toolroll 0.9.63 → 0.9.67

package/dist/server/console.css

@@ -182,7 +182,7 @@
      the act that resolves the screen. Cards, frames, and seals are neutral. */
   .badge-open, .badge-parked { color: var(--foreground); }
   .count {
-    min-width: 1.25rem; padding-inline: .35rem; border-radius: 9999px;
+    min-width: 1.25rem; padding-inline: .35rem; border-radius: var(--so-radius-full);
   }
   .count.badge-open {
     background: var(--brand-soft); color: var(--brand);
@@ -627,7 +627,7 @@
   .requirement-heading .badge { margin: 0; white-space: normal; }
   .requirement-statement { margin: .5rem 0; line-height: 1.55; white-space: pre-wrap; }
   .requirement-review { margin: .4rem 0; font-size: .78rem; color: var(--muted-foreground); }
-  .requirement-warning { margin: .65rem 0; padding: .6rem .75rem; border: 1px solid color-mix(in srgb, var(--warning) 35%, var(--border)); border-radius: 8px; background: var(--warning-soft); font-size: .8125rem; }
+  .requirement-warning { margin: .65rem 0; padding: .6rem .75rem; border: 1px solid color-mix(in srgb, var(--warning) 35%, var(--border)); border-radius: var(--so-radius-md); background: var(--warning-soft); font-size: .8125rem; }
   .requirement-warning strong { font-size: .78rem; }
   .requirement-warning p { margin: .3rem 0 0; }
   .requirement-issues { font-size: .8125rem; }
@@ -663,7 +663,7 @@
 
   .filters { font-size: 0.8125rem; color: var(--muted-foreground); }
   .filters a, .filters strong {
-    display: inline-block; padding: .25rem .625rem; border-radius: 9999px; text-decoration: none;
+    display: inline-block; padding: .25rem .625rem; border-radius: var(--so-radius-full); text-decoration: none;
     color: var(--muted-foreground); font-weight: 500;
   }
   .filters strong { background: var(--muted); color: var(--foreground); }
@@ -884,13 +884,18 @@
   }
   .banner .badge { margin-right: .5rem; }
   /* Chat in `toolroll demo`: the scripted lead's conversation. */
-  .demo-chat { display: flex; flex-direction: column; gap: 1rem; max-width: 46rem; margin: 0 auto; padding-bottom: 1rem; }
+  .demo-chat { display: flex; flex-direction: column; gap: 1rem; max-width: 46rem; min-height: 100%; margin: 0 auto; }
+  .demo-thread { flex: 1 0 auto; }
+  /* Empty: the greeting, the suggestions and the composer sit together in the middle, as in any modern chat. */
+  .demo-chat--empty { justify-content: center; min-height: min(70vh, 40rem); }
+  .demo-chat--empty .demo-thread { flex: 0 0 auto; }
   .demo-thread { display: flex; flex-direction: column; gap: 1.25rem; }
   .demo-turn { display: flex; flex-direction: column; gap: .75rem; scroll-margin-top: 1rem; }
   .demo-said p { margin: 0; }
-  .demo-you { align-self: flex-end; max-width: min(34rem, 85%); background: var(--so-ink); color: var(--so-paper); border-radius: .875rem .875rem .25rem .875rem; padding: .55rem .85rem; overflow-wrap: anywhere; }
+  .demo-you { align-self: flex-end; max-width: min(34rem, 85%); background: var(--so-soft); color: var(--so-ink); border: 1px solid var(--so-line); border-radius: 1rem 1rem .3rem 1rem; padding: .5rem .85rem; overflow-wrap: anywhere; }
   .demo-lead { max-width: 40rem; }
-  .demo-who { font-size: .75rem; font-weight: 600; color: var(--so-muted); margin-bottom: .15rem !important; }
+  .demo-who { display: flex; align-items: center; gap: .45rem; font-size: .8125rem; font-weight: 600; color: var(--so-ink); margin-bottom: .3rem !important; }
+  .demo-avatar { display: inline-grid; place-items: center; width: 1.25rem; height: 1.25rem; border-radius: 50%; background: var(--so-ink); color: var(--so-paper); font-size: .6875rem; font-weight: 700; }
   .demo-chat .card { margin: 0; padding: 1rem 1.125rem; }
   .demo-chat .card h2 { font-size: .9375rem; margin: .1rem 0 .4rem; }
   .demo-chat .card h3 { font-size: .75rem; font-weight: 600; color: var(--so-muted); margin: .75rem 0 .25rem; }
@@ -938,13 +943,22 @@
   .demo-evidence figure { margin: 0 0 .5rem; }
   .demo-evidence img { display: block; width: 100%; height: auto; border: 1px solid var(--so-line); border-radius: .5rem; }
   .demo-evidence figcaption { margin-top: .35rem; }
-  .demo-hint { padding: 1.25rem 0 .25rem; }
-  .demo-hint-title { font-size: .9375rem; font-weight: 600; margin: 0 0 .75rem; }
-  .demo-suggestions { display: flex; flex-wrap: wrap; gap: .5rem; margin: 0; }
-  .demo-suggestions button { min-height: 2.5rem; border-radius: 999px; padding: .35rem .95rem; }
-  .demo-composer { position: sticky; bottom: 0; padding: .75rem 0 .25rem; background: var(--so-paper); flex-direction: row; align-items: flex-end; }
-  .demo-chat .demo-composer textarea { flex: 1 1 auto; width: auto; min-width: 0; min-height: 2.75rem; }
-  .demo-chat .demo-composer button { flex: none; width: auto; min-height: 2.75rem; padding-inline: 1.1rem; }
+  .demo-hint { text-align: center; padding: 0 0 .5rem; }
+  .demo-hint-title { font-size: 1.375rem; font-weight: 600; letter-spacing: -.01em; margin: 0 0 .35rem; }
+  .demo-hint-sub { color: var(--so-muted); font-size: .875rem; margin: 0 0 1rem; }
+  .demo-suggestions { display: flex; flex-wrap: wrap; justify-content: center; gap: .5rem; margin: 0; padding: 0; border: 0; background: none; }
+  .demo-chat .demo-suggestions button { min-height: 2.25rem; border-radius: 999px; padding: .3rem .9rem; border: 1px solid var(--so-line); background: var(--so-paper); color: var(--so-muted); font-weight: 500; box-shadow: none; }
+  @media (hover: hover) and (pointer: fine) { .demo-chat .demo-suggestions button:hover { color: var(--so-ink); border-color: var(--so-input-line); background: var(--so-soft); } }
+  /* The composer: one card docked at the bottom, a borderless box that grows, the hint and a round send inside. */
+  .demo-composer { position: sticky; bottom: 0; margin: 0; padding: .75rem 0 1rem; border: 0; border-radius: 0; box-shadow: none; background: linear-gradient(to bottom, transparent, var(--so-paper) 1.25rem); }
+  .demo-composer-card { display: flex; flex-direction: column; gap: .35rem; padding: .7rem .7rem .55rem .9rem; border: 1px solid var(--so-input-line); border-radius: 1rem; background: var(--so-paper); box-shadow: 0 1px 2px rgba(0,0,0,.04), 0 4px 16px rgba(0,0,0,.04); transition: border-color .12s var(--so-ease-out), box-shadow .12s var(--so-ease-out); }
+  .demo-composer-card:focus-within { border-color: var(--so-muted); box-shadow: 0 0 0 3px var(--so-soft); }
+  .demo-chat .demo-composer textarea { width: 100%; min-height: 1.6rem; max-height: 12rem; field-sizing: content; padding: .15rem 0; border: 0; border-radius: 0; background: none; box-shadow: none; resize: none; font-size: .9375rem; line-height: 1.55; }
+  .demo-chat .demo-composer textarea:focus-visible { outline: 0; }
+  .demo-composer-bar { display: flex; align-items: center; justify-content: space-between; gap: .75rem; }
+  .demo-composer-bar > span { color: var(--so-muted); font-size: .75rem; }
+  .demo-chat .demo-composer .demo-send { display: inline-grid; place-items: center; flex: none; width: 2rem; min-height: 2rem; height: 2rem; padding: 0; border-radius: 50%; }
+  .demo-composer-card:has(textarea:placeholder-shown) .demo-send { opacity: .35; }
   .banner a { color: var(--muted-foreground); }
   .sign-in-banner form { display: inline; margin: 0 0 0 .5rem; padding: 0; border: 0; background: transparent; }
 
@@ -1190,26 +1204,26 @@
      rows, who builds in one line, one Approve & start beside the password,
      and every other signed term in one Details fold at the end. Sentence
      case, Geist, 12px and up; prose capped at 75ch. */
-  .approval-sheet { display: grid; gap: 16px; margin: 0; padding: 20px; border: 1px solid var(--border); border-radius: 10px; background: var(--card); }
+  .approval-sheet { display: grid; gap: var(--so-space-lg); margin: 0; padding: var(--so-space-xl); border: 1px solid var(--border); border-radius: var(--so-radius-card); background: var(--card); }
   .approval-sheet.approve-form > :not(input) { margin: 0; }
   .approval-sheet-title { margin: 0; font-size: 15px; font-weight: 600; line-height: 1.4; letter-spacing: -.01em; }
   .approval-revision, .approval-note { max-width: 75ch; font-size: 14px; line-height: 1.6; overflow-wrap: anywhere; }
   .approval-note { color: var(--muted-foreground); }
   .approval-rows { display: grid; gap: 14px; margin: 0; }
-  .approval-row { display: grid; grid-template-columns: 7.5rem minmax(0, 1fr); gap: 16px; }
+  .approval-row { display: grid; grid-template-columns: 7.5rem minmax(0, 1fr); gap: var(--so-space-lg); }
   .approval-row dt { margin: 0; color: var(--muted-foreground); font-size: 13px; font-weight: 500; line-height: 1.6; }
   .approval-row dd { min-width: 0; max-width: 75ch; margin: 0; font-size: 14px; line-height: 1.6; overflow-wrap: anywhere; }
   .approval-row dd p, .approval-sheet .approval-goal { margin: 0; font-size: 14px; line-height: 1.6; }
-  .approval-row dd :is(ol, ul) { display: grid; gap: 4px; margin: 0; padding-left: 1.25rem; }
+  .approval-row dd :is(ol, ul) { display: grid; gap: var(--so-space-xs); margin: 0; padding-left: 1.25rem; }
   .approval-row dd ol + p { margin-top: 6px; }
   .approval-row dd .approval-paths { margin-top: 2px; padding-left: 0; }
   .approval-row dd .approval-paths li { font-size: 13px; }
-  .approval-amendment { max-width: 75ch; padding: 12px 14px; border-radius: 8px; background: var(--muted); font-size: 14px; line-height: 1.55; overflow-wrap: anywhere; }
+  .approval-amendment { max-width: 75ch; padding: var(--so-space-md) 14px; border-radius: var(--so-radius-md); background: var(--muted); font-size: 14px; line-height: 1.55; overflow-wrap: anywhere; }
   .approval-amendment p { margin: 0; }
-  .approval-amendment ul { display: grid; gap: 4px; margin: 6px 0; padding-left: 1.25rem; }
+  .approval-amendment ul { display: grid; gap: var(--so-space-xs); margin: 6px 0; padding-left: 1.25rem; }
   .agents-size { margin: 0; font-size: 13px; line-height: 1.5; }
   .approval-who { max-width: 75ch; color: var(--muted-foreground); font-size: 13px; line-height: 1.5; }
-  .approval-act { display: grid; grid-template-columns: minmax(0, 20rem) auto; justify-content: start; align-items: center; gap: 8px; }
+  .approval-act { display: grid; grid-template-columns: minmax(0, 20rem) auto; justify-content: start; align-items: center; gap: var(--so-space-sm); }
   .approval-password { margin: 0; }
   .approval-act input[type=password] { margin: 0; font-family: var(--font-sans); }
   .approval-act button { margin: 0; min-height: 2.125rem; white-space: nowrap; }
@@ -1218,7 +1232,7 @@
   .approval-sheet .approval-allowing + .approval-you-check { margin-top: -10px; }
   .approval-act > button { grid-column: 2; grid-row: 1; }
   .approval-password-note { grid-column: 1; grid-row: 2; margin: 0; color: var(--muted-foreground); font-size: 13px; line-height: 1.5; }
-  .approval-secondary { display: flex; flex-wrap: wrap; align-items: center; gap: 8px; }
+  .approval-secondary { display: flex; flex-wrap: wrap; align-items: center; gap: var(--so-space-sm); }
   details.approval-edit, details.approval-edit[open] { margin: 0; padding: 0; border: 0; border-radius: 0; background: none; }
   /* Edit plan, in place: the rows become fields where they stood; the
      approval act and Details step aside until it is saved or cancelled. */
@@ -1233,32 +1247,32 @@
   .approval-secondary:has(> .approval-edit[open]) > a { display: none; }
   .approval-editor { display: grid; gap: 14px; }
   .approval-editor .problem { margin: 0; }
-  .approval-field { display: grid; gap: 4px; min-width: 0; margin: 0; padding: 0; border: 0; }
+  .approval-field { display: grid; gap: var(--so-space-xs); min-width: 0; margin: 0; padding: 0; border: 0; }
   .approval-field-label { padding: 0; color: var(--muted-foreground); font-size: 13px; font-weight: 500; line-height: 1.6; }
   .approval-field-hint { color: var(--muted-foreground); font-size: 12px; line-height: 1.5; }
   .approval-field textarea, .approval-field input[type=text] { width: 100%; max-width: 75ch; margin: 0; font-family: var(--font-sans); font-size: 14px; line-height: 1.55; }
   .approval-requirements { display: grid; gap: 6px; margin: 2px 0 0; padding: 0; list-style: none; }
-  .approval-edit-act { display: flex; flex-wrap: wrap; align-items: center; gap: 8px; }
+  .approval-edit-act { display: flex; flex-wrap: wrap; align-items: center; gap: var(--so-space-sm); }
   .approval-edit-act button { margin: 0; min-height: 2.125rem; white-space: nowrap; }
-  .approval-link { display: inline-flex; align-items: center; min-height: 32px; padding: 0 12px; border: 1px solid var(--border); border-radius: 8px; background: var(--card); color: var(--foreground); font-size: 13px; font-weight: 500; text-decoration: none; }
+  .approval-link { display: inline-flex; align-items: center; min-height: 32px; padding: 0 var(--so-space-md); border: 1px solid var(--border); border-radius: var(--so-radius-md); background: var(--card); color: var(--foreground); font-size: 13px; font-weight: 500; text-decoration: none; }
   .approval-secondary > .approval-link:not(:first-child) { border-color: transparent; background: none; color: var(--muted-foreground); }
   @media (hover: hover) and (pointer: fine) { .approval-link:hover { background: var(--muted); color: var(--foreground); } }
   details.approval-details { margin: 0; padding: 0; border: 0; border-top: 1px solid var(--border); border-radius: 0; background: none; }
   details.approval-details[open] { padding-bottom: 0; }
-  .approval-details > summary { display: flex; align-items: center; min-height: 40px; padding: 4px 0 0; font-size: 13px; }
-  .approval-detail { max-width: 75ch; margin: 12px 0 0; font-size: 13px; line-height: 1.55; overflow-wrap: anywhere; }
-  .approval-detail h3 { margin: 0 0 4px; font-size: 13px; font-weight: 600; letter-spacing: 0; text-transform: none; }
-  .approval-detail p, .approval-detail ul, .approval-detail dl { margin: 4px 0; }
+  .approval-details > summary { display: flex; align-items: center; min-height: 40px; padding: var(--so-space-xs) 0 0; font-size: 13px; }
+  .approval-detail { max-width: 75ch; margin: var(--so-space-md) 0 0; font-size: 13px; line-height: 1.55; overflow-wrap: anywhere; }
+  .approval-detail h3 { margin: 0 0 var(--so-space-xs); font-size: 13px; font-weight: 600; letter-spacing: 0; text-transform: none; }
+  .approval-detail p, .approval-detail ul, .approval-detail dl { margin: var(--so-space-xs) 0; }
   .approval-detail ul { padding-left: 1.25rem; }
   .approval-detail .revision-card { margin: 0; padding: 0; border: 0; background: none; }
-  .approval-roles { display: grid; gap: 8px; }
-  .approval-roles > div { display: grid; grid-template-columns: 6rem minmax(0, 1fr); gap: 12px; }
+  .approval-roles { display: grid; gap: var(--so-space-sm); }
+  .approval-roles > div { display: grid; grid-template-columns: 6rem minmax(0, 1fr); gap: var(--so-space-md); }
   .approval-roles dt { color: var(--muted-foreground); font-weight: 500; }
   .approval-roles dd { margin: 0; }
   .approval-roles dd ul { margin: 2px 0 0; color: var(--muted-foreground); }
   .chat-plan .approval-sheet { padding: 0; border: 0; background: none; }
   @media (max-width: 760px) {
-    .approval-sheet { gap: 12px; padding: 14px; }
+    .approval-sheet { gap: var(--so-space-md); padding: 14px; }
     .approval-row { grid-template-columns: 1fr; gap: 2px; }
     .approval-act { grid-template-columns: 1fr; }
     .approval-act > button, .approval-password-note { grid-column: auto; grid-row: auto; }
@@ -1269,7 +1283,7 @@
       position: sticky; bottom: 0; z-index: 20; margin: 0 -14px; padding: 10px 14px calc(10px + env(safe-area-inset-bottom, 0px));
       border-top: 1px solid var(--border); background: var(--card);
     }
-    .approval-link { min-height: 44px; padding: 0 16px; }
+    .approval-link { min-height: 44px; padding: 0 var(--so-space-lg); }
     .approval-edit[open] > summary { top: 6px; right: 6px; }
     .approval-field textarea, .approval-field input[type=text] { font-size: 16px; }
     .approval-edit-act button { width: 100%; min-height: 44px; font-size: 16px; }
@@ -1719,7 +1733,7 @@
     .tabbar a { position: relative; }
     .tabbar a .dot-badge {
       position: absolute; top: .3125rem; left: calc(50% + .375rem);
-      width: .375rem; height: .375rem; border-radius: 9999px; background: var(--brand);
+      width: .375rem; height: .375rem; border-radius: var(--so-radius-full); background: var(--brand);
     }
     .content > main { padding: 1rem 1rem calc(4.5rem + env(safe-area-inset-bottom, 0rem)); }
     .project-add-card { padding: 1rem; }
@@ -1752,7 +1766,7 @@
     white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
   .stat-card .v { font-size: .75rem; color: var(--muted-foreground); margin-top: .25rem;
     white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
-  .dot { display: inline-block; width: .5rem; height: .5rem; border-radius: 9999px; flex: none; }
+  .dot { display: inline-block; width: .5rem; height: .5rem; border-radius: var(--so-radius-full); flex: none; }
   .dot-ok { background: var(--success); }
   /* Caution without a claim on the operator: quiet, not magenta. */
   .dot-warn { background: var(--muted-foreground); }
@@ -1787,13 +1801,13 @@
   .sso-step-up { display: inline-flex; align-items: center; min-height: 36px; font-size: .9rem; }
   .sso-step-up[data-sso-step-up="confirmed"] { color: var(--so-success); }
   .sso-step-up[data-sso-step-up="confirmed"]::before { content: "✓"; margin-right: 6px; }
-  .login-shell .login-sso { display: flex; justify-content: center; align-items: center; min-height: 44px; border-radius: 8px; background: var(--so-accent); color: var(--so-on-accent); font-weight: 600; text-decoration: none; margin: 0 0 1rem; }
+  .login-shell .login-sso { display: flex; justify-content: center; align-items: center; min-height: 44px; border-radius: var(--so-radius-md); background: var(--so-accent); color: var(--so-on-accent); font-weight: 600; text-decoration: none; margin: 0 0 1rem; }
   @media (hover: hover) and (pointer: fine) { .login-shell .login-sso:hover { background: var(--so-accent-hover); } }
   .login-shell .login-password > summary { text-align: center; font-size: .875rem; color: var(--muted-foreground); cursor: pointer; margin: 0 0 .75rem; }
   .focus-page { max-width: 40rem; margin: 0 auto; padding: 2rem 1.25rem 3rem; }
   .focus-page .focus-brand { display: inline-flex; margin: 0 0 2.5rem; }
   .focus-page h1 { margin: 0 0 1rem; }
-  .secret-value { overflow-wrap: anywhere; font-size: .95rem; padding: .75rem .875rem; margin: .75rem 0; border: 1px solid var(--border); border-radius: 8px; background: var(--background); user-select: all; }
+  .secret-value { overflow-wrap: anywhere; font-size: .95rem; padding: .75rem .875rem; margin: .75rem 0; border: 1px solid var(--border); border-radius: var(--so-radius-md); background: var(--background); user-select: all; }
 
   @media (max-width: 640px) {
     button, form.option button { min-height: 2.75rem; }
@@ -1811,7 +1825,7 @@
      building, then the rest. A header is a 2.75rem tap; a drawn chevron
      says which way it folds. */
   @media (max-width: 760px) {
-    .board { display: flex; flex-direction: column; gap: .5rem; padding-bottom: 0; }
+    .board { display: flex; flex-direction: column; align-items: stretch; gap: .5rem; padding-bottom: 0; }
     .board .lane { min-height: 0; padding: 0 .625rem .125rem; }
     .board .lane > summary {
       cursor: pointer; display: flex; align-items: center; min-height: 2.75rem; margin: 0;
@@ -1845,12 +1859,12 @@
   .lane .hint { margin-top: 0; }
   .lane-count { color: var(--muted-foreground); font-weight: 400; font-variant-numeric: tabular-nums; }
   .lane h2::before {
-    content: ""; width: .375rem; height: .375rem; border-radius: 9999px; flex: none;
+    content: ""; width: .375rem; height: .375rem; border-radius: var(--so-radius-full); flex: none;
     background: var(--muted-foreground); opacity: .55;
   }
   .lane-attention h2::before { background: var(--brand); opacity: 1; }
   .lane-building h2::before { background: var(--running); opacity: 1; }
-  .lane-done h2::before { background: var(--success); opacity: 1; }
+  .lane-done h2::before { background: var(--muted-foreground); opacity: 1; }
   .lane-card {
     display: block; text-decoration: none; color: inherit;
     background: var(--card); border: 1px solid var(--border);
@@ -1877,6 +1891,37 @@
     font-family: var(--font-mono); font-size: .6875rem; color: var(--running); font-variant-numeric: tabular-nums;
   }
   .lane-card .live-line .clock { color: var(--muted-foreground); }
+  /* The build's steps — set up, writing, checking and committing: three quiet
+     ticks, the current one in the running hue. A stage, never a percent. */
+  .lane-card .steps { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: .1875rem; margin-top: .5rem; }
+  .lane-card .steps i { height: .1875rem; border-radius: 999px; background: var(--border); }
+  .lane-card .steps i.on { background: color-mix(in srgb, var(--running) 45%, var(--border)); }
+  .lane-card .steps i.now { background: var(--running); }
+
+  /* The worker strip: one quiet tile per worker above the lanes — what it is
+     building here, the stage, the clock. Ink and lines only; the running dot
+     is the one hue. */
+  .crew { display: grid; grid-template-columns: repeat(auto-fill, minmax(15rem, 1fr)); gap: .625rem; margin: .25rem 0 .875rem; }
+  .crew-empty { margin: .25rem 0 .875rem; }
+  .worker {
+    border: 1px solid var(--border); border-radius: var(--radius); background: var(--card);
+    padding: .625rem .75rem; min-width: 0; display: flex; flex-direction: column; gap: .375rem;
+  }
+  .worker-busy { border-color: color-mix(in srgb, var(--running) 30%, var(--border)); }
+  .worker-offline { opacity: .6; }
+  .worker-head { display: flex; align-items: center; gap: .5rem; min-width: 0; }
+  .worker-head .name { font-family: var(--font-mono); font-size: .75rem; font-weight: 500; }
+  .worker-head .kind { font-size: .6875rem; color: var(--muted-foreground); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; flex: 1; min-width: 0; }
+  .worker-head .slots { font-family: var(--font-mono); font-size: .6875rem; color: var(--muted-foreground); font-variant-numeric: tabular-nums; }
+  .worker-job { display: flex; flex-direction: column; gap: .0625rem; text-decoration: none; color: inherit; min-width: 0; margin: 0; }
+  .worker-job .t { font-size: .8125rem; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+  .worker-job .sub { display: flex; justify-content: space-between; gap: .5rem; font-family: var(--font-mono); font-size: .6875rem; color: var(--muted-foreground); font-variant-numeric: tabular-nums; }
+  .worker-job.idle { font-size: .75rem; color: var(--muted-foreground); }
+  @media (hover: hover) and (pointer: fine) { a.worker-job:hover .t { text-decoration: underline; } }
+  @media (max-width: 760px) {
+    .crew { grid-template-columns: minmax(0, 1fr); gap: .375rem; }
+    .worker { padding: .5rem .625rem; }
+  }
   .lane-empty { margin: .75rem 0 .25rem; }
   .plan-doc { white-space: pre-wrap; overflow-wrap: anywhere; font-size: .8125rem; max-height: 24rem; overflow-y: auto; }
   .lane-more { display: block; margin-top: .5rem; font-size: .75rem; }
@@ -1901,7 +1946,7 @@
   .command-metric .value { display: block; margin-top: .25rem; font-size: 1.5rem; font-weight: 600; line-height: 1.15; font-variant-numeric: tabular-nums; font-family: var(--font-mono); }
   .command-metric .label { display: flex; align-items: center; gap: .4rem; font-weight: 500; font-size: .8125rem; }
   .command-metric .label::before {
-    content: ""; width: .375rem; height: .375rem; border-radius: 9999px;
+    content: ""; width: .375rem; height: .375rem; border-radius: var(--so-radius-full);
     background: var(--muted-foreground); flex: none;
   }
   .command-metric .detail { display: block; color: var(--muted-foreground); font-size: .6875rem; margin-top: .18rem; }
@@ -2433,7 +2478,7 @@
   }
   .workspace-stats .pulse-stat b { display: block; color: var(--foreground); font-weight: 600; font-family: var(--font-mono); font-size: 1.125rem; line-height: 1.2; font-variant-numeric: tabular-nums; }
   .workspace-stats .pulse-stat.hot b { color: var(--brand); }
-  .workspace-bar { display: flex; gap: 2px; height: .375rem; margin-top: .625rem; border-radius: 9999px; overflow: hidden; background: var(--muted); }
+  .workspace-bar { display: flex; gap: 2px; height: .375rem; margin-top: .625rem; border-radius: var(--so-radius-full); overflow: hidden; background: var(--muted); }
   .workspace-bar .seg { flex: 1 1 0; }
   .workspace-bar .seg.attention { background: var(--brand); }
   .workspace-bar .seg.building { background: var(--running); }
@@ -2660,8 +2705,10 @@ button { min-height: 44px; }
 @media (hover: hover) and (pointer: fine) { .next-pager .skip:hover { border-color: color-mix(in srgb, var(--border) 60%, var(--muted-foreground)); } }
 
 /* Motion: only where a human caused the change — navigation, presses,
-   overlays. Liveness swaps stay instant; the pulse dot is the one "alive"
-   signal. Everything dies under prefers-reduced-motion; auto-refresh pages
+   overlays — and one exception, the live board: a card that changes lane
+   slides there and a worker that picks up work flashes once (the board's
+   swap, html.so-swap, below). Every other liveness swap stays instant; the
+   pulse dot is the one "alive" signal. Everything dies under prefers-reduced-motion; auto-refresh pages
    opt out of the navigation cross-fade separately (see shell()). */
 @view-transition { navigation: auto; }
 /* A page change fades THROUGH, not across: the old page leaves before the new
@@ -2762,3 +2809,21 @@ button.pick-file { min-height: 1.75rem; padding: 0 .55rem; font-size: .75rem; }
   .meta, .hint { line-height: 1.35; }
   details { margin: var(--so-phone-row) 0; }
 }
+
+/* The live board's swap (regionScript animate): only cards move — the page
+   itself does not fade — a short slide for a card that changed lane, a drop
+   for a new one, a fade for one that left. Transform and opacity only, and
+   the reduce block kills it with everything else (the script also skips the
+   transition under reduced motion). */
+html.so-swap::view-transition-old(root), html.so-swap::view-transition-new(root) { animation: none; }
+html.so-swap::view-transition-group(*) { animation-duration: 320ms; animation-timing-function: cubic-bezier(.2, .8, .2, 1); }
+html.so-swap::view-transition-new(*):only-child { animation: so-card-in 240ms ease-out both; }
+html.so-swap::view-transition-old(*):only-child { animation: so-card-out 160ms ease-in both; }
+@keyframes so-card-in { from { opacity: 0; transform: translateY(-.375rem); } }
+@keyframes so-card-out { to { opacity: 0; } }
+.worker.flash { animation: so-worker-claim 900ms ease-out; }
+@keyframes so-worker-claim { from { background: color-mix(in srgb, var(--running) 14%, var(--card)); } }
+@media (prefers-reduced-motion: reduce) {
+  html.so-swap::view-transition-group(*), html.so-swap::view-transition-new(*), html.so-swap::view-transition-old(*) { animation: none !important; }
+  .worker.flash { animation: none; }
+}

package/dist/server/flows.js

@@ -18,7 +18,7 @@ import { assignFlowCard, commentOnFlowCard, watchFlowCard } from "../flow-people
 import { saveScript } from "../flow-scripts.js";
 import { chooseFlowCard } from "../flow-send.js";
 import { exportFlow, fetchFlowFile, FlowFileError, importFlow, parseFlowFile, planFlowImport } from "../flow-share.js";
-import { addFlowTriggerTo, checkFlowTriggerNow, pressFlowButton, removeFlowTrigger, removeLinearKey, setFlowTriggerOn, renewFlowHook, saveHooksBase, saveLinearKey, saveLinearSigningSecret, shareFlowButton, stopSharingFlowButton } from "../flow-triggers.js";
+import { addFlowTriggerTo, checkFlowTriggerNow, pressFlowButton, removeFlowTrigger, removeLinearKey, setFlowTriggerOn, renewFlowHook, saveHooksBase, saveLinearKey, saveSigningSecret, setUpFlowHook, changeFlowHookSender, setFlowHookScope, shareFlowButton, stopSharingFlowButton, rawTakesDeliveries } from "../flow-triggers.js";
 import { FLOW_IMPORT_SCRIPT, flowFallbackHtml, flowImportHtml, flowsListHtml, flowView } from "../flows-ui.js";
 import { FLOW_TEMPLATES, FlowContractError, validateFlowDefinition, withZoneNames } from "../flows.js";
 import { prepareUnattendedCandidates, parseUnattendedAsk, revokeUnattended, signUnattended, untilWords } from "../flow-unattended.js";
@@ -43,7 +43,7 @@ import { redirect, respond, SAFETY, taskHref } from "./http.js";
 import { html } from "../html.js";
 import {} from "./session.js";
 export function createFlowsHandlers(runtime) {
-    const { store, clock, sendScreen, chromeFor, consoleProjects, options, visible, flowRooms, identify, liveCeiling, providerHome, toolHome, restricted, evidenceRoot, authenticateApprover, projectOf, unscopedMode, ceiling, authorizeMutation } = runtime;
+    const { store, clock, sendScreen, chromeFor, consoleProjects, options, visible, flowRooms, identify, liveCeiling, providerHome, toolHome, restricted, evidenceRoot, authenticateApprover, authenticateCredential, projectOf, unscopedMode, ceiling, authorizeMutation } = runtime;
     // ---- reads ---------------------------------------------------------------
     /** A gallery template's page (Flows → New → Use this): its questions, the preview of these answers, and Create. */
     function sendGalleryUse(response, who, template, projects, repo, given, name, notice, said = null) {
@@ -572,7 +572,11 @@ export function createFlowsHandlers(runtime) {
             catch {
                 return answer(400, { ok: false, said: "That trigger couldn't be read." });
             }
-            const made = addFlowTriggerTo(store, flow, raw, who.name, now, dir);
+            // A trigger that takes deliveries mints an address: a credential act (docs/plans/passwordless.md).
+            const ingress = rawTakesDeliveries(raw);
+            if (ingress && !authenticateCredential(who, body.get("password") ?? "").ok)
+                return answer(403, { ok: false, said: "Enter your Toolroll password to make a webhook address." });
+            const made = addFlowTriggerTo(store, flow, raw, who.name, now, dir, ingress ? { ingress: "proved" } : {});
             if (made.ok)
                 await prepareUnattendedCandidates(store, flow.id);
             return made.ok ? settle(made.said, made.reveal === null ? {} : { reveal: made.reveal }) : answer(400, { ok: false, said: made.message });
@@ -729,6 +733,10 @@ export function createFlowsHandlers(runtime) {
             removeFlowTrigger(store, trigger, now, dir, who.name);
             return settle("Trigger removed.");
         }
+        // A public form link and a new webhook address each open a way in: credential acts, a password typed now.
+        if ((verb === "share" || verb === "renew") && !authenticateCredential(who, body.get("password") ?? "").ok) {
+            return answer(403, { ok: false, said: verb === "share" ? "Enter your Toolroll password to share a form link." : "Enter your Toolroll password to make a new address." });
+        }
         if (verb === "share") {
             const shared = shareFlowButton(store, trigger, now, dir);
             return shared.ok ? settle(shared.said, { reveal: shared.reveal }) : answer(409, { ok: false, said: shared.message });
@@ -737,6 +745,11 @@ export function createFlowsHandlers(runtime) {
             stopSharingFlowButton(store, trigger, now);
             return settle("The form link no longer works.");
         }
+        // v126: a person has seen that deliveries were turned away (the banner stays until then).
+        if (verb === "dropped") {
+            store.clearFlowDeliveriesDropped(trigger.id);
+            return settle("Cleared.");
+        }
         if (verb === "press") {
             let answers;
             try {
@@ -764,11 +777,24 @@ export function createFlowsHandlers(runtime) {
             const renewed = renewFlowHook(store, trigger, now, dir);
             return renewed.ok ? settle(renewed.said, { reveal: renewed.reveal }) : answer(409, { ok: false, said: renewed.message });
         }
-        // Linear's signing secret, pasted on this secure panel behind the password — never in chat.
-        if (!authenticateApprover(who, body.get("password") ?? "").ok)
-            return answer(403, { ok: false, said: "Enter your Toolroll password to save a secret." });
-        const saved = saveLinearSigningSecret(trigger, body.get("secret") ?? "", dir);
-        return saved.ok ? settle("Signing secret saved. Linear's deliveries can be proved now.") : answer(400, { ok: false, said: saved.message });
+        // A webhook's credentials change only on this secure panel, behind the password — never in chat (v126): a secret
+        // pasted (Linear's, Sentry's, Vercel's), one made and shown once with a new address, or who signs its deliveries.
+        if (!authenticateCredential(who, body.get("password") ?? "").ok)
+            return answer(403, { ok: false, said: verb === "secret" ? "Enter your Toolroll password to save a secret." : "Enter your Toolroll password to change how this webhook is proved." });
+        if (verb === "setup") {
+            const made = setUpFlowHook(store, trigger, now, dir);
+            return made.ok ? settle(made.said, { reveal: made.reveal }) : answer(409, { ok: false, said: made.message });
+        }
+        if (verb === "scope") {
+            const scoped = setFlowHookScope(store, trigger, { project: body.get("project"), team: body.get("team") }, who.name, now);
+            return scoped.ok ? settle(scoped.said) : answer(400, { ok: false, said: scoped.message });
+        }
+        if (verb === "sender") {
+            const changed = changeFlowHookSender(store, trigger, body.get("sender"), who.name, now, dir);
+            return changed.ok ? settle(changed.said) : answer(400, { ok: false, said: changed.message });
+        }
+        const saved = saveSigningSecret(store, trigger, body.get("secret") ?? "", now, dir);
+        return saved.ok ? settle(saved.said) : answer(400, { ok: false, said: saved.message });
     };
     const recipeAct = (step) => async (ctx) => {
         const { who, request, response, now, posted } = ctx;
@@ -924,6 +950,10 @@ export function createFlowsHandlers(runtime) {
         "flow.trigger.press": triggerAct("press"),
         "flow.trigger.renew": triggerAct("renew"),
         "flow.trigger.secret": triggerAct("secret"),
+        "flow.trigger.setup": triggerAct("setup"),
+        "flow.trigger.sender": triggerAct("sender"),
+        "flow.trigger.scope": triggerAct("scope"),
+        "flow.trigger.dropped": triggerAct("dropped"),
         "flow.trigger.share": triggerAct("share"),
         "flow.trigger.unshare": triggerAct("unshare"),
         "recipes.prepare-send": recipeAct("prepare"),

package/dist/server/guards.d.ts

@@ -41,6 +41,7 @@ export interface GuardsRuntime {
 }
 export declare function createSharedGuards(runtime: GuardsRuntime): {
     authenticateApprover: (who: Who, token: string, repo?: string | null) => ReturnType<typeof checkApproverPassword>;
+    authenticateCredential: (who: Who, token: string, repo?: string | null) => ReturnType<typeof checkApproverPassword>;
     authorizeMutation: (request: IncomingMessage, who: Who, body: FormView<FormFieldOf<"mutationGuard">>) => {
         status: number;
         message: string;

package/dist/server/guards.js

@@ -6,23 +6,29 @@ import { tokenLive, tokenProjects } from "../api-tokens.js";
 import { oauthProjects, oauthTokenAllowed } from "../mcp-oauth.js";
 import { REMOTE_MESSAGES, reproveRemote } from "../operate-remote.js";
 import { canonicalProject, rowVisible } from "../project.js";
-import { authenticateAccount, authenticateApprover as checkApproverPassword } from "../scope.js";
+import { authenticateAccount, authenticateApprover as checkApproverPassword, credentialProof } from "../scope.js";
 import { SourceBudget } from "../sign-in-guard.js";
 import {} from "../store.js";
 import { requestContext } from "./request-context.js";
 import { refuse } from "./chrome.js";
 import { matchTaskPath } from "./http.js";
-import { PersistentSessions, SESSION_ABSOLUTE_MS, SESSION_COOKIE, SESSION_IDLE_MS } from "./session.js";
+import { PersistentSessions, SESSION_COOKIE, sessionWithinLifetime } from "./session.js";
 export function createSharedGuards(runtime) {
     // v99: wrong passwords. One address guessing across names runs out of tries here; each name
     // locks on its own (sign-in-guard.ts), and every lock, whatever road it came by, is kept.
     /**
-     * Every step-up in the console (v100): a person the identity provider
-     * checked in the last ten minutes confirms with that (an empty password
-     * field); anyone else types their password. Standing (an approver, with
-     * access to the project) is checked either way.
+     * Every step-up in the console: a password typed now, or (an empty field) an explicit identity-provider re-check
+     * made on request and not yet spent, or — inside an allowlisted act only — a remembered password (cockpit B2,
+     * scope.ts proveAccountNow / freshnessFor, reading the request's live facts). Standing (an approver, with access to
+     * the project) is checked either way.
      */
-    // v100: the shared check honours a fresh identity-provider sign-in itself (freshIdentitySignIn, set per request below).
+    /** A credential act (docs/plans/passwordless.md): only a password typed now (or a one-use provider re-check) proves it. */
+    function authenticateCredential(who, token, repo) {
+        if (who.via !== "cookie")
+            return { ok: false, reason: "not-an-approver" };
+        const proved = checkApproverPassword(runtime.store, who.name, token, repo, { credential: true });
+        return !proved.ok || credentialProof(proved.method) ? proved : { ok: false, reason: "not-an-approver" };
+    }
     function authenticateApprover(who, token, repo) {
         // Re-entering a password never upgrades a machine credential into a browser ceremony.
         if (who.via !== "cookie")
@@ -332,7 +338,7 @@ export function createSharedGuards(runtime) {
         }
         for (const [id, session] of found === null ? [] : [found]) {
             const now = Date.now();
-            if (now - session.lastSeen > SESSION_IDLE_MS || now - session.createdAt > SESSION_ABSOLUTE_MS) {
+            if (!sessionWithinLifetime(session, now)) {
                 runtime.sessions.delete(id);
                 return null;
             }
@@ -340,10 +346,18 @@ export function createSharedGuards(runtime) {
                 runtime.sessions.delete(id);
                 return null;
             }
+            // Ended in another process (or from Sessions): the cached copy is dropped, never used.
+            if (!runtime.sessions.stillSaved(id)) {
+                Map.prototype.delete.call(runtime.sessions, id);
+                return null;
+            }
             if (touch) {
                 session.lastSeen = now;
                 runtime.sessions.persist(session, true);
             }
+            // A touch that found the session ended elsewhere dropped it: this request is not signed in by it.
+            if (touch && !runtime.sessions.holds(session))
+                return null;
             return session;
         }
         return null;
@@ -356,5 +370,5 @@ export function createSharedGuards(runtime) {
     function runVisible(run) {
         return visible(taskRepoOf(run.taskRef));
     }
-    return { authenticateApprover, authorizeMutation, projectOf, resolveRouteProject, projectRequestAllowed, identify, lookupSession, restricted, visible, admissionList, codingActorAllowed, codingProjectAllowed, workAccess, familyOf, taskRepoOf, runVisible };
+    return { authenticateApprover, authenticateCredential, authorizeMutation, projectOf, resolveRouteProject, projectRequestAllowed, identify, lookupSession, restricted, visible, admissionList, codingActorAllowed, codingProjectAllowed, workAccess, familyOf, taskRepoOf, runVisible };
 }

package/dist/server/http.d.ts

@@ -1,4 +1,5 @@
 /** HTTP answers every console route shares: server options, body limits, safe responses, redirects and return paths. */
+import type { TerminalHost } from "../live-terminal.js";
 import { type Html } from "../html.js";
 import { type CliHttpOptions, type RunOperateAs } from "../cli-http.js";
 import { type CodingWorkspace } from "../coding-workspace.js";
@@ -25,6 +26,8 @@ export type ServeOptions = {
     installBin?: string;
     /** Native coding workspace injection for isolated integration tests. */
     codingWorkspace?: CodingWorkspace;
+    /** Live terminals (tests stand their own in; null turns them off). Default: one on a machine that runs agents. */
+    terminalHost?: TerminalHost | null;
     /** Read-only worker connections for heavy reads (read-executor.ts); 0 reads in-process. Default: off under tests. */
     readWorkers?: number;
     store: Store;
@@ -141,6 +144,10 @@ export type ServeOptions = {
     connectFetch?: typeof fetch;
     /** Tests: every request sign-in with the identity provider makes (discovery, keys, tokens). */
     ssoFetch?: typeof fetch;
+    /** Cockpit B1: this `up` console's instance secret (null: none — the instance route answers 404). */
+    instanceSecret?: () => string | null;
+    /** Cockpit E: how Finder is asked to reveal a proved checkout (tests pass their own; never a launch). True: shown. */
+    revealPath?: (path: string) => Promise<boolean> | boolean;
     chatEnv?: Record<string, string | undefined>;
     /**
      * The live peek's locality ASSERTION (live-peek v3 §3): the administrator

package/dist/server/http.js

@@ -1,4 +1,3 @@
-/** HTTP answers every console route shares: server options, body limits, safe responses, redirects and return paths. */
 import { html, htmlString, isHtml } from "../html.js";
 import { chatResultHref as sharedResultHref } from "../chat-controls.js";
 import {} from "../cli-http.js";
@@ -117,7 +116,9 @@ export function goOutside(response, to, words, bind) {
     response.end(htmlString(html `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="refresh" content="0;url=${to}"><title>Toolroll</title>${HANDOFF_STYLE}<p>${words} <a href="${to}">Continue</a></p>`));
 }
 export function redirect(response, to) {
-    response.writeHead(303, { ...SAFETY, Location: to });
+    // Set as a header (not only in writeHead) so the answer can be read back after: a refused act's redirect names it.
+    response.setHeader("Location", to);
+    response.writeHead(303, { ...SAFETY });
     response.end();
 }
 export const taskChatHref = (taskId) => `/chat?task=${encodeURIComponent(taskId)}`;

package/dist/server/live.d.ts

@@ -1,10 +1,32 @@
+/**
+ * GET /live: one stream per page, joined to every room the page shows.
+ *
+ *   room=workspace              the reader's workspace may have changed (any meaningful write, or a lapse)
+ *   room=task:<id>              the task family changed; who else has it open
+ *   room=flow:<id>?card=&editing=  the flow changed; who else is on it, and on which card
+ *   room=chat[?task=|?project=] the reader's own lead reply, as it runs (the only room that carries content)
+ *   room=team[?conversation=]   the team conversation's cursor moved
+ *   room=agent:<run>            one agent on the Agents board changed; while open, this person watches it (no pings)
+ *   room=summary                the reader's project states (the sidebar): each change carries the snapshot; never watching or seeing
+ *
+ * Every room is validated before anything is looked up, and admitted with
+ * the same checks and answers as the page it belongs to, before the stream
+ * opens; each is re-proved on every signal and its safety-net check, and a
+ * viewer who no longer passes hears `gone`. Events name their room. A page
+ * that falls behind gets one `reload` and the stream ends, so its
+ * EventSource reconnects (live-bus.ts).
+ */
+import type { IncomingMessage } from "node:http";
 import { type LiveBus } from "../live-bus.js";
 import type { WorkspaceRevision } from "../workspace-revision.js";
 import type { ServerRuntime } from "./runtime.js";
+import type { Who } from "./session.js";
 /** A page asks for a few rooms at once: its workspace, what it shows, its conversation. */
-export declare const LIVE_ROOMS_PER_PAGE = 5;
+export declare const LIVE_ROOMS_PER_PAGE = 6;
 export type LiveRoom = {
     kind: "workspace";
+} | {
+    kind: "summary";
 } | {
     kind: "task";
     task: string;
@@ -26,10 +48,21 @@ export type LiveRoom = {
 };
 /** A room's name, read strictly: anything else is not a room. */
 export declare function parseLiveRoom(name: string): LiveRoom | null;
+/** The same session, still signed in, from the cookie and the account (never this request's context): a live room's and
+ * a live terminal's re-proof. Null when it was signed out, ended elsewhere, revoked, rotated or re-roled. */
+export declare function rereadBrowser(runtime: Pick<ServerRuntime, "identify" | "sessions" | "store">, request: IncomingMessage, who: Who & {
+    via: "cookie";
+}): (Who & {
+    via: "cookie";
+}) | null;
 export declare function createLiveHandlers(runtime: ServerRuntime, live: {
     bus: LiveBus;
     workspaceRevision: WorkspaceRevision;
     chatProjectOf: (projects: string[]) => string | null | undefined;
+    /** One account's sidebar snapshot for one scope (serve.ts projectSummaryFor); null: gone, or the scope moved. */
+    projectSummaryFor: (account: string, scope: string) => string | null;
+    /** What one account may see now (serve.ts projectScopeFor); null: no such account. */
+    projectScopeFor: (account: string) => string | null;
 }): {
     registrations: import("./handler-registry.js").Registration[];
     turnStarted: (thread: number) => void;