toolroll 0.9.63 → 0.9.67

package/dist/server/remote.js

@@ -1,3 +1,4 @@
+import { credentialProof, freshFacts, proveAccountNow, ssoNowAvailable } from "../scope.js";
 import { handlersOf } from './handler-registry.js';
 /** tasks handlers, moved without changing their route bodies. */
 import {} from "node:http";
@@ -8,7 +9,6 @@ import { createOAuthHttp, resourceMetadataUrl } from "../mcp-oauth.js";
 import { reproveRemote } from "../operate-remote.js";
 import { rowVisible } from "../project.js";
 import { RequestBudget, SourceAdmission } from "../request-budget.js";
-import { authenticateAccount } from "../scope.js";
 import { createSessionRunner } from '../session-remote.js';
 import {} from "../store.js";
 import { handleTeamHttp, TEAM_PASSWORD_REVERIFY_MS } from '../team-http.js';
@@ -17,7 +17,7 @@ import { flowHook, telegramHook } from "./remote-hooks.js";
 import { respond } from "./http.js";
 import {} from "./session.js";
 export function createRemoteHandlers(runtime) {
-    const { identify, store, admitPasswordSource, admitBearer, allowedHost, team, teamBrowserReply, requestBudget, options, coding, codingProjects, liveCeiling, clock, evidenceRoot, consoleOrigin, managedRepos, joinSourceOf, ssoSettings, SSO_FRESH_MS, oauthTokenBudget, hookContext, teamsSourceBudget, teamsTenantBudget } = runtime;
+    const { identify, store, admitPasswordSource, admitBearer, allowedHost, team, teamBrowserReply, requestBudget, options, coding, codingProjects, liveCeiling, clock, evidenceRoot, consoleOrigin, managedRepos, joinSourceOf, ssoSettings, oauthTokenBudget, hookContext, teamsSourceBudget, teamsTenantBudget } = runtime;
     /**
      * The full principal a live `so_` API token stands for: its person and their generation, the token's own read/act
      * scope, its project limit narrowed by the person's current access, and its id. Every route that accepts an API token
@@ -119,8 +119,9 @@ export function createRemoteHandlers(runtime) {
             const who = identify(request, false);
             if (who === null || who.via !== "cookie")
                 return null;
-            return { name: who.name, role: who.role, csrf: who.session.csrf,
-                sso: who.session.sso === undefined ? null : { label: ssoSettings()?.label ?? "your identity provider", fresh: Date.now() - who.session.sso.at < SSO_FRESH_MS } };
+            return { name: who.name, role: who.role, csrf: who.session.csrf, generation: who.session.generation,
+                sso: who.session.sso === undefined ? null : { label: ssoSettings()?.label ?? "your identity provider",
+                    fresh: freshFacts.run(runtime.freshFactsOf(request, who), () => ssoNowAvailable(who.name)) } };
         },
         sameSite: request => {
             const origin = request.headers.origin, referer = request.headers.referer;
@@ -129,7 +130,15 @@ export function createRemoteHandlers(runtime) {
         },
         // The step-up for a credential: the person's password, or (empty) a fresh identity-provider check. What they may
         // grant (their role, their projects) is checked beside it.
-        confirm: (session, typed) => typed === "" ? session.sso?.fresh === true : authenticateAccount(store, session.name, typed).ok,
+        // Proved on this request's live session at the moment of consent (signed in here still, same generation), through
+        // the one account step-up: a password typed now, or an explicit re-check (spent). Never a remembered password.
+        confirm: (request, session, typed) => {
+            const who = identify(request, false);
+            if (who === null || who.via !== "cookie" || who.name !== session.name || who.session.generation !== session.generation)
+                return false;
+            // Connecting an outside app is a credential act: never a session (Passwordless) or a remembered password.
+            return freshFacts.run(runtime.freshFactsOf(request, who), () => { const proved = proveAccountNow(store, who.name, typed, { credential: true }); return proved.ok && credentialProof(proved.method); });
+        },
         projectsFor: account => store.knownRepos().filter(repo => store.accountCanAccess(account, repo)).sort(),
         admitToken: request => oauthTokenBudget.admit(joinSourceOf(request)),
     });

package/dist/server/render-chat.d.ts

@@ -1,3 +1,5 @@
+/** The conversation: chat and lead pages, proposal cards and the task chat. */
+import type { TaskOrigin } from "../task-source.js";
 import { type AssignmentSnapshot } from "../assignment.js";
 import { type BrowserActionCard } from "../browser-workspace.js";
 import { type ChatDraft } from "../converse.js";
@@ -10,6 +12,7 @@ import { type TaskControlView } from "../task-control.js";
 import { type TeamChatProviderResolver } from "../team-chat-authorization.js";
 import { type TeamSnapshot } from "../team-contract.js";
 import { type DisplayStatus } from "../workspace-ui.js";
+import type { LeadQueueRow } from "../lead-queue.js";
 import { type Html } from "../html.js";
 import { type Chrome, type Screen } from "./chrome.js";
 import { type ProjectPeek } from "./render-pages.js";
@@ -77,6 +80,8 @@ export type TaskChatFocus = {
             label: string;
             filedAgo: string | null;
         } | null;
+        /** v126: where the work came from (an outside event's line of context). */
+        origin?: TaskOrigin | null;
         /** The repair chain row when this task is a machine-drafted repair. */
         repairChain: RepairChainRow | null;
     } | null;
@@ -214,7 +219,7 @@ export declare function chatPage(chrome: Chrome, data: {
     /** Chat's first run is on the page: it already says what to do while there is no lead. */
     firstRunShown?: boolean;
 }): Screen;
-export declare function chatAckPage(chrome: Chrome, turn: ChatTurn, nonce: string): Screen;
+export declare function chatAckPage(chrome: Chrome, turn: ChatTurn, nonce: string, reply?: LeadTurn | null): Screen;
 /** The card that starts a conversation: the one password ceremony (mate arc §1). */
 export declare function leadMintCard(enabled: {
     billing: "metered" | "subscription";
@@ -301,19 +306,23 @@ export type LeadThreadRows = {
     focusTask: TaskChatFocus | null;
     /** The lead's open question to this reader, drawn as buttons under its reply. */
     ask?: LeadAsk | null;
+    /** The turn whose question the task has moved past: shown without buttons, marked out of date. */
+    staleAsk?: number | null;
     /** Every question the lead asked in these messages, by turn: answered ones show their words without buttons. */
     asks?: Map<number, LeadAsk>;
+    /** The person's lead queue rows for these messages, by message id (docs/plans/lead-message-queue.md). */
+    queue?: Map<number, LeadQueueRow>;
 };
 /** The lead's question as buttons: each option sends itself as the next message (the same POST as a typed one);
  * "Something else" moves to the composer. Nothing shows while a reply is running. */
 export declare function leadAskHtml(ask: LeadAsk, target: {
     task: string | null;
     project: string | null;
-}, composer: string, open?: boolean): Html;
+}, composer: string, open?: boolean, stale?: boolean): Html;
 /** The thread's messages as the React conversation renders them, each
  * with the proposal cards its turn produced; `back` is where a card's
  * confirm or dismiss returns. */
-export declare function leadBrowserMessages(rows: Pick<LeadThreadRows, "messages" | "proposals" | "decisions" | "pending" | "ask" | "asks">, back: string | null, target?: {
+export declare function leadBrowserMessages(rows: Pick<LeadThreadRows, "messages" | "proposals" | "decisions" | "pending" | "ask" | "staleAsk" | "asks" | "queue">, back: string | null, target?: {
     task: string | null;
     project: string | null;
 }): import("../browser-workspace.js").BrowserMessage[];

package/dist/server/render-chat.js

@@ -1,4 +1,3 @@
-/** The conversation: chat and lead pages, proposal cards and the task chat. */
 import { assignmentSummaryHtml } from "../assignment-ui.js";
 import {} from "../assignment.js";
 import {} from "../browser-workspace.js";
@@ -27,7 +26,7 @@ import { assignmentStageOf, stageOfCode } from "../task-status.js";
 import {} from "../team-chat-authorization.js";
 import {} from "../team-contract.js";
 import { buildProgressOf } from "../workspace-ui.js";
-import { html, htmlString, isHtml, joinHtml, postForm, replaceMarkup } from "../html.js";
+import { html, htmlString, isHtml, joinHtml, postForm, replaceMarkup, reauth } from "../html.js";
 import { requestContext, withFormToken } from "./request-context.js";
 import { createHash, randomBytes } from "node:crypto";
 import { chatMoney, oneLineOf, relativeAge, safePrUrl, screen, sentenceCase, strokeIcon } from "./chrome.js";
@@ -90,7 +89,9 @@ export function taskChatApproval(focus, csrf) {
         repairChain: approval.repairChain,
         route: focus.route,
         coordinator: approval.coordinator,
+        origin: approval.origin ?? null,
         deliverable: approval.deliverable,
+        rebuild: focus.assignment?.need != null && "key" in focus.assignment.need && focus.assignment.need.key === "replan" ? focus.assignment.need.build : null,
         // Edit plan opens the task page's sheet with its fields open for editing.
         editHref: `${taskHref(focus.id)}?edit=plan#plan-editor`,
         notNowHref: "/chat",
@@ -116,12 +117,15 @@ export function taskChatLiveRegion(focus, csrf, fragment = false, inert = false,
         : fragment && focus.approval !== null && focus.plan !== "requested"
             ? html `<section class="card chat-action-card chat-refresh-action"><a class="button-link" href="${approvalHref}" data-primary-action>Approve plan</a></section>`
             : taskChatApproval(focus, csrf));
-    const approvalCard = focus.approval !== null && focus.dispatch?.action !== "approve-scope"
+    // The approval leads when dispatch waits on it or the plan was rewritten after a build (the assignment's one action).
+    const approvalLeads = focus.dispatch?.action === "approve-scope" ||
+        (focus.assignment?.primaryAction?.code === "approve-scope" && focus.assignment.primaryAction.target.taskId === focus.executionId);
+    const approvalCard = focus.approval !== null && !approvalLeads
         ? html `<details class="task-secondary-approval"><summary>Updated approval terms</summary>${approvalContent}</details>` : approvalContent;
     const polling = !inert && ((focus.approval === null || focus.plan === "requested") && focus.state !== "done" && focus.state !== "cancelled" || focus.control.kind === "stopping" || focus.control.kind === "stop");
     const status = focus.assignment !== null
-        ? html `${assignmentSummaryHtml(focus.assignment, { workStatus: focus.status, hideAction: focus.approval !== null && focus.dispatch?.action === "approve-scope", sentence: chatStatusSentence(focus), ...(receiptLeads ? { resultHref: chatResultHref(focus.id, focus.result.runId) } : {}) })}${receiptLeads ? completionReceiptCard(focus.result, focus.id, "chat", focus.status, focus.assignment, false) : ""}`
-        : receiptLeads ? completionReceiptCard(focus.result, focus.id, "chat", focus.status) : taskStatusCard(focus.status, focus.id, focus.dispatch, focus.liveRun?.id ?? null, focus.approval !== null && focus.dispatch?.action === "approve-scope");
+        ? html `${assignmentSummaryHtml(focus.assignment, { workStatus: focus.status, hideAction: focus.approval !== null && approvalLeads, sentence: chatStatusSentence(focus), ...(receiptLeads ? { resultHref: chatResultHref(focus.id, focus.result.runId) } : {}) })}${receiptLeads ? completionReceiptCard(focus.result, focus.id, "chat", focus.status, focus.assignment, false) : ""}`
+        : receiptLeads ? completionReceiptCard(focus.result, focus.id, "chat", focus.status) : taskStatusCard(focus.status, focus.id, focus.dispatch, focus.liveRun?.id ?? null, focus.approval !== null && approvalLeads);
     const publication = focus.publication;
     const prUrl = publication === null ? null : safePrUrl(publication.prUrl);
     return html `<section id="task-chat-live" aria-live="polite" data-task="${focus.id}" data-execution="${focus.executionId}" data-source="/chat/task-status?task=${encodeURIComponent(focus.id)}" data-poll="${polling ? "1" : "0"}" data-approval="${focus.approval?.digest ?? ""}" data-plan="${focus.plan ?? ""}">${focus.guide === true && focus.state !== "cancelled" ? firstTaskJourneyHtml(focus) : ""}<div class="task-live-summary">${status}${checkProgressHtml(focus.checkProgress)}${
@@ -406,12 +410,12 @@ export function chatPage(chrome, data) {
     const candidates = data.chat === null ? [] : [...data.chat.candidates.values()];
     for (const one of candidates) {
         const draft = one.draft;
-        parts.push(html `<div class="card"><p><strong>${draft.title}</strong> <span class="badge">Draft ${draft.kind}</span></p><p class="meta">Drafted by the model from fleet context — nothing is filed; drafts do not survive a restart</p><p style="white-space:pre-wrap">${draft.goal}</p>${draft.outOfScope === null ? "" : html `<p class="meta">Not: ${draft.outOfScope}</p>`}${draft.touches.length > 0 ? html `<p class="meta">Touches: ${draft.touches.join(", ")}</p>` : ""}<p class="meta">Repo: <span class="mono">${projectName(one.repoPath)}</span></p>${postForm(`/chat/file/${one.key}`, html `<input type="password" name="token" placeholder="your password" autocomplete="current-password"><button type="submit">File unapproved</button>`, { attrs: { class: "inline" } })}</div>`);
+        parts.push(html `<div class="card"><p><strong>${draft.title}</strong> <span class="badge">Draft ${draft.kind}</span></p><p class="meta">Drafted by the model from fleet context — nothing is filed; drafts do not survive a restart</p><p style="white-space:pre-wrap">${draft.goal}</p>${draft.outOfScope === null ? "" : html `<p class="meta">Not: ${draft.outOfScope}</p>`}${draft.touches.length > 0 ? html `<p class="meta">Touches: ${draft.touches.join(", ")}</p>` : ""}<p class="meta">Repo: <span class="mono">${projectName(one.repoPath)}</span></p>${postForm(`/chat/file/${one.key}`, html `${reauth(html `<input type="password" name="token" placeholder="your password" autocomplete="current-password">`)}<button type="submit">File unapproved</button>`, { attrs: { class: "inline" } })}</div>`);
     }
     if (!subscription && data.canManage && data.focusTask === null) {
         parts.push(html `<h2>Ask</h2>`, postForm("/chat", joinHtml([
             html `<label>Message<textarea name="message" rows="3" maxlength="2000"></textarea></label>`,
-            html `<label>Your password <span class="meta">(every message — chat spends)</span><input type="password" name="token" autocomplete="current-password"></label>`,
+            html `${reauth(html `<label>Your password <span class="meta">(every message — chat spends)</span><input type="password" name="token" autocomplete="current-password"></label>`)}`,
             html `<button type="submit">Ask</button>`,
         ], "\n"), { attrs: { class: "card" } }));
     }
@@ -423,15 +427,20 @@ export function chatPage(chrome, data) {
     }
     return screen("chat", chatWorkspace(joinHtml(parts, "\n"), data.projects, true, data.focusTask, data.resultPanel ?? null), { chrome, functional: { script: CHAT_UI_SCRIPT + (data.focusTask === null ? "" : RESULT_REVIEW_SCRIPT), fetches: data.focusTask !== null } });
 }
-export function chatAckPage(chrome, turn, nonce) {
+export function chatAckPage(chrome, turn, nonce, reply = null) {
+    // A lead reply's step reserves nothing itself: the reply set the money aside, and a reply whose cost is unknown has
+    // already counted that whole amount against its conversation. Say that amount, never the step's zero.
+    const replyCharge = reply === null ? null : reply.settledMicrousd ?? reply.reservedMicrousd;
     return screen("chat", joinHtml([
         html `<h1>Unknown spend</h1>`,
         html `<div class="card">`,
         html `<p>Turn <span class="mono">#${turn.id}</span> on <span class="mono">${turn.provider} · ${turn.model}</span> may have started before it failed (${turn.failureReason ?? "crashed"}), and its cost could not be measured.</p>`,
-        html `<p><strong>Acknowledging charges the reserved worst case, ${chatMoney(turn.reservedMicrousd)}, to the ledger and re-enables chat on this credential.</strong></p>`,
+        replyCharge === null
+            ? html `<p><strong>Acknowledging charges the reserved worst case, ${chatMoney(turn.reservedMicrousd)}, to the ledger and re-enables chat on this credential.</strong></p>`
+            : html `<p><strong>This lead reply's worst case, ${chatMoney(replyCharge)}, has already been counted against its conversation. Acknowledging adds nothing more and re-enables chat on this credential.</strong></p>`,
         html `<p class="meta">Check the provider's own usage dashboard if you want the exact figure first; the ledger keeps whichever is known.</p>`,
         postForm(`/chat/ack/${turn.id}`, joinHtml([
-            html `<label>Your password<input type="password" name="token" autocomplete="current-password"></label>`,
+            html `${reauth(html `<label>Your password<input type="password" name="token" autocomplete="current-password"></label>`)}`,
             html `<button type="submit">Accept the charge — re-enable chat</button>`,
         ], "\n"), { hidden: { nonce } }),
         html `</div>`,
@@ -752,9 +761,26 @@ export function replacedThreadHtml(previous) {
         ? html `<div class="msg op" data-previous-message="${one.id}"><p style="white-space:pre-wrap">${one.text}</p></div>`
         : html `<div class="msg mate" data-previous-message="${one.id}">${renderChatText(one.text)}</div>`)}<p class="chat-previous-divider" role="separator" data-thread-divider>${REPLACED_THREAD_DIVIDER}</p></section>`;
 }
+/** A queued message's state under its words: waiting (with Remove), or why it was not sent. Nothing for one that ran.
+ * A div, not a p: the Remove form can't sit inside a paragraph (the parser would close it first). */
+function queuedStateHtml(row, back) {
+    if (row.status === "queued") {
+        const waiting = row.error?.startsWith("Waiting: ") === true ? row.error.slice("Waiting: ".length) : "It goes to the lead when it finishes.";
+        return html `<div class="so-queued" data-queued="${row.message}" data-queue-state="queued"><span class="so-queued-state">Queued</span> · ${waiting}${postForm(`/chat/queued/${row.message}/remove`, html `<button type="submit" class="so-queued-remove quiet">Remove</button>`, { attrs: { class: "inline" }, ...(back === null ? {} : { returnTo: back }) })}</div>`;
+    }
+    if (row.status === "running" && row.turnId === null)
+        return html `<div class="so-queued" data-queued="${row.message}" data-queue-state="starting"><span class="so-queued-state">Starting</span></div>`;
+    if (row.status === "cancelled" || row.status === "failed")
+        return html `<div class="so-queued" data-queued="${row.message}" data-queue-state="${row.status}"><span class="so-queued-state">Not sent</span> · ${row.error ?? "It was not sent."}</div>`;
+    if (row.status === "uncertain")
+        return html `<div class="so-queued" data-queued="${row.message}" data-queue-state="uncertain"><span class="so-queued-state">Not confirmed</span> · ${row.error ?? "Delivery could not be confirmed. Nothing was sent again."}</div>`;
+    return html ``;
+}
 /** The lead's question as buttons: each option sends itself as the next message (the same POST as a typed one);
  * "Something else" moves to the composer. Nothing shows while a reply is running. */
-export function leadAskHtml(ask, target, composer, open = true) {
+export function leadAskHtml(ask, target, composer, open = true, stale = false) {
+    if (stale)
+        return html `<div class="so-owner-ask" data-ask="${ask.turn}" data-ask-stale><p class="so-owner-ask-question"><strong>${ask.question}</strong></p><p class="so-owner-ask-stale">Out of date: the task changed after this was asked. Its status above says what it needs now.</p></div>`;
     if (!open)
         return html `<div class="so-owner-ask" data-ask="${ask.turn}"><p class="so-owner-ask-question"><strong>${ask.question}</strong></p></div>`;
     const hidden = target.task !== null ? { task: target.task } : target.project !== null ? { project: target.project } : {};
@@ -767,7 +793,7 @@ export function leadBrowserMessages(rows, back, target = { task: null, project:
     const open = rows.pending === null ? rows.ask?.turn ?? null : null;
     const asked = (turn) => {
         const ask = turn === null ? undefined : rows.asks?.get(turn);
-        return ask === undefined ? "" : leadAskHtml(ask, target, target.task === null ? "lead-message" : "task-message", ask.turn === open);
+        return ask === undefined ? "" : leadAskHtml(ask, target, target.task === null ? "lead-message" : "task-message", ask.turn === open, ask.turn === rows.staleAsk);
     };
     // The owner's message each reply answers: when it asked for ids, the reply keeps them.
     const askedBy = new Map();
@@ -776,7 +802,9 @@ export function leadBrowserMessages(rows, back, target = { task: null, project:
         askedBy.set(message.id, last); return last; }, undefined);
     return rows.messages.map(message => ({
         id: message.id, role: message.role, text: message.text,
-        html: htmlString(message.role === 'operator' ? html `<p>${message.text}</p>` : html `${renderChatText(message.text, askedBy.get(message.id))}${asked(message.turn)}`),
+        html: htmlString(message.role === 'operator'
+            ? (() => { const queued = rows.queue?.get(message.id); return html `${message.text === "" ? "" : html `<p>${message.text}</p>`}${queued === undefined ? "" : queuedStateHtml(queued, back)}`; })()
+            : html `${renderChatText(message.text, askedBy.get(message.id))}${asked(message.turn)}`),
         activity: message.activity, createdAt: message.createdAt,
         ...(() => {
             // Under the lead's message only, as the server-rendered thread does: the person's message shares the turn.
@@ -796,6 +824,7 @@ export function leadChatVersion(rows) {
     const focus = rows.focusTask;
     const facts = [
         rows.messages.map(one => [one.id, one.role, one.turn]),
+        rows.queue === undefined ? null : [...rows.queue.values()].map(one => [one.message, one.status, one.revision, one.error]),
         rows.previous == null ? null : rows.previous.messages.map(one => one.id),
         rows.proposals.map(one => [one.id, one.state, one.outcome === null ? null : JSON.stringify(one.outcome)]),
         rows.coordinatorProposals.map(one => [one.id, one.state, one.outcome === null ? null : JSON.stringify(one.outcome)]),
@@ -851,7 +880,9 @@ export function leadThreadHtml(data) {
     for (const message of data.messages) {
         if (message.role === "operator") {
             asked = message.text;
-            thread.push(html `<div class="msg op" data-message-role="operator" data-key="m${message.id}"><p style="white-space:pre-wrap">${message.text}</p></div>`);
+            // A message that waits its turn (the lead queue) says so, with Remove while it still waits — as in the React thread.
+            const queued = data.queue?.get(message.id);
+            thread.push(html `<div class="msg op" data-message-role="operator" data-key="m${message.id}">${message.text === "" ? "" : html `<p style="white-space:pre-wrap">${message.text}</p>`}${queued === undefined ? "" : queuedStateHtml(queued, returnTo)}</div>`);
             continue;
         }
         const cards = message.turn === null ? [] : (byTurn.get(message.turn) ?? []);
@@ -917,7 +948,7 @@ export function leadPage(chrome, data) {
     // keyboard reaches it. Only this act moves the reader.
     html `<div class="chat-new-update-holder"><button type="button" class="chat-new-update" id="chat-new-update" hidden>New update ↓</button></div>`, postForm("/chat", joinHtml([
         html `<label>Message<textarea id="chat-message" name="message" rows="1" maxlength="${LEAD_MESSAGE_MAX_CHARS}" placeholder="${data.focusTask !== null ? "Ask about this task…" : chatProject !== null ? `Ask about ${projectName(chatProject)}…` : "Describe what you want done…"}"></textarea></label>`,
-        html `<button type="submit" aria-label="${data.pending === null ? "send message" : "wait for the current reply before sending"}"${data.pending === null ? "" : html ` disabled`}>Send</button>`,
+        html `<button type="submit" aria-label="${data.pending === null ? "send message" : "send message — it waits for the current reply"}">Send</button>`,
     ], "\n"), {
         attrs: { class: "card composer", id: latestReply === null && data.pending === null ? "latest" : "chat-composer", "aria-label": "message the lead", "data-chat-session": data.session.id, "data-chat-task": data.focusTask?.id ?? "", "data-chat-user": data.session.approver, "data-chat-busy": data.pending === null ? "0" : "1", "data-chat-version": leadChatVersion(data), "data-chat-approval": data.focusTask?.approval?.digest ?? "" },
         hidden: { request: randomBytes(16).toString("hex"), "request-session": data.session.id, task: data.focusTask?.id, project: chatProject, result: data.resultRunId },
@@ -925,7 +956,7 @@ export function leadPage(chrome, data) {
     // Concise pass (2026-09-13): the status line speaks only when there is
     // a state to report — a reply in progress here, the connection from
     // the continuity script — and the composer carries no second intro.
-    html `<p class="meta composer-hint" id="chat-connection" role="status" aria-live="polite">${data.pending === null ? "" : "Reply in progress. You can draft your next message or come back later."}</p>`, 
+    html `<p class="meta composer-hint" id="chat-connection" role="status" aria-live="polite">${data.pending === null ? "" : "Reply in progress. A message you send now waits its turn."}</p>`, 
     // The explicit reconnection (package 2): shown only once the session
     // or sign-in changed under this page; it reloads on the reader's act.
     html `<p class="meta composer-hint" id="chat-reconnect" hidden><button type="button" class="quiet">Reconnect</button></p>`, leadAfterComposerHtml(data), controlsHtml);

package/dist/server/render-pages.d.ts

@@ -1,4 +1,5 @@
 /** Everyday console pages: home, inbox, board, work, projects, fleet and the queue. */
+import { type TaskOrigin } from "../task-source.js";
 import { type Html } from "../html.js";
 import { type AssignmentSnapshot } from "../assignment.js";
 import { type BoardCard } from "../board.js";
@@ -145,14 +146,39 @@ export declare function systemPage(chrome: Chrome, data: {
     }[];
     now: Date;
 }): Screen;
+/**
+ * A build's stage as one of three steps — set up, writing, checking and
+ * committing — read from the machine's own phase, never a percent. The
+ * steps only move forward: evidence and proof checks run both before and
+ * after the commit (builder.ts), so everything after the agent's turn is
+ * one step, and the stage words say which part. Null for runs that are not
+ * builds (planning, review, investigation): those have no honest steps.
+ */
+export declare const BUILD_STEPS: readonly ["setting up", "writing", "checking and committing"];
+export declare function buildStepOf(claim: NonNullable<BoardCard["claim"]>): number | null;
+/**
+ * The workers a board's strip may show: not retired, bound to at least one
+ * project the server's ceiling admits (never a runner serving only projects
+ * this server must not speak about), and — on a one-project board — bound to
+ * that project.
+ */
+export declare function boardWorkers(runners: readonly Runner[], scope: {
+    all: boolean;
+    project: string | null;
+    visible: (repo: string) => boolean;
+}): Runner[];
 /**
  * The board: the pipeline as lanes, position as meaning — attention, then
- * queued, then waiting, then building, then recently done. Read-only by
- * construction (every card is a link, no forms, no nonces), which is what
- * makes it safe to re-render itself while somebody watches.
+ * queued, then waiting, then building, then recently done — under a strip
+ * of the workers doing it. Read-only by construction (every card is a link,
+ * no forms, no nonces), which is what makes it safe to re-render itself
+ * while somebody watches; a card that changes lane slides there
+ * (regionScript's animate swap, keyed by data-vt).
  */
 export declare function boardBody(data: {
     cards: BoardCard[];
+    /** The workers this board's work can go to (retired ones left out). */
+    workers: readonly Runner[];
     done: ReturnType<Store["listCompletedWorkScoped"]>;
     saturated: boolean;
     now: Date;
@@ -360,7 +386,7 @@ export declare function portfolioOverview(data: {
         startedAt: string;
         ranMinutes: number | null;
         costUsd: number | null;
-        authMode: "subscription" | "api-key" | null;
+        authMode: "subscription" | "api-key" | "agent-login" | null;
         prNumber: number | null;
         prUrl: string | null;
     }[];
@@ -519,6 +545,8 @@ export declare function nextPage(chrome: Chrome, data: {
     deliverable?: "branch" | "report";
     /** v48: the agents the yes freezes — the one block every ceremony shows. */
     route: RouteView | null;
+    /** v126: where the work came from (an outside event's line of context, never a term agreed to). */
+    origin?: TaskOrigin | null;
     csrf: string;
     nonce: string;
     remaining: number;

package/dist/server/render-pages.js

@@ -1,5 +1,6 @@
 /** Everyday console pages: home, inbox, board, work, projects, fleet and the queue. */
-import { html, htmlString, joinHtml, postForm, replaceMarkup } from "../html.js";
+import { originNote } from "../task-source.js";
+import { html, htmlString, joinHtml, postForm, replaceMarkup, reauth } from "../html.js";
 import {} from "../assignment.js";
 import {} from "../board.js";
 import { browserWorkActionHref } from "../browser-workspace.js";
@@ -206,11 +207,74 @@ export function systemPage(chrome, data) {
                     : html `<span class="meta">syncing normally</span>`}</p>`), "\n")}`,
     ], "\n"), { chrome, refreshSeconds: data.building.length > 0 ? 10 : 60 });
 }
+/**
+ * A build's stage as one of three steps — set up, writing, checking and
+ * committing — read from the machine's own phase, never a percent. The
+ * steps only move forward: evidence and proof checks run both before and
+ * after the commit (builder.ts), so everything after the agent's turn is
+ * one step, and the stage words say which part. Null for runs that are not
+ * builds (planning, review, investigation): those have no honest steps.
+ */
+export const BUILD_STEPS = ["setting up", "writing", "checking and committing"];
+export function buildStepOf(claim) {
+    if (claim.role === "planner" || claim.role === "reviewer" || claim.role === "scout")
+        return null;
+    if (claim.model === null)
+        return 0;
+    if (claim.phase === null || claim.phase === "agent-running")
+        return 1;
+    return 2;
+}
+/** A clock that ticks in the page (boardTickScript) from the server's own start time; the text is the no-script answer. */
+function tickingClock(startedIso, now) {
+    const minutes = Math.max(0, Math.round((now.getTime() - new Date(startedIso).getTime()) / 60_000));
+    return html `<time class="clock" datetime="${startedIso}" data-tick>${minutes}m</time>`;
+}
+/**
+ * The workers a board's strip may show: not retired, bound to at least one
+ * project the server's ceiling admits (never a runner serving only projects
+ * this server must not speak about), and — on a one-project board — bound to
+ * that project.
+ */
+export function boardWorkers(runners, scope) {
+    return runners.filter(runner => runner.retiredAt === null &&
+        runner.repos.some(repo => scope.visible(repo)) &&
+        (scope.all || scope.project === null || runner.repos.includes(scope.project)));
+}
+/**
+ * The worker strip across the top of the board: every worker this board's
+ * work can go to, what it is building here, and its stage and clock. Only
+ * builds the board already shows are named — a worker busy in a project
+ * this reader cannot see reads "no build on this board", never "free".
+ */
+function workerStrip(runners, cards, now) {
+    if (runners.length === 0)
+        return html `<p class="meta crew-empty">No workers yet — work waits in the queue until one joins.</p>`;
+    const tiles = runners.map(runner => {
+        const builds = cards
+            .filter(card => card.lane === "building" && card.claim !== null && card.claim.runner === runner.name)
+            .sort((a, b) => a.claim.claimedAt.localeCompare(b.claim.claimedAt));
+        const online = runnerAlive(runner, now);
+        const state = !online ? "offline" : builds.length > 0 ? "busy" : "idle";
+        const dot = state === "busy" ? html `<span class="dot dot-ok pulse"></span>` : html `<span class="dot dot-off"></span>`;
+        const jobs = builds.length > 0
+            ? builds.map(card => {
+                const claim = card.claim;
+                const words = claim.model === null ? "preparing workspace" : claim.phase === null ? "the agent is working" : phaseWords(claim.phase);
+                return html `<a class="worker-job" href="${card.href}"><span class="t">${card.title}</span><span class="sub"><span>${words}</span>${tickingClock(claim.claimedAt, now)}</span></a>`;
+            })
+            : html `<p class="worker-job idle">${online ? "no build on this board" : html `offline since ${whenTime(runner.heartbeatAt)}`}</p>`;
+        return html `<div class="worker worker-${state}" data-flash="${runner.name}" data-flash-value="${builds.map(card => card.taskId).join(" ")}"><div class="worker-head">${dot}<span class="name">${runner.name}</span><span class="kind">${runner.agents.join(" · ")}</span>${runner.capacity > 1 ? html `<span class="slots">${builds.length}/${runner.capacity}</span>` : null}</div>${jobs}</div>`;
+    });
+    return html `<section class="crew" aria-label="Workers">${tiles}</section>`;
+}
 /**
  * The board: the pipeline as lanes, position as meaning — attention, then
- * queued, then waiting, then building, then recently done. Read-only by
- * construction (every card is a link, no forms, no nonces), which is what
- * makes it safe to re-render itself while somebody watches.
+ * queued, then waiting, then building, then recently done — under a strip
+ * of the workers doing it. Read-only by construction (every card is a link,
+ * no forms, no nonces), which is what makes it safe to re-render itself
+ * while somebody watches; a card that changes lane slides there
+ * (regionScript's animate swap, keyed by data-vt).
  */
 export function boardBody(data, ciRed) {
     const chip = (repo) => !data.all || repo === null ? null : html `<span class="badge">${projectName(repo)}</span>`;
@@ -260,7 +324,7 @@ export function boardBody(data, ciRed) {
         const kept = parts.filter((one) => one !== null);
         return kept.length === 0 ? null : html `<span class="chips">${joinHtml(kept, " ")}</span>`;
     };
-    const plain = (card) => html `<a class="lane-card" href="${card.href}"><span class="id">${card.taskId}</span><span class="t">${card.title}</span><span class="why">${card.reason}</span>${facts([
+    const plain = (card) => html `<a class="lane-card" href="${card.href}" data-vt="${card.taskId}"><span class="id">${card.taskId}</span><span class="t">${card.title}</span><span class="why">${card.reason}</span>${facts([
         ...(card.stalledSince === null ? [] : [["waiting", age(card.stalledSince)]]),
     ])}${chips([
         chip(card.repo),
@@ -278,7 +342,7 @@ export function boardBody(data, ciRed) {
         }
         return heads;
     })();
-    const queuedCard = (card) => html `<a class="lane-card" href="${card.href}"><span class="id">${card.taskId}</span><span class="t">${card.title}</span><span class="why">${card.reason}</span>${facts([
+    const queuedCard = (card) => html `<a class="lane-card" href="${card.href}" data-vt="${card.taskId}"><span class="id">${card.taskId}</span><span class="t">${card.title}</span><span class="why">${card.reason}</span>${facts([
         ["worker", card.assignedRunner === null ? "any free worker" : card.assignedRunner],
     ])}${chips([
         queuedHeads.get(`${card.assignedRunner ?? ""}|${card.repo ?? ""}`) === card.taskId
@@ -291,14 +355,19 @@ export function boardBody(data, ciRed) {
         const claim = card.claim;
         if (claim === null)
             return plain(card);
-        const minutes = Math.max(1, Math.round((data.now.getTime() - new Date(claim.claimedAt).getTime()) / 60_000));
         const workspace = claim.worktree === null ? null : (claim.worktree.split("/").pop() ?? claim.worktree);
         // Chip copy: unknown phases show nothing rather than raw tokens.
         const phase = claim.phase === null ? undefined : PHASE_WORDS[claim.phase];
         // The live strip is the run's own phase and clock — never a percent:
         // a build has no honest progress figure, only a stage and an elapsed.
         const live = claim.model === null ? "preparing workspace" : (phase ?? "the agent is working");
-        return html `<a class="lane-card building" href="${card.href}"><span class="id">${card.taskId}</span><span class="t"><span class="dot dot-ok pulse"></span>${card.title}</span><span class="live-line"><span class="stage">${live}</span><span class="clock">${minutes}m</span></span>${facts([
+        // The steps: where the build is among set up → writing → checking →
+        // committing, from its phase — a stage, never a percent.
+        const step = buildStepOf(claim);
+        const steps = step === null
+            ? null
+            : html `<span class="steps" role="img" aria-label="${`step ${step + 1} of ${BUILD_STEPS.length}: ${BUILD_STEPS[step]}`}">${BUILD_STEPS.map((_, index) => html `<i class="${index < step ? "on" : index === step ? "now" : ""}"></i>`)}</span>`;
+        return html `<a class="lane-card building" href="${card.href}" data-vt="${card.taskId}"><span class="id">${card.taskId}</span><span class="t"><span class="dot dot-ok pulse"></span>${card.title}</span>${steps}<span class="live-line"><span class="stage">${live}</span>${tickingClock(claim.claimedAt, data.now)}</span>${facts([
             ["worker", claim.runner],
             ...(claim.model === null
                 ? []
@@ -315,7 +384,7 @@ export function boardBody(data, ciRed) {
             const pr = row.prNumber === null
                 ? null
                 : html `<span class="badge badge-open">PR #${row.prNumber}</span>${ciRed(row.prNumber) ? html ` <span class="badge badge-failed">CI failing</span>` : null}`;
-            return html `<a class="lane-card" href="${taskHref(row.taskId)}"><span class="id">${row.taskId}</span><span class="t">${row.title}</span>${row.handoff === null ? null : html `<span class="why">${row.handoff.length > 120 ? row.handoff.slice(0, 120) + "…" : row.handoff}</span>`}${facts([
+            return html `<a class="lane-card" href="${taskHref(row.taskId)}" data-vt="${row.taskId}"><span class="id">${row.taskId}</span><span class="t">${row.title}</span>${row.handoff === null ? null : html `<span class="why">${row.handoff.length > 120 ? row.handoff.slice(0, 120) + "…" : row.handoff}</span>`}${facts([
                 ...(row.ranMinutes === null ? [] : [["ran", `${row.ranMinutes}m`]]),
                 ["usage", runCostWords({ authMode: row.authMode, costUsd: row.costUsd, tokensIn: null, tokensOut: null })],
             ])}${chips([
@@ -346,7 +415,8 @@ export function boardBody(data, ciRed) {
         data.all ? null : html `<p class="meta board-view"><strong>State</strong> · <a href="/board?view=order">order →</a> <span class="meta">drag to reorder, or to reserve a task for one worker</span></p>`,
         deltaLine,
         toggle,
-        html `<div class="board">`,
+        workerStrip(data.workers, data.cards, data.now),
+        html `<div class="board" data-now="${String(data.now.getTime())}">`,
         lane("attention", "needs you", "these wait for a person", plain),
         lane("queued", "queued", "starts when a worker is free", queuedCard),
         lane("waiting", "waiting", "paused until a time, another task, or a requirement is ready", plain),
@@ -912,7 +982,7 @@ export function projectsPage(chrome, recent, candidates, open, problem, _unscope
                             onboard.record[1].large
                                 ? html `<label class="row"><input type="checkbox" name="big-ok" value="1"> this is a large repository (or its size is unknown) — clone it anyway</label>`
                                 : null,
-                            html `<label>Your password, typed again <input type="password" name="token" autocomplete="current-password"></label>`,
+                            html `${reauth(html `<label>Your password, typed again <input type="password" name="token" autocomplete="current-password"></label>`)}`,
                             html `<div class="sticky-actions"><button type="submit">Clone and open</button></div>`,
                         ], "\n"), { hidden: { nonce: onboard.record[0] } }),
                         html `</div>`,
@@ -1258,11 +1328,11 @@ export function nextPage(chrome, data) {
         card =
             html `<h1>${item.approval.taskId}</h1><p>${item.approval.title}</p>${data.planDocument === null
                 ? null
-                : html `<div class="card"><p><strong>The plan</strong> <span class="meta">drafted by a planning session</span></p>${executionPlanHtml(data.planDocument, true)}${planContractHtml(data.planContract ?? null, "ceremony")}</div>`}${postForm(`${taskHref(item.approval.taskId)}/approve`, html `<p><strong>Approve exactly this:</strong></p>${data.deliverable === "report" ? html `<p class="meta"><span class="badge">Scout</span> a read-only session investigates this goal and delivers a report — no branch, nothing changes in the repository</p>` : null}${scope === null || scope.profileState !== "unresolved" ? null : profileWords(scope)}<p class="meta">Goal</p><p class="recap" style="margin-top:0">${scope?.goal ?? item.approval.goal}</p><p class="meta">Not this</p><p class="recap" style="margin-top:0">${scope?.outOfScope == null ? html `<em>no exclusions</em>` : scope.outOfScope}</p><p class="meta">Touches · ${scope === null || scope.touches.length === 0 ? "anything" : joinHtml(scope.touches, ", ")}</p>${scope === null ? null : acceptanceCeremonyHtml(scope.acceptance)}${
+                : html `<div class="card"><p><strong>The plan</strong> <span class="meta">drafted by a planning session</span></p>${executionPlanHtml(data.planDocument, true)}${planContractHtml(data.planContract ?? null, "ceremony")}</div>`}${postForm(`${taskHref(item.approval.taskId)}/approve`, html `<p><strong>Approve exactly this:</strong></p>${data.deliverable === "report" ? html `<p class="meta"><span class="badge">Scout</span> a read-only session investigates this goal and delivers a report — no branch, nothing changes in the repository</p>` : null}${scope === null || scope.profileState !== "unresolved" ? null : profileWords(scope)}${originNote(data.origin) === null ? null : html `<p class="meta" data-approval-origin>${originNote(data.origin)}</p>`}<p class="meta">Goal</p><p class="recap" style="margin-top:0">${scope?.goal ?? item.approval.goal}</p><p class="meta">Not this</p><p class="recap" style="margin-top:0">${scope?.outOfScope == null ? html `<em>no exclusions</em>` : scope.outOfScope}</p><p class="meta">Touches · ${scope === null || scope.touches.length === 0 ? "anything" : joinHtml(scope.touches, ", ")}</p>${scope === null ? null : acceptanceCeremonyHtml(scope.acceptance)}${
             // The AGENTS the yes freezes (v48): the same concise block the task
             // page and chat sign under, before the password — runtime limits one
             // tap away, never in the way.
-            agentsCeremonyHtml(data.route)}${scope === null ? null : runtimeDetailsHtml(scope)}<label>Your password, typed again — a signed-in session alone cannot agree to work<input type="password" name="token" autocomplete="current-password"></label><div class="sticky-actions"><button type="submit">Approve this scope</button></div>`, { attrs: { class: "card approve-form" }, returnTo: "next", hidden: { nonce: data.nonce, digest: data.approvalDigest ?? item.approval.digest } })}<p class="meta"><a href="${taskHref(item.approval.taskId)}">open the full task</a> to edit the scope first</p>`;
+            agentsCeremonyHtml(data.route)}${scope === null ? null : runtimeDetailsHtml(scope)}${reauth(html `<label>Your password, typed again — a signed-in session alone cannot agree to work<input type="password" name="token" autocomplete="current-password"></label>`)}<div class="sticky-actions"><button type="submit">Approve this scope</button></div>`, { attrs: { class: "card approve-form" }, returnTo: "next", hidden: { nonce: data.nonce, digest: data.approvalDigest ?? item.approval.digest } })}<p class="meta"><a href="${taskHref(item.approval.taskId)}">open the full task</a> to edit the scope first</p>`;
     }
     else if (item.kind === "requeue") {
         card =

package/dist/server/render-people.d.ts

@@ -7,8 +7,9 @@ export declare function joinDeadPage(): Html;
 /**
  * v100: for someone signed in with the identity provider, every step-up
  * password field (autocomplete="current-password"; a secret like a bot token
- * is never one) becomes that sign-in: confirmed, when the provider checked
- * them in the last ten minutes, or a link to be checked again, then back here.
+ * is never one) becomes that sign-in: confirmed, when an explicit re-check
+ * made on request awaits its one step-up (cockpit B2), or a link to be
+ * checked again, then back here. An ordinary sign-in never confirms.
  */
 export declare function ssoStepUps(page: Html, sso: {
     label: string;

package/dist/server/render-people.js

@@ -33,8 +33,9 @@ export function joinDeadPage() {
 /**
  * v100: for someone signed in with the identity provider, every step-up
  * password field (autocomplete="current-password"; a secret like a bot token
- * is never one) becomes that sign-in: confirmed, when the provider checked
- * them in the last ten minutes, or a link to be checked again, then back here.
+ * is never one) becomes that sign-in: confirmed, when an explicit re-check
+ * made on request awaits its one step-up (cockpit B2), or a link to be
+ * checked again, then back here. An ordinary sign-in never confirms.
  */
 export function ssoStepUps(page, sso, returnTo) {
     const stepUp = (attributes) => /\btype="password"/.test(attributes) && /\bautocomplete="current-password"/.test(attributes);

package/dist/server/render-results.d.ts

@@ -1,3 +1,5 @@
+/** Results and runs: the review cockpit, evidence, receipts, diffs and the result panel. */
+import type { RunNetworkRecord } from "../egress.js";
 import { type AssignmentSnapshot } from "../assignment.js";
 import { type BrowserCheckItem, type BrowserNeedAction, type BrowserResultPanel, type BrowserResultView } from "../browser-workspace.js";
 import { type ReportShot } from "../evidence.js";
@@ -7,6 +9,7 @@ import { type CriterionMatrixRow, type ProofVerdict } from "../proof.js";
 import { type PullRequestView } from "../pull-request-flow.js";
 import { type StructuredHandoffView, type TerminalDiffView } from "../result-evidence-readers.js";
 import { type FollowUpCheck } from "../result-follow-ups.js";
+import type { RunEfficiency } from "../run-efficiency.js";
 import { type ResultScreenshot, type ResultTab, type SharedResultFacts } from "../result-review.js";
 import { type BuildReviewView } from "../review-switch.js";
 import { type AcceptanceCriterion, type approvalOf } from "../scope.js";
@@ -180,6 +183,10 @@ export type RankedReviewRow = CompletedWorkRow & {
  * scope, plan, run, artifact, verdict, and publication records,
  * each read through the verifier the run page already uses. */
 export type ReviewCockpitView = {
+    /** How the result's run went (docs/plans/run-efficiency.md): display only, its sources and their gaps said. */
+    efficiency?: RunEfficiency | null;
+    /** What the run's network was and what its proxy saw (egress.ts): display only. */
+    network?: RunNetworkRecord | null;
     taskId: string;
     title: string;
     repo: string | null;
@@ -285,7 +292,16 @@ export declare function reviewCockpitPage(chrome: Chrome, data: {
 export declare function reviewCockpitDetail(view: ReviewCockpitView, csrf: string, noted: boolean, canRetryReview?: boolean, tab?: ResultTab, user?: string): Html;
 /** The selected result's HTML and, for the rebuilt page, the same result
  * as data: every form and panel body is the one the HTML carries. */
-export declare function reviewCockpitDetailParts(view: ReviewCockpitView, csrf: string, noted: boolean, canRetryReview: boolean, tab: ResultTab, user: string): {
+/** Where a result is shown: its own page (/review), or the Result tab of its task's page (docs/plans/one-page-task-and-agent.md),
+ * whose address is `base` (the task page with tab=result, and its version when not the current one). The result's own
+ * view (Summary / Changes / Checks) rides `section=` there, so it never fights the task page's `tab`. */
+export type ResultHost = {
+    kind: "review";
+} | {
+    kind: "task";
+    base: string;
+};
+export declare function reviewCockpitDetailParts(view: ReviewCockpitView, csrf: string, noted: boolean, canRetryReview: boolean, tab: ResultTab, user: string, host?: ResultHost): {
     html: Html;
     selected: NonNullable<BrowserResultView["selected"]>;
 };
@@ -319,7 +335,7 @@ export declare function pullRequestCardHtml(pr: TaskPullRequest, csrf: string):
  * bearer session (no token) sees the road named, never a form. */
 export declare function reviewNextAction(view: ReviewCockpitView, csrf: string, _accepted: boolean, _canAnnotate: boolean): Html;
 /** The next action for the browser workspace's JSON: its control as markup text. */
-export declare function reviewNextActionOf(view: ReviewCockpitView, csrf: string): {
+export declare function reviewNextActionOf(view: ReviewCockpitView, csrf: string, back?: string): {
     kind: string;
     title: string;
     detail: string;