export declare const chatObject: (v: unknown) => Record<string, unknown>;
 export type ChatDeliveryOptions = {
     store: Store;

package/dist/chat-delivery.js

@@ -26,7 +26,33 @@ import { isShotsKind, resultShotsFor } from "./result-shots.js";
 import { CHAT_APP_NAMES } from "./flow-triggers.js";
 import { answersPrompt, applyDecideFeedback, applyDecideTap, decideFallbackLink, decideOffer, decideTargetOf, hasLiveDecideTokens, linksFor, mergedText, mintDecideButtons, offerFingerprint, openPromptFor, recordChatMerge } from "./chat-decide.js";
 import { mergePullRequest } from "./pull-request-flow.js";
-import { watchedPing } from "./agent-board.js";
+import { attentionSubjectOf, neverHeld, watchedPing } from "./agent-board.js";
+/**
+ * The watch at a chat app's final fence (cockpit §3, R11), right before the network: a notice about an agent its
+ * person has open now waits, as a held part, until the watch ends; then it is delivered as usual. The subject is the
+ * part's own run, or its task's live build. Only a part planned with `watch` (never a security alert or the digest)
+ * can be held. True: held, so nothing is sent now.
+ */
+export function heldForWatch(state, store, part, event, approver, content, now) {
+    // Fail closed: only a notice planned as holdable (a kind a watch may hold) is ever held here.
+    if (event.kind !== "notice" || content.watch !== true)
+        return false;
+    // One part may cover several tasks (a grouped card, a batch): it waits only while every one of them is watched,
+    // until the first of those watches ends.
+    const subjects = content.subjects ?? [{ ref: content.task ? store.lookupRef(content.task)?.id ?? null : null, run: content.run ?? null }];
+    if (subjects.length === 0)
+        return false;
+    let until = null;
+    for (const subject of subjects) {
+        const decided = watchedPing(store, { kind: "notice", run: subject.run, taskRef: subject.ref }, approver, now);
+        if (decided === "send" || decided === "skip")
+            return false;
+        if (until === null || decided.hold < until)
+            until = decided.hold;
+    }
+    state.holdPart(part, until);
+    return true;
+}
 export const chatObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v)
     ? v
     : {};
@@ -397,8 +423,9 @@ export async function processChatEvent(options) {
                 return false;
             if (!outcome.ok &&
                 "refused" in outcome &&
-                outcome.refused === "concurrent") {
-                state.defer(event.id, "Assistant is answering another message", new Date(nowOf(options).getTime() + 5000));
+                (outcome.refused === "concurrent" || outcome.refused === "backlog")) {
+                // The lead is answering, or messages sent earlier wait in the person's lead queue: this one waits its turn.
+                state.defer(event.id, outcome.refused === "backlog" ? "Waiting behind earlier messages" : "Assistant is answering another message", new Date(nowOf(options).getTime() + 5000));
                 return true;
             }
             receipt = store.leadRequestReceipt(resolved.session.id, request);
@@ -422,7 +449,7 @@ export async function processChatEvent(options) {
         if (turn?.state !== "answered") {
             state.plan(event.id, [
                 {
-                    text: leadFailureText(turn?.failureReason ?? null),
+                    text: leadFailureText(turn?.failureReason ?? null, turn != null && store.leadTurnCostUnconfirmed(turn.id)),
                 },
             ], nowOf(options));
             return true;
@@ -734,7 +761,12 @@ function planQuietCard(options, binding, notification, now) {
     const view = quietCardView(store, card.tasks, now, options.evidenceRoot, binding.approver);
     if (view === null)
         return;
-    const content = { text: view.text, link: view.link, ...(card.tasks.length === 1 ? { task: notification.taskId } : {}) };
+    // A card about one task is that task's: its person's watch may hold it at the final fence (never a security kind).
+    // A card about its tasks is theirs: its person's watch may hold it at the final fence while every one of them is
+    // watched (never for a security kind).
+    const content = { text: view.text, link: view.link, ...(card.tasks.length === 1 ? { task: notification.taskId } : {}),
+        ...(card.tasks.length > 0 && !neverHeld(notification.kind) ? { watch: true } : {}),
+        ...(card.tasks.length > 1 && !neverHeld(notification.kind) ? { subjects: card.tasks.slice(0, 100).map(ref => ({ ref, run: null })) } : {}) };
     const shown = chatHash(JSON.stringify(content));
     if (card.message !== null) {
         if (card.digest === shown)
@@ -763,7 +795,12 @@ function planFinished(options, binding, taskRef, run, now, notification = null,
     // A single update keeps its task and run, so a reply to it names that work.
     const single = batch.items.length === 1 ? batch.items[0] : null;
     const task = single === null ? null : store.refById(single.taskRef)?.externalId ?? null;
-    const about = { ...(task === null ? {} : { task }), ...(single?.run == null ? {} : { run: single.run }) };
+    // Holdable when its fact is a kind a watch may hold (the batch line for a finished run, or the notification joining
+    // it); a batch of several holds only while every one of them is watched.
+    const joining = notification === null ? null : options.store.notificationById(notification);
+    const holdable = batch.items.length > 0 && (joining === null || !neverHeld(joining.kind));
+    const about = { ...(task === null ? {} : { task }), ...(single?.run == null ? {} : { run: single.run }), ...(holdable ? { watch: true } : {}),
+        ...(holdable && batch.items.length > 1 ? { subjects: batch.items.slice(0, 100).map(one => ({ ref: one.taskRef, run: one.run })) } : {}) };
     // A message about one result, plan, failure or pull request acts in place (chat-decide.ts), as on Telegram: its
     // buttons are minted only when what it offers changed, or its own were spent (Not now), so an unchanged repaint keeps them.
     const offer = decideOfferFor(options, binding, view.target, repos, now);
@@ -962,6 +999,7 @@ function offerNotice(options, notification, binding, registry) {
                     task: notification.taskId,
                     run: run.id,
                     link: card.link,
+                    ...(attentionSubjectOf(store, notification) !== null ? { watch: true } : {}),
                 };
                 const digest = chatHash(JSON.stringify(content));
                 const prior = state
@@ -1044,6 +1082,7 @@ function offerNotice(options, notification, binding, registry) {
                         text: offer?.text ?? chatText(phoneText(notification.body === "" ? leadSubjectOf(store, notification, binding.approver) : `${leadSubjectOf(store, notification, binding.approver)}\n\n${notification.body}`, 2500), notification.taskId === null ? [] : [{ id: notification.taskId, title: chatTitle(store, notification.taskId) }]),
                         ...(notification.taskId ? { task: notification.taskId } : {}),
                         ...(run ? { run: run.id } : {}),
+                        ...(attentionSubjectOf(store, notification) !== null ? { watch: true } : {}),
                         ...(offer !== null ? { decide: mintDecide(options, binding, target, offer, now) }
                             : fallback !== null ? { link: fallback }
                                 : notification.link

package/dist/chat-messages.d.ts

@@ -174,6 +174,8 @@ export declare class ChatMessages extends ChatCore {
         taskId: string | null;
         sourceRun: number | null;
     }, now: Date): number;
+    /** How many of this chat's messages wait for, or are being answered by, the lead (the lead queue's bound per chat). */
+    messagesWaiting(binding: number): number;
     /** Whether a message from this chat is already waiting on, or being answered from, this bot message (a tapped question). */
     messageWaitingOn(binding: number, messageId: string): boolean;
     getMessage(id: number): TelegramConversation | null;
@@ -294,6 +296,12 @@ export declare class ChatMessages extends ChatCore {
     claimDeliveries(binding: TelegramBinding, owner: string, ttlMs: number, now: Date, only?: "all" | "urgent"): TelegramDelivery[];
     /** Synchronous final fence, called AFTER each asynchronous enrollment read. */
     deliveryProblem(row: TelegramDelivery, binding: TelegramBinding, owner: string, projects: readonly string[], now: Date, batch?: readonly number[]): string | null;
+    /**
+     * The watch at the final fence (cockpit §3, R11): right before the network, a person who has since opened the
+     * agent this ping is about holds it — the claim is released with the watch's end as its next attempt, no attempt
+     * spent — and news about a finished run they have now seen settles quietly. "send": nothing changed.
+     */
+    watchFence(row: TelegramDelivery, binding: TelegramBinding, owner: string, now: Date): "send" | "held" | "skipped";
     claimHeld(row: TelegramDelivery, owner: string, now: Date): boolean;
     /** A confirmed network message remains history even if authority changed
      * while it was in flight. It only binds the OLD destination, never new work. */