toolroll 0.9.65 → 0.9.68

package/dist/server/settings.js

@@ -32,7 +32,7 @@ import { budgetLabel, monthOf } from "../spend.js";
 import { PACKAGE_VERSION } from "../version.js";
 import { handlersOf } from './handler-registry.js';
 import { refuse, screen } from "./chrome.js";
-import { HANDOFF_STYLE, redirect, respond, safeReturn, signInSpent, startedHere } from "./http.js";
+import { HANDOFF_STYLE, redirect, respond, safeReturn, sayTo, signInSpent, startedHere } from "./http.js";
 import { html, htmlString, joinHtml, postForm, reauth } from "../html.js";
 import { browserCaller } from "./session.js";
 /** settings handlers, moved without changing their route bodies. */
@@ -80,6 +80,7 @@ import { policyHtml } from "../policy-ui.js";
 import { checkPolicy, parseList, policyParts } from "../policy.js";
 import { parseProjectConcurrency, saveProjectConcurrency } from "../project-concurrency.js";
 import { MAX_NETWORK_HOSTS, normalizeHost } from "../egress.js";
+import { isWritesMode } from "../writes-mode.js";
 import { projectDeleteConfirmHtml, projectSettingsHtml } from "../project-delete-ui.js";
 import { deleteProject, holdingsWords } from "../project-delete.js";
 import { applySavedKnowledge, changeKnowledge, knowledgeVersion, knowledgeView } from "../project-knowledge.js";
@@ -126,7 +127,7 @@ import { personChip, ROLE_TITLES } from "./chrome.js";
 import { chatReturnWithSaid, goOutside } from "./http.js";
 import { latestReleaseFor, leadSettingsHtml, notificationProjects, SETTINGS_AUTOSAVE_SCRIPT, settingsPage, settingsWorkers, telegramDeliveryWords, telegramTrouble } from "./render-settings.js";
 export function createSettingsHandlers(runtime) {
-    const { store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, authenticateCredential, deletedRepos, recordSignIn, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, defaultProject, googleVisits } = runtime;
+    const { store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, authenticateCredential, deletedRepos, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, defaultProject, googleVisits } = runtime;
     // v105: what agent work cost, by month, and the monthly budgets. An instance operator's page.
     async function spendPage(ctx) {
         const { url, who, response, now } = ctx;
@@ -450,7 +451,7 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
     // v105: Settings → Data, where an instance operator downloads everything. The download is a POST with the password.
     async function dataPage(ctx) {
         const { url, response, project } = ctx;
-        const who = browserCaller(ctx.who);
+        browserCaller(ctx.who);
         return sendScreen(response, 200, screen("Data", html `<p><a href="/settings">Settings</a></p><h1>Data</h1>${(dataExportHtml({ problem: url.searchParams.get("problem") }))}`, { chrome: chromeFor(project, "settings") }));
     }
     // v100: Settings → Sign-in, the identity provider people sign in with. An instance operator's page.
@@ -485,7 +486,7 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const { response, now, posted } = ctx;
         const who = browserCaller(ctx.who);
         const body = readForm(posted, CONSOLE_FORMS.passwordless);
-        const back = (key, words) => redirect(response, `/settings/passwordless?${key}=${encodeURIComponent(words)}`);
+        const back = sayTo(response, "/settings/passwordless");
         const action = body.get("action");
         if (action === "off") {
             setPasswordless(store, false, who.name, now);
@@ -811,7 +812,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
     async function spendBudget(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.spendBudget);
-        const back = (key, words) => redirect(response, `/spend?${key}=${encodeURIComponent(words)}`);
+        const back = sayTo(response, "/spend");
         if (!authenticateApprover(who, body.get("password") ?? "").ok)
             return back("problem", "Enter your Toolroll password to change a budget.");
         const target = /^(installation|project|person|subagent):(.+)$/.exec(body.get("target") ?? "");
@@ -847,7 +848,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
             return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
         if (who.via !== "cookie" || who.role !== "approver" || !store.accountCanAccess(who.name, repo))
             return refuse(response, who, 403, "An approver for this project sets how many tasks build at once.", "/settings/project");
-        const back = (key, words) => redirect(response, `/settings/project?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}`);
+        const back = sayTo(response, `/settings/project?repo=${encodeURIComponent(repo)}`);
         const n = parseProjectConcurrency(body.get("concurrency") ?? "");
         if (n === null)
             return back("problem", "Builds at once is a whole number from 1 to 64. Nothing changed.");
@@ -869,7 +870,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
             return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
         if (who.via !== "cookie" || who.role !== "approver" || store.isDemo() || !store.accountCanAccess(who.name, repo))
             return refuse(response, who, 403, "An approver for this project changes the live view.", "/settings/project");
-        const back = (key, words) => redirect(response, `/settings/project?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}`);
+        const back = sayTo(response, `/settings/project?repo=${encodeURIComponent(repo)}`);
         const act = body.get("act");
         if (act === "off")
             return back("said", setLiveCommands(store, { repo, commands: false, by: who.name, via: "the console" }, now).said);
@@ -892,7 +893,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
             return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
         if (who.via !== "cookie" || who.role !== "approver" || store.isDemo() || !store.accountCanAccess(who.name, repo))
             return refuse(response, who, 403, "An approver for this project changes what its builds may reach.", "/settings/project");
-        const back = (key, words) => redirect(response, `/settings/project?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}#network`);
+        const back = sayTo(response, `/settings/project?repo=${encodeURIComponent(repo)}`, "#network");
         const hosts = (body.get("hosts") ?? "").split(/[\s,]+/).filter(Boolean).map(normalizeHost);
         if (hosts.some(one => one === null))
             return back("problem", "A host is a name like api.stripe.com or *.stripe.com: no address, port or path. Nothing changed.");
@@ -941,7 +942,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
     async function policySave(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.policy);
-        const back = (key, words) => redirect(response, `/settings/policy?${key}=${encodeURIComponent(words)}`);
+        const back = sayTo(response, "/settings/policy");
         if (!authenticateApprover(who, body.get("password") ?? "").ok)
             return back("problem", "That password didn't match. Nothing changed.");
         const chosen = body.getAll("provider");
@@ -961,7 +962,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         const known = consoleProjects();
         if (!known.includes(repo))
             return refuse(response, who, 403, "That project is outside your access.", "/settings/approval");
-        const back = (key, words) => redirect(response, `/settings/approval?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}`);
+        const back = sayTo(response, `/settings/approval?repo=${encodeURIComponent(repo)}`);
         if (!authenticateApprover(who, body.get("password") ?? "").ok)
             return back("problem", "That password didn't match. Nothing changed.");
         const protect = body.get("protect") ?? "none";
@@ -979,7 +980,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
     async function requestLimitsSave(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.requestLimits);
-        const back = (key, words) => redirect(response, `/settings/sessions?${key}=${encodeURIComponent(words)}`);
+        const back = sayTo(response, "/settings/sessions");
         const target = body.get("target") ?? "";
         const token = target === "*" ? null : store.apiTokens(null).find(one => one.id === target && one.revokedAt === null) ?? null;
         if (target !== "*" && token === null)
@@ -1003,7 +1004,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         const body = readForm(posted, CONSOLE_FORMS.signIn);
         if (!options.configDir)
             return refuse(response, who, 403, "An instance operator sets up sign-in.", "/settings");
-        const back = (key, words) => redirect(response, `/settings/sign-in?${key}=${encodeURIComponent(words)}`);
+        const back = sayTo(response, "/settings/sign-in");
         const action = body.get("action") ?? "";
         const before = ssoSettings();
         if (action === "test") {
@@ -1045,7 +1046,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         if (databaseFile === null)
             return refuse(response, who, 403, "An instance operator updates Toolroll.", "/settings");
         const stateDir = dirname(databaseFile);
-        const back = (key, words) => redirect(response, `/settings/updates?${key}=${encodeURIComponent(words)}`);
+        const back = sayTo(response, "/settings/updates");
         if (op === "seen") {
             markWhatsNewSeen(stateDir);
             return redirect(response, "/settings/updates");
@@ -1089,7 +1090,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
     async function retentionSave(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.retention);
-        const back = (key, words) => redirect(response, `/settings/retention?${key}=${encodeURIComponent(words)}`);
+        const back = sayTo(response, "/settings/retention");
         if (!authenticateApprover(who, body.get("password") ?? "").ok)
             return back("problem", "Enter your Toolroll password to change retention.");
         const before = store.retentionPeriods();
@@ -1111,7 +1112,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
             return refuse(response, who, 403, "An instance operator looks after storage.", "/settings");
-        const back = (key, words) => redirect(response, `/settings/storage?${key}=${encodeURIComponent(words)}`);
+        const back = sayTo(response, "/settings/storage");
         const what = op === "clean" ? "clean up" : op === "discard" ? "discard a checkout" : "change checkout cleanup";
         if (!authenticateApprover(who, body.get("password") ?? "").ok)
             return back("problem", `Enter your Toolroll password to ${what}.`);
@@ -1151,7 +1152,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
             return refuse(response, who, 404, "No such project.", "/projects");
         if (who.role !== "approver" || store.isDemo())
             return refuse(response, who, 403, "An approver sets up pull requests.", "/projects");
-        const back = (key, words) => redirect(response, `/settings/pull-requests?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}`);
+        const back = sayTo(response, `/settings/pull-requests?repo=${encodeURIComponent(repo)}`);
         const act = body.get("act");
         if (!authenticateApprover(who, body.get("password") ?? "", repo).ok)
             return back("problem", "Enter your Toolroll password to change pull requests.");
@@ -1192,7 +1193,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
             return refuse(response, who, 404, "No such project.", "/projects");
         if (who.role !== "approver" || store.isDemo())
             return refuse(response, who, 403, "An approver sets a project's checks.", "/projects");
-        const back = (key, words) => redirect(response, `/settings/checks?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}`);
+        const back = sayTo(response, `/settings/checks?repo=${encodeURIComponent(repo)}`);
         if (!authenticateApprover(who, body.get("password") ?? "", repo).ok)
             return back("problem", "Enter your Toolroll password to change checks.");
         const act = body.get("act");
@@ -1255,7 +1256,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
             return refuse(response, who, 403, "An instance operator looks after backups.", "/settings");
-        const back = (key, words) => redirect(response, `/settings/backups?${key}=${encodeURIComponent(words)}`);
+        const back = sayTo(response, "/settings/backups");
         if (!authenticateApprover(who, body.get("password") ?? "").ok)
             return back("problem", "Enter your Toolroll password to change backups.");
         const every = body.get("every") ?? "";
@@ -1295,7 +1296,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         const { who, response, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.flowsOn);
         const repo = body.get("repo") ?? "";
-        const back = (key, words) => redirect(response, `/settings/flows?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}`);
+        const back = sayTo(response, `/settings/flows?repo=${encodeURIComponent(repo)}`);
         const known = [...new Set([...(admissionList() ?? []), ...managedRepos(), ...store.knownRepos()])];
         if (store.isDemo())
             return refuse(response, who, 403, "An approver switches starter flows on.", "/settings/flows");
@@ -1314,7 +1315,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         if (!options.configDir)
             return refuse(response, who, 403, "An installation approver tests integrations.", "/settings");
         const key = body.get("key") ?? "";
-        const back = (name, words) => redirect(response, `/settings/integrations?${name}=${encodeURIComponent(words)}`);
+        const back = sayTo(response, "/settings/integrations");
         const checked = (await integrations.check([key])).find(one => one.key === key);
         if (checked === undefined)
             return back("problem", "That integration isn't here any more.");
@@ -1327,7 +1328,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         const body = readForm(posted, CONSOLE_FORMS.monitoring);
         if (!options.configDir)
             return refuse(response, who, 403, "An instance operator sets up monitoring.", "/settings");
-        const back = (key, words) => redirect(response, `/settings/monitoring?${key}=${encodeURIComponent(words)}`);
+        const back = sayTo(response, "/settings/monitoring");
         if (!authenticateApprover(who, body.get("password") ?? "").ok)
             return back("problem", "Enter your Toolroll password to change monitoring.");
         const before = readMonitoring(options.configDir);
@@ -1428,7 +1429,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         const repo = body.get("repo") ?? "";
         if (!visible(repo) || !consoleProjects().includes(repo))
             return refuse(response, who, 403, "That project is outside your access.", "/projects");
-        const back = (key, words, anchor = "") => redirect(response, `/settings/tools?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}${anchor}`);
+        const back = sayTo(response, `/settings/tools?repo=${encodeURIComponent(repo)}`);
         // As for Connect: a post from a page that showed another project is refused, never applied here.
         const shown = body.get("shown") ?? "";
         if (shown !== repo) {
@@ -2483,6 +2484,7 @@ ${modeWords(terms)
         "settings.project-concurrency": projectConcurrency,
         "settings.project-live-view": projectLiveView,
         "settings.project-network": projectNetwork,
+        "settings.project-writes": projectWrites,
         "settings.project-delete": projectDelete,
         "settings.policy-send": policySave,
         "settings.approval-send": approvalSave,
@@ -2566,5 +2568,24 @@ ${modeWords(terms)
         "edge.google-callback": googleCallback,
         "edge.connect-callback": connectCallback,
     });
+    // Settings → Project → Where builds write (writes-mode.ts). An approver for the project changes it with their password
+    // typed now; the ledger keeps before → after. New scopes use it; approved ones keep theirs.
+    async function projectWrites(ctx) {
+        const { who, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.projectWrites);
+        const repo = body.get("repo") ?? "";
+        if (!consoleProjects().includes(repo) || !visible(repo))
+            return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
+        if (who.via !== "cookie" || who.role !== "approver" || store.isDemo() || !store.accountCanAccess(who.name, repo))
+            return refuse(response, who, 403, "An approver for this project changes where its builds may write.", "/settings/project");
+        const back = sayTo(response, `/settings/project?repo=${encodeURIComponent(repo)}`, "#writes");
+        const wanted = body.get("writes");
+        if (!isWritesMode(wanted))
+            return back("problem", "Choose where builds may write. Nothing changed.");
+        if (!authenticateCredential(who, body.get("password") ?? "").ok)
+            return back("problem", "Enter your Toolroll password to change where builds may write.");
+        const changed = store.setProjectWrites(repo, wanted, who.name, now);
+        return back("said", changed.before === changed.after ? "Nothing changed." : "Saved. Tasks scoped from now on use it; tasks already approved keep what they were approved with.");
+    }
     return { registrations, modelsView };
 }

package/dist/server/task-views.js

@@ -3,7 +3,7 @@ import { liveAttemptOf, steerControlsFor } from "../steer-controls.js";
 import { originOf } from "../task-source.js";
 import { taskBaseOf } from "../task-base.js";
 import { assignmentPresentationOf, historicalAssessmentReason } from '../assignment-presentation.js';
-import { html, htmlString, joinHtml } from "../html.js";
+import { html, joinHtml } from "../html.js";
 import { assignmentStatusOf, assignmentWithEvidence } from '../assignment-ui.js';
 import { assignmentOf } from '../assignment.js';
 import { knowledgeContextHtml } from "../knowledge-ui.js";

package/dist/server/tasks.js

@@ -11,7 +11,7 @@ import { handlersOf } from './handler-registry.js';
 import { closedQuestionWords } from "../decision.js";
 import { DEPRECATED_PAGE } from "../deprecations.js";
 /** tasks handlers, moved without changing their route bodies. */
-import { html, htmlString, joinHtml, postForm, textHtml } from "../html.js";
+import { html, htmlString, joinHtml, textHtml } from "../html.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { lstatSync, realpathSync } from "node:fs";
 import {} from "node:http";
@@ -40,7 +40,7 @@ import { isTaskSize, PHASES as ROUTE_PHASES } from "../phase-routing.js";
 import { applyModeToNewFiling, authorizePlanUnderMode } from "../plan-auto.js";
 import { milestonesOf, parseExecutionPlanDocument } from "../plan.js";
 import { levelOfProfile } from "../policy.js";
-import { authorizedProject, canonicalProject, projectName, rowVisible } from "../project.js";
+import { authorizedProject, canonicalProject, projectName, } from "../project.js";
 import { fileTaskProposal } from "../proposal.js";
 import { isProviderId, PROVIDER_IDS, validateSpec } from "../provider.js";
 import { completeAndOpenPullRequest, mergeAsPerson } from '../pull-request-flow.js';
@@ -61,15 +61,15 @@ import { agentQuestion, answerAgentQuestion, markAgentSeen } from "../agent-boar
 import { WorkIndexCursorError, workIndexPage } from "../work-index.js";
 import { buildProgressOf, parseWorkView } from "../workspace-ui.js";
 import { requestContext } from "./request-context.js";
-import { oneLineOf, QUEUE_VIEW, refuse, regionScript, screen, transcriptScript, whenTime } from "./chrome.js";
+import { boardTickScript, oneLineOf, QUEUE_VIEW, refuse, regionScript, screen, transcriptScript, whenTime } from "./chrome.js";
 import { chatReturnWithSaid, matchTaskPath, redirect, respond, reviewHref, safeChatReturn, safeReturn, SAFETY, taskChatHref, taskHref } from "./http.js";
-import { boardBody, donePage, inboxFingerprints, inboxPage, newTaskPage, nextPage, parseInboxTab, QUEUE_FRONT, queueBody, queueScript, TASK_STATES, tasksPage, workPage } from "./render-pages.js";
+import { boardBody, boardWorkers, donePage, inboxFingerprints, inboxPage, newTaskPage, nextPage, parseInboxTab, QUEUE_FRONT, queueBody, queueScript, TASK_STATES, tasksPage, workPage } from "./render-pages.js";
 import { runEfficiencyOf } from "../run-efficiency.js";
 import { ACCEPT_ANYWAY_NEEDS_REASON, editorFileHref, proofBundleView, rankReviewQueue, RESULT_REFUSALS, REVIEW_QUEUE_CAP, reviewCockpitDetailParts, reviewCockpitPage, reviewPriorityOf, runFactsFragment, runOutcomeBadge, runPage, RUNS_PAGE, runsPage, withRefusal } from "./render-results.js";
 import { approvalFormDigest, approveRefusalWords, checkProgressHtml, consentDoorOf, decisionPage, nonceHashOf, PermissionsWouldChange, requirementsFromEditor, resumeDigestOf, taskOf } from "./render-tasks.js";
 import {} from "./session.js";
 export function createTasksHandlers(runtime) {
-    const { store, peekSay, peekCache, PEEK_CACHE_TTL_MS, peekInFlight, PEEK_GLOBAL_INFLIGHT, peekBySession, PEEK_SESSION_INFLIGHT, clock, peekName, PEEK_FRAGMENT_BYTES, peekEvict, evidenceRoot, sendScreen, chromeFor, visible, consumeApprovalNonce, authenticateApprover, options, mintApprovalNonce, taskScreen, unscopedMode, admissionList, planViewOf, revisionViewOf, runIsTaskResult, leadPrincipal, familyOf, armTaskResume, runIsLive, revisionLedgerOf, resultDetailOf, reviewFactsFor, taskRepoOf, runVisible, restricted, codingActorAllowed, codingProjectAllowed, managedRepos, routeViewOf, workAccess, firstRunStepsNow, revisionDocOf, failureOf, dockedConversation, planContractViewOf, familiesInView, explainAttempt, taskChatFocus, familyTasksInView, taskRooms, identify, liveCeiling, projectOf, ceiling, bustBadge, revisionDestination } = runtime;
+    const { store, peekSay, peekCache, PEEK_CACHE_TTL_MS, peekInFlight, PEEK_GLOBAL_INFLIGHT, peekBySession, PEEK_SESSION_INFLIGHT, clock, peekName, PEEK_FRAGMENT_BYTES, peekEvict, evidenceRoot, sendScreen, chromeFor, visible, consumeApprovalNonce, authenticateApprover, options, mintApprovalNonce, taskScreen, unscopedMode, admissionList, planViewOf, revisionViewOf, runIsTaskResult, leadPrincipal, familyOf, armTaskResume, runIsLive, revisionLedgerOf, resultDetailOf, reviewFactsFor, taskRepoOf, runVisible, restricted, codingActorAllowed, codingProjectAllowed, managedRepos, routeViewOf, workAccess, firstRunStepsNow, revisionDocOf, failureOf, dockedConversation, planContractViewOf, familiesInView, explainAttempt, taskChatFocus, familyTasksInView, liveCeiling, projectOf, ceiling, bustBadge, revisionDestination } = runtime;
     /** A row admitted the address but its path parameter does not parse: the console's unknown page. */
     function noPage(who, response) {
         return refuse(response, who, 404, "There's no page at this address.", "/chat");
@@ -399,7 +399,10 @@ export function createTasksHandlers(runtime) {
             });
         });
         const laneCards = [...cards, ...unverifiedCards];
-        const body = boardBody({ cards: laneCards, done: verifiedDone, saturated: snapshot.saturated, now, all, project, delta }, pr => store.ciFailureObserved(pr));
+        // The worker strip: the workers this board's work can go to — bound to
+        // this project, or (rolled up) to any project the ceiling admits.
+        const workers = boardWorkers(store.listRunners(), { all, project, visible });
+        const body = boardBody({ cards: laneCards, workers, done: verifiedDone, saturated: snapshot.saturated, now, all, project, delta }, pr => store.ciFailureObserved(pr));
         if (url.searchParams.get("fragment") === "1") {
             // The live region alone — the in-page swapper's diet. Same auth,
             // same ceiling, no shell, no scripts (finding 2).
@@ -423,7 +426,7 @@ export function createTasksHandlers(runtime) {
         const regionBody = html `<div id="board-region">${body}</div><p class="meta" id="board-region-stamp"></p>`;
         return sendScreen(response, 200, screen("board", regionBody, {
             chrome: chromeFor(project, "board", undefined, all ? "board-all" : undefined),
-            functional: { script: regionScript("board-region", "1"), fetches: true },
+            functional: { script: regionScript("board-region", "1", undefined, { animate: true }) + boardTickScript(), fetches: true },
         }));
     }
     /** A completed (or attempted) row as the review list ranks it: its proof reasons, CI standing, and the assignment

package/dist/setup-guide.d.ts

@@ -15,10 +15,10 @@ export declare function detectPreparation(repo: string): {
 } | null;
 /** Browser installation may write only this known file inside its project. */
 export declare function previewProjectInstructions(repo: string): {
-    content?: never;
     ok: false;
     message: string;
     plan?: never;
+    content?: never;
     fingerprint?: never;
     installed?: never;
 } | {
@@ -30,10 +30,10 @@ export declare function previewProjectInstructions(repo: string): {
     installed: boolean;
 };
 export declare function addProjectInstructions(repo: string, fingerprint: string): {
-    content?: never;
     ok: false;
     message: string;
     plan?: never;
+    content?: never;
     fingerprint?: never;
     installed?: never;
 } | import("./skills.js").InstallResult;

package/dist/skills.d.ts

@@ -33,12 +33,6 @@ export declare const CONTEXT_END = "<!-- standing-orders:end -->";
 export declare function skillContent(): string;
 /** The AGENTS.md block, marker-fenced so reinstalls replace only themselves. */
 export declare function contextBlock(): string;
-/**
- * Whether a repository has the Toolroll skill: a SKILL.md in the current
- * folder, or in the one installs before the rename used. The setup guide
- * and the console's first-run checklist both ask this, so they agree.
- */
-export declare function projectSkillInstalled(repo: string): boolean;
 export type InstallPlan = {
     skillPath: string;
     skillAction: "create" | "replace" | "refuse-foreign";

package/dist/skills.js

@@ -72,14 +72,6 @@ in the plane: read \`skills get knowledge\`, search it with
 merge anything yourself.
 ${CONTEXT_END}`;
 }
-/**
- * Whether a repository has the Toolroll skill: a SKILL.md in the current
- * folder, or in the one installs before the rename used. The setup guide
- * and the console's first-run checklist both ask this, so they agree.
- */
-export function projectSkillInstalled(repo) {
-    return [SKILL_DIR, LEGACY_SKILL_DIR].some(dir => existsSync(join(repo, dir, SKILL_FILE)));
-}
 /** What install would do, computed without writing anything. */
 export function planInstall(repo, writeContext) {
     const skillPath = join(repo, SKILL_DIR, SKILL_FILE);

package/dist/slack-chat.d.ts

@@ -1,4 +1,4 @@
-import { ChatState, type ChatBinding, type ChatContent, type ChatEvent } from "./chat-delivery-state.js";
+import { ChatState } from "./chat-delivery-state.js";
 import { uploadSlackBytes, type SlackApi, type SlackIdentity } from "./slack-api.js";
 import { type Store } from "./store.js";
 import type { SubscriptionLeadRunner } from "./subscription-chat.js";
@@ -19,12 +19,6 @@ export type SlackChatOptions = {
 /** Synchronous receipt before ACK. Never stores response_url, raw tokens, or a pairing code. */
 export declare function receiveSlack(state: ChatState, identity: SlackIdentity, type: string, raw: unknown, now: Date): boolean;
 export declare const processSlackEvent: (options: SlackChatOptions) => Promise<boolean>;
-export declare const applySlackAction: (options: SlackChatOptions, event: ChatEvent, binding: ChatBinding, repos: readonly string[]) => {
-    merge: import("./chat-decide.js").ChatMerge;
-    part: number;
-    shown: string;
-    content: ChatContent;
-} | null;
 export declare const planSlackNotifications: (options: SlackChatOptions) => Promise<void>;
 export declare const planSlackRooms: (options: SlackChatOptions) => Promise<void>;
 export declare function slackBlocks(text: string, buttons?: Record<string, unknown>[]): Record<string, unknown>[];

package/dist/slack-chat.js

@@ -2,9 +2,8 @@ import { chatFlowButtons } from "./chat-flow.js";
 import { refuseResultShots, resultShotsPruned, shotWaitsUntil } from "./result-shots.js";
 import { chatQuestionButtons } from "./subagent-question.js";
 import { chatAskButtons } from "./chat-ask.js";
-import { channelInbox } from "./chat-inbox.js";
-import { roomCommand } from "./chat-rooms.js";
-import { processChatEvent, applyChatAction, planChatNotifications, channelAccess, planRoomMessages, heldForWatch, } from "./chat-delivery.js";
+import { admitChatEvent } from "./chat-admission.js";
+import { processChatEvent, planChatNotifications, channelAccess, planRoomMessages, heldForWatch, } from "./chat-delivery.js";
 /** Slack is a transport for the same saved assistant and confirmation doors. */
 import { proposalPreview, proposalLink, proposalOutcomeText, armedCardText, armedYesLabel, } from "./chat-channel.js";
 import { LEAD_MESSAGE_MAX_CHARS } from "./lead.js";
@@ -100,21 +99,10 @@ export function receiveSlack(state, identity, type, raw, now) {
     // A channel or private group is a room: accepted only while it follows a
     // conversation, or for the `/team` words that make it follow one.
     const isRoom = !slackId(channel, "D");
-    const words = "text" in payload ? payload.text ?? "" : "";
-    // v89: a channel that feeds a flow takes anyone's message (as a card, with no say over anything); "flow 12" connects one.
-    const inbox = isRoom && kind === "message" ? channelInbox(state.store, "slack", identity.installation, String(channel), words) : { watched: false, command: false };
-    const roomish = isRoom && (state.room(identity.installation, String(channel)) !== null || (kind === "message" && roomCommand(words) !== null) || inbox.watched || inbox.command);
-    if (isRoom && !roomish)
-        return false;
-    const binding = state.bindingFor(identity.installation, member);
-    const open = inbox.watched && !inbox.command;
-    if (kind !== "pair" && !open &&
-        (!binding ||
-            !state.live(binding) ||
-            (binding.channel !== channel && !roomish)))
-        return false;
-    if (kind === "pair" && (binding || isRoom))
+    const admitted = admitChatEvent(state, "slack", identity.installation, { kind, member, channel, isRoom, payload });
+    if (admitted === null)
         return false;
+    const { binding } = admitted;
     return state.enqueue({
         id,
         installation: identity.installation,
@@ -139,7 +127,6 @@ const delivery = (options) => ({
     }),
 });
 export const processSlackEvent = (options) => processChatEvent(delivery(options));
-export const applySlackAction = (options, event, binding, repos) => applyChatAction(delivery(options), event, binding, repos);
 export const planSlackNotifications = (options) => planChatNotifications(delivery(options));
 export const planSlackRooms = (options) => planRoomMessages(delivery(options));
 const access = (options, binding, ceiling) => channelAccess(delivery(options), binding, ceiling);

package/dist/slack-settings.d.ts

@@ -1,8 +1,4 @@
 import type { Store } from "./store.js";
 import { type Html } from "./html.js";
-export declare function slackSettingsHtml(store: Store, dir: string, options?: {
-    code?: string;
-    problem?: string;
-    now?: Date;
-    who?: string;
-}): Html;
+import { type ChatSettingsOptions } from "./chat-settings-page.js";
+export declare function slackSettingsHtml(store: Store, dir: string, options?: ChatSettingsOptions): Html;

package/dist/slack-settings.js

@@ -1,41 +1,13 @@
-import { loadPrimary } from "./webhooks.js";
-import { html, postForm } from "./html.js";
+import { html } from "./html.js";
 import { loadSlackCredentials } from "./slack-api.js";
-import { ChatState } from "./chat-delivery-state.js";
+import { chatSettingsHtml } from "./chat-settings-page.js";
 export function slackSettingsHtml(store, dir, options = {}) {
-    const credentials = loadSlackCredentials(dir), state = new ChatState(store, "slack"), bindings = credentials ? state.bindings(credentials.installation).filter(one => state.live(one)) : [], binding = options.who === undefined ? null : bindings.find(one => one.approver === options.who) ?? null, others = bindings.length - (binding === null ? 0 : 1);
-    const runtime = credentials ? state.runtime(credentials.installation) : null;
-    const now = options.now ?? new Date(), live = runtime &&
-        runtime.leaseUntil !== null &&
-        runtime.leaseUntil > now.toISOString() &&
-        runtime.connected;
-    const password = html `<label>Your Toolroll password<input style="min-height:44px" type="password" name="password" autocomplete="current-password" required></label>`;
-    const post = (action, content) => postForm(`/settings/slack/${action}`, content, { attrs: { class: "card" } });
-    const parts = [];
-    if (!credentials) {
-        parts.push(html `<p>Manage projects and review results in a private Slack conversation.</p>`, html `<details open><summary>Create your Slack app</summary><ol><li>Download the <a href="/settings/slack/manifest">app manifest</a>, then <a href="https://api.slack.com/apps" target="_blank" rel="noopener noreferrer">create an app</a> in your workspace using that manifest.</li><li>Under Basic Information, create an app-level token with <code>connections:write</code>.</li><li>Under OAuth &amp; Permissions, install the app and copy its bot token.</li></ol></details>`, post("connect", html `<label>App token<input style="min-height:44px" type="password" name="app-token" autocomplete="off" placeholder="xapp-…" required></label><label>Bot token<input style="min-height:44px" type="password" name="bot-token" autocomplete="off" placeholder="xoxb-…" required></label>${password}<p class="meta">Tokens stay on this installation. Next, pair your own Slack account.</p><button type="submit">Connect Slack</button>`));
-    }
-    else {
-        parts.push(html `<p><strong>${credentials.workspace}</strong> · ${live ? "Connected" : "Waiting for connection"}</p>`);
-        if (runtime?.problem)
-            parts.push(html `<p role="status">${String(runtime.problem)}</p>`);
-        if (!live && !runtime?.problem)
-            parts.push(html `<p>Keep the Toolroll worker running to receive Slack messages.</p>`);
-        if (options.code) {
-            parts.push(html `<h2>Pair your account</h2><p>Send this in a direct message to your Toolroll Slack app. It expires in 10 minutes.</p>`, html `<label>Pairing message<input type="text" readonly value="pair ${options.code}" autocomplete="off" style="width:100%;max-width:100%;font-size:14px;min-height:44px"></label>`, html `<a class="button-link" style="min-height:44px;white-space:nowrap" href="/settings/slack">Check connection</a>`);
-        }
-        else if (binding && state.live(binding)) {
-            const { pending, dropped: failed } = state.partCounts(binding.id);
-            parts.push(html `<p>Your Slack account is paired.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} paired too.` : ""}${pending ? ` ${pending} replies waiting to send.` : ""}${failed ? ` ${failed} replies could not be delivered. Open the saved chat to recover them.` : ""}</p>`, html `<p>Try “What needs my attention?” or “Show the evidence for the latest result.”</p>`, html `<p><a href="/chat">Open saved chat</a></p>`, loadPrimary(process.env, dir) === "slack"
-                ? html `<p>Task updates are sent here.</p>`
-                : post("alerts", html `<button type="submit">Send task updates here</button>`));
-        }
-        else {
-            parts.push(post("pair", html `<h2>Pair your account</h2><p>Your paired Slack account can read your connected projects and confirm proposed changes. Password approvals still open in Toolroll.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} already paired.` : ""}</p>${password}<button type="submit">Create pairing code</button>`));
-        }
-        if (binding && state.live(binding) && !options.code)
-            parts.push(post("unpair", html `${password}<p class="meta">Unpairing ends every open button in your chat. Teammates are unaffected.</p><button type="submit">Unpair my account</button>`));
-        parts.push(html `<details><summary>Connection settings</summary>${post("disconnect", html `${password}<button type="submit">Disconnect Slack</button>`)}</details>`);
-    }
-    return html `<section style="max-width:42rem;overflow-wrap:anywhere"><p><a href="/settings">Settings</a></p><h1>Slack</h1>${options.problem ? html `<p class="problem" role="alert">${options.problem}</p>` : ""}${parts}<details><summary>Access and setup</summary><p>Private messages and threads use your Toolroll permissions. Shared channels are not supported. Secure review links use this installation’s configured HTTPS console address.</p><p>Socket Mode connects out to Slack. It does not need a public webhook or a Tailscale account.</p></details></section>`;
+    return chatSettingsHtml(store, dir, options, {
+        provider: "slack",
+        label: "Slack",
+        credentials: loadSlackCredentials(dir),
+        setup: html `<details open><summary>Create your Slack app</summary><ol><li>Download the <a href="/settings/slack/manifest">app manifest</a>, then <a href="https://api.slack.com/apps" target="_blank" rel="noopener noreferrer">create an app</a> in your workspace using that manifest.</li><li>Under Basic Information, create an app-level token with <code>connections:write</code>.</li><li>Under OAuth &amp; Permissions, install the app and copy its bot token.</li></ol></details>`,
+        connect: password => html `<label>App token<input style="min-height:44px" type="password" name="app-token" autocomplete="off" placeholder="xapp-…" required></label><label>Bot token<input style="min-height:44px" type="password" name="bot-token" autocomplete="off" placeholder="xoxb-…" required></label>${password}<p class="meta">Tokens stay on this installation. Next, pair your own Slack account.</p><button type="submit">Connect Slack</button>`,
+        access: html `<p>Private messages and threads use your Toolroll permissions. Shared channels are not supported. Secure review links use this installation’s configured HTTPS console address.</p><p>Socket Mode connects out to Slack. It does not need a public webhook or a Tailscale account.</p>`,
+    });
 }

package/dist/slack.js

@@ -1,19 +1,12 @@
 /** One leased Socket Mode connection, hosted by the ordinary worker. */
 import { randomBytes } from "node:crypto";
-import { setTimeout as sleep } from "node:timers/promises";
+import { abortablePause, workChatQueue } from "./chat-follow.js";
 import { loadSlackCredentials, slackApi } from "./slack-api.js";
 import { ChatState } from "./chat-delivery-state.js";
 import { receiveSlack, processSlackEvent, deliverSlackPart, planSlackNotifications, planSlackRooms, } from "./slack-chat.js";
 export async function followSlack(options) {
     const owner = randomBytes(16).toString("hex"), state = new ChatState(options.store, "slack");
-    const pause = async (ms) => {
-        try {
-            await sleep(ms, undefined, { signal: options.signal });
-        }
-        catch {
-            /* shutdown */
-        }
-    };
+    const pause = abortablePause(options.signal);
     while (!options.signal.aborted) {
         const credentials = loadSlackCredentials(options.dir);
         if (!credentials ||
@@ -104,20 +97,16 @@ export async function followSlack(options) {
         };
         try {
             await client.start();
-            while (same()) {
-                if (!connected || state.retryAt(credentials.installation) > new Date().toISOString()) {
-                    await pause(1000);
-                    continue;
-                }
-                await processSlackEvent(chat);
-                if (same())
-                    await planSlackRooms(chat);
-                if (same())
-                    await deliverSlackPart(chat);
-                if (same() && options.notifications())
-                    await planSlackNotifications(chat);
-                await pause(1000);
-            }
+            await workChatQueue({
+                same,
+                ready: () => connected && !(state.retryAt(credentials.installation) > new Date().toISOString()),
+                pause,
+                notifications: () => options.notifications(),
+                process: () => processSlackEvent(chat),
+                rooms: () => planSlackRooms(chat),
+                deliver: () => deliverSlackPart(chat),
+                notify: () => planSlackNotifications(chat),
+            });
         }
         catch {
             if (alive)

package/dist/sleep.d.ts

@@ -0,0 +1,2 @@
+/** Wait `ms` milliseconds on the global timer (so fake timers in tests still drive it). */
+export declare const sleep: (ms: number) => Promise<void>;

package/dist/sleep.js

@@ -0,0 +1,2 @@
+/** Wait `ms` milliseconds on the global timer (so fake timers in tests still drive it). */
+export const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));