toolroll 0.9.63 → 0.9.67

package/dist/server/runtime.d.ts

@@ -1,3 +1,5 @@
+import type { FreshFacts } from '../scope.js';
+import type { createPersonalQueueRuntime } from '../lead-queue-runtime.js';
 import type { FlowRooms } from '../flow-live.js';
 import type { IntegrationMonitor } from '../integrations.js';
 import type { OidcSettings } from '../oidc.js';
@@ -7,7 +9,8 @@ import type { TaskRooms } from '../task-live.js';
 /** Captured server state and shared guards. Getters preserve live state across requests. */
 import { type IncomingMessage, type ServerResponse } from "node:http";
 import { type AssignmentSnapshot } from '../assignment.js';
-import { type BrowserPhoneCard, type BrowserUpdates } from '../browser-workspace.js';
+import { type BrowserPhoneCard, type BrowserResultView, type BrowserTaskTab, type BrowserUpdates } from '../browser-workspace.js';
+import type { Html } from '../html.js';
 import { CodingWorkspace } from '../coding-workspace.js';
 import { type FormFieldOf, type FormView } from "../contracts/console-api.js";
 import type { DemoLead } from "../demo.js";
@@ -93,7 +96,7 @@ export interface ServerRuntime {
         repos: string[];
         roots: readonly string[];
     };
-    taskScreen: (response: ServerResponse, who: Who, taskId: string, problem: string | null, status: number, scopeDraft?: URLSearchParams, cancelDraft?: string, editPlan?: boolean) => void;
+    taskScreen: (response: ServerResponse, who: Who, taskId: string, problem: string | null, status: number, scopeDraft?: URLSearchParams, cancelDraft?: string, editPlan?: boolean, page?: TaskPageExtras) => void;
     runVisible: (run: Run) => boolean;
     runIsLive: (run: Pick<Run, "outcome" | "leaseId" | "taskRef">) => boolean;
     options: ServeOptions;
@@ -134,6 +137,8 @@ export interface ServerRuntime {
         generation: number;
     }, csrf: string) => TeamResponse;
     team: ReturnType<typeof createTeamRuntime>;
+    /** The personal lead queue (lead-queue-runtime.ts): a message sent while the person's lead is busy waits here. */
+    personalQueue: ReturnType<typeof createPersonalQueueRuntime>;
     teamChatProvider: TeamChatProviderResolver;
     pullRequestTargetOf: (runId: number) => string | null;
     chatEnablement: () => ChatEnablement;
@@ -176,6 +181,8 @@ export interface ServerRuntime {
     settingsUpdates: (actor: string, csrf: string) => BrowserUpdates | null;
     phoneSetup: (who: Who) => BrowserPhoneCard | undefined;
     authenticateApprover: (who: Who, token: string, repo?: string | null) => ReturnType<typeof checkApproverPassword>;
+    /** A credential act (passwordless.md's closed list): a password typed now, never a session or a remembered one. */
+    authenticateCredential: (who: Who, token: string, repo?: string | null) => ReturnType<typeof checkApproverPassword>;
     projectOf: (who: Who, request: IncomingMessage) => string | null | undefined;
     bustBadge: () => void;
     revisionDestination: (child: string, back: string) => string;
@@ -223,6 +230,8 @@ export interface ServerRuntime {
     }>;
     linkKey: (code: string) => string;
     fromThisComputer: (request: IncomingMessage) => boolean;
+    /** Cockpit B2: the request's live password-freshness facts (null off a browser session). */
+    freshFactsOf: (request: IncomingMessage, who: Who | null) => FreshFacts | null;
     passwordAllowed: (name: string) => boolean;
     arrival: (request: IncomingMessage) => {
         agent: string | null;
@@ -236,6 +245,11 @@ export interface ServerRuntime {
         intent: SsoIntent;
         returnTo: string;
         expires: number;
+        startedAt: number;
+        session: {
+            hash: string;
+            generation: number;
+        } | null;
     }>;
     ssoHandoffs: Map<string, {
         claims: OidcClaims;
@@ -243,6 +257,11 @@ export interface ServerRuntime {
         intent: SsoIntent;
         returnTo: string;
         expires: number;
+        checkedAt: number | null;
+        session: {
+            hash: string;
+            generation: number;
+        } | null;
     }>;
     joinSourceOf: (request: IncomingMessage) => string;
     signInBudget: SourceBudget;
@@ -286,3 +305,15 @@ export interface ServerRuntime {
         reading: boolean;
     }>;
 }
+/** What the task page's GET adds (docs/plans/one-page-task-and-agent.md): the tab its address names, and the Result tab's
+ * selected result (its no-script HTML and its view), whether it is the task's current one. Refusals re-render without. */
+export type TaskPageExtras = {
+    tab?: BrowserTaskTab;
+    result?: {
+        html: Html;
+        selected: NonNullable<BrowserResultView["selected"]>;
+        current: boolean;
+    } | null;
+    /** The result runs the attempt picker may offer (the Result tab would show each); absent: every finished result run. */
+    admissible?: ReadonlySet<number>;
+};

package/dist/server/session.d.ts

@@ -14,6 +14,11 @@ export declare const SIGN_IN_LINK_MS: number;
 /** A cookie idles out after half a day and dies outright after a week. */
 export declare const SESSION_IDLE_MS: number;
 export declare const SESSION_ABSOLUTE_MS: number;
+/** A session's lifetime, the one reading: within its idle and absolute limits (sign-in lookup and every act use it). */
+export declare const sessionWithinLifetime: (session: {
+    lastSeen: number;
+    createdAt: number;
+}, now: number) => boolean;
 /** An approval nonce is a rendered form, not a standing right — it ages out fast. */
 export declare const NONCE_TTL_MS: number;
 export declare const NONCE_CAP = 500;
@@ -37,6 +42,15 @@ export type Session = {
     sso?: {
         at: number;
     };
+    /** Cockpit B2: when a password was last verified on this session (in memory only: a restart forgets it). */
+    passwordAt?: number;
+    /** Cockpit B2: when the identity provider last re-checked this person on request (a step-up's re-authentication).
+     * Only this, or a password, starts a freshness window; an ordinary sign-in never does. In memory only. */
+    ssoReauthAt?: number;
+    /** Cockpit B2: an explicit provider re-check not yet spent: stands in for ONE step-up (consumed by it). In memory only. */
+    ssoNowAt?: number;
+    /** Forget: nothing verified before this counts as fresh. */
+    freshFloor?: number;
     /** v101: the browser and address it signed in from, for the person to recognise it. */
     agent?: string | null;
     address?: string | null;
@@ -121,12 +135,22 @@ export declare class PersistentSessions extends Map<string, Session> {
     static hash(id: string): string;
     set(id: string, session: Session): this;
     delete(id: string): boolean;
-    /** Keep a changed session (its project, its provider check); `seen` only once a minute. */
+    /**
+     * Keep a changed session (its project, its provider check); `seen` only once a minute. Only ever an update: a session
+     * ended elsewhere (another process, Sessions) is dropped here, never written back by its cached copy (live terminals
+     * review, rounds 2–3, finding 1).
+     */
     persist(session: Session, seen?: boolean): void;
+    /** Whether this exact session is still saved in the database (ended from another process, it isn't): read at the act. */
+    savedNow(session: Session): boolean;
+    /** Whether this cookie's session is still saved (one ended in another process is not). */
+    stillSaved(id: string): boolean;
     /** A cookie from before a restart, if its session is still kept. */
     load(id: string): Session | null;
     /** End one session by its kept hash (from the Sessions page). */
     endByHash(idHash: string): void;
+    /** Whether this exact session is still signed in here (not signed out, ended from Sessions, expired or replaced). */
+    holds(session: Session): boolean;
     hashOf(session: Session): string | null;
 }
 /** The console's server, and the one-time sign-in link `up` opens: a path on this server, or null for no such approver.

package/dist/server/session.js

@@ -26,6 +26,8 @@ export const SIGN_IN_LINK_MS = 10 * 60_000;
 /** A cookie idles out after half a day and dies outright after a week. */
 export const SESSION_IDLE_MS = 12 * 60 * 60_000;
 export const SESSION_ABSOLUTE_MS = 7 * 24 * 60 * 60_000;
+/** A session's lifetime, the one reading: within its idle and absolute limits (sign-in lookup and every act use it). */
+export const sessionWithinLifetime = (session, now) => now - session.lastSeen <= SESSION_IDLE_MS && now - session.createdAt <= SESSION_ABSOLUTE_MS;
 /** An approval nonce is a rendered form, not a standing right — it ages out fast. */
 export const NONCE_TTL_MS = 15 * 60_000;
 export const NONCE_CAP = 500;
@@ -55,22 +57,32 @@ export class PersistentSessions extends Map {
     set(id, session) {
         super.set(id, session);
         this.ids.set(session, id);
-        this.persist(session);
+        this.savedAt.set(session, Date.now());
+        this.db.saveWebSession({ idHash: PersistentSessions.hash(id), account: session.name, csrf: session.csrf, role: session.role, generation: session.generation, createdAt: session.createdAt,
+            lastSeen: session.lastSeen, project: session.project, projectRevision: session.projectRevision, ssoAt: session.sso?.at ?? null, agent: session.agent ?? null, address: session.address ?? null });
         return this;
     }
     delete(id) {
         this.db.dropWebSession(PersistentSessions.hash(id));
         return super.delete(id);
     }
-    /** Keep a changed session (its project, its provider check); `seen` only once a minute. */
+    /**
+     * Keep a changed session (its project, its provider check); `seen` only once a minute. Only ever an update: a session
+     * ended elsewhere (another process, Sessions) is dropped here, never written back by its cached copy (live terminals
+     * review, rounds 2–3, finding 1).
+     */
     persist(session, seen = false) {
         const id = this.ids.get(session);
         if (id === undefined || (seen && Date.now() - (this.savedAt.get(session) ?? 0) < 60_000))
             return;
         this.savedAt.set(session, Date.now());
-        this.db.saveWebSession({ idHash: PersistentSessions.hash(id), account: session.name, csrf: session.csrf, role: session.role, generation: session.generation, createdAt: session.createdAt,
-            lastSeen: session.lastSeen, project: session.project, projectRevision: session.projectRevision, ssoAt: session.sso?.at ?? null, agent: session.agent ?? null, address: session.address ?? null });
+        if (!this.db.updateWebSession({ idHash: PersistentSessions.hash(id), lastSeen: session.lastSeen, project: session.project, projectRevision: session.projectRevision, ssoAt: session.sso?.at ?? null }))
+            super.delete(id);
     }
+    /** Whether this exact session is still saved in the database (ended from another process, it isn't): read at the act. */
+    savedNow(session) { const hash = this.hashOf(session); return hash !== null && this.db.webSession(hash) !== null; }
+    /** Whether this cookie's session is still saved (one ended in another process is not). */
+    stillSaved(id) { return this.db.webSession(PersistentSessions.hash(id)) !== null; }
     /** A cookie from before a restart, if its session is still kept. */
     load(id) {
         const row = this.db.webSession(PersistentSessions.hash(id));
@@ -90,5 +102,7 @@ export class PersistentSessions extends Map {
                 super.delete(id);
         this.db.dropWebSession(idHash);
     }
+    /** Whether this exact session is still signed in here (not signed out, ended from Sessions, expired or replaced). */
+    holds(session) { const id = this.ids.get(session); return id !== undefined && super.get(id) === session; }
     hashOf(session) { const id = this.ids.get(session); return id === undefined ? null : PersistentSessions.hash(id); }
 }

package/dist/server/settings.js

@@ -1,3 +1,6 @@
+import { PASSWORDLESS_TRADE, passwordlessSetting, setPasswordless } from "../passwordless.js";
+import { ACP_AGENTS, isKeyedProvider } from "../acp-agents.js";
+import { LIVE_VIEW_CONSENT, liveViewConsentDigest, setLiveCommands } from "../live-detail.js";
 import { CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
 import { galleryTemplateOf } from "../flow-gallery.js";
 import { finishGoogleConsent, GOOGLE_CALLBACK } from "../google-mail.js";
@@ -30,7 +33,7 @@ import { PACKAGE_VERSION } from "../version.js";
 import { handlersOf } from './handler-registry.js';
 import { refuse, screen } from "./chrome.js";
 import { HANDOFF_STYLE, redirect, respond, safeReturn, signInSpent, startedHere } from "./http.js";
-import { html, htmlString, joinHtml, postForm } from "../html.js";
+import { html, htmlString, joinHtml, postForm, reauth } from "../html.js";
 import { browserCaller } from "./session.js";
 /** settings handlers, moved without changing their route bodies. */
 import { DEFAULT_ACCENT, normalHex } from "../accent-colors.js";
@@ -76,6 +79,8 @@ import { openRouterPickerScript } from "../openrouter-models.js";
 import { policyHtml } from "../policy-ui.js";
 import { checkPolicy, parseList, policyParts } from "../policy.js";
 import { parseProjectConcurrency, saveProjectConcurrency } from "../project-concurrency.js";
+import { MAX_NETWORK_HOSTS, normalizeHost } from "../egress.js";
+import { isWritesMode } from "../writes-mode.js";
 import { projectDeleteConfirmHtml, projectSettingsHtml } from "../project-delete-ui.js";
 import { deleteProject, holdingsWords } from "../project-delete.js";
 import { applySavedKnowledge, changeKnowledge, knowledgeVersion, knowledgeView } from "../project-knowledge.js";
@@ -122,7 +127,7 @@ import { personChip, ROLE_TITLES } from "./chrome.js";
 import { chatReturnWithSaid, goOutside } from "./http.js";
 import { latestReleaseFor, leadSettingsHtml, notificationProjects, SETTINGS_AUTOSAVE_SCRIPT, settingsPage, settingsWorkers, telegramDeliveryWords, telegramTrouble } from "./render-settings.js";
 export function createSettingsHandlers(runtime) {
-    const { store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, deletedRepos, recordSignIn, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, defaultProject, googleVisits } = runtime;
+    const { store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, authenticateCredential, deletedRepos, recordSignIn, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, defaultProject, googleVisits } = runtime;
     // v105: what agent work cost, by month, and the monthly budgets. An instance operator's page.
     async function spendPage(ctx) {
         const { url, who, response, now } = ctx;
@@ -461,6 +466,40 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const body = ssoSettingsHtml({ settings, redirect: origin === null ? null : `${origin}${SSO_CALLBACK}`, projects, linked: settings !== null && store.ssoIdentitiesOf(who.name).some(one => one.issuer.replace(/\/+$/, "") === settings.issuer) }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") });
         return sendScreen(response, 200, screen("Sign-in", html `<p><a href="/settings">Settings</a></p><h1>Sign-in</h1>${body}`, { chrome: chromeFor(project, "settings") }));
     }
+    /** Passwordless (docs/plans/passwordless.md): the switch, and the trade in plain words. */
+    async function passwordlessPage(ctx) {
+        const { url, response, project } = ctx;
+        browserCaller(ctx.who);
+        const setting = passwordlessSetting(store);
+        const said = url.searchParams.get("said"), problem = url.searchParams.get("problem");
+        const note = problem ? html `<p class="problem" role="alert">${problem}</p>` : said ? html `<p role="status">${said}</p>` : "";
+        const since = setting.at === null ? "" : html ` <span class="meta">(${setting.on ? "on" : "off"} since ${new Date(setting.at).toLocaleString("en-US", { dateStyle: "medium", timeStyle: "short" })}, by ${setting.setBy ?? "someone"})</span>`;
+        const control = setting.on
+            ? postForm("/settings/passwordless", html `<button class="secondary">Turn Passwordless off</button>`, { hidden: { action: "off" } })
+            : postForm("/settings/passwordless", html `<label>Your password<input type="password" name="password" autocomplete="current-password" required></label><button>Turn Passwordless on</button>`, { attrs: { class: "card approve-form" }, hidden: { action: "on" } });
+        return sendScreen(response, 200, screen("Passwordless", html `<p><a href="/settings">Settings</a></p><h1>Passwordless</h1>${note}\
+<p>When it's on, signing in is the only password: approvals, settings, budgets, signing a mode and starting a terminal no longer ask again — in the browser, on the phone, and in this computer's <code>toolroll</code> command (through its remembered login).</p>\
+<p class="meta">${PASSWORDLESS_TRADE}</p>\
+<p><strong>Passwordless is ${setting.on ? "on" : "off"}.</strong>${since}</p>${control}`, { chrome: chromeFor(project, "settings") }));
+    }
+    async function passwordlessSave(ctx) {
+        const { response, now, posted } = ctx;
+        const who = browserCaller(ctx.who);
+        const body = readForm(posted, CONSOLE_FORMS.passwordless);
+        const back = (key, words) => redirect(response, `/settings/passwordless?${key}=${encodeURIComponent(words)}`);
+        const action = body.get("action");
+        if (action === "off") {
+            setPasswordless(store, false, who.name, now);
+            return back("said", "Passwordless is off. Step-ups ask for your password again.");
+        }
+        if (action !== "on")
+            return back("problem", "Choose on or off.");
+        // Turning it on is a credential act: a password typed now (or a one-use provider re-check), never a session.
+        if (!authenticateCredential(who, body.get("password") ?? "").ok)
+            return back("problem", "Enter your Toolroll password to turn Passwordless on.");
+        setPasswordless(store, true, who.name, now);
+        return back("said", "Passwordless is on. Signing in is the only password now.");
+    }
     async function knowledgePage(ctx) {
         const { url, who, response, project } = ctx;
         const projects = consoleProjects();
@@ -600,13 +639,14 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         };
         const providerKeys = who.role !== "approver"
             ? null
-            : await Promise.all(PROVIDER_IDS.map(async (provider) => ({
+            // ACP agents sign in their own way; Toolroll keeps no key for them, so the key card lists only the others.
+            : await Promise.all(PROVIDER_IDS.filter(isKeyedProvider).map(async (provider) => ({
                 provider,
                 envName: PROVIDER_KEY_ENV[provider],
                 ...keyStatus(provider, providerHome),
                 connection: await connectionCheck(provider, url.searchParams.get("check-connection") === provider),
                 ambient: (process.env[PROVIDER_KEY_ENV[provider]] ?? "") !== "",
-                mode: readAuthMode(provider, providerHome),
+                mode: readAuthMode(provider, providerHome) === "api-key" ? "api-key" : "subscription",
                 subscriptionCapable: SUBSCRIPTION_CAPABLE[provider],
             })));
         const telegramConfigured = loadBotToken(process.env, options.telegramTokenFile) !== null;
@@ -656,6 +696,18 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         return redirect(response, "/work");
     }
     // The update notice is dismissed per browser and per version: a newer release shows it again.
+    // Cockpit B2: Forget — nothing verified on this session before now counts as fresh (a CSRF-checked post, like every act).
+    async function forgetPassword(ctx) {
+        const { who, response, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.forgetPassword);
+        if (who.via === "cookie") {
+            who.session.freshFloor = Date.now();
+            delete who.session.passwordAt;
+            delete who.session.ssoReauthAt;
+            delete who.session.ssoNowAt;
+        }
+        return redirect(response, safeReturn(body.get("return") ?? "/"));
+    }
     async function updatesDismiss(ctx) {
         const { who, response, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.updatesDismiss);
@@ -808,6 +860,51 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         store.bumpWake();
         return back("said", changed.before === changed.after ? "Nothing changed." : `Saved. Up to ${n} at once.`);
     }
+    // Settings → Project → Live view (live-detail.ts): an approver for the project shows commands with their password,
+    // or hides them in one step; the ledger keeps each change. It applies from the next run.
+    async function projectLiveView(ctx) {
+        const { who, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.projectLiveView);
+        const repo = body.get("repo") ?? "";
+        if (!consoleProjects().includes(repo) || !visible(repo))
+            return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
+        if (who.via !== "cookie" || who.role !== "approver" || store.isDemo() || !store.accountCanAccess(who.name, repo))
+            return refuse(response, who, 403, "An approver for this project changes the live view.", "/settings/project");
+        const back = (key, words) => redirect(response, `/settings/project?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}`);
+        const act = body.get("act");
+        if (act === "off")
+            return back("said", setLiveCommands(store, { repo, commands: false, by: who.name, via: "the console" }, now).said);
+        if (act !== "on")
+            return back("problem", "That change isn't available.");
+        // Single use, for this person and exactly this change: a replayed or copied form changes nothing.
+        if (!consumeApprovalNonce(body.get("nonce") ?? "", who.name, LIVE_VIEW_CONSENT, liveViewConsentDigest(repo)))
+            return back("problem", "That form was already used or is out of date. Try again from this page.");
+        if (!authenticateApprover(who, body.get("password") ?? "", repo).ok)
+            return back("problem", "Enter your Toolroll password to show commands.");
+        return back("said", setLiveCommands(store, { repo, commands: true, by: who.name, via: "the console" }, now).said);
+    }
+    // Settings → Project → Network (egress.ts): what the project's builds may reach. An approver for the project changes it
+    // with their password typed now; the ledger keeps before → after. New scopes use it; approved ones keep theirs.
+    async function projectNetwork(ctx) {
+        const { who, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.projectNetwork);
+        const repo = body.get("repo") ?? "";
+        if (!consoleProjects().includes(repo) || !visible(repo))
+            return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
+        if (who.via !== "cookie" || who.role !== "approver" || store.isDemo() || !store.accountCanAccess(who.name, repo))
+            return refuse(response, who, 403, "An approver for this project changes what its builds may reach.", "/settings/project");
+        const back = (key, words) => redirect(response, `/settings/project?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}#network`);
+        const hosts = (body.get("hosts") ?? "").split(/[\s,]+/).filter(Boolean).map(normalizeHost);
+        if (hosts.some(one => one === null))
+            return back("problem", "A host is a name like api.stripe.com or *.stripe.com: no address, port or path. Nothing changed.");
+        if (hosts.length > MAX_NETWORK_HOSTS)
+            return back("problem", `A project lists at most ${MAX_NETWORK_HOSTS} hosts. Nothing changed.`);
+        if (!authenticateCredential(who, body.get("password") ?? "").ok)
+            return back("problem", "Enter your Toolroll password to change what builds may reach.");
+        const changed = store.setProjectNetwork(repo, { mode: body.get("mode") === "open" ? "open" : "allowlist", hosts: hosts, loopback: body.get("local") === "any" ? "any" : "proxy-only" }, who.name, now);
+        const same = JSON.stringify(changed.before) === JSON.stringify(changed.after);
+        return back("said", same ? "Nothing changed." : "Saved. Tasks scoped from now on use it; tasks already approved keep the network they were approved with.");
+    }
     // Delete a project, in two steps: its name, then what goes and the password. An instance operator; the ledger keeps who and what.
     async function projectDelete(ctx) {
         const { response, now, posted } = ctx;
@@ -917,7 +1014,8 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
             const found = await providerFor(before.issuer);
             return found.ok ? back("said", `${before.label} answers: it's ready for people to sign in.`) : back("problem", found.said);
         }
-        if (!authenticateApprover(who, body.get("password") ?? "").ok)
+        // Sign-in methods and the identity provider are the login itself: a credential act, a password typed now.
+        if (!authenticateCredential(who, body.get("password") ?? "").ok)
             return back("problem", "Enter your Toolroll password to change sign-in.");
         if (action === "remove") {
             removeSsoSettings(options.configDir);
@@ -1611,7 +1709,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
             const nonceKey = `project-instructions:${project}`;
             if (step === "preview") {
                 const nonce = mintApprovalNonce(who.name, nonceKey, preview.fingerprint);
-                return sendScreen(response, 200, screen("Review agent instructions", html `<h1>Review agent instructions</h1><p>${preview.plan.skillPath}</p><pre class="recap">${preview.content}</pre>${postForm("/control/instructions-approve", html `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label><button>Add these instructions</button>`, { hidden: { repo: project, nonce, fingerprint: preview.fingerprint } })}`, { chrome: chromeFor(project, "settings") }));
+                return sendScreen(response, 200, screen("Review agent instructions", html `<h1>Review agent instructions</h1><p>${preview.plan.skillPath}</p><pre class="recap">${preview.content}</pre>${postForm("/control/instructions-approve", html `${reauth(html `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label>`)}<button>Add these instructions</button>`, { hidden: { repo: project, nonce, fingerprint: preview.fingerprint } })}`, { chrome: chromeFor(project, "settings") }));
             }
             if (who.via === "cookie" && !consumeApprovalNonce(body.get("nonce") ?? "", who.name, nonceKey, body.get("fingerprint") ?? ""))
                 return refuse(response, who, 409, "This instruction preview expired. Review it again.", "/control");
@@ -1655,7 +1753,8 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
             savePrimary(dir, "slack");
             return redirect(response, "/settings/slack");
         }
-        if (!authenticateApprover(who, body.get("password") ?? "").ok)
+        // Connecting or pairing opens a way to act from Slack: a credential act. Unpairing or disconnecting only closes one.
+        if (!(action === "connect" || action === "pair" ? authenticateCredential(who, body.get("password") ?? "") : authenticateApprover(who, body.get("password") ?? "")).ok)
             return show("Enter your Toolroll password to change Slack access.", 403);
         const generation = store.accountOf(who.name).generation;
         if (action === "connect") {
@@ -1758,6 +1857,11 @@ ${postForm("/settings/chat-approval/save", html `\
             return show("Submit one value for each field.");
         if (botId === null)
             return show("Connect the Telegram bot first.", 409);
+        // Pairing a phone is a credential act (a typed password, always); unpairing only closes a way in.
+        if (op === "unpair" && authenticateApprover(who, body.get("password") ?? "").ok) {
+            store.unpairTelegram(botId, who.name, now);
+            return redirect(response, "/settings/telegram");
+        }
         const pairingIdentity = authenticateAccount(store, who.name, body.get("password") ?? "");
         if (!pairingIdentity.ok || pairingIdentity.role !== "approver" || pairingIdentity.generation !== who.session.generation)
             return show("Enter your Toolroll password to change your phone pairing.", 403);
@@ -1788,7 +1892,7 @@ ${postForm("/settings/chat-approval/save", html `\
             savePrimary(dir, "teams");
             return redirect(response, "/settings/teams");
         }
-        if (!authenticateApprover(who, body.get("password") ?? "").ok)
+        if (!(action === "connect" || action === "pair" ? authenticateCredential(who, body.get("password") ?? "") : authenticateApprover(who, body.get("password") ?? "")).ok)
             return show("Enter your Toolroll password to change Teams access.", 403);
         const generation = store.accountOf(who.name).generation;
         if (action === "connect") {
@@ -1845,7 +1949,7 @@ ${postForm("/settings/chat-approval/save", html `\
             savePrimary(dir, "discord");
             return redirect(response, "/settings/discord");
         }
-        if (!authenticateApprover(who, body.get("password") ?? "").ok)
+        if (!(action === "connect" || action === "pair" ? authenticateCredential(who, body.get("password") ?? "") : authenticateApprover(who, body.get("password") ?? "")).ok)
             return show("Enter your Toolroll password to change Discord access.", 403);
         const generation = store.accountOf(who.name).generation;
         if (action === "connect") {
@@ -1984,6 +2088,8 @@ ${postForm("/settings/chat-approval/save", html `\
         const provider = body.get("provider") ?? "";
         if (!isProviderId(provider))
             return refuse(response, who, 400, "unknown provider", "/settings");
+        if (!isKeyedProvider(provider))
+            return refuse(response, who, 400, `${ACP_AGENTS[provider].name} signs in its own way — Toolroll keeps no key for it`, "/settings");
         if (op === "clear") {
             const cleared = clearProviderKey(provider, providerHome);
             const clearedMode = readAuthMode(provider, providerHome);
@@ -2167,7 +2273,8 @@ ${modeWords(terms)
             return refuse(response, who, 409, "the terms moved while you were reading — read them again", "/mode");
         }
         const token = body.get("token") ?? "";
-        if (!authenticateApprover(who, token).ok) {
+        // A mode that lets a chat app approve opens a way to act: a credential act. Any other mode is an ordinary one.
+        if (!(body.get("chat-approve") === "1" ? authenticateCredential(who, token) : authenticateApprover(who, token)).ok) {
             return refuse(response, who, 403, "signing a mode takes your password, typed again", "/mode");
         }
         store.signMode({
@@ -2353,6 +2460,8 @@ ${modeWords(terms)
         "settings.backups": backupsPage,
         "settings.data": dataPage,
         "settings.sign-in": signInPage,
+        "settings.passwordless": passwordlessPage,
+        "settings.passwordless-send": passwordlessSave,
         "settings.lead": leadPage,
         "settings.teams": teamsPage,
         "settings.discord": discordPage,
@@ -2366,12 +2475,16 @@ ${modeWords(terms)
         "settings.page": settingsHome,
         "provider.resume": providerResume,
         "settings.updates-dismiss": updatesDismiss,
+        "session.forget-password": forgetPassword,
         "settings.updates-checks": updatesChecks,
         "settings.skills-revise": skillsRevise,
         "settings.skills-import": skillsAct("import"),
         "settings.skills-change": skillsAct("change"),
         "spend.budget": spendBudget,
         "settings.project-concurrency": projectConcurrency,
+        "settings.project-live-view": projectLiveView,
+        "settings.project-network": projectNetwork,
+        "settings.project-writes": projectWrites,
         "settings.project-delete": projectDelete,
         "settings.policy-send": policySave,
         "settings.approval-send": approvalSave,
@@ -2455,5 +2568,24 @@ ${modeWords(terms)
         "edge.google-callback": googleCallback,
         "edge.connect-callback": connectCallback,
     });
+    // Settings → Project → Where builds write (writes-mode.ts). An approver for the project changes it with their password
+    // typed now; the ledger keeps before → after. New scopes use it; approved ones keep theirs.
+    async function projectWrites(ctx) {
+        const { who, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.projectWrites);
+        const repo = body.get("repo") ?? "";
+        if (!consoleProjects().includes(repo) || !visible(repo))
+            return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
+        if (who.via !== "cookie" || who.role !== "approver" || store.isDemo() || !store.accountCanAccess(who.name, repo))
+            return refuse(response, who, 403, "An approver for this project changes where its builds may write.", "/settings/project");
+        const back = (key, words) => redirect(response, `/settings/project?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}#writes`);
+        const wanted = body.get("writes");
+        if (!isWritesMode(wanted))
+            return back("problem", "Choose where builds may write. Nothing changed.");
+        if (!authenticateCredential(who, body.get("password") ?? "").ok)
+            return back("problem", "Enter your Toolroll password to change where builds may write.");
+        const changed = store.setProjectWrites(repo, wanted, who.name, now);
+        return back("said", changed.before === changed.after ? "Nothing changed." : "Saved. Tasks scoped from now on use it; tasks already approved keep what they were approved with.");
+    }
     return { registrations, modelsView };
 }

package/dist/server/sweeps.d.ts

@@ -0,0 +1,4 @@
+import type { ServerRuntime } from "./runtime.js";
+export declare function createSweepHandlers(runtime: ServerRuntime): {
+    registrations: import("./handler-registry.js").Registration[];
+};

package/dist/server/sweeps.js

@@ -0,0 +1,58 @@
+/**
+ * A lead sweep's table (docs/plans/lead-fan-out.md): every child with its state, its verdict and its result, read from
+ * facts on each look (the page follows the console's live beat). The only sweep-wide act is "cancel the rest"; steer,
+ * cancel or retry one child is that task's own page.
+ */
+import { CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
+import { html, postForm } from "../html.js";
+import { cancelSweepRest, sweepLine, sweepOpen, sweepOpenDigest, sweepTable } from "../lead-sweep.js";
+import { refuse, screen } from "./chrome.js";
+import { handlersOf } from "./handler-registry.js";
+import { redirect } from "./http.js";
+const SWEEP_PATH = /^\/sweeps\/([1-9][0-9]{0,9})(?:\/cancel-rest)?$/;
+const STATE_WORDS = {
+    working: "Working", checking: "Checking", "needs-decision": "Needs you", "ready-to-check": "Ready", complete: "Complete", cancelled: "Cancelled", missing: "Gone",
+};
+export function createSweepHandlers(runtime) {
+    const { store, clock, sendScreen, chromeFor, evidenceRoot, consoleProjects, liveRefreshSeconds } = runtime;
+    const readable = () => runtime.workAccess().repos ?? consoleProjects();
+    async function page(ctx) {
+        const { url, who, response } = ctx;
+        const id = Number(SWEEP_PATH.exec(url.pathname)?.[1]);
+        const table = sweepTable(store, id, clock(), readable(), evidenceRoot);
+        if (table === null)
+            return refuse(response, who, 404, "There's no sweep at this address you can see.", "/chat");
+        const said = url.searchParams.get("said");
+        const rows = table.rows.map(row => html `<tr data-sweep-row="${row.ordinal}">
+      <td>${row.ordinal + 1}</td>
+      <td><a href="/t/${encodeURIComponent(row.task)}">${row.label}</a></td>
+      <td><span class="chip">${STATE_WORDS[row.state]}</span></td>
+      <td>${row.verdict === null ? html `<span class="meta">—</span>` : html `<strong>${row.verdict.verdict}</strong> <span class="meta">${row.verdict.why}</span>`}</td>
+      <td>${row.result === null ? "" : html `<a href="/t/${encodeURIComponent(row.result.taskId)}">Result →</a>`}</td>
+    </tr>`);
+        // The form names exactly what it would act on (each item's active task, state and attempt): a change is refused.
+        const open = sweepOpen(store, table, clock());
+        const running = open.filter(one => one.run !== null).length;
+        const cancel = who.role !== "approver" || open.length === 0 ? "" : html `<details class="card"><summary>Cancel the rest (${open.length})</summary>${postForm(`/sweeps/${id}/cancel-rest`, html `<p>Cancels ${open.length - running} unfinished item${open.length - running === 1 ? "" : "s"}${running === 0 ? "" : ` and stops ${running} running build${running === 1 ? "" : "s"}`}: ${open.map(one => one.label).join(", ")}. Finished results stay.</p><label class="arm"><input type="checkbox" name="confirm" value="yes" required> Cancel the rest</label><button class="danger">Cancel the rest</button>`, { hidden: { snapshot: sweepOpenDigest(open) } })}</details>`;
+        const body = html `<h1>${table.title}</h1>${said === null ? "" : html `<p role="status">${said}</p>`}
+      <p class="meta">${sweepLine(table)} · at most ${table.maxParallel} at once · each item is its own task in its own worktree</p>
+      <table class="sweep-table"><thead><tr><th>#</th><th>Item</th><th>State</th><th>Verdict</th><th></th></tr></thead><tbody>${rows}</tbody></table>${cancel}`;
+        return sendScreen(response, 200, screen(table.title, body, { chrome: chromeFor(table.repo, "work"), refreshSeconds: liveRefreshSeconds() }));
+    }
+    async function cancelRest(ctx) {
+        const { url, who, response, posted } = ctx;
+        const id = Number(SWEEP_PATH.exec(url.pathname)?.[1]);
+        const body = readForm(posted, CONSOLE_FORMS.sweep);
+        const table = sweepTable(store, id, clock(), readable(), evidenceRoot);
+        if (table === null)
+            return refuse(response, who, 404, "There's no sweep at this address you can see.", "/chat");
+        if (body.get("confirm") !== "yes")
+            return redirect(response, `/sweeps/${id}?said=${encodeURIComponent("Tick the box to cancel the rest.")}`);
+        const now = clock();
+        const open = sweepOpen(store, table, now);
+        if (body.get("snapshot") !== sweepOpenDigest(open))
+            return redirect(response, `/sweeps/${id}?said=${encodeURIComponent("The sweep changed while you were reading. Look again, then cancel.")}`);
+        return redirect(response, `/sweeps/${id}?said=${encodeURIComponent(cancelSweepRest(store, who.name, open, now, "web"))}`);
+    }
+    return { registrations: handlersOf("tasks", { "sweep.page": page, "sweep.cancel-rest": cancelRest }) };
+}

package/dist/server/task-views.d.ts

@@ -11,6 +11,7 @@ import { type ProjectPeek, type WorkRow } from "./render-pages.js";
 import { type CompletionReceiptView, type ResultDetail, type TaskPullRequest } from "./render-results.js";
 import { taskBody, type MilestoneProgressView, type PlanContractView, type PlanRevisionLedgerView, type RevisionDocView, type RevisionView, type RouteView } from "./render-tasks.js";
 import { type Who } from "./session.js";
+import type { TaskPageExtras } from "./runtime.js";
 import type { PlanRevision, TaskRef } from "../store.js";
 import { type Run, type Store, type Task, type TaskState } from "../store.js";
 import { type ReviewFacts } from "../workspace-ui.js";
@@ -74,7 +75,7 @@ export declare function createTaskViews(runtime: TaskViewsRuntime): {
         level: "quick" | "full";
         returnTo: string;
     } | null;
-    taskScreen: (response: ServerResponse, who: Who, taskId: string, problem: string | null, status: number, scopeDraft?: URLSearchParams, cancelDraft?: string, editPlan?: boolean) => void;
+    taskScreen: (response: ServerResponse, who: Who, taskId: string, problem: string | null, status: number, scopeDraft?: URLSearchParams, cancelDraft?: string, editPlan?: boolean, extras?: TaskPageExtras) => void;
     armTaskResume: (response: ServerResponse, who: Who, taskId: string, named: string, returnTo: "chat" | "task", now: Date) => void;
     planViewOf: (taskRef: number) => {
         document: string;