toolroll 0.9.63 → 0.9.67

package/dist/server/tasks.js

@@ -1,3 +1,12 @@
+import { steerCapabilityOf } from "../steer-capabilities.js";
+import { canReveal, localCheckoutOf, revealInFinder } from "../checkout-proof.js";
+/** A form's way back to a flow card ("flow:<flow>:<card>"), read strictly: numbers only, never a path. */
+function returnedFlow(value) {
+    const match = /^flow:([1-9][0-9]{0,9}):([1-9][0-9]{0,9})$/.exec(value ?? "");
+    return match === null ? null : { flow: Number(match[1]), card: Number(match[2]) };
+}
+import { originOf } from "../task-source.js";
+import { ACP_AGENTS, isAcpProvider } from "../acp-agents.js";
 import { handlersOf } from './handler-registry.js';
 import { closedQuestionWords } from "../decision.js";
 import { DEPRECATED_PAGE } from "../deprecations.js";
@@ -21,7 +30,9 @@ import { evidencePack, evidencePackHtml } from "../evidence-pack.js";
 import { readVerifiedArtifact, readVerifiedReport, writeEvidenceFile } from "../evidence.js";
 import { computeGaps } from "../gaps.js";
 import { limitsView } from "../limits-ui.js";
-import { readLiveWindow } from "../live.js";
+import { liveWindowLines, liveWindowRecords, readLiveWindow } from "../live.js";
+import { validKeyTail } from "../live-records.js";
+import { runNotes } from "../live-notes.js";
 import { latestFinishedAttempt, retryNoteOf } from '../needs-you.js';
 import { REMOTE_MESSAGES } from "../operate-remote.js";
 import { aggregateNewNames, observeWorktree, parseBaseTreeSnapshot, PEEK_LIMITS } from "../peek.js";
@@ -31,7 +42,7 @@ import { milestonesOf, parseExecutionPlanDocument } from "../plan.js";
 import { levelOfProfile } from "../policy.js";
 import { authorizedProject, canonicalProject, projectName, rowVisible } from "../project.js";
 import { fileTaskProposal } from "../proposal.js";
-import { isProviderId, validateSpec } from "../provider.js";
+import { isProviderId, PROVIDER_IDS, validateSpec } from "../provider.js";
 import { completeAndOpenPullRequest, mergeAsPerson } from '../pull-request-flow.js';
 import { isQualityMode } from "../quality.js";
 import { createResultRevision, requestResultChanges } from "../result-actions.js";
@@ -39,7 +50,7 @@ import { structuredHandoffView, terminalDiffView } from "../result-evidence-read
 import { fileAddTestsTask, requestFollowUpChecks } from '../result-follow-ups.js';
 import { commentSourceKey, isRevisionFeedback, parseResultTab, resultReturnTarget } from "../result-review.js";
 import { isAlive as runnerAlive } from "../runner.js";
-import { acceptanceLinesToInput, acceptanceToLines, approvalOf, approve as approveScope, hasFreshIdentitySignIn, modeFilingCoverage, PLACEHOLDER_RUBRIC, proposeGuarded } from "../scope.js";
+import { passwordlessSessionFor, acceptanceLinesToInput, acceptanceToLines, approvalOf, approve as approveScope, freshnessFor, spendingOnlyOnSuccess, ssoNowAvailable, withFreshness, modeFilingCoverage, PLACEHOLDER_RUBRIC, proposeGuarded } from "../scope.js";
 import { subagentNames as subagentNamesOf } from "../spend.js";
 import { verifiedAuthor } from "../store.js";
 import { runCostWords } from "../summary.js";
@@ -50,10 +61,11 @@ import { agentQuestion, answerAgentQuestion, markAgentSeen } from "../agent-boar
 import { WorkIndexCursorError, workIndexPage } from "../work-index.js";
 import { buildProgressOf, parseWorkView } from "../workspace-ui.js";
 import { requestContext } from "./request-context.js";
-import { oneLineOf, QUEUE_VIEW, refuse, regionScript, screen, transcriptScript, whenTime } from "./chrome.js";
+import { boardTickScript, oneLineOf, QUEUE_VIEW, refuse, regionScript, screen, transcriptScript, whenTime } from "./chrome.js";
 import { chatReturnWithSaid, matchTaskPath, redirect, respond, reviewHref, safeChatReturn, safeReturn, SAFETY, taskChatHref, taskHref } from "./http.js";
-import { boardBody, donePage, inboxFingerprints, inboxPage, newTaskPage, nextPage, parseInboxTab, QUEUE_FRONT, queueBody, queueScript, TASK_STATES, tasksPage, workPage } from "./render-pages.js";
-import { ACCEPT_ANYWAY_NEEDS_REASON, editorFileHref, proofBundleView, rankReviewQueue, RESULT_REFUSALS, REVIEW_QUEUE_CAP, reviewCockpitPage, reviewPriorityOf, runFactsFragment, runOutcomeBadge, runPage, RUNS_PAGE, runsPage, withRefusal } from "./render-results.js";
+import { boardBody, boardWorkers, donePage, inboxFingerprints, inboxPage, newTaskPage, nextPage, parseInboxTab, QUEUE_FRONT, queueBody, queueScript, TASK_STATES, tasksPage, workPage } from "./render-pages.js";
+import { runEfficiencyOf } from "../run-efficiency.js";
+import { ACCEPT_ANYWAY_NEEDS_REASON, editorFileHref, proofBundleView, rankReviewQueue, RESULT_REFUSALS, REVIEW_QUEUE_CAP, reviewCockpitDetailParts, reviewCockpitPage, reviewPriorityOf, runFactsFragment, runOutcomeBadge, runPage, RUNS_PAGE, runsPage, withRefusal } from "./render-results.js";
 import { approvalFormDigest, approveRefusalWords, checkProgressHtml, consentDoorOf, decisionPage, nonceHashOf, PermissionsWouldChange, requirementsFromEditor, resumeDigestOf, taskOf } from "./render-tasks.js";
 import {} from "./session.js";
 export function createTasksHandlers(runtime) {
@@ -299,6 +311,7 @@ export function createTasksHandlers(runtime) {
                 approvalDigest,
                 deliverable: ref?.deliverable ?? "branch",
                 route,
+                origin: originOf(store, item.approval.taskId, repo => store.accountCanAccess(who.name, repo)),
                 csrf, nonce, remaining: remaining.length, skipped: [...skipped], now,
             }));
         }
@@ -386,7 +399,10 @@ export function createTasksHandlers(runtime) {
             });
         });
         const laneCards = [...cards, ...unverifiedCards];
-        const body = boardBody({ cards: laneCards, done: verifiedDone, saturated: snapshot.saturated, now, all, project, delta }, pr => store.ciFailureObserved(pr));
+        // The worker strip: the workers this board's work can go to — bound to
+        // this project, or (rolled up) to any project the ceiling admits.
+        const workers = boardWorkers(store.listRunners(), { all, project, visible });
+        const body = boardBody({ cards: laneCards, workers, done: verifiedDone, saturated: snapshot.saturated, now, all, project, delta }, pr => store.ciFailureObserved(pr));
         if (url.searchParams.get("fragment") === "1") {
             // The live region alone — the in-page swapper's diet. Same auth,
             // same ceiling, no shell, no scripts (finding 2).
@@ -410,9 +426,73 @@ export function createTasksHandlers(runtime) {
         const regionBody = html `<div id="board-region">${body}</div><p class="meta" id="board-region-stamp"></p>`;
         return sendScreen(response, 200, screen("board", regionBody, {
             chrome: chromeFor(project, "board", undefined, all ? "board-all" : undefined),
-            functional: { script: regionScript("board-region", "1"), fetches: true },
+            functional: { script: regionScript("board-region", "1", undefined, { animate: true }) + boardTickScript(), fetches: true },
         }));
     }
+    /** A completed (or attempted) row as the review list ranks it: its proof reasons, CI standing, and the assignment
+     * when that assignment's receipt is this very row. */
+    function reviewRowOf(row, now) {
+        const assignment = assignmentOf(store, row.taskId, now, workAccess(), evidenceRoot);
+        return { ...row, proofReasons: row.runId === null ? [] : store.proofVerdictFor(row.runId)?.reasons ?? [], ciFailing: ciFailingFor(row.runId, row.prNumber),
+            assignment: assignment?.activeTaskId === row.taskId && (assignment.receipt?.runId ?? null) === row.runId ? assignment : null };
+    }
+    /** The result a link names (the task's own result, or the exact run `namedRun` of it): its completed row when the
+     * task is done (`inQueue` when the review list already holds it), else that attempt's own result (a failed or stopped
+     * build has a result page too), with what went wrong and Retry / Accept anyway as the review page offers them.
+     * Shared by /review and the task page's Result tab (docs/plans/one-page-task-and-agent.md). */
+    function selectResultFor(wantedId, namedRun, project, who, now, inQueue = null) {
+        const csrf = who.via === "cookie" ? who.session.csrf : "";
+        const beyond = inQueue !== null ? null : completedRowFor(wantedId, project);
+        const beyondRow = beyond === null ? null : reviewRowOf(beyond, now);
+        const completedChoice = inQueue ?? (beyondRow === null ? null : { ...beyondRow, priority: reviewPriorityOf(beyondRow) });
+        // A build that failed (or stopped) has its own result page too: the run named, or a failed task's latest attempt.
+        const attempt = (completedChoice !== null && (namedRun === null || completedChoice.runId === namedRun)) ? null : attemptRowFor(wantedId, namedRun, project);
+        const attemptRow = attempt === null ? null : reviewRowOf(attempt, now);
+        const chosen = attemptRow !== null ? { ...attemptRow, priority: reviewPriorityOf(attemptRow) } : completedChoice;
+        const selected = chosen === null ? null : reviewCockpitViewOf(chosen, who, now);
+        // A build that delivered nothing reads Failed here, and so does a failed task's delivered result: what went wrong
+        // is the card and Retry the ink act. That result may still be accepted, but only in outline, as Accept anyway, with
+        // a reason.
+        const delivered = selected?.run?.outcome === "built" || selected?.run?.outcome === "no-change";
+        const failedTask = selected === null ? null : store.getTask(selected.taskId);
+        if (selected !== null && attemptRow !== null && selected.run !== null && (!delivered || failedTask?.state === "failed")) {
+            const attemptRun = store.getRun(selected.run.id);
+            const runs = attemptRun === null ? [] : store.runsFor(attemptRun.taskRef);
+            const latest = latestFinishedAttempt(runs);
+            // Retry from here only when the task failed, nothing holds it, and this is its latest attempt or a result it delivered.
+            const retry = failedTask?.state === "failed" && (latest?.id === selected.run.id || delivered) && csrf !== "" && who.role === "approver" && store.currentLiveLease(attemptRun.taskRef, now) === null
+                ? { action: `${taskHref(selected.taskId)}/requeue` } : null;
+            // Accept anyway: the same acceptance this task's latest result takes, never for an older one or one already accepted.
+            const family = delivered ? familyOf(selected.taskId) : null;
+            const acceptAnyway = delivered && csrf !== "" && who.role === "approver" && family?.current.id === selected.taskId && family.problem === null &&
+                runs.find(runIsTaskResult)?.id === selected.run.id && store.proofAcceptance(selected.run.id) === null
+                ? { action: `${taskHref(selected.taskId)}/accept-proof`, run: selected.run.id } : null;
+            if (attemptRun !== null) {
+                // A delivered result didn't fail itself: the task's failure is its latest attempt's.
+                const failure = delivered ? failureOf(runs, null) : explainAttempt(attemptRun, null);
+                selected.failure = { ...failure, retry: retry === null ? null : { ...retry, note: retryNoteOf(failure.suggestion) }, ...(acceptAnyway === null ? {} : { acceptAnyway }) };
+            }
+        }
+        return { chosen, attemptRow, beyond, selected };
+    }
+    /** Whether `run` is a result selectResultFor shows for version `taskId`: a finished attempt that didn't deliver (failed,
+     * stopped, refused…), or the delivered one that is the version's own result — its completed row's, or, for a failed
+     * version, its latest finished attempt. An older delivered build is not (its version's result is the newer one). */
+    function resultRunAdmissible(taskId, run, project) {
+        if ((run.role !== "builder" && run.role !== "scout") || (run.finishedAt === null && run.outcome === null) || runIsLive(run))
+            return false;
+        if (run.outcome !== "built" && run.outcome !== "no-change")
+            return true;
+        const task = store.getTask(taskId);
+        if (task?.state === "failed")
+            return latestFinishedAttempt(store.runsFor(run.taskRef).filter(one => (one.role === "builder" || one.role === "scout") && (one.finishedAt !== null || one.outcome !== null)))?.id === run.id;
+        return completedRowFor(taskId, project)?.runId === run.id;
+    }
+    /** A run's own task and its family's root: the task pages a result form may return to. */
+    function runTasks(taskRef) {
+        const task = store.externalIdFor(taskRef);
+        return task === null ? [] : [task, familyOf(task)?.root.id ?? task];
+    }
     async function showReview(ctx) {
         const { url, who, response, now, project, chosenProject } = ctx;
         // The review cockpit (Priority 5): every visible COMPLETED task,
@@ -423,11 +503,7 @@ export function createTasksHandlers(runtime) {
         // stored verdict, and the sealed patch downloads exactly as stored.
         // Admission binds BEFORE the SQL limit (the done page's own rule),
         // and every row is re-proved against the ceiling before ranking.
-        const resultRow = (row) => {
-            const assignment = assignmentOf(store, row.taskId, now, workAccess(), evidenceRoot);
-            return { ...row, proofReasons: row.runId === null ? [] : store.proofVerdictFor(row.runId)?.reasons ?? [], ciFailing: ciFailingFor(row.runId, row.prNumber),
-                assignment: assignment?.activeTaskId === row.taskId && (assignment.receipt?.runId ?? null) === row.runId ? assignment : null };
-        };
+        const resultRow = (row) => reviewRowOf(row, now);
         const rows = familiesInView(project, { states: ["done"], limit: REVIEW_QUEUE_CAP }).flatMap(family => {
             const row = completedRowFor(family.current.id, project);
             return row === null ? [] : [{ ...resultRow(row), title: family.root.title }];
@@ -441,50 +517,23 @@ export function createTasksHandlers(runtime) {
         // directly — re-proved as done, in this project, and inside the
         // ceiling — so an old receipt never reads as unfinished or foreign.
         // The ranked queue itself stays bounded and says so.
-        const beyond = wantedId === null || inQueue !== null ? null : completedRowFor(wantedId, project);
-        const beyondRow = beyond === null ? null : resultRow(beyond);
-        const completedChoice = inQueue ?? (beyondRow === null ? null : { ...beyondRow, priority: reviewPriorityOf(beyondRow) });
         const expectedRun = url.searchParams.get("run");
         const namedRun = expectedRun !== null && /^[1-9]\d*$/.test(expectedRun) ? Number(expectedRun) : null;
-        // A build that failed (or stopped) has its own result page too: the run named, or a failed task's latest attempt.
-        const attempt = wantedId === null || (completedChoice !== null && (namedRun === null || completedChoice.runId === namedRun)) ? null : attemptRowFor(wantedId, namedRun, project);
-        const attemptRow = attempt === null ? null : resultRow(attempt);
-        const chosen = attemptRow !== null ? { ...attemptRow, priority: reviewPriorityOf(attemptRow) } : completedChoice;
-        const selectedRow = wantedId === null ? ranked[0] ?? null : chosen;
         const csrf = who.via === "cookie" ? who.session.csrf : "";
+        const picked = wantedId === null ? null : selectResultFor(wantedId, namedRun, project, who, now, inQueue);
+        const chosen = picked?.chosen ?? null, attemptRow = picked?.attemptRow ?? null, beyond = picked?.beyond ?? null;
+        const selectedRow = wantedId === null ? ranked[0] ?? null : chosen;
         // An exact link to a result this person can't see (or that never existed) reads the same either way.
         if (expectedRun !== null && wantedId !== null && chosen === null)
             return refuse(response, who, 404, "No such result in your projects.", "/work");
         if (expectedRun !== null && (!/^[1-9]\d*$/.test(expectedRun) || selectedRow?.runId !== Number(expectedRun))) {
             return sendScreen(response, 409, screen("Result changed", html `<h1>Result changed</h1><p>This acceptance link no longer matches the current result. Review the current task before accepting.</p><p class="refusal-back"><a class="button-link" href="/review">Review results</a></p>`, { chrome: chromeFor(project, "runs") }));
         }
-        const selected = selectedRow === null ? null : reviewCockpitViewOf(selectedRow, who, now);
-        // Opening a run's own result page is viewing it: it leaves this person's unread Done on the Agents board.
-        if (wantedId !== null && selected?.run != null)
+        const selected = picked !== null ? picked.selected : selectedRow === null ? null : reviewCockpitViewOf(selectedRow, who, now);
+        // Opening a run's own result page is viewing it: it leaves this person's unread Done on the Agents board — but only
+        // once the run has finished (cockpit §3): a page shown while it was still running saw no finished version.
+        if (wantedId !== null && selected?.run != null && store.getRun(selected.run.id)?.finishedAt != null)
             markAgentSeen(store, who.name, selected.run.id, now);
-        // A build that delivered nothing reads Failed here, and so does a failed task's delivered result: what went wrong
-        // is the card and Retry the ink act. That result may still be accepted, but only in outline, as Accept anyway, with
-        // a reason.
-        const delivered = selected?.run?.outcome === "built" || selected?.run?.outcome === "no-change";
-        const failedTask = selected === null ? null : store.getTask(selected.taskId);
-        if (selected !== null && attemptRow !== null && selected.run !== null && (!delivered || failedTask?.state === "failed")) {
-            const attemptRun = store.getRun(selected.run.id);
-            const runs = attemptRun === null ? [] : store.runsFor(attemptRun.taskRef);
-            const latest = latestFinishedAttempt(runs);
-            // Retry from here only when the task failed, nothing holds it, and this is its latest attempt or a result it delivered.
-            const retry = failedTask?.state === "failed" && (latest?.id === selected.run.id || delivered) && csrf !== "" && who.role === "approver" && store.currentLiveLease(attemptRun.taskRef, now) === null
-                ? { action: `${taskHref(selected.taskId)}/requeue` } : null;
-            // Accept anyway: the same acceptance this task's latest result takes, never for an older one or one already accepted.
-            const family = delivered ? familyOf(selected.taskId) : null;
-            const acceptAnyway = delivered && csrf !== "" && who.role === "approver" && family?.current.id === selected.taskId && family.problem === null &&
-                runs.find(runIsTaskResult)?.id === selected.run.id && store.proofAcceptance(selected.run.id) === null
-                ? { action: `${taskHref(selected.taskId)}/accept-proof`, run: selected.run.id } : null;
-            if (attemptRun !== null) {
-                // A delivered result didn't fail itself: the task's failure is its latest attempt's.
-                const failure = delivered ? failureOf(runs, null) : explainAttempt(attemptRun, null);
-                selected.failure = { ...failure, retry: retry === null ? null : { ...retry, note: retryNoteOf(failure.suggestion) }, ...(acceptAnyway === null ? {} : { acceptAnyway }) };
-            }
-        }
         const reviewPage = reviewCockpitPage(chromeFor(wantedId === null ? project : chosenProject, "runs"), {
             queue: ranked,
             queueCap: REVIEW_QUEUE_CAP,
@@ -570,9 +619,42 @@ export function createTasksHandlers(runtime) {
         if (version !== null && !family.versions.some(one => one.id === version))
             return refuse(response, who, 404, "That version is not available for this task.", taskHref(family.root.id));
         // A version's own address lands on its family's page, still asking for the plan editor when it did (Chat's Edit plan).
-        if (task.taskId !== family.root.id)
-            return redirect(response, `${taskHref(family.root.id)}?version=${encodeURIComponent(task.taskId)}${url.searchParams.get("edit") === "plan" ? "&edit=plan" : ""}`);
-        return taskScreen(response, who, version ?? family.current.id, null, 200, undefined, undefined, url.searchParams.get("edit") === "plan");
+        if (task.taskId !== family.root.id) {
+            // Everything else the address asked for (its tab, result run and view, a form's feedback) rides along.
+            const kept = new URLSearchParams(url.searchParams);
+            kept.delete("version");
+            return redirect(response, `${taskHref(family.root.id)}?version=${encodeURIComponent(task.taskId)}${kept.size === 0 ? "" : `&${kept.toString()}`}`);
+        }
+        // One page per task (docs/plans/one-page-task-and-agent.md): the tab named, and the Result tab's result — the shown
+        // version's own, or the exact run `run=` names, which must be a result of that very version.
+        const tabWord = url.searchParams.get("tab");
+        const tab = tabWord === "result" || tabWord === "plan" ? tabWord : "activity";
+        const runWord = url.searchParams.get("run");
+        const named = runWord === null ? null : /^[1-9][0-9]{0,14}$/.test(runWord) ? Number(runWord) : -1;
+        if (named === -1)
+            return refuse(response, who, 404, "No such result for this task.", taskHref(family.root.id));
+        // A run named without a version is shown with the version it belongs to: a saved link to a result outlives a newer
+        // revision becoming current. A run of no version of this family is no result of it.
+        const owner = named === null || version !== null ? null : (() => { const ref = store.getRun(named)?.taskRef; const id = ref === undefined ? null : store.externalIdFor(ref); return id !== null && family.versions.some(one => one.id === id) ? id : null; })();
+        const shown = version ?? owner ?? family.current.id;
+        const picked = selectResultFor(shown, named, ctx.project, who, ctx.now);
+        if (named !== null && picked.chosen?.runId !== named)
+            return refuse(response, who, 404, "No such result for this task.", taskHref(family.root.id));
+        const base = `${taskHref(family.root.id)}?${shown !== family.current.id ? `version=${encodeURIComponent(shown)}&` : ""}tab=result`;
+        const csrf = who.via === "cookie" ? who.session.csrf : "";
+        const result = picked.selected === null ? null : (() => {
+            const parts = reviewCockpitDetailParts(picked.selected, csrf, url.searchParams.get("noted") !== null, who.via === "cookie" && who.role === "approver", parseResultTab(url.searchParams.get("section")), who.name, { kind: "task", base });
+            // Current: the result the task itself would show (its latest), however the address named it — the header then
+            // owns its status and ceremonies, so no form is ever on the page twice.
+            const latest = named === null ? picked.chosen?.runId ?? null : selectResultFor(shown, null, ctx.project, who, ctx.now).chosen?.runId ?? null;
+            return { html: parts.html, selected: parts.selected, current: shown === family.current.id && latest !== null && latest === picked.chosen?.runId };
+        })();
+        // The attempts the picker offers: exactly the runs this page would show for their version (the same rule as above).
+        const admissible = new Set(family.versions.flatMap(one => {
+            const ref = store.lookupRef(one.id);
+            return ref === null ? [] : store.runsFor(ref.id).filter(run => resultRunAdmissible(one.id, run, ctx.project)).map(run => run.id);
+        }));
+        return taskScreen(response, who, shown, null, 200, undefined, undefined, url.searchParams.get("edit") === "plan", { tab, result, admissible });
     }
     // v103: a task's evidence pack, as a printable page or JSON (the whole family, sealed ledger entries included).
     async function showTaskEvidence(ctx) {
@@ -644,23 +726,28 @@ export function createTasksHandlers(runtime) {
             return respond(response, peeked.status, "text/html; charset=utf-8", peeked.body);
         }
         if (url.searchParams.get("fragment") === "transcript") {
-            // The live transcript window (arc 1): raw sanitized TEXT as JSON —
-            // the sink is textContent, never innerHTML. Guards, enumerated:
-            // cookie session; run visible (proved above); this machine's
-            // runner asserted; byte offsets validated; the file read through
-            // its own descriptor with the exact numeric-id name. Display
-            // state, not evidence — and never cached.
+            // The live conversation's window (arc 1; live-conversation.md §3–4):
+            // JSON over sanitized text or records — the sinks are textContent and
+            // React text, never innerHTML. Guards, enumerated: cookie session; run
+            // visible (proved above); this machine's runner asserted AND owning
+            // the run; byte offsets validated; the file read through its own
+            // descriptor with the exact numeric-id name, and its generation
+            // matched. Display state, not evidence — and never cached.
             response.setHeader("cache-control", "no-store");
             if (who.via !== "cookie")
                 return respond(response, 403, "application/json", JSON.stringify({ error: "session" }));
-            if (options.localRunner === undefined) {
-                return respond(response, 200, "application/json", JSON.stringify({ error: "off" }));
+            const records = url.searchParams.get("shape") === "records";
+            // Notes come from the store, not the file: they show even where the transcript cannot be read.
+            const notesOf = () => (records ? runNotes(store, found, who.name, now) : {});
+            if (options.localRunner === undefined || found.runner !== options.localRunner) {
+                return respond(response, 200, "application/json", JSON.stringify({ error: "off", ...notesOf() }));
             }
             const fromRaw = url.searchParams.get("from") ?? "0";
             const from = /^[0-9]{1,15}$/.test(fromRaw) ? Number(fromRaw) : Number.NaN;
             if (!Number.isSafeInteger(from) || from < 0) {
                 return respond(response, 400, "application/json", JSON.stringify({ error: "offset" }));
             }
+            const sawGen = url.searchParams.get("gen");
             const live = runIsLive(found);
             // The final drain: a finished run's tail — including a torn last
             // line — may be read until the sweep removes the file.
@@ -671,15 +758,35 @@ export function createTasksHandlers(runtime) {
                 }
                 // Missing or unreadable: nothing to show. Final only when the
                 // run can never write again.
-                return respond(response, 200, "application/json", JSON.stringify({ text: "", nextOffset: from, final: !live }));
+                // Nothing was read, so the key state the cursor carried is handed straight back.
+                const inKey = url.searchParams.get("inkey") === "1";
+                const keyTail = validKeyTail(url.searchParams.get("ktail") ?? "") ? url.searchParams.get("ktail") ?? "" : "";
+                const empty = records ? { records: [], nextOffset: from, gen: sawGen, inKey, keyTail, final: !live } : { text: "", nextOffset: from, inKey, keyTail, final: !live };
+                return respond(response, 200, "application/json", JSON.stringify({ ...empty, ...notesOf() }));
+            }
+            // An offset belongs to the file it was read from: another file starts over, visibly.
+            if (sawGen !== null && sawGen !== "" && sawGen !== window.gen) {
+                return respond(response, 409, "application/json", JSON.stringify({ error: "replaced" }));
             }
             // Re-proof after the read (peek discipline): the run row still says
-            // what admission said, or nothing is shown.
+            // what admission said — visible, and still this machine's — or nothing is shown.
             const again = store.getRun(found.id);
-            if (again === null || !runVisible(again)) {
-                return respond(response, 200, "application/json", JSON.stringify({ text: "", nextOffset: from, final: true }));
+            if (again === null || !runVisible(again) || again.runner !== options.localRunner) {
+                const inKey = url.searchParams.get("inkey") === "1";
+                const keyTail = validKeyTail(url.searchParams.get("ktail") ?? "") ? url.searchParams.get("ktail") ?? "" : "";
+                return respond(response, 200, "application/json", JSON.stringify(records ? { records: [], nextOffset: from, gen: window.gen, inKey, keyTail, final: true } : { text: "", nextOffset: from, inKey, keyTail, final: true }));
+            }
+            const final = !live && window.eof;
+            // A key block split across reads stays hidden: the cursor carries whether the last read ended inside one.
+            const tailRaw = url.searchParams.get("ktail") ?? "";
+            const keys = { inKey: url.searchParams.get("inkey") === "1", tail: validKeyTail(tailRaw) ? tailRaw : "" };
+            if (records) {
+                const shown = liveWindowRecords(window, keys);
+                return respond(response, 200, "application/json", JSON.stringify({ records: shown, nextOffset: window.nextOffset, gen: window.gen, inKey: keys.inKey, keyTail: keys.tail ?? "", final, ...notesOf() }));
             }
-            return respond(response, 200, "application/json", JSON.stringify({ text: window.text, nextOffset: window.nextOffset, final: !live && window.eof }));
+            // The plain words, whatever the file's format; the offset moves by the bytes read even when nothing shows.
+            const lines = liveWindowLines(window, keys);
+            return respond(response, 200, "application/json", JSON.stringify({ text: lines.length === 0 ? "" : `${lines.join("\n")}\n`, nextOffset: window.nextOffset, gen: window.gen, inKey: keys.inKey, keyTail: keys.tail ?? "", final }));
         }
         // One result page (2026-10-02): a builder's finished result opens on
         // its task's result page, titled with the task. The raw run record
@@ -1160,7 +1267,7 @@ export function createTasksHandlers(runtime) {
                 ? `Something from build #${run.id} may still be running, so it can't be confirmed stopped yet.` : `Build #${run.id} can't be confirmed stopped.`, 409);
         }
         bustBadge();
-        const to = resultReturnTarget(body.get("return"), run.id);
+        const to = resultReturnTarget(body.get("return"), run.id, runTasks(run.taskRef));
         return redirect(response, body.get("return") ? to : back);
     }
     async function taskMerge(ctx) {
@@ -1195,6 +1302,28 @@ export function createTasksHandlers(runtime) {
             return noPage(who, response);
         return taskMutation(response, who, act.taskId, verb, posted, now);
     };
+    // Cockpit E: Show in Finder — the checkout proved again right now (live, this machine's runner, inside the pool),
+    // then Finder asked to reveal it with a fixed argv. Nothing runs in it; a Mac only.
+    async function runReveal(ctx) {
+        const { url, who, response, now, posted } = ctx;
+        const asked = /^\/r\/([0-9]{1,15})\/reveal$/.exec(url.pathname);
+        if (asked === null)
+            return noPage(who, response);
+        readForm(posted, CONSOLE_FORMS.runReveal);
+        const id = Number(asked[1]);
+        const found = store.getRun(id);
+        if (found === null || !visible(taskRepoOf(found.taskRef)))
+            return refuse(response, who, 404, "no such run");
+        if (store.isDemo())
+            return refuse(response, who, 403, "the demo authorizes nothing");
+        const proof = localCheckoutOf(store, id, { runner: options.localRunner, poolRoot: options.poolRoot }, now);
+        if (!proof.ok)
+            return redirect(response, `/agents?run=${id}&said=reveal-refused`);
+        if (!canReveal(options.revealPath !== undefined))
+            return redirect(response, `/agents?run=${id}&said=reveal-mac-only`);
+        const shown = await (options.revealPath ?? revealInFinder)(proof.path);
+        return redirect(response, `/agents?run=${id}&said=${shown ? "revealed" : "reveal-failed"}`);
+    }
     async function runNote(ctx) {
         const { url, who, response, now, posted } = ctx;
         const noted = /^\/r\/([0-9]{1,15})\/note$/.exec(url.pathname);
@@ -1235,9 +1364,12 @@ export function createTasksHandlers(runtime) {
         // the chat's result view, or the run page — validated to those exact
         // shapes. A refusal sends them back THERE, where the browser has kept
         // their draft, so a failed submission is recoverable in place.
-        const returnTo = resultReturnTarget(body.get("return"), id);
+        const returnTo = resultReturnTarget(body.get("return"), id, runTasks(found.taskRef));
         const selectedTab = parseResultTab(body.get("tab"));
-        const back = selectedTab === "summary" ? returnTo : `${returnTo}${returnTo.includes("?") ? "&" : "?"}tab=${selectedTab}`;
+        // A task page's Result tab keeps the result's own view in `section=` (its `tab` is the task's).
+        const viewParam = returnTo.startsWith("/t/") ? "section" : "tab";
+        const back = selectedTab === "summary" ? returnTo
+            : `${returnTo.replace(/&section=(?:summary|changes|checks)$/, "")}${returnTo.includes("?") ? "&" : "?"}${viewParam}=${selectedTab}`;
         if (body.get("intent") === "revise") {
             const result = requestResultChanges(store, evidenceRoot, {
                 run: id, batch: body.get("batch"), source: body.get("source"), actor: who.name,
@@ -1337,7 +1469,7 @@ export function createTasksHandlers(runtime) {
         if (found === null || !visible(taskRepoOf(found.taskRef))) {
             return refuse(response, who, 404, "no such run");
         }
-        const back = resultReturnTarget(body.get("return"), id);
+        const back = resultReturnTarget(body.get("return"), id, runTasks(found.taskRef));
         const result = createResultRevision(store, evidenceRoot, {
             run: id, batch: body.get("batch"), source: body.get("source"), actor: who.name,
             repos: admissionList(), includeUnplaced: visible(null), allowMode: who.via === "cookie",
@@ -1359,8 +1491,7 @@ export function createTasksHandlers(runtime) {
         if (found === null || !visible(taskRepoOf(found.taskRef)))
             return refuse(response, who, 404, "no such run");
         // The task page that offered Run checks in place is a return target too: this run's own task, or its family's root.
-        const runTask = store.externalIdFor(found.taskRef);
-        const back = resultReturnTarget(body.get("return"), id, runTask === null ? [] : [runTask, familyOf(runTask)?.root.id ?? runTask]);
+        const back = resultReturnTarget(body.get("return"), id, runTasks(found.taskRef));
         if (who.via !== "cookie")
             return refuse(response, who, 403, "Sign in with a browser session to do this.", back);
         if (op === "checks") {
@@ -1615,6 +1746,72 @@ export function createTasksHandlers(runtime) {
                 if (who.via !== "cookie") {
                     return refuse(response, who, 403, "steering is a browser session's act");
                 }
+                // The same gates as a pause or a stop (the route's act scope already refuses a viewer; this says why).
+                if (who.role !== "approver")
+                    return taskScreen(response, who, taskId, "your login can watch — sending an agent a note is an approver's act", 403);
+                if (store.isDemo())
+                    return taskScreen(response, who, taskId, "the demo authorizes nothing", 403);
+                // From the Agents view, the note is for the exact run on screen (live-conversation.md §6): filed only while that
+                // run is still the task's live build, once per draft key. Nothing is filed on a refusal; the view keeps the draft.
+                // An unsent note from an attempt that ended, sent on to the task's next attempt from that agent's page: filed
+                // task-level, back to the same agent with its draft key so only a confirmed send clears the draft.
+                if (body.has("after")) {
+                    const afterRaw = body.get("after") ?? "";
+                    const keyRaw = body.get("key") ?? "";
+                    const ended = /^[1-9][0-9]{0,14}$/.test(afterRaw) ? store.getRun(Number(afterRaw)) : null;
+                    const afterBack = body.get("return");
+                    const afterFlow = returnedFlow(afterBack);
+                    if (ended === null || ended.taskRef !== ref.id || !/^[A-Za-z0-9-]{8,64}$/.test(keyRaw) || body.has("run") || (afterBack !== null && afterBack !== "task" && afterFlow === null)) {
+                        return taskScreen(response, who, taskId, "that note did not say which agent it came from, so nothing was sent", 400);
+                    }
+                    // The same receipt as a send to that run: a draft already filed while it ran comes back as sent, not twice.
+                    const filed = store.fileSteerNoteForRun(taskId, verifiedAuthor(who.name), body.get("note") ?? "", now, { run: ended.id, key: keyRaw, onward: true });
+                    // From the task page or a flow card: back there with the draft's key (only that draft clears), or the refusal in words.
+                    if (afterBack !== null) {
+                        if (filed.ok)
+                            return redirect(response, afterFlow !== null ? `/flows/${afterFlow.flow}?card=${afterFlow.card}&sent=${keyRaw}` : `${taskHref(taskId)}?sent=${keyRaw}#steering`);
+                        return taskScreen(response, who, taskId, filed.reason === "task-finished" ? "this task is finished, so there's no next attempt to send it to" : filed.reason === "key-reused" ? "that form was already used — reload and send it again" : "that note will not store", 409);
+                    }
+                    if (filed.ok)
+                        return redirect(response, `/agents?run=${ended.id}&said=steered-next&sent=${keyRaw}`);
+                    return redirect(response, `/agents?run=${ended.id}&said=${filed.reason === "task-finished" ? "steer-next-finished" : filed.reason === "key-reused" ? "steer-stale" : "steer-invalid"}`);
+                }
+                // A form that asks for a run but names none properly is refused — never quietly filed unbound.
+                if (body.get("return") === "agents" || body.get("return") === "task" || returnedFlow(body.get("return")) !== null || body.has("run") || body.has("key")) {
+                    const runRaw = body.get("run") ?? "";
+                    const keyRaw = body.get("key") ?? "";
+                    const flowBack = returnedFlow(body.get("return"));
+                    const from = flowBack !== null ? "task" : body.get("return");
+                    if ((from !== "agents" && from !== "task") || !/^[1-9][0-9]{0,14}$/.test(runRaw) || !/^[A-Za-z0-9-]{8,64}$/.test(keyRaw)) {
+                        return taskScreen(response, who, taskId, "that note did not say which agent it is for, so nothing was sent", 400);
+                    }
+                    const shown = store.getRun(Number(runRaw));
+                    if (shown === null || shown.taskRef !== ref.id)
+                        return taskScreen(response, who, taskId, "that run is not part of this task", 404);
+                    // An attempt that takes no notes (a planner, a scout, a reviewer, one repairing its handoff) is never filed one:
+                    // it would never read it (cockpit §4).
+                    const capability = steerCapabilityOf(store, shown.id, now);
+                    if (capability !== null && capability.send === null) {
+                        return from === "agents" ? redirect(response, `/agents?run=${shown.id}&said=steer-no-notes`) : taskScreen(response, who, taskId, capability.words, 409);
+                    }
+                    const bound = store.fileSteerNoteForRun(taskId, verifiedAuthor(who.name), body.get("note") ?? "", now, { run: shown.id, key: keyRaw });
+                    // From the task page: back to its steering card, or the refusal in words (the page keeps nothing to restore).
+                    if (from === "task") {
+                        // Back where it was written (the task page, or a flow card's task), with its draft's key: only that draft clears.
+                        if (bound.ok)
+                            return redirect(response, flowBack !== null ? `/flows/${flowBack.flow}?card=${flowBack.card}&sent=${keyRaw}` : `${taskHref(taskId)}?sent=${keyRaw}#steering`);
+                        return taskScreen(response, who, taskId, bound.reason === "attempt-ended" || bound.reason === "task-finished" ? "that attempt ended before your note, so nothing was sent — reload and send it to the current one"
+                            : bound.reason === "invalid-note" ? "that note will not store" : "that form was already used — reload and send it again", 409);
+                    }
+                    // The draft's own key comes back: only that draft is cleared from the box.
+                    if (bound.ok)
+                        return redirect(response, `/agents?run=${shown.id}&said=steered&sent=${keyRaw}`);
+                    if (bound.reason === "attempt-ended" || bound.reason === "task-finished")
+                        return redirect(response, `/agents?run=${shown.id}&said=steer-ended`);
+                    if (bound.reason === "invalid-note")
+                        return redirect(response, `/agents?run=${shown.id}&said=steer-invalid`);
+                    return redirect(response, `/agents?run=${shown.id}&said=steer-stale`);
+                }
                 // The session IS the verified principal here — cookie + CSRF proved it.
                 const filed = store.fileSteerNote(taskId, verifiedAuthor(who.name), body.get("note") ?? "", now);
                 if (!filed.ok) {
@@ -1625,10 +1822,6 @@ export function createTasksHandlers(runtime) {
                             : "no such task";
                     return taskScreen(response, who, taskId, said, 400);
                 }
-                // From the Agents board, back to the same agent (allow-listed: a run of this task, never a URL from the form).
-                const run = Number(body.get("run") ?? "");
-                if (body.get("return") === "agents" && Number.isSafeInteger(run) && store.getRun(run)?.taskRef === ref.id)
-                    return redirect(response, `/agents?run=${run}&said=steered`);
                 return redirect(response, taskHref(taskId));
             }
             case "reply": {
@@ -1999,7 +2192,7 @@ export function createTasksHandlers(runtime) {
                     return taskScreen(response, who, taskId, "nothing to change about the agents", 400);
                 if (phaseGiven !== null) {
                     if (providerGiven === null || !isProviderId(providerGiven))
-                        return taskScreen(response, who, taskId, "provider is claude, codex, openrouter, or gemini", 400);
+                        return taskScreen(response, who, taskId, `provider is one of ${PROVIDER_IDS.join(", ")}`, 400);
                     if (modelGiven === "")
                         return taskScreen(response, who, taskId, "name the exact model id — approvals bind exact agents", 400);
                     const valid = validateSpec({ provider: providerGiven, model: modelGiven });
@@ -2007,6 +2200,8 @@ export function createTasksHandlers(runtime) {
                         return taskScreen(response, who, taskId, `agents not changed: ${valid.problem}`, 400);
                     if (phaseGiven === "review" && providerGiven === "gemini")
                         return taskScreen(response, who, taskId, "gemini cannot review yet — choose claude or codex", 400);
+                    if ((phaseGiven === "plan" || phaseGiven === "review") && isAcpProvider(providerGiven))
+                        return taskScreen(response, who, taskId, `${ACP_AGENTS[providerGiven].name} builds and repairs only — choose another agent to ${phaseGiven}`, 400);
                 }
                 // The configured-choice proof lives INSIDE the edit transaction
                 // (`configured`): the pair is held to the role's choices under the
@@ -2186,7 +2381,9 @@ export function createTasksHandlers(runtime) {
                 if (!consumeApprovalNonce(nonce, who.name, taskId, digest)) {
                     return approvalProblem("that approval form is stale — read it again", 409);
                 }
-                if (token === "" && !hasFreshIdentitySignIn(who.name)) {
+                // An empty password stands for an explicit identity-provider re-check not yet spent, or (cockpit B2) a password
+                // remembered on this session; approve() decides whether these terms may stand on a remembered one.
+                if (token === "" && !passwordlessSessionFor(store, who.name) && !ssoNowAvailable(who.name) && withFreshness("approve-standard", () => freshnessFor(who.name)) === null) {
                     return approvalProblem("approval requires your password, typed again", 400);
                 }
                 const scopeRow = store.getScope(taskId);
@@ -2208,7 +2405,8 @@ export function createTasksHandlers(runtime) {
                         return approvalProblem(`approval is blocked: ${view.problem}`, 409);
                     }
                 }
-                const approved = approveScope(store, taskId, who.name, now, scopeRow.digest, token);
+                // A re-check is spent only if this yes is kept (sealed, or a protected-work vote recorded).
+                const approved = spendingOnlyOnSuccess(() => withFreshness("approve-standard", () => approveScope(store, taskId, who.name, now, scopeRow.digest, token)), result => !result.ok && !(result.reason === "second-approver" && !result.already));
                 if (!approved.ok) {
                     // v102: a first yes on protected work is recorded, not refused — the page says who else is needed.
                     if (approved.reason === "second-approver")
@@ -2218,6 +2416,20 @@ export function createTasksHandlers(runtime) {
                     const status = approved.reason === "changed" || approved.reason === "unrouted" ? 409 : 403;
                     return approvalProblem(approveRefusalWords(approved.reason), status);
                 }
+                // Approve & build again (the plan was rewritten after a build): the same yes requeues, only for the build the
+                // sheet named, and only while it is still the task's latest result, made to an earlier plan than this one.
+                const rebuildRaw = body.get("rebuild") ?? "";
+                if (rebuildRaw !== "") {
+                    const named = /^[0-9]{1,15}$/.test(rebuildRaw) ? store.getRun(Number(rebuildRaw)) : null;
+                    // Built to an earlier plan than the one just approved (the scope this approval sealed, scopeRow.digest);
+                    // requeueTask re-proves, in its own transaction, that it is still the latest result and that scope approved.
+                    const offered = named != null && named.taskRef === ref.id && named.role === "builder" && !!named.scopeDigest && named.scopeDigest !== scopeRow.digest;
+                    const requeued = offered ? store.requeueTask(taskId, who.name, now, { run: named.id, scopeDigest: scopeRow.digest }) : null;
+                    if (requeued === null || (!requeued.ok && requeued.reason === "moved"))
+                        return approvalProblem("Approved. The task changed while this page was open, so it wasn't built again — check its status.", 200);
+                    if (!requeued.ok)
+                        return approvalProblem(`Approved, but building again didn't start (${requeued.reason}). Use Build again.`, 200);
+                }
                 return redirect(response, approvalBack);
             }
             case "accept-proof": {
@@ -2297,7 +2509,8 @@ export function createTasksHandlers(runtime) {
                 const completed = checkAssignmentAsOperator(store, taskId, digest, principal, now, evidenceRoot);
                 if (!completed.ok)
                     return taskScreen(response, who, taskId, completed.message, 409);
-                return redirect(response, reviewHref(taskId, Number(namedRun)));
+                // Back where it was completed (the task page's Result tab, or the result page), as Accept and finish does.
+                return redirect(response, body.get("return") === null ? reviewHref(taskId, Number(namedRun)) : safeReturn(body.get("return")));
             }
             case "retry-review": {
                 return taskScreen(response, who, taskId, "Separate agent reviews have retired. Open the saved result to mark it complete or request a revision.", 410);
@@ -2331,6 +2544,12 @@ export function createTasksHandlers(runtime) {
                     return taskScreen(response, who, taskId, words[asked.reason] ?? asked.detail, 409);
                 }
                 const back = body.get("return") ?? "";
+                // From the Agents board: back to the same agent, saying what happens now.
+                if (back === "agents")
+                    return redirect(response, `/agents?run=${Number(named)}&said=stopping`);
+                const stopFlow = returnedFlow(back);
+                if (stopFlow !== null)
+                    return redirect(response, `/flows/${stopFlow.flow}?card=${stopFlow.card}`);
                 return redirect(response, back === "chat" ? `${taskChatHref(taskId)}#task-control` : `${taskHref(taskId)}#task-control`);
             }
             case "pause": {
@@ -2365,6 +2584,26 @@ export function createTasksHandlers(runtime) {
                     return taskScreen(response, who, taskId, words[asked.reason] ?? asked.detail, asked.reason === "invalid-note" ? 400 : 409);
                 }
                 const back = body.get("return") ?? "";
+                // A note that rode along came from a composer's draft: its key comes back, so only that draft clears.
+                const keyRaw = body.get("key") ?? "";
+                // Only a note this request actually stored clears its draft: a repeated request answers with the note it stored
+                // the first time, and a draft edited since is not that note.
+                const storedId = "note" in asked && typeof asked.note === "number" ? asked.note : null;
+                const stored = storedId === null ? null : store.handle.prepare("SELECT note FROM task_steer WHERE id = ?").get(storedId)?.["note"];
+                const sent = note !== "" && /^[A-Za-z0-9-]{8,64}$/.test(keyRaw) && typeof stored === "string" && stored.trim() === note ? keyRaw : null;
+                // A note that rode along but is not the one this request stored (a reused form): said plainly, the draft kept.
+                if (note !== "" && (typeof stored !== "string" || stored.trim() !== note)) {
+                    if (back === "agents")
+                        return redirect(response, `/agents?run=${Number(named)}&said=pause-note-stale`);
+                    return taskScreen(response, who, taskId, "that form was already used, so your note was not sent — it is still in the box; send it again", 409);
+                }
+                if (back === "agents")
+                    return redirect(response, `/agents?run=${Number(named)}&said=${body.get("mode") === "resume" ? "resuming" : note === "" ? "pausing" : "pausing-with-note"}${sent === null ? "" : `&sent=${sent}`}`);
+                const pauseFlow = returnedFlow(back);
+                if (pauseFlow !== null)
+                    return redirect(response, `/flows/${pauseFlow.flow}?card=${pauseFlow.card}${sent === null ? "" : `&sent=${sent}`}`);
+                if (back === "task")
+                    return redirect(response, `${taskHref(taskId)}${sent === null ? "" : `?sent=${sent}`}#task-control`);
                 return redirect(response, back === "chat" ? `${taskChatHref(taskId)}#task-control` : `${taskHref(taskId)}#task-control`);
             }
             case "resume-arm": {
@@ -2523,7 +2762,7 @@ export function createTasksHandlers(runtime) {
             handoff: run?.handoff ?? null,
             costUsd: run?.costUsd ?? null,
             provider: run?.provider ?? null,
-            authMode: run?.authMode === "subscription" || run?.authMode === "api-key" ? run.authMode : null,
+            authMode: run?.authMode === "subscription" || run?.authMode === "api-key" || run?.authMode === "agent-login" ? run.authMode : null,
             ranMinutes: run === null || run.finishedAt === null
                 ? null
                 : Math.max(1, Math.round((new Date(run.finishedAt).getTime() - new Date(run.startedAt).getTime()) / 60_000)),
@@ -2598,6 +2837,15 @@ export function createTasksHandlers(runtime) {
                 summary: detail.handoff?.conclusion ?? run.handoff,
             },
             detail,
+            // How it ran: derived from the run's own records once it has finished, display only.
+            efficiency: (() => { try {
+                return runEfficiencyOf(store, evidenceRoot, run.id, now);
+            }
+            catch {
+                return null;
+            } })(),
+            // What its network was and what its proxy saw (egress.ts), display only.
+            network: store.runNetwork(run.id),
             reviewRetry: store.reviewRetryStateOf(run.id),
             review: reviewFactsFor(run.id),
             notes: store.notesForRun(run.id),
@@ -2793,6 +3041,7 @@ export function createTasksHandlers(runtime) {
         "task.act.unblock": taskAct("unblock"),
         "task.act.repair-dependency": taskAct("repair-dependency"),
         "task.act.follow-up": taskAct("follow-up"),
+        "run.act.reveal": runReveal,
         "run.act.note": runNote,
         "run.act.comment": runComment,
         "run.act.revise": runRevise,