toolroll 0.9.63 → 0.9.67

package/dist/server/chat.js

@@ -1,3 +1,4 @@
+import { freshFacts, freshlyApprovable, freshnessFor, spendingOnlyOnSuccess, withFreshness } from "../scope.js";
 import { handlersOf } from './handler-registry.js';
 import { DEPRECATED_PAGE } from "../deprecations.js";
 /** chat handlers, moved without changing their route bodies. */
@@ -34,9 +35,9 @@ import { runActivityOf } from "../task-activity.js";
 import { teamWorkspaceHtml } from '../team-ui.js';
 import { loadBotToken, redactToken } from "../telegram.js";
 import { WORK_INDEX_MAX_LIMIT, workIndexPage } from "../work-index.js";
-import { html, htmlString, postForm } from "../html.js";
+import { html, htmlString, postForm, reauth } from "../html.js";
 import { requestContext } from "./request-context.js";
-import { refuse, screen } from "./chrome.js";
+import { refuse, screen, whenTime } from "./chrome.js";
 import { chatResultHref, chatReturnWithLatest, chatReturnWithSaid, projectChatHref, redirect, respond, safeChatReturn, safeReturn, taskChatHref, taskHref } from "./http.js";
 import { chatAckPage, chatPage, coordinatorProposalsSection, decisionsFor, leadAfterComposerHtml, leadChatVersion, leadMintCard, leadPage, leadThreadHtml, PHONE_CARD_FACT, TASK_COMPOSER_MODES, taskChatLiveRegion, teamProposalCardParts } from "./render-chat.js";
 import {} from "./render-pages.js";
@@ -60,17 +61,18 @@ export function createChatHandlers(runtime) {
         }
         store.sweepStaleLeadTurns(now);
         const request = url.searchParams.get("request") ?? "";
-        const receipt = /^[a-f0-9]{32}$/.test(request) ? store.leadRequestReceipt(session.id, request) : null;
+        // Received: the engine took it, or the lead queue holds it (a queued acknowledgement lost on the way still frees the draft).
+        const received = /^[a-f0-9]{32}$/.test(request) && store.leadRequestReceived(session.id, request);
         const requestedTask = url.searchParams.get("task");
         const focusTask = requestedTask === null || requestedTask === "" ? null : taskChatFocus(requestedTask, now, who, { mintNonce: false });
         if (requestedTask !== null && requestedTask !== "" && focusTask === null) {
             // The lens's task is gone or no longer admitted: the page keeps its
             // draft and says so; it never falls back to the unified thread.
-            return respond(response, 200, "application/json", JSON.stringify({ session: session.id, task: requestedTask, unavailable: true, received: receipt !== null }));
+            return respond(response, 200, "application/json", JSON.stringify({ session: session.id, task: requestedTask, unavailable: true, received }));
         }
         const chatProject = focusTask !== null ? null : chatProjectOf(url.searchParams.getAll("project").filter(one => one !== ""));
         if (chatProject === undefined)
-            return respond(response, 200, "application/json", JSON.stringify({ session: session.id, unavailable: true, received: receipt !== null }));
+            return respond(response, 200, "application/json", JSON.stringify({ session: session.id, unavailable: true, received }));
         const rows = leadConversationRows(who, principal, focusTask, now, chatProject);
         const version = leadChatVersion({ ...rows, focusTask });
         const known = url.searchParams.get("version") ?? "";
@@ -87,7 +89,7 @@ export function createChatHandlers(runtime) {
             task: focusTask?.id ?? "",
             version,
             pending: rows.pending !== null,
-            received: receipt !== null,
+            received,
             approval: focusTask?.approval?.digest ?? "",
             ...(fragments === null ? {} : { fragments }),
         }));
@@ -357,7 +359,7 @@ export function createChatHandlers(runtime) {
         // The one nonce in chat — this screen restates exact financial terms
         // and re-enables spend, which is precisely what nonces are for.
         const nonce = mintApprovalNonce(who.name, `chat-ack-${turn.id}`, String(turn.reservedMicrousd));
-        return sendScreen(response, 200, chatAckPage(chromeFor(project, "chat"), turn, nonce));
+        return sendScreen(response, 200, chatAckPage(chromeFor(project, "chat"), turn, nonce, store.leadTurnOfStep(turn.id)));
     }
     async function sharedActionReview(ctx) {
         const { url, response } = ctx;
@@ -391,7 +393,22 @@ export function createChatHandlers(runtime) {
             const review = mintSharedActionReview(store, principal, id, evidenceRoot, clock()), action = review.payload;
             const terms = action.terms.map(term => html `<p style="white-space:pre-wrap;overflow-wrap:anywhere">${term}</p>`);
             const evidenceLink = action.operation === 'result_accept' ? html `<a href="/r/${Number(action.request['run'])}">Inspect this result</a>` : '';
-            const content = html `<section class="shared-action"><h1>${action.title}</h1>${evidenceLink}${terms}${postForm(`/chat/proposal/${id}/confirm`, html `<label class="arm"><input type="checkbox" name="confirm" value="yes" required>I confirm this exact action</label>${CHAT_ACTIONS[action.operation].password ? html `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label>` : ''}<button>${CHAT_ACTIONS[action.operation].label}</button>`, { returnTo: '/chat', hidden: { nonce: review.nonce } })}</section>`;
+            // Cockpit B2: approving standard work may stand on a password remembered on this session, exactly as on the task
+            // page (the same rule approve() applies when the form comes back); the field then may be left empty.
+            const freshSince = (() => {
+                const task = typeof action.request['task'] === 'string' ? action.request['task'] : null;
+                if (action.operation !== 'scope_approve' || task === null)
+                    return null;
+                const scope = store.getScope(task), fresh = withFreshness('approve-standard', () => freshnessFor(who.name, Date.now(), true));
+                if (scope === null || fresh === null)
+                    return null;
+                const gate = store.approvalGate(task, who.name, 'person');
+                return freshlyApprovable(store, task, scope, gate.verdict === 'seal' && !gate.protectedWork) ? new Date(fresh.at) : null;
+            })();
+            const passwordField = !CHAT_ACTIONS[action.operation].password ? '' : reauth(freshSince === null
+                ? html `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label>`
+                : html `<label>Your password<input type="password" name="token" autocomplete="current-password"></label><p class="approval-password-note" data-approval-fresh>Your password from ${whenTime(freshSince.toISOString())} is remembered on this computer — leave this blank to approve with it, or type it again.</p>`);
+            const content = html `<section class="shared-action"><h1>${action.title}</h1>${evidenceLink}${terms}${postForm(`/chat/proposal/${id}/confirm`, html `<label class="arm"><input type="checkbox" name="confirm" value="yes" required>I confirm this exact action</label>${passwordField}<button>${CHAT_ACTIONS[action.operation].label}</button>`, { returnTo: '/chat', hidden: { nonce: review.nonce } })}</section>`;
             return sendScreen(response, 200, screen('Review action', content, { chrome: chromeFor(action.repo, 'chat') }));
         }
         catch (error) {
@@ -665,6 +682,22 @@ export function createChatHandlers(runtime) {
         leadSaid.delete(who.session.csrf);
         return redirect(response, back);
     }
+    /** Remove a message still waiting in the person's lead queue: theirs only, only while it waits; its words are forgotten. */
+    async function leadQueuedRemove(ctx) {
+        const { url, who, request, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.leadQueuedRemove);
+        if (who.via !== "cookie")
+            return refuse(response, who, 403, "the lead is a browser surface");
+        const wantsJson = String(request.headers["accept"] ?? "").includes("application/json");
+        const back = safeChatReturn(body.get("return"));
+        const outcome = runtime.personalQueue.queue.remove(who.name, Number(url.pathname.split("/")[3]), now);
+        const words = outcome === "removed" ? "Removed. It won't be sent." : outcome === "started" ? "Already sent: it started before it could be removed." : "That message isn't waiting.";
+        if (wantsJson)
+            return respond(response, outcome === "not-found" ? 404 : outcome === "started" ? 409 : 200, "application/json", JSON.stringify({ ok: outcome === "removed", said: words }));
+        if (outcome === "not-found")
+            return refuse(response, who, 404, words, back);
+        return redirect(response, chatReturnWithSaid(back, words));
+    }
     async function leadStop(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.leadStop);
@@ -722,7 +755,12 @@ export function createChatHandlers(runtime) {
                 noteLead(who.session.csrf, null, "that proposal was already acted on");
             return redirect(response, chatReturnWithLatest(back));
         }
-        const outcome = confirmLeadProposal(store, principal, id, now, { chatProvider: teamChatProvider, confirm: body.get("confirm") === "yes", via: "web", evidenceRoot, ...(body.has("nonce") ? { actionReview: { nonce: body.get("nonce") ?? "", password: body.get("token") ?? "" } } : {}) });
+        // A scope approval's re-check is spent only if the whole confirmation commits (one transaction: the proposal's
+        // settlement included). Any other action spends it whatever comes of it (its effects aren't all in the database).
+        const confirmIt = () => confirmLeadProposal(store, principal, id, now, { chatProvider: teamChatProvider, confirm: body.get("confirm") === "yes", via: "web", evidenceRoot, ...(body.has("nonce") ? { actionReview: { nonce: body.get("nonce") ?? "", password: body.get("token") ?? "" } } : {}) });
+        const proposed = store.getLeadProposal(id);
+        const approving = proposed?.kind === "action" && sharedActionPayload(proposed.payload)?.operation === "scope_approve";
+        const outcome = approving ? spendingOnlyOnSuccess(confirmIt, result => !result.ok || ("already" in result && result.already === true)) : confirmIt();
         if (cardJson) {
             if (!outcome.ok)
                 return cardAnswer(outcome.reason === "standing" ? 403 : outcome.reason === "not-yours" ? 404 : 409, false, outcome.said);
@@ -839,10 +877,12 @@ export function createChatHandlers(runtime) {
         // its own terms and the thread shows why.
         const leadSession = who.role === "approver" ? store.activeLeadSession(who.name) : null;
         if (leadSession !== null) {
-            const requestId = body.get("request");
-            if (requestId !== null && (body.getAll("request").length !== 1 || body.getAll("request-session").length !== 1 || body.get("request-session") !== String(leadSession.id))) {
+            const sentRequest = body.get("request");
+            if (sentRequest !== null && (body.getAll("request").length !== 1 || body.getAll("request-session").length !== 1 || body.get("request-session") !== String(leadSession.id))) {
                 return said(409, "This conversation changed. Reload it before sending your message.");
             }
+            // Every send has one identity (a form without one gets it here): a message that waits is known by it.
+            const requestId = sentRequest ?? randomBytes(16).toString("hex");
             const principal = leadPrincipal(who);
             if (principal === null)
                 return wantsJson ? said(403, "your approver standing changed — sign in again") : refuse(response, who, 403, "your approver standing changed — sign in again", back);
@@ -851,15 +891,50 @@ export function createChatHandlers(runtime) {
                 return said(400, `a message is 1 to ${LEAD_MESSAGE_MAX_CHARS} characters`, leadSession.id);
             }
             const opened = store.openLeadThread(who.name, principal.ceilingDigest, now, chatScopeOf(focusTask, chatProject));
-            const onProgress = beginLiveTurn(opened.thread.id);
-            void runLeadTurn({ store, who: principal, session: leadSession, thread: opened.thread, config: enabled.config, key: enabled.key, message, onProgress, channel: "console", ...(requestId === null ? {} : { requestId }), ...(focusTask === null && chatProject !== null ? { context: `Current project: ${projectName(chatProject)} (${chatProject}). Keep this conversation about that project unless the operator explicitly asks to broaden it; use it as the repo for project tools.` } : {}), ...(focusTask === null ? {} : { context: `Current task: ${focusTask.id}. Read it with get_task before answering or proposing changes. Read its currentExecution next and bind new actions to that exact execution. Never replace the target of a prior proposal with a newer revision. Keep this turn about that task unless the operator explicitly asks to broaden it.${resultContext}${modeContext}` }), fetcher: chatFetcher, ...(options.subscriptionChatRunner === undefined ? {} : { subscriptionRunner: options.subscriptionChatRunner }), clock, evidenceRoot })
+            // The personal queue (docs/plans/lead-message-queue.md): while this person's lead is busy, or something of theirs
+            // waits, the message waits its turn instead of being refused. A request the engine already took replays as before.
+            const queueContext = focusTask !== null
+                ? { task: focusTask.id, ...(viewedRun === null ? {} : { result: viewedRun.id }), ...(modeValue === null ? {} : { mode: modeValue }) }
+                : chatProject !== null ? { project: chatProject } : null;
+            const queueIt = () => runtime.personalQueue.queue.sendOrQueue({ approver: who.name, approverGeneration: principal.generation, session: leadSession.id,
+                ceilingDigest: principal.ceilingDigest, thread: opened.thread.id, text: message, requestId, context: queueContext }, clock());
+            // A message the engine would refuse for a secret never waits (nothing stored): it goes straight to the engine,
+            // which refuses it before any row exists, exactly as when the lead is free.
+            if (scanForSecrets(message).length === 0 && store.leadRequestReceipt(leadSession.id, requestId) === null) {
+                const decided = queueIt();
+                if (decided.kind === "conflict")
+                    return said(409, "This message was already sent with different words. Reload the conversation to see it.", leadSession.id);
+                if (decided.kind === "full")
+                    return said(409, decided.message, leadSession.id);
+                if (decided.kind === "queued") {
+                    runtime.personalQueue.kick();
+                    return wantsJson
+                        ? respond(response, 202, "application/json", JSON.stringify({ ok: true, queued: true, session: leadSession.id, task: focusTask?.id ?? "", ...(chatProject === null ? {} : { project: chatProject }), request: requestId, message: decided.row.message, status: decided.row.status }))
+                        : redirect(response, chatReturnWithLatest(back));
+                }
+            }
+            // The live display starts once this message holds a turn: a refusal (a secret, a turn still running) never blanks
+            // the display of a reply that is still running in the same conversation.
+            let onProgress;
+            const ended = (ok) => { if (onProgress !== undefined)
+                endLiveTurn(opened.thread.id, ok, onProgress); };
+            // Detached work never carries this request's browser session (Passwordless reads it): it runs with no session facts.
+            void freshFacts.run(null, () => runLeadTurn({ store, who: principal, session: leadSession, thread: opened.thread, config: enabled.config, key: enabled.key, message,
+                onAdmitted: () => { onProgress = beginLiveTurn(opened.thread.id); }, onProgress: event => onProgress?.(event), channel: "console", requestId, ...(focusTask === null && chatProject !== null ? { context: `Current project: ${projectName(chatProject)} (${chatProject}). Keep this conversation about that project unless the operator explicitly asks to broaden it; use it as the repo for project tools.` } : {}), ...(focusTask === null ? {} : { context: `Current task: ${focusTask.id}. Read it with get_task before answering or proposing changes. Read its currentExecution next and bind new actions to that exact execution. Never replace the target of a prior proposal with a newer revision. Keep this turn about that task unless the operator explicitly asks to broaden it.${resultContext}${modeContext}` }), fetcher: chatFetcher, ...(options.subscriptionChatRunner === undefined ? {} : { subscriptionRunner: options.subscriptionChatRunner }), clock, evidenceRoot }))
                 .then(outcome => {
+                // Lost a race to another turn of this person's between deciding and admission: it waits instead of being refused.
+                if (!outcome.ok && "refused" in outcome && (outcome.refused === "concurrent" || outcome.refused === "backlog") && queueIt().kind === "queued") {
+                    ended(false);
+                    return;
+                }
                 // A turn that saved its outcome in the thread (one stopped at its deadline) is said there, once.
                 if (!outcome.ok && !("saved" in outcome && outcome.saved === true))
                     noteLead(who.session.csrf, "turn" in outcome ? outcome.turn : null, outcome.message);
-                endLiveTurn(opened.thread.id, outcome.ok);
+                ended(outcome.ok);
             })
-                .catch(() => { noteLead(who.session.csrf, null, "the turn failed unexpectedly"); endLiveTurn(opened.thread.id, false); });
+                .catch(() => { noteLead(who.session.csrf, null, "the turn failed unexpectedly"); ended(false); })
+                // A personal turn ended: the next waiting message (this person's or anyone's) may start now.
+                .finally(() => runtime.personalQueue.kick());
             // Accepted for the engine, not received: the receipt is written by
             // the turn's own admission, and the status poll is where the page
             // learns of it — the same road as after a native send.
@@ -877,10 +952,6 @@ export function createChatHandlers(runtime) {
         }
         // The password, typed again, on EVERY message (v2 ruling 2): chat is
         // spend, and a seven-day cookie is not a spend credential.
-        const password = body.get("token") ?? "";
-        if (password === "" || !authenticateApprover(who, password).ok) {
-            return redirect(response, `/chat?said=${encodeURIComponent("chat spends — your password, typed again, with every message")}`);
-        }
         const message = (body.get("message") ?? "").trim();
         if (message === "" || message.length > 2_000) {
             return redirect(response, `/chat?said=${encodeURIComponent("a message is 1 to 2000 characters")}`);
@@ -912,16 +983,28 @@ export function createChatHandlers(runtime) {
         if (disallowed !== null)
             return redirect(response, `/chat?said=${encodeURIComponent(disallowed)}`);
         const reserved = worstCaseForPrice(enabled.price, Buffer.byteLength(composed.body, "utf8"));
-        const opened = store.openChatTurn({
-            approver: who.name,
-            credentialKey: enabled.credentialKey,
-            provider: enabled.config.provider,
-            model: enabled.config.model,
-            reservedMicrousd: reserved,
-            dailyTurns: enabled.config.dailyTurns,
-            weeklyCeilingMicrousd: enabled.config.weeklyCeilingMicrousd,
-            deadlineMs: TURN_WALL_CLOCK_MS + 10_000,
-        }, now);
+        // The password comes last, right where the turn opens: every refusal above leaves an explicit re-check unspent,
+        // and a turn that doesn't open (a cap, a budget) puts it back.
+        const password = body.get("token") ?? "";
+        const opened = spendingOnlyOnSuccess(() => {
+            // Typed now, or (cockpit B2) a password or explicit provider re-check given on this session, on a direct local
+            // request, within its window. An ordinary provider sign-in never starts that window.
+            if (!withFreshness("chat-send", () => authenticateApprover(who, password)).ok)
+                return null;
+            return store.openChatTurn({
+                approver: who.name,
+                credentialKey: enabled.credentialKey,
+                provider: enabled.config.provider,
+                model: enabled.config.model,
+                reservedMicrousd: reserved,
+                dailyTurns: enabled.config.dailyTurns,
+                weeklyCeilingMicrousd: enabled.config.weeklyCeilingMicrousd,
+                deadlineMs: TURN_WALL_CLOCK_MS + 10_000,
+            }, now);
+        }, result => result === null || !result.ok);
+        if (opened === null) {
+            return redirect(response, `/chat?said=${encodeURIComponent("chat spends — your password, typed again, with every message")}`);
+        }
         if (!opened.ok) {
             const said = opened.reason === "latched"
                 ? "a turn with unknown cost blocks this credential — acknowledge it below first"
@@ -1046,6 +1129,9 @@ export function createChatHandlers(runtime) {
         const wanted = values[0] ?? "";
         return values.length === 1 && visible(wanted) && managedRepos().includes(wanted) ? wanted : undefined;
     }
+    /** Which live display each progress handle started: ending a turn ends only its own display (a turn stopped from
+     * another window that settles late can never end the next turn's). */
+    const progressOf = new WeakMap();
     function beginLiveTurn(thread) {
         const previous = liveTurns.get(thread);
         if (previous?.expiry)
@@ -1055,7 +1141,7 @@ export function createChatHandlers(runtime) {
         // A page that has this conversation open follows the reply (GET /live, its chat room).
         runtime.liveTurnStarted(thread);
         const current = () => live.steps.at(-1) ?? (live.steps.push({ tools: [], toolCalls: [], text: "" }), live.steps.at(-1));
-        return event => {
+        const progress = (event) => {
             if (live.done)
                 return;
             if (event.kind === "step")
@@ -1078,11 +1164,15 @@ export function createChatHandlers(runtime) {
             for (const listener of live.listeners)
                 listener();
         };
+        progressOf.set(progress, live);
+        return progress;
     }
-    function endLiveTurn(thread, ok) {
+    function endLiveTurn(thread, ok, progress) {
         const live = liveTurns.get(thread);
         if (live === undefined || live.done)
             return;
+        if (progress !== undefined && progressOf.get(progress) !== live)
+            return;
         live.done = true;
         live.ok = ok;
         for (const listener of live.listeners)
@@ -1388,6 +1478,7 @@ export function createChatHandlers(runtime) {
         "chat.mate-follow": leadFollow,
         "chat.mate-end": leadEnd,
         "chat.mate-stop": leadStop,
+        "chat.queued-remove": leadQueuedRemove,
         "chat.proposal.confirm": chatProposalAct("confirm"),
         "chat.proposal.dismiss": chatProposalAct("dismiss"),
         "coordinator.proposal.confirm": coordinatorProposalAct("confirm"),

package/dist/server/chrome.d.ts

@@ -128,13 +128,16 @@ export type Chrome = {
  * at the sink like every page, fetched same-origin — and the nonce'd CSP
  * refuses to execute anything the region could smuggle. Nothing reads on a timer.
  */
-export declare function regionScript(regionId: string, fragmentName: string, path?: string): string;
+export declare function regionScript(regionId: string, fragmentName: string, path?: string, options?: {
+    animate?: boolean;
+}): string;
 /**
  * The live transcript's DEDICATED poller (arc 1 §4): a JSON byte-offset
  * protocol, not an HTML fragment — the response is raw sanitized text and
  * the ONLY sink is textContent, so nothing here can become markup. One
  * request in flight, visibility-paused, stops on `final`, and a `replaced`
- * answer restarts from zero with a visible line — never a silent re-read.
+ * answer — or another file's generation — restarts from zero with a visible
+ * line, never a silent re-read.
  */
 export declare function transcriptScript(path?: string, elementId?: string): string;
 /**
@@ -170,6 +173,10 @@ export type Screen = {
     /** Render sensitive even when no password field is visible — one-time
      * secrets and judgment calls the classifier cannot see. */
     forceSensitive?: boolean;
+    /** The page's sensitivity, said explicitly (cockpit §2, R14): true for a page that asks for a password or shows a
+     * secret even when no password field renders (an SSO step-up, a fresh-password grant); false only where a page is
+     * known safe. Unset: judged from the page as authored. A sensitive page has no sidebar states and no summary room. */
+    sensitive?: boolean;
     /** Structured conversation; complex guarded forms stay native islands. */
     workspace?: Partial<Pick<BrowserWorkspace, 'conversation' | 'team' | 'focus' | 'result' | 'notices' | 'view' | 'firstRun' | 'phone' | 'home'>> & {
         /** Markup the workspace shows in place; it becomes bytes where the page's JSON is written (sendScreen). */
@@ -292,3 +299,10 @@ export declare function safePrUrl(url: string | null): string | null;
 export declare function shortDigest(digest: string): Html;
 /** One display line, bounded — turn text is data, never layout. */
 export declare function oneLineOf(text: string, cap: number): string;
+/**
+ * The board's clocks tick in the page: each <time data-tick> counts up from
+ * its datetime, measured against the server's own now (the board's data-now)
+ * so a skewed device clock cannot run them backwards. The server-rendered
+ * minutes are the answer without script.
+ */
+export declare function boardTickScript(regionId?: string): string;

package/dist/server/chrome.js

@@ -161,7 +161,7 @@ export const WORKSPACE_STYLE = styleAsset(STYLE + BRAND_MARK_CSS + INBOX_TABS_CS
  * at the sink like every page, fetched same-origin — and the nonce'd CSP
  * refuses to execute anything the region could smuggle. Nothing reads on a timer.
  */
-export function regionScript(regionId, fragmentName, path) {
+export function regionScript(regionId, fragmentName, path, options = {}) {
     // Where the fragment lives: the page's own URL by default; an explicit
     // path when a page embeds another entity's region (the task page embeds
     // the live run's peek, slice 1c — no proxy route exists for it).
@@ -184,7 +184,7 @@ export function regionScript(regionId, fragmentName, path) {
         `function keep(){var data={lanes:[],focus:null,pager:-1,fold:{}};` +
         `region.querySelectorAll("details.lane").forEach(function(d){var k=laneKey(d);if(k)data.fold[k]=d.open;});` +
         `var act=document.activeElement;` +
-        `if(act&&region.contains(act)&&act.matches&&act.matches("a.row, a.lane-card"))data.focus=act.getAttribute("href");` +
+        `if(act&&region.contains(act)&&act.matches&&act.matches("a.row, a.lane-card, a.worker-job")){data.focus=act.getAttribute("href");data.focusKind=act.matches("a.worker-job")?"a.worker-job":"a.row, a.lane-card";}` +
         `var board=region.querySelector(".board");` +
         `if(board&&board.scrollLeft>0){var lanes=board.querySelectorAll(".lane");` +
         `var bc=board.getBoundingClientRect();var mid=bc.left+bc.width/2;var best=-1,bd=1e9;` +
@@ -208,24 +208,56 @@ export function regionScript(regionId, fragmentName, path) {
         `if(board){var lanes=board.querySelectorAll(".lane");var at=Math.min(data.pager,lanes.length-1);` +
         `if(at>=0){var br=board.getBoundingClientRect();var lr=lanes[at].getBoundingClientRect();` +
         `board.scrollLeft=board.scrollLeft+(lr.left+lr.width/2)-(br.left+br.width/2);}}}` +
-        `if(data.focus!==null){var links=region.querySelectorAll("a.row, a.lane-card");` +
+        `if(data.focus!==null){var links=region.querySelectorAll(data.focusKind);` +
         `for(var i=0;i<links.length;i++){if(links[i].getAttribute("href")===data.focus){links[i].focus({preventScroll:true});break;}}}}` +
         `function tell(){if(!stamp||stopped)return;var s=Math.round((Date.now()-last)/1000);` +
         `stamp.textContent=failed?"stale — retrying ("+s+"s old)":"updated "+s+"s ago";}` +
         `setInterval(tell,1000);` +
+        // The animated swap (the live board): a card that changed lane slides there and a new one drops in, through one
+        // same-document view transition keyed by each card's data-vt; a worker whose builds changed flashes once
+        // (data-flash). Never under reduced motion, in a hidden tab, or where the browser lacks view transitions — there
+        // the swap is the plain instant one. Names are set only for the swap and cleared after it.
+        `var animate=${options.animate === true ? "true" : "false"};` +
+        // A name spells the whole key in hex — two tasks can never share one, so a card's identity never jumps to another.
+        `function vtName(v){var n="so-c";for(var i=0;i<v.length;i++){n+=("000"+v.charCodeAt(i).toString(16)).slice(-4);}return n;}` +
+        `function nameAll(){var seen={};region.querySelectorAll("[data-vt]").forEach(function(e){var n=vtName(e.getAttribute("data-vt"));if(seen[n])return;seen[n]=1;e.style.setProperty("view-transition-name",n);});}` +
+        `function flashes(){var m={};region.querySelectorAll("[data-flash]").forEach(function(e){m[e.getAttribute("data-flash")]=e.getAttribute("data-flash-value");});return m;}` +
+        `function apply(t){var before=animate?flashes():{};var kept=keep();region.innerHTML=t;restore(kept);` +
+        `if(animate)region.querySelectorAll("[data-flash]").forEach(function(e){var k=e.getAttribute("data-flash"),v=e.getAttribute("data-flash-value");if(k in before&&before[k]!==v&&v!=="")e.classList.add("flash");});}` +
+        // The swap resolves when its transition has finished, and the next fetch waits for it (refresh holds busy), so
+        // one transition runs at a time; each cleans up only its own (the generation), never a later one's.
+        `var generation=0;` +
+        `function swap(t){var calm=!window.matchMedia||matchMedia("(prefers-reduced-motion: reduce)").matches;` +
+        `if(!animate||calm||document.hidden||typeof document.startViewTransition!=="function"){apply(t);return Promise.resolve();}` +
+        // Bounded: a transition that never settles (or never runs its update) is let go after 1.5 s — the fragment is
+        // applied exactly once either way, so the board can never stop refreshing behind an animation.
+        `var root=document.documentElement;var mine=++generation;var applied=false;var settled=false;nameAll();root.classList.add("so-swap");` +
+        `var once=function(){if(applied)return false;applied=true;apply(t);return true;};` +
+        `var end=function(){if(settled)return;settled=true;once();if(mine!==generation)return;root.classList.remove("so-swap");region.querySelectorAll("[data-vt]").forEach(function(e){e.style.removeProperty("view-transition-name");});};` +
+        `var vt;try{vt=document.startViewTransition(function(){if(once())nameAll();});}catch(e){end();return Promise.resolve();}` +
+        `return new Promise(function(done){var timer=setTimeout(function(){end();done();},1500);` +
+        `var fin=function(){clearTimeout(timer);end();done();};try{Promise.resolve(vt&&vt.finished).then(fin,fin);}catch(e){fin();}});}` +
         `function refresh(){if(stopped)return;if(busy){again=true;return;}busy=true;again=false;` +
         `var q=location.search?location.search+"&fragment="+${JSON.stringify(fragmentName)}:"?fragment="+${JSON.stringify(fragmentName)};` +
         `fetch(${target},{redirect:"manual",cache:"no-store"})` +
         `.then(function(r){if(r.type==="opaqueredirect"||r.status===401||r.status===403){location.href="/login";return null;}` +
         `return r.ok?r.text():null;})` +
-        `.then(function(t){if(t){var kept=keep();region.innerHTML=t;restore(kept);last=Date.now();failed=false;}else{failed=true;}})` +
+        `.then(function(t){if(t){return swap(t).then(function(){last=Date.now();failed=false;});}failed=true;})` +
         `.catch(function(){failed=true;})` +
         // A fragment that marks itself final stops: a finished or abandoned build is not fetched again.
         `.then(function(){busy=false;tell();if(region.querySelector("[data-region-stop]")){stopped=true;if(stamp)stamp.textContent="";return;}if(again)refresh();});}` +
         `function heard(name){if(name==="change"||name==="reload")refresh();}` +
-        `if(document.documentElement.dataset.live==="1"){addEventListener("so:live",function(e){heard(e.detail&&e.detail.event);});}` +
-        `else if(typeof EventSource!=="undefined"){var es=new EventSource("/live?room=workspace");` +
+        // On a workspace page the page's one stream (browser/live.ts) carries the workspace room: ask it, never open a second.
+        `function mine(e){var d=e.detail;if(d&&(d.room==="workspace"||d.room===null))heard(d.event);}` +
+        `if(document.getElementById("standing-orders-workspace")){(window.__soLiveRooms=window.__soLiveRooms||[]).push("workspace");addEventListener("so:live",mine);}` +
+        `else if(document.documentElement.dataset.live==="1"){addEventListener("so:live",mine);}` +
+        // Refused (signed out, access lost): stop instead of reconnecting at once into a request that can't sign in, and
+        // listen again in 30 s, as the page's own stream does (browser/live.ts RETRY_MS).
+        `else if(typeof EventSource!=="undefined"){var listen=function(){var es=new EventSource("/live?room=workspace");` +
         `es.addEventListener("change",function(){heard("change");});es.addEventListener("reload",function(){heard("reload");});` +
+        // A retry the server answers with an error (still signed out) is given up by the browser: try again later too.
+        `var again=function(){es.close();setTimeout(listen,30000);};` +
+        `es.addEventListener("ended",again);es.addEventListener("error",function(){if(es.readyState===2)again();});};listen();` +
         `document.addEventListener("visibilitychange",function(){if(!document.hidden)refresh();});}` +
         `})();`);
 }
@@ -234,23 +266,24 @@ export function regionScript(regionId, fragmentName, path) {
  * protocol, not an HTML fragment — the response is raw sanitized text and
  * the ONLY sink is textContent, so nothing here can become markup. One
  * request in flight, visibility-paused, stops on `final`, and a `replaced`
- * answer restarts from zero with a visible line — never a silent re-read.
+ * answer — or another file's generation — restarts from zero with a visible
+ * line, never a silent re-read.
  */
 export function transcriptScript(path, elementId = "live-transcript") {
     const base = path === undefined ? "location.pathname" : JSON.stringify(path);
     return (`(function(){var out=document.getElementById(${JSON.stringify(elementId)});if(!out)return;` +
-        `var from=0,busy=false,stopped=false;` +
+        `var from=0,gen="",inkey=false,ktail="",busy=false,stopped=false;` +
         `function near(){return out.scrollHeight-out.scrollTop-out.clientHeight<40;}` +
         `function go(){if(stopped)return;if(busy||document.hidden){later();return;}busy=true;` +
-        `fetch(${base}+"?fragment=transcript&from="+from,{redirect:"manual",cache:"no-store"})` +
+        `fetch(${base}+"?fragment=transcript&from="+from+(gen?"&gen="+encodeURIComponent(gen):"")+(inkey?"&inkey=1":"")+(ktail?"&ktail="+encodeURIComponent(ktail):""),{redirect:"manual",cache:"no-store"})` +
         `.then(function(r){if(r.type==="opaqueredirect"||r.status===401||r.status===403){stopped=true;return null;}` +
         `if(r.status===409)return{error:"replaced"};return r.ok?r.json():null;})` +
         `.then(function(d){busy=false;if(d===null){later();return;}if(stopped)return;` +
-        `if(d.error==="replaced"){from=0;out.textContent="[the view restarted]\\n";later();return;}` +
+        `if(d.error==="replaced"){from=0;gen="";inkey=false;ktail="";out.textContent="[the view restarted]\\n";later();return;}` +
         `if(d.error){stopped=true;return;}` +
         `var stick=near();` +
         `if(typeof d.text==="string"&&d.text!==""){out.appendChild(document.createTextNode(d.text));if(stick)out.scrollTop=out.scrollHeight;}` +
-        `if(typeof d.nextOffset==="number"&&d.nextOffset>=from){from=d.nextOffset;}` +
+        `if(typeof d.nextOffset==="number"&&d.nextOffset>=from){from=d.nextOffset;}if(typeof d.gen==="string")gen=d.gen;if(typeof d.inKey==="boolean")inkey=d.inKey;if(typeof d.keyTail==="string")ktail=d.keyTail;` +
         `if(d.final===true){stopped=true;var m=document.getElementById(${JSON.stringify(`${elementId}-state`)});` +
         `if(m)m.textContent="the agent finished — the record on this page is the story";return;}` +
         `later();})` +
@@ -680,6 +713,8 @@ export const NAV_ICONS = {
 export function workToolRows(scoped = false, _offersChat = false, offersCode = false) {
     const rows = [
         // D5: coding sessions are deprecated; /code still opens this release, but nothing links to it.
+        // Live terminals: an operator's own Claude Code, Codex or shell, in a real terminal (docs/plans/live-terminal.md).
+        ...(offersCode ? [{ key: "code", href: "/term", label: "Live", hint: "your own terminals: Claude Code, Codex or a shell" }] : []),
         { key: "inbox", href: "/inbox", label: "Inbox", hint: "questions, approvals, and repairs to act on" },
         { key: "board", href: "/board", label: "Board", hint: "lanes by state, with the order view" },
         { key: "tasks", href: "/tasks", label: "Task list", hint: "everything, filterable by state" },
@@ -749,3 +784,20 @@ export function oneLineOf(text, cap) {
     const flat = text.replace(/\s+/g, " ").trim();
     return flat.length <= cap ? flat : `${flat.slice(0, cap - 1)}…`;
 }
+/**
+ * The board's clocks tick in the page: each <time data-tick> counts up from
+ * its datetime, measured against the server's own now (the board's data-now)
+ * so a skewed device clock cannot run them backwards. The server-rendered
+ * minutes are the answer without script.
+ */
+export function boardTickScript(regionId = "board-region") {
+    return (`(function(){var seen=null,offset=0;var region=document.getElementById(${JSON.stringify(regionId)});` +
+        `function fmt(s){if(s<0)s=0;var h=Math.floor(s/3600),m=Math.floor(s%3600/60),x=s%60;return h>0?h+"h "+(m<10?"0":"")+m+"m":m+":"+(x<10?"0":"")+x;}` +
+        `function run(){var scope=region||document;var anchor=scope.querySelector("[data-now]");var v=anchor?anchor.getAttribute("data-now"):null;` +
+        `if(v!==null&&v!==seen){seen=v;var n=Number(v);offset=isFinite(n)?n-Date.now():0;}` +
+        `var now=Date.now()+offset;scope.querySelectorAll("time[data-tick]").forEach(function(t){var at=Date.parse(t.getAttribute("datetime")||"");if(isNaN(at))return;var text=fmt(Math.floor((now-at)/1000));if(t.textContent!==text)t.textContent=text;});}` +
+        // A swapped region brings back the server's minutes, so a swap (the region's children replaced — never a clock's
+        // own text) ticks at once and no clock flickers back to them. Hidden tabs do not tick.
+        `run();setInterval(function(){if(!document.hidden)run();},1000);document.addEventListener("visibilitychange",function(){if(!document.hidden)run();});` +
+        `if(region&&typeof MutationObserver==="function")new MutationObserver(run).observe(region,{childList:true});})();`);
+}