toolroll 0.9.63 → 0.9.67

package/dist/server/live.js

@@ -10,8 +10,8 @@ import { respond } from "./http.js";
 import { adapterPolicy } from "./route-policy.js";
 import { requestContext } from "./request-context.js";
 /** A page asks for a few rooms at once: its workspace, what it shows, its conversation. */
-export const LIVE_ROOMS_PER_PAGE = 5;
-const ROOM_NAME = /^(workspace|task|flow|chat|team|agent)(?::([^?]{1,400}))?(?:\?([^#]{0,600}))?$/;
+export const LIVE_ROOMS_PER_PAGE = 6;
+const ROOM_NAME = /^(workspace|task|flow|chat|team|agent|summary)(?::([^?]{1,400}))?(?:\?([^#]{0,600}))?$/;
 /** At most one workspace nudge a second: a burst of writes is one re-read, the first heard at once. */
 const WORKSPACE_SETTLE_MS = 1_000;
 /** A running reply's preview: at most one snapshot every 80 ms; the last one always goes out. */
@@ -33,6 +33,7 @@ export function parseLiveRoom(name) {
     const only = (...allowed) => [...params.keys()].every(one => allowed.includes(one)) && allowed.every(one => params.getAll(one).length <= 1);
     switch (kind) {
         case "workspace": return key === null && query === undefined ? { kind } : null;
+        case "summary": return key === null && query === undefined ? { kind } : null;
         case "task": return key !== null && key !== "" && query === undefined ? { kind, task: key } : null;
         case "flow": {
             const flow = Number(key), card = params.get("card");
@@ -53,11 +54,34 @@ export function parseLiveRoom(name) {
     }
     return null;
 }
+/** The same session, still signed in, from the cookie and the account (never this request's context): a live room's and
+ * a live terminal's re-proof. Null when it was signed out, ended elsewhere, revoked, rotated or re-roled. */
+export function rereadBrowser(runtime, request, who) {
+    const again = runtime.identify(request, false);
+    if (again?.via !== "cookie" || again.name !== who.name || again.session.generation !== who.session.generation)
+        return null;
+    // The in-memory session may still exist after another process ends the saved session.
+    const hash = runtime.sessions.hashOf(again.session);
+    const saved = hash === null ? null : runtime.store.webSession(hash), account = runtime.store.accountOf(again.name);
+    if (saved === null || account === null || account.revokedAt !== null || account.generation !== again.session.generation
+        || saved.generation !== account.generation || saved.role !== account.role || again.role !== account.role)
+        return null;
+    return again;
+}
 const json = (response, status, value) => respond(response, status, "application/json", JSON.stringify(value));
 export function createLiveHandlers(runtime, live) {
     const { store, identify, liveCeiling, familyOf, taskRooms, flowRooms, clock, leadPrincipal, taskChatFocus, chatScopeOf, liveTurns, team, visible } = runtime;
     // The reader's workspace: one room for everyone, nudged by any meaningful write or a clock-bound lapse.
     const workspaceRooms = createLiveRooms(() => `${live.workspaceRevision.current()}:${live.workspaceRevision.expiresAt(clock())}`, null, { bus: live.bus, minIntervalMs: WORKSPACE_SETTLE_MS });
+    // The reader's project states, per account AND scope: the fingerprint IS the snapshot, so each `change` carries it
+    // (`at`). Every delivery re-proves the viewer's scope, so a snapshot read for a wider scope (a cached one, a held
+    // one, one a newcomer would be handed on joining) never reaches a narrowed reader: it hears `gone` instead. Reads
+    // settle: a burst of writes is one read, while every signal still re-proves at once.
+    const summaryKey = (account, scope) => JSON.stringify([account, scope]);
+    const summaryRooms = createLiveRooms(key => {
+        const [account, scope] = JSON.parse(key);
+        return live.projectSummaryFor(account, scope);
+    }, null, { bus: live.bus, minIntervalMs: WORKSPACE_SETTLE_MS, readSettleMs: WORKSPACE_SETTLE_MS });
     // A team audience is per actor (and per token): its key carries who reads, the room keeps how to read as them.
     const teamActors = new Map();
     const teamRooms = createLiveRooms(key => {
@@ -68,19 +92,7 @@ export function createLiveHandlers(runtime, live) {
     const chatViewers = new Set();
     // One agent's open view (Agents board): what it shows, keyed by the exact run.
     const agentRooms = createLiveRooms(run => agentRunFingerprint(store, run), null, { bus: live.bus });
-    /** The same session, still signed in, from the cookie and the account (never this request's context). */
-    const readBrowser = (request, who) => {
-        const again = identify(request, false);
-        if (again?.via !== "cookie" || again.name !== who.name || again.session.generation !== who.session.generation)
-            return null;
-        // The in-memory session may still exist after another process ends the saved session.
-        const hash = runtime.sessions.hashOf(again.session);
-        const saved = hash === null ? null : store.webSession(hash), account = store.accountOf(again.name);
-        if (saved === null || account === null || account.revokedAt !== null || account.generation !== again.session.generation
-            || saved.generation !== account.generation || saved.role !== account.role || again.role !== account.role)
-            return null;
-        return again;
-    };
+    const readBrowser = (request, who) => rereadBrowser(runtime, request, who);
     const sameBrowser = (request, who) => () => readBrowser(request, who) !== null;
     function admitted(viewer, thread) {
         let valid = false;
@@ -90,7 +102,7 @@ export function createLiveHandlers(runtime, live) {
         catch { /* Failed proof stops this room. */ }
         if (!valid) {
             viewer.connection.send(viewer.room, "gone");
-            viewer.leave();
+            viewer.connection.refuse(() => viewer.leave());
         }
         return valid;
     }
@@ -184,7 +196,7 @@ export function createLiveHandlers(runtime, live) {
         if ([...url.searchParams.keys()].some(key => key !== "room") || names.length === 0 || names.length > LIVE_ROOMS_PER_PAGE || new Set(names).size !== names.length)
             return json(response, 400, { error: "room" });
         const rooms = names.map(name => ({ name, room: parseLiveRoom(name) }));
-        if (rooms.some(one => one.room === null) || rooms.filter(one => one.room?.kind === "agent").length > 1 || rooms.filter(one => one.room?.kind === "workspace").length > 1 || rooms.filter(one => one.room?.kind === "chat").length > 1 || rooms.filter(one => one.room?.kind === "team").length > 1)
+        if (rooms.some(one => one.room === null) || rooms.filter(one => one.room?.kind === "agent").length > 1 || rooms.filter(one => one.room?.kind === "workspace").length > 1 || rooms.filter(one => one.room?.kind === "chat").length > 1 || rooms.filter(one => one.room?.kind === "team").length > 1 || rooms.filter(one => one.room?.kind === "summary").length > 1)
             return json(response, 400, { error: "room" });
         // Admit every room before the stream opens, with the answers each page's own stream gave.
         const joins = [];
@@ -195,6 +207,15 @@ export function createLiveHandlers(runtime, live) {
                 const browser = who;
                 joins.push(connection => workspaceRooms.join("workspace", { name: who.name, room: name, connection, valid: sameBrowser(request, browser) }));
             }
+            else if (room.kind === "summary") {
+                const browser = who;
+                const scope = live.projectScopeFor(who.name);
+                if (scope === null)
+                    return json(response, 404, { error: "summary" });
+                const signedIn = sameBrowser(request, browser);
+                joins.push(connection => summaryRooms.join(summaryKey(who.name, scope), { name: who.name, room: name, connection,
+                    valid: () => signedIn() && live.projectScopeFor(who.name) === scope }));
+            }
             else if (room.kind === "task") {
                 const browser = who;
                 const family = familyOf(room.task);
@@ -333,6 +354,7 @@ export function createLiveHandlers(runtime, live) {
         close() {
             detachChat();
             workspaceRooms.close();
+            summaryRooms.close();
             teamRooms.close();
             agentRooms.close();
             for (const viewer of [...chatViewers])

package/dist/server/pages-assets.js

@@ -6,6 +6,9 @@ const PWA_ICON_192 = "iVBORw0KGgoAAAANSUhEUgAAAMAAAADACAIAAADdvvtQAAAB1klEQVR42u
 const PWA_ICON_512 = "iVBORw0KGgoAAAANSUhEUgAAAgAAAAIACAIAAAB7GkOtAAAJF0lEQVR42u3VwQ0AEBBFQXU4KUD/TW0R3JzcRLJhfqYCwivDzMy+XHEEZmYCYGZmAmBmZgJgZmYCYGZmAmBmZgJgZmYCYGZmAmBmZgJgZmYCYGZmAmBmZgJgZmYCYGZmAmBmZgJgZmYCYGZmAmBmZgJgZmYCYGZmAmBmZgJgZmYCYGZmAmBmJgBmZiYAZmYmAGZmJgBmZiYAZmYmAGZmJgDb1dYBOCEAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACAIAAACAAAAgAAAIAgAAAIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACAIAAACAAAAgAAAIAgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIAAACAIAAACAAAAgAAAIAgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIAAACAIAAACAAAAgAAAIAIAACACAAAgAgAAIAIAACACAAAgAgAAIAIAACACAAAgAgAAIAIAACACAAAgAgAAIAIAACACAAAgAgAAIAIAACcF+Y5Z5HKgACIAAmAAgAAmACgAAgACYACAACYAKAACAAJgAIAAJgAoAAIAAmAAgAAmACIAACgP/FBEAABEAAzARAAARAAMwEQAAEQADMBEAABEAAzARAAARAAMwEQAAEQADMBEAABEAAzARAAARAAMwEQAAEQADMBEAABEAAzARAAARAAMwEQAAEQADMBEAABEAAzARAAARAAMwEQAAEQABMABAAARAAEwAEAAEwAUAAEAATAAQAATABQAAQABMABAABMAFAABAAEwABEAAEwARAAARAAMwEQAAEQADMBEAABEAAzARAAARAAMwEQAAEQADMBEAABEAAzARAAARAAMwEQAAEQADMBEAABEAAzARAAARAAMwEQAAEQADMBEAABEAAzARAAARAAMwEQAAEAEAABABAAAQAQAAAEAAABAAAAQBAAAAQAAAEAEAABABAAAQAQAAEAEAABABAAAQAQAAEAEAABABAAAQAQAAEAEAABABAAAQAQAAEAEAABABAAAQAQAAEAEAABABAANwcgAAAIAAACAAAAgCAAAAgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIAgAAAIAAACAAAAgCAAAAgAAACIAC/C7Pc80gFQAAEwAQAAUAATAAQAATABAABQABMABAABMAEAAFAAEwAEAAEwAQAAUAATAAEQADwv5gACIAACICZAAiAAAiAmQAIgAAIgJkACIAACICZAAiAAAiAmQAIgAAIgJkACIAACICZAAiAAAiAmQAIgAAIgJkACIAACICZAAiAAAiAmQAIgAAIgJkACIAACICZAAiAAAiAmQAIgAAIgAkAAiAAAmACgAAgACYACAACYAKAACAAJgAIAAJgAoAAIAAmAAgAAmACIAACgACYAAiAAAiAmQAIgAAIgJkACIAACICZAAiAAAiAmQAIgAAIgJkACIAACICZAAiAAAiAmQAIgAAIgJkACIAACICZAAiAAAiAmQAIgAAIgJkACIAACICZAAiAAAiAmQAIgAAACIAAAAiAAAAIAAACAIAAACAAAAgAAAIAgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAmwMQAAAEAAABAEAAABAAAAQAQAAEAEAABABAAAQAQAAEAEAABABAAAQAQAAEAEAABABAAAQAQAAEAEAABABAAAQAQAAEAEAABABAAAQAQAAEAEAABABAAAAQAAAEAAABAEAAABAAAASAJcxyzyMVAAEQABMABAABMAFAABAAEwAEAAEwAUAAEAATAAQAATABQAAQABMABAABMAEQAAHA/2ICIAACIABmAiAAAiAAZgIgAAIgAGYCIAACIABmAiAAAiAAZgIgAAIgAGYCIAACIABmAiAAAiAAZgIgAAIgAGYCIAACIABmAiAAAiAAZgIgAAIgAGYCIAACIABmAiAAAiAAZgIgAAIgACYACIAACIAJAAKAAJgAIAAIgAkAAoAAmAAgAAiACQACgACYACAACIAJgAAIAAJgAiAAAiAAZgIgAAIgAGYCIAACIABmAiAAAiAAZgIgAAIgAGYCIAACIABmAiAAAiAAZgIgAAIgAGYCIAACIABmAiAAAiAAZgIgAAIgAGYCIAACIABmAiAAAiAAZgIgAAIAIAACACAAAgAgAAAIAAACAIAAACAAAAgAAAIAIAACACAAAgAgAAIAIAACACAAAgAgAAIAIAACACAAAgAgAAIAIAACACAAAgAgAAIAIAACACAAAgAgAAIAIAACACAAbg5AAAAQAAAEAAABAEAAABAAAAEQAAABEAAAARAAAAEQAAABEAAAARAAAAEQAAABEAAAARAAAAEQAAABEAAAARAAAAEQAAABEAAAARAAAAEQAAABEAAAAQBAAAAQAAAEAAABAEAAABAAAAEQAAABEAAAARAAAAEQAAABEAAAARAAAAEQAAABEAAAARAAAAEQAAABEAAAARAAAAEQAAABEAAAARAAAAEQAAABcHkAAgCAAAAgAAAIAAACAIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgJmZPT4BMDMTADMzEwAzMxMAMzMTADMzEwAzMxMAMzMTADMzEwAzMxMAMzMTADMzEwAzMxMAMzMTADMzEwAzMxMAMzMTADMzEwAzMxMAMzMTADMzEwAzMxMAMzMTADMzEwAzMwEwMzMBMDMzATAzMwEwMzMBMDOzJzYBVJhD+Nnu218AAAAASUVORK5CYII=";
 const PWA_ICON_APPLE = "iVBORw0KGgoAAAANSUhEUgAAALQAAAC0CAIAAACyr5FlAAABqklEQVR42u3aMQ0AIAxFwepgQgD+TSECFHQiYWjv5ylobmwcs2ThBAaHwWFwGBwGh8FhcBgcBofBkW7MparBITgEh+AQHIJDcAgOwQEHHHDAAYfgEByCQ3AIDsEhOASHI8IBBxxwCA7BITgEh+AQHIJDcAgOOOCAQ3AIDsEhOASH4BAcguNPu9PggAMOOOCAAw444IADDjjggAMOOOCAAw444IADDjjggAMOOOCAAw44PPsIDsEhOASH4BAcgkNwCA444IADDjgEh+AQHIJDcAgOwSE44IDDg7EHYzjggAMOOOCAAw444IADDjjggAMOOOCAAw444IADDjjggAMOOOCAAw559hEcgkNwwAEHHHDAITgEh+AQHIJDcAgOwQEHHHDAAYfgEByCQ3B4MIYDDjjggAMOOOCAAw444IADDjjggAMOOOCAAw444IADDjjggAMOOODw7OPZBw7BITgEh+AQHIJDcAgOOOCAAw44BIfgEByCQ3AIDsEhOAQHHHDAITgEh+AQHIJDcAgOwSE44IADDjgecVjbwWFwGBwGh8FhcBgcBofBYeV3AaohX51oqNRKAAAAAElFTkSuQmCC";
 const PWA_ICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><rect x="6" y="6" width="88" height="88" rx="14" fill="#1a202c"/><rect x="28" y="28" width="44" height="8" rx="4" fill="#ebebeb"/><rect x="28" y="47" width="44" height="8" rx="4" fill="#ebebeb"/><rect x="28" y="66" width="44" height="8" rx="4" fill="#ebebeb"/></svg>`;
+/** The icon with the attention dot (cockpit §3): a tab whose reader has something waiting shows it. Same origin, so
+ * the page's img-src 'self' allows it; nothing about the reader rides the asset. */
+const PWA_ICON_ATTENTION_SVG = PWA_ICON_SVG.replace("</svg>", `<circle cx="78" cy="22" r="20" fill="#bb2649" stroke="#ffffff" stroke-width="6"/></svg>`);
 /** The typefaces by route: exact names only, served pre-auth like the icons. */
 const FONT_FILES = {
     "/fonts/geist-sans-400.woff2": GEIST_SANS_400,
@@ -87,6 +90,8 @@ export function serveInstallAsset(response, pathname, respond) {
         return asset("image/png", Buffer.from(PWA_ICON_APPLE, "base64"));
     if (pathname === "/icon.svg")
         return asset("image/svg+xml", PWA_ICON_SVG);
+    if (pathname === "/icon-attention.svg")
+        return asset("image/svg+xml", PWA_ICON_ATTENTION_SVG);
     if (pathname === "/icon-192.png")
         return asset("image/png", Buffer.from(PWA_ICON_192, "base64"));
     if (pathname === "/icon-512.png")

package/dist/server/pages.js

@@ -1,5 +1,8 @@
+import { steerControlsFor } from "../steer-controls.js";
+import { canReveal, cdCommandOf, localCheckoutOf } from "../checkout-proof.js";
+import { instanceHttpAnswer } from "../console-instance.js";
 import { handlersOf } from './handler-registry.js';
-import { html, joinHtml, postForm } from "../html.js";
+import { html, joinHtml, postForm, reauth } from "../html.js";
 /** pages handlers, moved without changing their route bodies. */
 import { createHmac, randomBytes } from "node:crypto";
 import { existsSync, opendirSync, readdirSync, realpathSync } from "node:fs";
@@ -21,7 +24,7 @@ import { run as execRun } from "../exec.js";
 import { computeGaps } from "../gaps.js";
 import { LEDGER_CSV_HEADER, ledgerCsvRows } from "../ledger-csv.js";
 import { ledgerBody } from "../ledger-view.js";
-import { agentRowOf, agentsBoardOf, agentFactsFor, sealedDiffOf } from "../agents-board.js";
+import { agentLanesOf, agentRowOf, agentsBoardOf, agentFactsFor, laneWindowOf, sealedDiffOf } from "../agents-board.js";
 import { markAgentSeen } from "../agent-board.js";
 import { prometheusMetrics } from "../metrics.js";
 import { readMonitoring } from "../monitoring-settings.js";
@@ -37,12 +40,14 @@ import { serveInstallAsset } from "./pages-assets.js";
 import { healthz } from "./remote-hooks.js";
 import { projectChip, refuse, regionScript, relativeAge, screen, settingsRows, transcriptScript, WORKSPACE_STYLE, workToolRows } from "./chrome.js";
 import { redirect, respond, safeReturn, SAFETY, taskHref } from "./http.js";
+import { assignmentOf } from "../assignment.js";
+import { assignmentTaskStatusOf } from "../assignment-presentation.js";
 import { browsePage, fleetBody, fleetScript, githubIdentityOf, githubReposPage, homePage, originUrlOf, portfolioOverview, projectsPage, systemPage, workbenchRail } from "./render-pages.js";
 import { capsPage } from "./render-settings.js";
 import { decisionAnswerScript, taskBody } from "./render-tasks.js";
 import {} from "./session.js";
 export function createPagesHandlers(runtime) {
-    const { clock, store, visible, consoleProjects, restricted, ceiling, options, projectFamilyPeek, sendScreen, chromeFor, unscopedMode, admissionList, taskRepoOf, taskViewData, runVisible, evidenceRoot, workAccess, identify, liveCeiling, sessions, deletedRepos, authenticateApprover, projectOf, lookupSession } = runtime;
+    const { clock, store, visible, consoleProjects, restricted, ceiling, options, projectFamilyPeek, sendScreen, chromeFor, unscopedMode, admissionList, taskRepoOf, taskViewData, runVisible, evidenceRoot, workAccess, identify, liveCeiling, sessions, deletedRepos, authenticateApprover, authenticateCredential, projectOf, lookupSession } = runtime;
     // The filesystem browser (operator request): pick a project folder by
     // looking, not typing. CONFINED to exactly what opening allows —
     // explicit --repo mode has an enumerable list and gets no browser at
@@ -382,11 +387,57 @@ export function createPagesHandlers(runtime) {
     /** What the board says after a Reply or a steer, in fixed words (never text from the address). */
     const AGENT_SAID = {
         replied: { tone: "info", text: "Reply sent. The agent reads it at its next check." },
-        steered: { tone: "info", text: "Note sent. The agent reads it at its next check." },
+        steered: { tone: "info", text: "Note sent. It shows in the conversation with whether the agent has read it." },
+        "steer-ended": { tone: "error", text: "That attempt ended before your note, so nothing was sent. Your note is kept below." },
+        "steered-next": { tone: "info", text: "Note sent. The task's next attempt reads it before starting." },
+        "steer-next-finished": { tone: "error", text: "This task is finished, so there's no next attempt to send it to. Your note is kept below." },
+        "steer-invalid": { tone: "error", text: "That note will not store. Your note is still in the box." },
+        "steer-stale": { tone: "error", text: "That form was already used. Your note is still in the box — send it again." },
         "reply-closed": { tone: "error", text: "That question was already answered." },
         "reply-stale": { tone: "error", text: "This attempt ended before your reply, so nothing was sent." },
         "reply-invalid": { tone: "error", text: "Write a reply of up to 1,500 characters." },
+        "steer-no-notes": { tone: "error", text: "This agent takes no notes right now, so nothing was sent. Stop it to change its course." },
+        stopping: { tone: "info", text: "Stopping. The work so far is kept." },
+        pausing: { tone: "info", text: "Pausing. It stops at the end of its current step." },
+        "pausing-with-note": { tone: "info", text: "Pausing. Your note goes to it as soon as it stops." },
+        "pause-note-stale": { tone: "error", text: "That form was already used, so your note was not sent. It is still in the box — send it again." },
+        resuming: { tone: "info", text: "Resuming. It carries on where it stopped." },
+        revealed: { tone: "info", text: "Shown in Finder." },
+        "reveal-refused": { tone: "error", text: "That checkout couldn't be shown: it isn't this attempt's running checkout on this computer any more." },
+        "reveal-mac-only": { tone: "error", text: "Show in Finder works on a Mac. Copy the command instead." },
+        "reveal-failed": { tone: "error", text: "Finder didn't show it. The path is above; copy the command instead." },
     };
+    /**
+     * The opened agent's head (docs/plans/one-page-task-and-agent.md): its task's status in the task page's own words and
+     * that status's one action as a link to the task page tab holding its form, and where this run opens there — a
+     * result (the shared predicate: a finished builder or scout run) on the Result tab at this run, a plan on the Plan
+     * tab, anything else on its record.
+     */
+    function agentTaskHeadOf(taskId, runId, live, access, now) {
+        const family = store.taskFamilyOf(taskId, access.repos, access.includeUnplaced);
+        const root = family?.root.id ?? taskId;
+        const versionOf = (id) => family !== null && id !== family.current.id ? `version=${encodeURIComponent(id)}&` : "";
+        const run = store.getRun(runId);
+        const open = live || run === null ? null
+            : run.finishedAt !== null && (run.role === "builder" || run.role === "scout") ? { label: run.role === "scout" ? "Report" : "Result", href: `${taskHref(root)}?${versionOf(taskId)}tab=result&run=${runId}` }
+                : run.role === "planner" ? { label: "Plan", href: `${taskHref(root)}?${versionOf(taskId)}tab=plan` }
+                    : { label: "Record", href: `/r/${runId}?record=1` };
+        let task = null;
+        try {
+            const assignment = family === null ? null : assignmentOf(store, family.current.id, now, access, evidenceRoot);
+            if (assignment !== null) {
+                const words = assignmentTaskStatusOf(assignment);
+                const wants = words.primaryAction?.href ?? "";
+                // A result to review is on the Result tab; everything else the task page heads with (the approval, a retry…).
+                const href = /^\/review\?result=|[?&]result=/.test(wants) ? `${taskHref(root)}?tab=result` : taskHref(root);
+                task = { headline: words.headline, sentence: words.sentence, tone: words.tone, action: { label: words.primaryAction?.label ?? "Open task", href } };
+            }
+        }
+        catch {
+            task = null;
+        }
+        return { task, open };
+    }
     // The Agents board (one place to check on running agents): rows by state, and the opened agent's live view.
     async function agentsPage(ctx) {
         const { url, who, response, project } = ctx;
@@ -402,29 +453,43 @@ export function createPagesHandlers(runtime) {
                 if (facts.outcome !== null && markAgentSeen(store, who.name, facts.runId, now))
                     facts.seen = true;
                 const live = facts.outcome === null;
+                const composer = live ? steerControlsFor(store, facts.taskId, facts.runId, now, who.role === "approver") : null;
                 const sealed = live ? null : sealedDiffOf(store, evidenceRoot, facts.runId);
                 // A reply's own word first; otherwise the note that the agent asked past the questions cap.
                 const said = AGENT_SAID[url.searchParams.get("said") ?? ""] ?? (facts.questionNote === null ? null : { tone: "info", text: facts.questionNote });
                 selected = {
                     ...agentRowOf(store, facts, now, evidenceRoot), live,
                     question: live && facts.question !== null ? { ...facts.question, action: `${taskHref(facts.taskId)}/reply` } : null,
-                    transcript: options.localRunner === undefined ? null : `/r/${facts.runId}?fragment=transcript`,
-                    // The live look at its checkout needs this machine's runner and pool, as the run page's does.
-                    peek: live && options.localRunner !== undefined && options.poolRoot !== undefined ? `/r/${facts.runId}?fragment=peek` : null,
+                    // The conversation's window: its notes answer anywhere; its transcript only from the machine that runs it (the window says so).
+                    transcript: `/r/${facts.runId}?fragment=transcript&shape=records`,
+                    // The live look at its checkout needs this machine's runner — the one running it — and pool, as the run page's does.
+                    peek: live && options.localRunner !== undefined && run.runner === options.localRunner && options.poolRoot !== undefined ? `/r/${facts.runId}?fragment=peek` : null,
                     files: (sealed?.files ?? []).slice(0, 30).map(one => ({ path: one.path, added: one.additions, removed: one.deletions })),
                     filesMore: Math.max(0, (sealed?.fileCount ?? 0) - 30),
-                    steer: live ? { action: `${taskHref(facts.taskId)}/steer`, run: facts.runId } : null,
+                    // A note goes only to an attempt that reads notes (steer-controls.ts); the composer says what it takes.
+                    steer: composer?.steer ?? null,
+                    controls: composer?.controls ?? null,
+                    checkout: (() => {
+                        if (!live || who.role !== "approver" || store.isDemo())
+                            return null;
+                        const proof = localCheckoutOf(store, facts.runId, { runner: options.localRunner, poolRoot: options.poolRoot }, now);
+                        // Show in Finder only where it can work (a Mac); elsewhere the path and the command stand alone.
+                        return proof.ok ? { path: proof.path, cd: cdCommandOf(proof.path), reveal: canReveal(options.revealPath !== undefined) ? `/r/${facts.runId}/reveal` : null } : null;
+                    })(),
                     canAct: who.role === "approver" && !store.isDemo(),
                     taskHref: taskHref(facts.taskId),
                     // The run's own address: a finished result opens on its result page, anything else on its record.
                     resultHref: live ? null : `/r/${facts.runId}`,
+                    ...agentTaskHeadOf(facts.taskId, facts.runId, live, access, now),
                     room: `agent:${facts.runId}`, said,
                 };
             }
         }
         const groups = agentsBoardOf(store, now, access, who.name, evidenceRoot);
-        const view = { kind: "agents", groups, selected,
-            empty: groups.length === 0 ? "No agents in the last day. They show here the moment one starts." : null };
+        const lanes = selected === null ? agentLanesOf(store, now, access, who.name, laneWindowOf(url.searchParams.get("window"))) : null;
+        const view = { kind: "agents", groups, selected, lanes,
+            // Empty only when nothing ran at all: a planner or review on the timeline is activity too.
+            empty: groups.length === 0 && (lanes === null || lanes === undefined) ? "No agents in the last day. They show here the moment one starts." : null };
         const fallback = joinHtml([
             html `<h1>Agents</h1>`,
             groups.length === 0 ? html `<p class="meta">${view.empty ?? ""}</p>` : joinHtml(groups.map(group => joinHtml([
@@ -456,7 +521,7 @@ export function createPagesHandlers(runtime) {
             html `<p class="meta" id="fleet-region-stamp"></p>`,
             html `<h2>Register a worker</h2>`,
             postForm("/fleet/runner/register", html `<label>Name<input type="text" name="name" placeholder="builder-2" maxlength="60" required></label><label>Capacity<input type="text" name="capacity" inputmode="numeric" value="1" aria-label="capacity"></label><label>Your password, typed again<input type="password" name="token" autocomplete="current-password" required></label><button type="submit">Register — its token is shown once</button>`, { attrs: { class: "card" } }),
-            html `<details class="arm-danger"><summary>Retire a worker</summary>${postForm("/fleet/runner/retire", html `<label>Which worker<input type="text" name="name" placeholder="builder-1" required></label><label>Your password, typed again<input type="password" name="token" autocomplete="current-password" required></label><button type="submit" class="danger">Retire it</button>`, { attrs: { class: "card" } })}</details>`,
+            html `<details class="arm-danger"><summary>Retire a worker</summary>${postForm("/fleet/runner/retire", html `<label>Which worker<input type="text" name="name" placeholder="builder-1" required></label>${reauth(html `<label>Your password, typed again<input type="password" name="token" autocomplete="current-password" required></label>`)}<button type="submit" class="danger">Retire it</button>`, { attrs: { class: "card" } })}</details>`,
         ], "\n"), 
         // The password fields make this screen sensitive: sendScreen strips
         // the chrome additions and keeps the reorder poller — the named
@@ -649,7 +714,8 @@ export function createPagesHandlers(runtime) {
         if (who.via !== "cookie")
             return refuse(response, who, 403, "runner registration is a browser surface");
         const token = body.get("token") ?? "";
-        if (!authenticateApprover(who, token).ok) {
+        // A worker credential is minted here: a credential act, a password typed now even with Passwordless on.
+        if (!authenticateCredential(who, token).ok) {
             return refuse(response, who, 403, "registering a worker takes your password, typed again", "/fleet");
         }
         const name = (body.get("name") ?? "").trim();
@@ -769,7 +835,7 @@ export function createPagesHandlers(runtime) {
         // (finding 22/33) — the record is consumed from the RETURNED live
         // session, synchronously, before the first await.
         const password = body.get("token") ?? "";
-        if (password === "" || !authenticateApprover(who, password).ok) {
+        if (!authenticateApprover(who, password).ok) {
             return projectsScreen(response, who, "cloning takes your password, typed again", 403);
         }
         const cookieId = /(?:^|;\s*)standing-orders_session=([0-9a-f]{64})/.exec(request.headers.cookie ?? "")?.[1];
@@ -879,6 +945,16 @@ export function createPagesHandlers(runtime) {
             peeks[path] = peekOf(path);
         return sendScreen(response, status, projectsPage(chromeFor(open, "projects"), recent, [...candidates], open, problem, !restricted() && unscopedMode, !restricted() && (ceiling.roots.length > 0 || unscopedMode), onboardState, peeks, returnTo, who.via === "cookie" ? (path) => publishingOf(store, path).on : undefined, who.via === "cookie" ? (path) => projectCheckLevel(store, path).level : undefined));
     }
+    async function instanceEdge(ctx) {
+        const { request, response, url } = ctx;
+        const secret = options.instanceSecret?.() ?? null;
+        if (secret === null)
+            return respond(response, 404, "application/json; charset=utf-8", JSON.stringify({ error: "not-up" }));
+        // Bound to what THIS console saw as the receiving end of this very connection — never the Host header.
+        const answer = instanceHttpAnswer(secret, url.searchParams.getAll("c").length === 1 ? url.searchParams.get("c") : null, { address: request.socket.localAddress, port: request.socket.localPort });
+        response.setHeader("Cache-Control", "no-store");
+        return respond(response, answer.status, "application/json; charset=utf-8", answer.body);
+    }
     async function healthzEdge(ctx) {
         const { response, method } = ctx;
         return healthz(store, response, method === 'HEAD');
@@ -941,6 +1017,7 @@ export function createPagesHandlers(runtime) {
         "projects.onboard-confirm": onboardConfirm,
     }, {
         "edge.healthz": healthzEdge,
+        "edge.instance": instanceEdge,
         "edge.browser-asset": browserAsset,
         "edge.workspace-style": workspaceStyle,
         "edge.install-asset": installAsset,

package/dist/server/people-tokens.d.ts

@@ -1,6 +1,9 @@
 import type { ServerRuntime } from './runtime.js';
 import { type IncomingMessage, type ServerResponse } from "node:http";
 import { type FormView } from "../contracts/console-api.js";
+/** When the provider checked the person, in ms, if its auth_time is a check made for this visit: present, no earlier
+ * than the second the visit began, and not in the future beyond the skew. Null otherwise. */
+export declare function sameVisitCheck(authTime: number | null, startedAt: number, now: number): number | null;
 export declare function createPeopleHandlers(runtime: ServerRuntime): {
     registrations: import("./handler-registry.js").Registration[];
     takeJoinAttempt: (source: string) => boolean;

package/dist/server/people-tokens.js

@@ -3,7 +3,7 @@ import { adapterPolicy } from "./route-policy.js";
 /** settings handlers, moved without changing their route bodies. */
 import { mintApiToken, TOKEN_DAYS } from "../api-tokens.js";
 import { CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
-import { html, htmlString, joinHtml, postForm } from "../html.js";
+import { html, htmlString, joinHtml, postForm, reauth } from "../html.js";
 import { credentialsHtml, tokenShownHtml } from "../credentials-ui.js";
 import { projectName } from "../project.js";
 import { requestLimitsHtml, tokenLimitWords } from "../request-budget-ui.js";
@@ -21,12 +21,26 @@ import { logEvent } from "../log.js";
 import { accessFromGroups, accountNameFor, exchangeOidcCode, newOidcVisit, oidcAuthorizeUrl, verifyIdToken } from "../oidc.js";
 import { personAuditHtml, personHref } from "../people-audit-ui.js";
 import { cursorOf as auditCursorOf, remoteAudit } from "../remote-audit.js";
-import { hashPassword } from "../scope.js";
+import { credentialProof, hashPassword, proveAccountNow } from "../scope.js";
 import { form, HANDOFF_STYLE, loginHref, loginReturn, page, SIGN_IN_COOKIE, signInSpent, startedHere } from "./http.js";
 import { joinDeadPage, joinFormPage, loginPage, signupPage } from "./render-people.js";
 import { SESSION_COOKIE, SIGN_IN_LINK_PATH } from "./session.js";
+/** Clock skew allowed between the provider and this server when reading auth_time — forward only (a provider clock
+ * running ahead). auth_time is in whole seconds, so a check made in the visit's own second is floored below startedAt:
+ * the one allowance backward is that rounding, never a check made before the visit began. */
+const AUTH_TIME_SKEW_MS = 60_000;
+/** When the provider checked the person, in ms, if its auth_time is a check made for this visit: present, no earlier
+ * than the second the visit began, and not in the future beyond the skew. Null otherwise. */
+export function sameVisitCheck(authTime, startedAt, now) {
+    if (authTime === null || !Number.isFinite(authTime))
+        return null;
+    const at = authTime * 1000;
+    if (at < Math.floor(startedAt / 1000) * 1000 || at > now + AUTH_TIME_SKEW_MS)
+        return null;
+    return Math.min(Math.max(at, startedAt), now);
+}
 export function createPeopleHandlers(runtime) {
-    const { settingsUpdates, joinBySource, ssoOffer, ssoVisits, ssoSettings, options, clock, ssoHandoffs, managedRepos, store, visible, admissionList, sendScreen, chromeFor, restricted, sessions, consoleProjects, authenticateApprover, bustBadge, projectOf, signInLinks, linkKey, fromThisComputer, recordSignIn, passwordAllowed, arrival, defaultProject, cookieSecure, consoleOrigin, providerFor, joinSourceOf, signInBudget, signInActor, minutesWords } = runtime;
+    const { settingsUpdates, joinBySource, ssoOffer, ssoVisits, ssoSettings, options, clock, ssoHandoffs, managedRepos, store, visible, admissionList, sendScreen, chromeFor, restricted, sessions, consoleProjects, authenticateApprover, authenticateCredential, bustBadge, projectOf, signInLinks, linkKey, fromThisComputer, recordSignIn, passwordAllowed, arrival, defaultProject, cookieSecure, consoleOrigin, providerFor, joinSourceOf, signInBudget, signInActor, minutesWords } = runtime;
     // v101: Settings → Sessions & tokens: where you're signed in, and your API tokens. An instance operator can see everyone's.
     async function sessionsPage(ctx) {
         const { url, who, response, project } = ctx;
@@ -95,7 +109,7 @@ export function createPeopleHandlers(runtime) {
                     : joinHtml(acts.map(act => html `<p class="row meta">${act.kind} ${act.subject} \u00b7 ${act.at.slice(0, 16).replace("T", " ")}</p>`), "\n"),
                 approverView && one.revokedAt === null && one.name !== who.name
                     ? postForm("/people/revoke", html `\
-<label>Your password<input type="password" name="token" autocomplete="current-password"></label>\
+${reauth(html `<label>Your password<input type="password" name="token" autocomplete="current-password"></label>`)}\
 <button type="submit">Remove ${one.name}'s sign-in</button>\
 <span class="meta">ends their access and everything it signed \u2014 history stays</span>`, { attrs: { class: "row" }, hidden: { name: one.name } })
                     : "",
@@ -105,7 +119,7 @@ export function createPeopleHandlers(runtime) {
         const invites = approverView ? store.openInvites(now) : [];
         const inviteRows = invites.map(one => html `<p class="row">${one.role} invite · ${one.projects === null ? "all projects" : one.projects.map(repo => projectName(repo)).join(", ")} \u00b7 from ${personChip(one.mintedBy)} \u00b7 expires ${one.expiresAt.slice(0, 16).replace("T", " ")}${one.attempts > 0 ? ` \u00b7 ${one.attempts} failed attempt${one.attempts === 1 ? "" : "s"}` : ""}\
  ${postForm("/people/invite-revoke", html `\
-<label>Password <input type="password" name="token" autocomplete="current-password" style="width:8rem"></label>\
+${reauth(html `<label>Password <input type="password" name="token" autocomplete="current-password" style="width:8rem"></label>`)}\
 <button type="submit">Cancel it</button>`, { attrs: { style: "display:inline" }, hidden: { id: one.id } })}</p>`);
         const inviteCard = !approverView
             ? ""
@@ -193,10 +207,13 @@ export function createPeopleHandlers(runtime) {
                 return back("problem", "Choose when it expires.");
             if (access === "act" && who.role !== "approver")
                 return back("problem", "A viewer's token can only read.");
-            // A token is a credential: made with the person's password (or their identity provider's check from moments ago), counted once.
+            // A token is a credential: made with the person's password typed now (or an explicit identity-provider re-check,
+            // spent by it), counted once. Never a remembered password: this act is outside every freshness allowlist.
             const typed = body.get("password") ?? "";
-            const confirmed = who.role === "approver" ? authenticateApprover(who, typed).ok
-                : typed === "" ? requestContext.getStore()?.sso?.fresh === true : authenticateAccount(store, who.name, typed).ok;
+            // Passwordless never covers it (docs/plans/passwordless.md: a credential act).
+            const viewerProof = who.role === "approver" || who.via !== "cookie" ? null : proveAccountNow(store, who.name, typed, { credential: true });
+            const confirmed = who.role === "approver" ? authenticateCredential(who, typed).ok
+                : viewerProof !== null && viewerProof.ok && credentialProof(viewerProof.method);
             if (!confirmed)
                 return back("problem", "Enter your Toolroll password to make a token.");
             const minted = mintApiToken();
@@ -210,7 +227,8 @@ export function createPeopleHandlers(runtime) {
     async function peopleProjects(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.peopleProjects);
-        if (!authenticateApprover(who, body.get("token") ?? "", null).ok)
+        // Widening access (up to instance operator) is a credential act: a password typed now, Passwordless or not.
+        if (!authenticateCredential(who, body.get("token") ?? "", null).ok)
             return refuse(response, who, 403, "Saving access requires your password.", "/people");
         const access = readAccessForm(body);
         if (!access.ok)
@@ -229,7 +247,7 @@ export function createPeopleHandlers(runtime) {
         const token = body.get("token") ?? "";
         // RAISING authority is a password ceremony (the doctrine): adding a
         // person to the instance is exactly that.
-        if (!authenticateApprover(who, token).ok) {
+        if (!authenticateCredential(who, token).ok) {
             return refuse(response, who, 403, "making an invite takes your password, typed again", "/people");
         }
         const role = body.get("role") === "approver" ? "approver" : "viewer";
@@ -346,7 +364,9 @@ export function createPeopleHandlers(runtime) {
         // Bounded: anyone may start a sign-in, so the oldest waiting ones give way.
         while (ssoVisits.size >= 1000)
             ssoVisits.delete(ssoVisits.keys().next().value);
-        ssoVisits.set(visit.state, { visit, provider: found.provider, redirect: redirectUri, intent, returnTo, expires: Date.now() + 15 * 60_000 });
+        const asker = intent === "sign-in" || who?.via !== "cookie" ? null : sessions.hashOf(who.session);
+        ssoVisits.set(visit.state, { visit, provider: found.provider, redirect: redirectUri, intent, returnTo, expires: Date.now() + 15 * 60_000, startedAt: Date.now(),
+            session: asker === null || who?.via !== "cookie" ? null : { hash: asker, generation: who.session.generation } });
         response.writeHead(302, { location: oidcAuthorizeUrl(found.provider, settings, visit, redirectUri, intent === "reauth"), "cache-control": "no-store", "referrer-policy": "no-referrer",
             "set-cookie": `${SIGN_IN_COOKIE}=${visit.state}; Path=${SSO_CALLBACK}; Max-Age=900; HttpOnly; SameSite=Lax${origin.startsWith("https:") ? "; Secure" : ""}` });
         response.end();
@@ -371,18 +391,28 @@ export function createPeopleHandlers(runtime) {
         if (handoff.intent === "link" || handoff.intent === "reauth") {
             if (who?.via !== "cookie")
                 return redirect(response, loginHref(handoff.returnTo));
+            // Only the session that asked: same kept session, same credential generation.
+            if (handoff.session === null || sessions.hashOf(who.session) !== handoff.session.hash || who.session.generation !== handoff.session.generation) {
+                return page(response, 403, loginPage(`That ${settings.label} check was started by another sign-in. Start it again from this page.`, handoff.returnTo, ssoOffer()));
+            }
             if (handoff.intent === "link") {
                 const linked = store.linkSsoIdentity(who.name, identity, clock());
                 if (!linked.ok)
                     return redirect(response, `/settings/sign-in?problem=${encodeURIComponent(`That ${settings.label} account signs in as someone else here.`)}`);
-                who.session.sso = { at: Date.now() };
+                who.session.sso = { at: handoff.checkedAt ?? 0 };
                 sessions.persist(who.session);
                 return redirect(response, `/settings/sign-in?said=${encodeURIComponent(`This account signs in with ${settings.label} now.`)}`);
             }
             // A step-up: the provider checked the same person again.
             if (store.ssoAccount(identity.issuer, identity.subject) !== who.name)
                 return page(response, 403, loginPage(`That ${settings.label} account isn't the one signed in here.`, handoff.returnTo, ssoOffer()));
-            who.session.sso = { at: Date.now() };
+            who.session.sso = { at: handoff.checkedAt ?? 0 };
+            // An explicit re-check on request: the one identity-provider event that stands in for a password typed now (for ONE
+            // step-up, spent by it) and may start a freshness window (B2). Kept in memory only: a restart forgets it.
+            if (handoff.checkedAt !== null) {
+                who.session.ssoReauthAt = handoff.checkedAt;
+                who.session.ssoNowAt = handoff.checkedAt;
+            }
             sessions.persist(who.session);
             recordSignIn(who.name, "confirmed", settings.label);
             return redirect(response, handoff.returnTo);
@@ -397,7 +427,7 @@ export function createPeopleHandlers(runtime) {
         const account = store.accountOf(signedIn.account);
         const id = randomBytes(32).toString("hex");
         sessions.set(id, { ...arrival(request), name: signedIn.account, csrf: randomBytes(32).toString("hex"), role: account.role, generation: account.generation, createdAt: Date.now(), sawBoardAt: null, lastSeen: Date.now(),
-            project: defaultProject, projectRevision: 1, sso: { at: Date.now() } });
+            project: defaultProject, projectRevision: 1, sso: { at: handoff.checkedAt ?? 0 } });
         recordSignIn(signedIn.account, "signed in", settings.label);
         response.setHeader("Set-Cookie", [signInSpent("/login/sso/finish"), `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`]);
         return redirect(response, handoff.returnTo);
@@ -447,6 +477,8 @@ export function createPeopleHandlers(runtime) {
             lastSeen: Date.now(),
             project: defaultProject,
             projectRevision: 1,
+            // A password typed on this computer starts this session's freshness window (cockpit B2); from anywhere else, never.
+            ...(fromThisComputer(request) ? { passwordAt: Date.now() } : {}),
         });
         response.setHeader("Set-Cookie", `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`);
         return redirect(response, "/");
@@ -496,6 +528,9 @@ export function createPeopleHandlers(runtime) {
             lastSeen: Date.now(),
             project: defaultProject,
             projectRevision: 1,
+            // A password typed to sign in on this computer starts this session's freshness window (cockpit B2); from anywhere
+            // else (a phone, a proxy) it signs in and proves nothing more.
+            ...(fromThisComputer(request) ? { passwordAt: Date.now() } : {}),
         });
         response.setHeader("Set-Cookie", `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`);
         return redirect(response, returnTo);
@@ -641,8 +676,11 @@ export function createPeopleHandlers(runtime) {
             logEvent("warn", "sso.refused", { reason: verified.said });
             return back(verified.said);
         }
-        // A step-up must be a check made just now, not a remembered one.
-        if (held.intent === "reauth" && verified.claims.authTime !== null && Date.now() / 1000 - verified.claims.authTime > 300)
+        // When the provider checked the person (its auth_time), proved against this visit (cockpit B2, N18): no earlier than
+        // this visit began, and not in the future beyond a minute of clock skew. A step-up must carry one that holds — a
+        // check made for this request, never a remembered one; any other sign-in without one signs in, but is never fresh.
+        const checkedAt = sameVisitCheck(verified.claims.authTime, held.startedAt, Date.now());
+        if (held.intent === "reauth" && checkedAt === null)
             return back(`${settings.label} didn't check you again. Try once more.`);
         const key = randomBytes(24).toString("base64url");
         for (const [one, value] of ssoHandoffs)
@@ -650,7 +688,7 @@ export function createPeopleHandlers(runtime) {
                 ssoHandoffs.delete(one);
         while (ssoHandoffs.size >= 1000)
             ssoHandoffs.delete(ssoHandoffs.keys().next().value);
-        ssoHandoffs.set(key, { claims: verified.claims, issuer: held.provider.issuer, intent: held.intent, returnTo: held.returnTo, expires: Date.now() + 60_000 });
+        ssoHandoffs.set(key, { claims: verified.claims, issuer: held.provider.issuer, intent: held.intent, returnTo: held.returnTo, expires: Date.now() + 60_000, checkedAt, session: held.session });
         const to = `/login/sso/finish?h=${key}`;
         response.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "x-frame-options": "DENY",
             // The hand-off key is this browser's alone, like the visit's state: its cookie rides to /login/sso/finish.

package/dist/server/remote-hooks.js

@@ -1,5 +1,5 @@
 import { adapterPolicy } from "./route-policy.js";
-import { flowFormPage, FORM_PATH, HOOK_PATH, receiveFlowForm, receiveFlowHook } from "../flow-triggers.js";
+import { flowFormPage, FORM_PATH, HOOK_PATH, hookRefusedUnread, receiveFlowForm, receiveFlowHook } from "../flow-triggers.js";
 import { keepPushedUpdate, loadBotToken, pushedByTelegram, telegramHookSecret } from "../telegram.js";
 /** Flow webhooks (v82): the one road a public relay may expose. The secret
  * address proves nothing about the sender on its own for GitHub and Linear:
@@ -48,15 +48,21 @@ export async function telegramHook(ctx, request, response) {
 }
 export async function flowHook(ctx, request, response, url) {
     const { store, options, clock } = ctx;
-    const reply = (status, said) => { response.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" }); response.end(JSON.stringify({ said })); request.resume(); };
+    const reply = (status, said, retryAfter) => {
+        response.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store", ...(retryAfter === undefined ? {} : { "retry-after": String(retryAfter) }) });
+        response.end(JSON.stringify({ said }));
+        request.resume();
+    };
     if (url.pathname.startsWith(FORM_PATH))
         return flowForm(ctx, request, response, url);
     if (options.configDir === undefined || !url.pathname.startsWith(HOOK_PATH))
         return reply(404, "No such address.");
     if (request.method !== "POST")
         return reply(405, "Send a POST.");
+    // Refused before it is read (v126): it still counts toward its address's minute, as anything unproven does.
+    const refused = (status, said) => { const over = hookRefusedUnread(store, url.pathname.slice(HOOK_PATH.length), clock()); return over === null ? reply(status, said) : reply(over.status, over.said, over.retryAfter); };
     if (Number(request.headers["content-length"] ?? 0) > 1_000_000)
-        return reply(413, "Too large.");
+        return refused(413, "Too large.");
     const chunks = [];
     try {
         await new Promise((resolve, reject) => {
@@ -70,11 +76,11 @@ export async function flowHook(ctx, request, response, url) {
         });
     }
     catch (error) {
-        return reply(error instanceof Error && error.message === "too-large" ? 413 : 400, "Couldn't read that.");
+        return refused(error instanceof Error && error.message === "too-large" ? 413 : 400, "Couldn't read that.");
     }
     try {
-        const answer = receiveFlowHook(store, url.pathname.slice(HOOK_PATH.length), { headers: request.headers, body: Buffer.concat(chunks) }, options.configDir, clock());
-        return reply(answer.status, answer.said);
+        const answer = receiveFlowHook(store, url.pathname.slice(HOOK_PATH.length), { headers: request.headersDistinct, body: Buffer.concat(chunks) }, options.configDir, clock());
+        return reply(answer.status, answer.said, answer.retryAfter);
     }
     catch {
         return reply(500, "Not saved.");

package/dist/server/remote.d.ts

@@ -1,3 +1,4 @@
+import { type FreshFacts } from "../scope.js";
 /** tasks handlers, moved without changing their route bodies. */
 import { type IncomingMessage } from "node:http";
 import { CodingWorkspace } from '../coding-workspace.js';
@@ -45,11 +46,11 @@ export interface RemoteRuntime {
     managedRepos: () => string[];
     joinSourceOf: (request: IncomingMessage) => string;
     ssoSettings: () => import("../oidc.js").OidcSettings | null;
-    SSO_FRESH_MS: number;
     oauthTokenBudget: SourceAdmission;
     hookContext: RemoteHookContext;
     teamsSourceBudget: SourceAdmission;
     teamsTenantBudget: SourceAdmission;
+    freshFactsOf: (request: IncomingMessage, who: Who | null) => FreshFacts | null;
 }
 export declare function createRemoteHandlers(runtime: RemoteRuntime): {
     registrations: import("./handler-registry.js").Registration[];