toolroll 0.9.72 → 0.9.74

package/dist/server/render-tasks.js

@@ -20,7 +20,7 @@ import { CHAT_TASK_ACTIONS } from "../chat-task-actions.js";
 import {} from "../contracts/console-api.js";
 import {} from "../dispatch.js";
 import {} from "../evidence.js";
-import { firstTaskJourney } from "../first-run.js";
+import { taskRoad } from "../first-run.js";
 import { starterForWork } from "../flow-starters.js";
 import {} from "../gaps.js";
 import { readAuthModeStrict } from "../keys.js";
@@ -2359,10 +2359,17 @@ export function taskBodyParts(data) {
             { id: "task-diagnostics", title: "Task options", html: htmlString(optionsHtml), open: optionsOpen, count: null },
         ],
         cancel: cancelForm === "" ? null : { html: htmlString(cancelForm), open: data.cancelDraft !== undefined },
-        journey: data.guide !== true || task.state === "cancelled" || data.status === undefined ? null : (() => {
+        // Every task's road (the first task's guide used to be the only one): facts only, so the checks step says when
+        // checks didn't run, and a research report has none.
+        journey: task.state === "cancelled" || data.status === undefined ? null : (() => {
             const planning = data.plan === "requested" && approveForm === "";
             const read = data.assignment != null ? assignmentStageOf(data.assignment, { token: data.status.token }, planning) : stageOfCode(data.status.token, { planning });
-            return firstTaskJourney(read, scope !== null && approvalOf(scope).approved, task.state === "done");
+            // The checks fact the status card shows, read as what happened: a "note" is a failure when its words say so.
+            const shown = statusCard?.status.details.find(one => one.key === "checks") ?? null;
+            const checks = shown === null ? null : shown.mark === "ok" ? "passed" : shown.mark === "running" ? "running"
+                : shown.mark === "failed" || /\bfailed\b/i.test(shown.text) ? "failed" : shown.mark === "none" ? "not-run" : "unread";
+            const report = data.deliverable === "report" || data.report != null;
+            return taskRoad(read, scope !== null && approvalOf(scope).approved, task.state === "done", { checks, report });
         })(),
         // "Do this every time…": the starter flow that does this kind of work on its own, one yes away.
         thread,

package/dist/server/route-table.js

@@ -139,10 +139,14 @@ get("tasks", "done", "/done", { limited: "collection" });
 get("settings", "mode", "/mode");
 get("people", "people.page", "/people", { limited: "unscoped", ...free });
 get("pages", "system", "/system");
-get("tasks", "tasks", "/tasks", { limited: "collection" });
+get("tasks", "tasks", "/tasks", { limited: "collection", ...free }); // a redirect to /work now: never sent to the project opener first
 get("tasks", "queue", "/queue");
 get("pages", "peek", "/peek", free);
 get("pages", "agents", "/agents", { limited: "unscoped", ...free });
+// The Agents view's Live grid (docs/plans/agents-view.md §3): read-only, every request filtered to what the viewer may see.
+// Browser sessions only, like the transcript and the peek: no token (a lead's, a runner's, a remote one) reads live output.
+get("pages", "agents.live", "/agents/live", { limited: "unscoped", callers: ["cookie"], ...free });
+get("pages", "agents.live.read", `^\\/agents\\/live\\/${ID}$`, { limited: "unscoped", callers: ["cookie"], ...free, sample: "/agents/live/1" });
 get("pages", "fleet", "/fleet", free);
 get("tasks", "tasks.new", "/tasks/new", { limited: "collection", ...free });
 get("tasks", "task.page", `^\\/t\\/${TASK}$`, { project: "task", limited: "resource", ...free, sample: "/t/one" });

package/dist/server/runtime.d.ts

@@ -146,7 +146,7 @@ export interface ServerRuntime {
         via: "cookie";
     }, principal: VerifiedApprover, enabled: Extract<ChatEnablement, {
         ok: true;
-    }>, ceilingUsd: number, follow: boolean, now: Date) => number;
+    }>, ceilingUsd: number, follow: boolean, now: Date, scope?: LeadThreadScope, request?: string) => number;
     projectFamilyPeek: (repo: string, now: Date) => ProjectPeek;
     needsYouBadge: (project: string | null) => {
         count: number;

package/dist/server/settings.js

@@ -63,7 +63,7 @@ import { starterOf, startersFor, switchOnStarter } from "../flow-starters.js";
 import { disconnectGoogle, googleConnected, googleConsent, readGoogleMail, saveGoogleClient } from "../google-mail.js";
 import { integrationsHtml } from "../integrations-ui.js";
 import { clearProviderKey, keyStatus, plausibleKey, PROVIDER_KEY_ENV, readAuthMode, readProviderKey, saveProviderKey, setAuthMode, SUBSCRIPTION_CAPABLE, verdictWords, verifyProviderKey } from "../keys.js";
-import { decisionsHtml, knowledgeHtml, MEMORY_INTRO, memorySearchHtml, proposalsHtml } from "../knowledge-ui.js";
+import { decisionsHtml, framedSection, knowledgeHtml, MEMORY_INTRO, memorySearchHtml, proposalsHtml } from "../knowledge-ui.js";
 import { aboutYouOf, checkAboutYou, saveAboutYou } from "../lead-about.js";
 import { cancelCommitment, conditionWords, openCommitments } from '../lead-commitments.js';
 import { checkLeadIdentity, leadIdentityOf } from "../lead-identity.js";
@@ -508,7 +508,7 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const chosen = url.searchParams.get("repo") ?? project ?? projects[0] ?? "";
         if (chosen && (!projects.includes(chosen) || !visible(chosen)))
             return refuse(response, who, 403, "That project is outside your access.", "/settings/knowledge");
-        const selector = projects.length > 1 ? html `<form class="knowledge" method="get" action="/settings/knowledge"><label>Project<select name="repo">${projects.map(p => html `<option value="${p}"${p === chosen ? ' selected' : ''}>${p.split('/').at(-1) ?? p}</option>`)}</select></label><button>Show project</button></form>` : '';
+        const selector = projects.length > 1 ? framedSection('Project', html `<form class="field-row" method="get" action="/settings/knowledge"><label><span class="visually-hidden">Project</span><select name="repo">${projects.map(p => html `<option value="${p}"${p === chosen ? ' selected' : ''}>${p.split('/').at(-1) ?? p}</option>`)}</select></label><button>Show project</button></form>`) : '';
         let content = html `<p>Add a project to keep its knowledge here.</p>`;
         if (chosen) {
             try {
@@ -533,7 +533,7 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
                 }
                 content = html `<p class="meta">${MEMORY_INTRO}</p>${memorySearchHtml(chosen, memoryQuery, hits)}${proposals}${(decisionsHtml(chosen, listDecisions(store, chosen, who.name, { limit: 50 }), csrf, who.role === 'approver'))}\
 ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf : '')}${knowledgeHtml(view, csrf, who.role === 'approver')}\
-<details class="knowledge"><summary>Learned lessons</summary>${(learningHtml(learningView(store, evidenceRoot, chosen, who.name), csrf, who.role === 'approver'))}</details>`;
+<details class="knowledge frame"><summary class="frame-head">Learned lessons</summary><div class="frame-panel">${(learningHtml(learningView(store, evidenceRoot, chosen, who.name), csrf, who.role === 'approver'))}</div></details>`;
             }
             catch {
                 content = html `<p class="problem" role="alert">Project knowledge is unavailable. Reload to retry.</p>`;
@@ -1422,7 +1422,12 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         for (const [key, visit] of connectVisits)
             if (visit.expires < Date.now())
                 connectVisits.delete(key);
-        connectVisits.set(started.state, started.visit);
+        // The password above proves one thing: this connection, by this account as it is now, and (from a kit whose subagent
+        // is set up) letting that subagent use this tool in this project. The callback holds the visit to exactly that.
+        const kitSet = kit === null || also !== null ? null : kitOf(kit);
+        const installed = kitSet === null || !kitSet.tools.some(one => one.tool === service.id) ? null : kitInstalled(store, kitSet, target);
+        connectVisits.set(started.state, { ...started.visit, generation: store.accountOf(who.name)?.generation ?? -1,
+            grant: installed === null ? null : { subagent: installed.mate.id, tool: service.id, repo: target } });
         return goOutside(response, started.go, `Going to ${service.label} to sign in…`, { state: started.state, path: CONNECT_CALLBACK, secure: origin.startsWith("https:") });
     }
     async function toolsChange(ctx) {
@@ -2015,6 +2020,11 @@ ${postForm("/settings/chat-approval/save", html `\
         if (wanted !== "auto" && wanted !== "bypassPermissions") {
             return refuse(response, who, 400, "permissions must be Auto or Full access", "/settings");
         }
+        // Widening every new task to Full access takes a password (chat-management.md §0a.3): an ordinary step-up, so a
+        // signed-in session does under Passwordless. Back to Auto narrows, and needs none.
+        if (wanted === "bypassPermissions" && store.permissionDefault().mode !== "bypassPermissions" && !authenticateApprover(who, body.get("password") ?? "").ok) {
+            return redirect(response, `/settings?said=${encodeURIComponent("Enter your Toolroll password to start new tasks with Full access. Nothing changed.")}`);
+        }
         store.setPermissionDefault(wanted, who.name, now);
         return redirect(response, `/settings?said=${encodeURIComponent(wanted === "bypassPermissions"
             ? "New tasks now start with Full access. Approved tasks keep their setting."
@@ -2413,7 +2423,14 @@ ${modeWords(terms)
             return done("/settings/tools", "problem", "That sign-in was started in another browser. Connect again from this one.");
         const visit = connectVisits.get(state);
         connectVisits.delete(state);
-        if (visit === undefined || visit.expires < Date.now() || store.accountOf(visit.by)?.role !== "approver")
+        // The signer as at Connect: still an approver, not revoked, the same generation, still in the project. Checked here,
+        // before the connection changes, and again at the grant, after every wait.
+        const standing = () => {
+            const account = visit === undefined ? null : store.accountOf(visit.by);
+            return visit !== undefined && account !== null && account.role === "approver" && account.revokedAt === null && visit.generation !== undefined
+                && account.generation === visit.generation && store.accountCanAccess(visit.by, visit.repo);
+        };
+        if (visit === undefined || visit.expires < Date.now() || !standing())
             return done("/settings/tools", "problem", "That sign-in expired. Connect again.");
         const service = oneClickOf(visit.service);
         const kit = visit.kit === null ? null : kitOf(visit.kit);
@@ -2430,13 +2447,17 @@ ${modeWords(terms)
         const now = clock();
         if (!adapterPolicy({ caller: "service", capability: "none" }).ok)
             return respond(response, 403, "text/plain", "Forbidden");
-        const finished = await finishConnect(store, visit, code, now, { fetcher: options.connectFetch ?? fetch, home: toolHome, omitEnv: ALL_CREDENTIAL_ENV });
+        const finished = await finishConnect(store, visit, code, now, { fetcher: options.connectFetch ?? fetch, home: toolHome, omitEnv: ALL_CREDENTIAL_ENV, stillStanding: standing });
         if (!finished.ok)
             return done(back, "problem", finished.said);
         // From a kit: its teammate may use the tool now (reading freely, the rest after a person approves each call).
         const set = kit === null || !kit.tools.some(one => one.tool === service.id) ? null : kitInstalled(store, kit, visit.repo);
-        if (set !== null && store.subagentGrant(set.mate.id, service.id) === null) {
-            const granted = await grantTool(store, set.mate, service.id, visit.by, now, { toolHome });
+        const bound = visit.grant ?? null;
+        if (set !== null && bound !== null && bound.subagent === set.mate.id && bound.tool === service.id && bound.repo === visit.repo && set.mate.repo === visit.repo
+            && store.subagentGrant(set.mate.id, service.id) === null && standing()) {
+            // The password at Connect (toolsConnect) is this grant's proof, for exactly the grant the visit names, while the
+            // signer still stands: re-checked after the tool's listing, in the step that saves the grant.
+            const granted = await grantTool(store, set.mate, service.id, visit.by, now, { toolHome }, { widening: "proved", stillProved: standing });
             if (granted.ok)
                 return done(back, "said", `${service.label} is connected to ${to}, and ${nameOf(set.mate)} can use it: reading freely, the rest after you approve each call.`);
         }

package/dist/server/task-views.js

@@ -779,7 +779,7 @@ export function createTaskViews(runtime) {
             return runtime.sendScreen(response, status, screen(admittedFamily.root.title, html `<h1>${admittedFamily.root.title}</h1><p>${admittedFamily.current.state}</p><p class="problem" data-history-problem>${admittedFamily.problem}</p>`, { chrome: runtime.chromeFor(admittedFamily.root.repo, "tasks") }));
         const data = taskViewData(taskId, who, problem);
         if (data === null)
-            return refuse(response, who, 404, "no such task", "/tasks");
+            return refuse(response, who, 404, "no such task", "/work");
         const family = runtime.familyOf(taskId);
         const presentedData = { ...data, rootId: family?.root.id ?? taskId, rootTitle: family?.root.title ?? data.task.title,
             ...(family === null || data.assignment != null ? {} : { history: familyHistory(family) }),

package/dist/server/tasks.js

@@ -1,4 +1,4 @@
-import { releaseAuthorityOfTask, revokeRelease } from "../store.js";
+import { releaseAuthorityOfTask, revokeRelease, runLiveCommands } from "../store.js";
 import { steerCapabilityOf } from "../steer-capabilities.js";
 import { canReveal, localCheckoutOf, revealInFinder } from "../checkout-proof.js";
 /** A form's way back to a flow card ("flow:<flow>:<card>"), read strictly: numbers only, never a path. */
@@ -64,7 +64,7 @@ import { buildProgressOf, parseWorkView } from "../workspace-ui.js";
 import { requestContext } from "./request-context.js";
 import { boardTickScript, oneLineOf, QUEUE_VIEW, refuse, regionScript, screen, transcriptScript, whenTime } from "./chrome.js";
 import { chatReturnWithSaid, matchTaskPath, redirect, respond, reviewHref, safeChatReturn, safeReturn, SAFETY, taskChatHref, taskHref } from "./http.js";
-import { boardBody, boardWorkers, donePage, inboxFingerprints, inboxPage, newTaskPage, nextPage, parseInboxTab, QUEUE_FRONT, queueBody, queueScript, TASK_STATES, tasksPage, workPage } from "./render-pages.js";
+import { boardBody, boardWorkers, donePage, inboxFingerprints, inboxPage, newTaskPage, nextPage, parseInboxTab, QUEUE_FRONT, queueBody, queueScript, TASK_STATES, workPage } from "./render-pages.js";
 import { runEfficiencyOf } from "../run-efficiency.js";
 import { ACCEPT_ANYWAY_NEEDS_REASON, editorFileHref, proofBundleView, rankReviewQueue, RESULT_REFUSALS, REVIEW_QUEUE_CAP, reviewCockpitDetailParts, reviewCockpitPage, reviewPriorityOf, runFactsFragment, runOutcomeBadge, runPage, RUNS_PAGE, runsPage, withRefusal } from "./render-results.js";
 import { approvalFormDigest, approveRefusalWords, checkProgressHtml, consentDoorOf, decisionPage, nonceHashOf, PermissionsWouldChange, requirementsFromEditor, resumeDigestOf, taskOf } from "./render-tasks.js";
@@ -207,12 +207,18 @@ export function createTasksHandlers(runtime) {
         // up like the inbox: admission binds the query and every row's repo
         // is re-proved here.
         const view = parseWorkView(url.searchParams.get("view"));
+        // The stored-state filter the old task list had (`?state=`): an unknown state is refused, as it was there.
+        const wantedState = url.searchParams.get("state");
+        if (wantedState !== null && !TASK_STATES.includes(wantedState))
+            return refuse(response, who, 400, "no such state", "/work");
+        const state = wantedState;
         const rollup = project === null && !unscopedMode;
         let work;
         try {
-            work = workIndexPage(store, now, workAccess(), { view, limit: 40, cursor: url.searchParams.get('cursor'), project, root: evidenceRoot });
+            work = workIndexPage(store, now, workAccess(), { view, limit: 40, cursor: url.searchParams.get('cursor'), project, root: evidenceRoot, ...(state === null ? {} : { state }) });
             const facts = requestContext.getStore();
-            if (facts !== undefined) {
+            // A filtered page never stands in for the counts or the Crew: those read the unfiltered work.
+            if (facts !== undefined && state === null) {
                 // These counts cover the exact admitted project lens, including
                 // unplaced tasks where permitted. Crew excludes unplaced rows.
                 if (project === null)
@@ -259,6 +265,7 @@ export function createTasksHandlers(runtime) {
             previous: url.searchParams.has('cursor'),
             multiProject: new Set(work.items.map(task => task.repo ?? "")).size > 1,
             now,
+            state,
             // v105: subscription windows and monthly budgets, for whoever runs the installation.
             limits: store.isInstanceOperator(who.name)
                 ? limitsView(store.providerLimits(), store.budgets().length === 0 ? [] : store.monthSpendCached(now).budgets, { project: projectName, subagent: id => subagentNamesOf(store.handle).get(id) ?? `Subagent ${id}` }, now)
@@ -565,24 +572,18 @@ export function createTasksHandlers(runtime) {
         const { response, project } = ctx;
         return sendScreen(response, 200, donePage(chromeFor(project, "runs"), store.listCompletedWorkScoped(project, 50), pr => store.ciFailureObserved(pr)));
     }
+    /** The old task list, retired into /work (docs/plans/reui-polish.md slice 7): its address keeps answering, as a
+     * redirect, so links and bookmarks still land. `state` carries over (an unknown one is still refused); `template`
+     * goes to the add page, which now pre-fills it. Anything else is dropped. */
     async function showTasks(ctx) {
-        const { url, who, response, project } = ctx;
+        const { url, who, response } = ctx;
         const wanted = url.searchParams.get("state");
-        if (wanted !== null && !TASK_STATES.includes(wanted)) {
-            return refuse(response, who, 400, "no such state", "/tasks");
-        }
-        // ?template=<name> pre-fills the add form from the shipped library —
-        // a pre-filled form and nothing more; the submission path is the
-        // same guarded handler either way.
-        const fromTemplate = url.searchParams.get("template");
-        const picked = fromTemplate === null ? null : templateByName(fromTemplate);
-        const prefill = picked !== null && picked.kind === "task"
-            ? {
-                title: picked.title, goal: picked.goal, not: picked.outOfScope ?? "", touches: picked.touches.join(", "),
-                acceptance: acceptanceToLines(picked.acceptance).join("\n"),
-            }
-            : null;
-        return sendScreen(response, 200, tasksPage(chromeFor(project, "tasks"), familyTasksInView(project, wanted === null ? undefined : wanted).slice(0, 200), wanted, null, project, prefill, store.permissionDefault().mode, store.qualityDefault().mode, store.replacements()));
+        if (wanted !== null && !TASK_STATES.includes(wanted))
+            return refuse(response, who, 400, "no such state", "/work");
+        const template = url.searchParams.get("template");
+        if (template !== null)
+            return redirect(response, `/tasks/new?template=${encodeURIComponent(template)}`);
+        return redirect(response, wanted === null ? "/work" : `/work?state=${encodeURIComponent(wanted)}`);
     }
     async function showQueue(ctx) {
         const { url, who, response, project } = ctx;
@@ -599,14 +600,11 @@ export function createTasksHandlers(runtime) {
         return redirect(response, QUEUE_VIEW);
     }
     async function showNewTask(ctx) {
-        const { who, response, project } = ctx;
-        const revision = who.via === "cookie" ? who.session.projectRevision : 0;
-        const chainable = store
-            .listTasksScoped(project, undefined, 100, null)
-            .filter(one => one.state !== "done" && one.state !== "cancelled" && visible(one.repo))
-            .map(one => ({ id: one.id, title: one.title }));
-        const chrome = chromeFor(project, "tasks");
-        return sendScreen(response, 200, newTaskPage(chrome, project, revision, null, chainable, store.permissionDefault().mode, store.qualityDefault().mode, chrome.projects ?? []));
+        const picked = (() => { const name = ctx.url.searchParams.get("template"); return name === null ? null : templateByName(name); })();
+        const prefill = picked !== null && picked.kind === "task"
+            ? { title: picked.title, goal: picked.goal, not: picked.outOfScope ?? "", touches: picked.touches.join(", "), acceptance: acceptanceToLines(picked.acceptance).join("\n") }
+            : null;
+        return newTaskScreen(ctx, 200, null, prefill);
     }
     async function showTask(ctx) {
         const { url, who, response } = ctx;
@@ -615,7 +613,7 @@ export function createTasksHandlers(runtime) {
             return noPage(who, response);
         const family = familyOf(task.taskId);
         if (family === null)
-            return refuse(response, who, 404, "no such task", "/tasks");
+            return refuse(response, who, 404, "no such task", "/work");
         const version = url.searchParams.get("version");
         if (version !== null && !family.versions.some(one => one.id === version))
             return refuse(response, who, 404, "That version is not available for this task.", taskHref(family.root.id));
@@ -666,12 +664,12 @@ export function createTasksHandlers(runtime) {
         const access = workAccess();
         const family = store.taskFamilyOf(evidence.taskId, access.repos, access.includeUnplaced);
         if (family === null || !visible(family.root.repo))
-            return refuse(response, who, 404, "no such task", "/tasks");
+            return refuse(response, who, 404, "no such task", "/work");
         if (evidence.taskId !== family.root.id)
             return redirect(response, `${taskHref(family.root.id)}/evidence${url.search}`);
         const pack = evidencePack(store, family.root.id, access, who.name, now, evidenceRoot);
         if (pack === null)
-            return refuse(response, who, 404, "no such task", "/tasks");
+            return refuse(response, who, 404, "no such task", "/work");
         if (url.searchParams.get("format") === "json") {
             response.writeHead(200, { "content-type": "application/json; charset=utf-8", "content-disposition": `attachment; filename="evidence-${family.root.id.replace(/[^A-Za-z0-9._-]/g, "_")}.json"`,
                 "cache-control": "no-store", "x-content-type-options": "nosniff" });
@@ -782,11 +780,13 @@ export function createTasksHandlers(runtime) {
             const tailRaw = url.searchParams.get("ktail") ?? "";
             const keys = { inKey: url.searchParams.get("inkey") === "1", tail: validKeyTail(tailRaw) ? tailRaw : "" };
             if (records) {
-                const shown = liveWindowRecords(window, keys);
+                // Command text and output only under this run's own captured answer, never the file's `open` record (v136).
+                const commands = runLiveCommands(store, found.id);
+                const shown = liveWindowRecords(window, commands, keys);
                 return respond(response, 200, "application/json", JSON.stringify({ records: shown, nextOffset: window.nextOffset, gen: window.gen, inKey: keys.inKey, keyTail: keys.tail ?? "", final, ...notesOf() }));
             }
             // The plain words, whatever the file's format; the offset moves by the bytes read even when nothing shows.
-            const lines = liveWindowLines(window, keys);
+            const lines = liveWindowLines(window, runLiveCommands(store, found.id), keys);
             return respond(response, 200, "application/json", JSON.stringify({ text: lines.length === 0 ? "" : `${lines.join("\n")}\n`, nextOffset: window.nextOffset, gen: window.gen, inKey: keys.inKey, keyTail: keys.tail ?? "", final }));
         }
         // One result page (2026-10-02): a builder's finished result opens on
@@ -978,7 +978,7 @@ export function createTasksHandlers(runtime) {
         if (who.via === "cookie") {
             const seen = body.get("projectRevision");
             if (seen !== null && seen !== String(who.session.projectRevision)) {
-                return refuse(response, who, 409, "the open project changed since this form was rendered — reload and try again", "/tasks");
+                return refuse(response, who, 409, "the open project changed since this form was rendered — reload and try again", "/tasks/new");
             }
         }
         const id = (body.get("id") ?? "").trim();
@@ -998,8 +998,10 @@ export function createTasksHandlers(runtime) {
         // finding 1): the form's `required` is a courtesy, not the guard — a
         // direct POST with no project open must not mint an unplaced task
         // under a ceiling. Unscoped mode keeps its historic unplaced filings.
+        // A refusal from here on is the add page again with the person's own words (the old task list kept them too).
+        const draft = { title, goal: body.get("goal") ?? "", not: body.get("not") ?? "", touches: body.get("touches") ?? "", acceptance: body.get("acceptance") ?? "", values: body.sent };
         if (!unscopedMode && effective === "") {
-            return sendScreen(response, 400, tasksPage(chromeFor(project, "tasks"), familyTasksInView(project).slice(0, 200), null, "name a repository — no project is open, so the task must say where it belongs", project, null, store.permissionDefault().mode, store.qualityDefault().mode, store.replacements()));
+            return newTaskScreen(ctx, 400, "name a repository — no project is open, so the task must say where it belongs", draft);
         }
         let repo = effective;
         let admitted = unscopedMode ? null : admissionList() ?? [];
@@ -1007,7 +1009,7 @@ export function createTasksHandlers(runtime) {
         if (rootMode && effective !== "") {
             const canonical = (await authorizedProject(liveCeiling(), effective)) ? canonicalProject(effective) : null;
             if (canonical === null || canonical === undefined) {
-                return sendScreen(response, 403, tasksPage(chromeFor(project, "tasks"), familyTasksInView(project).slice(0, 200), null, `${effective} is outside what this server was configured to show`, project, null, store.permissionDefault().mode, store.qualityDefault().mode, store.replacements()));
+                return newTaskScreen(ctx, 403, `${effective} is outside what this server was configured to show`, draft);
             }
             repo = canonical;
             admitted = [canonical];
@@ -1063,7 +1065,7 @@ export function createTasksHandlers(runtime) {
             return filed;
         });
         if (!made.ok) {
-            return sendScreen(response, made.reason === "backlog-full" ? 429 : 400, tasksPage(chromeFor(project, "tasks"), familyTasksInView(project).slice(0, 200), null, made.message, project, { title, goal, not: notThis, touches: body.get("touches") ?? "", acceptance: body.get("acceptance") ?? "", values: body.sent }, store.permissionDefault().mode, store.qualityDefault().mode, store.replacements()));
+            return newTaskScreen(ctx, made.reason === "backlog-full" ? 429 : 400, made.message, { title, goal, not: notThis, touches: body.get("touches") ?? "", acceptance: body.get("acceptance") ?? "", values: body.sent });
         }
         const actionContext = requestContext.getStore();
         if (actionContext !== undefined)
@@ -1248,7 +1250,7 @@ export function createTasksHandlers(runtime) {
         const back = taskHref(act.taskId);
         const ref = store.lookupRef(act.taskId);
         if (ref === null || !visible(ref.repo))
-            return refuse(response, who, 404, "no such task", "/tasks");
+            return refuse(response, who, 404, "no such task", "/work");
         const named = (body.get("run") ?? "").trim();
         const run = /^[0-9]{1,15}$/.test(named) ? store.getRun(Number(named)) : null;
         const runTask = run === null ? null : store.externalIdFor(run.taskRef);
@@ -1283,7 +1285,7 @@ export function createTasksHandlers(runtime) {
             return taskScreen(response, who, act.taskId, "The demo merges nothing.", 403);
         const ref = store.lookupRef(act.taskId);
         if (ref === null || !visible(ref.repo))
-            return refuse(response, who, 404, "no such task", "/tasks");
+            return refuse(response, who, 404, "no such task", "/work");
         const named = (body.get("run") ?? "").trim();
         const run = /^[0-9]{1,15}$/.test(named) ? store.getRun(Number(named)) : null;
         const runTask = run === null ? null : store.externalIdFor(run.taskRef);
@@ -1733,10 +1735,10 @@ export function createTasksHandlers(runtime) {
     function taskMutation(response, who, taskId, verb, posted, now) {
         const ref = store.lookupRef(taskId);
         if (ref === null || store.getTask(taskId) === null) {
-            return refuse(response, who, 404, "no such task", "/tasks");
+            return refuse(response, who, 404, "no such task", "/work");
         }
         if (!visible(ref.repo)) {
-            return refuse(response, who, 404, "no such task", "/tasks");
+            return refuse(response, who, 404, "no such task", "/work");
         }
         switch (verb) {
             case "steer": {
@@ -3065,5 +3067,21 @@ export function createTasksHandlers(runtime) {
         "session.editor-links": sessionEditorLinks,
         "incident.resolve": resolveIncident,
     });
+    /** The add page, once more: blank, from a shipped template (`?template=`, as the old task list did), or with a refused
+     * filing's own words and status (the draft keeps the project revision it was written against). */
+    function newTaskScreen(ctx, status, problem, draft) {
+        const { who, response, project } = ctx;
+        const chainable = store
+            .listTasksScoped(project, undefined, 100, null)
+            .filter(one => one.state !== "done" && one.state !== "cancelled" && visible(one.repo))
+            .map(one => ({ id: one.id, title: one.title }));
+        // A refused draft keeps the task it was to start after, even if the refreshed list no longer carries it.
+        const after = draft?.values?.get("after") ?? "";
+        if (after !== "" && !chainable.some(one => one.id === after))
+            chainable.unshift({ id: after, title: "(as submitted)" });
+        const chrome = chromeFor(project, "tasks");
+        const revision = draft?.values !== undefined ? undefined : who.via === "cookie" ? who.session.projectRevision : 0;
+        return sendScreen(response, status, newTaskPage(chrome, project, revision, problem, chainable, store.permissionDefault().mode, store.qualityDefault().mode, chrome.projects ?? [], draft));
+    }
     return { registrations, runListPane, peekFragment, taskMutation, queueRegionFor, ciFailingFor, completedRowFor, attemptRowFor, resultRowOf, reviewCockpitViewOf, decisionEvidence, runEvidence, sendArtifact, peekGuards, liveRunIds };
 }

package/dist/setup-guide.d.ts

@@ -15,10 +15,10 @@ export declare function detectPreparation(repo: string): {
 } | null;
 /** Browser installation may write only this known file inside its project. */
 export declare function previewProjectInstructions(repo: string): {
+    content?: never;
     ok: false;
     message: string;
     plan?: never;
-    content?: never;
     fingerprint?: never;
     installed?: never;
 } | {
@@ -30,10 +30,10 @@ export declare function previewProjectInstructions(repo: string): {
     installed: boolean;
 };
 export declare function addProjectInstructions(repo: string, fingerprint: string): {
+    content?: never;
     ok: false;
     message: string;
     plan?: never;
-    content?: never;
     fingerprint?: never;
     installed?: never;
 } | import("./skills.js").InstallResult;

package/dist/store.d.ts

@@ -103,6 +103,9 @@ export declare const BRANCH_BASE_MOVE_SCHEMA = "\nCREATE TABLE IF NOT EXISTS bra
  * continues a paused build with a short continue frame and no note: one row per request, bound to the exact paused run;
  * sent_at when the frame was written, ended_at when the run was no longer paused to take it. */
 export declare const LIVE_STEER_SCHEMA = "\nCREATE TABLE IF NOT EXISTS run_pause (\n  id            INTEGER PRIMARY KEY AUTOINCREMENT,\n  run           INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  task_ref      INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  request_id    TEXT NOT NULL UNIQUE,\n  requested_by  TEXT NOT NULL,\n  requested_via TEXT NOT NULL CHECK (requested_via IN ('cli','web','chat')),\n  requested_at  TEXT NOT NULL,\n  note          INTEGER REFERENCES task_steer(id) ON DELETE SET NULL,\n  sent_at       TEXT,\n  paused_at     TEXT,\n  resumed_at    TEXT,\n  ended_at      TEXT\n);\nCREATE INDEX IF NOT EXISTS run_pause_by_run ON run_pause (run, id);\nCREATE TABLE IF NOT EXISTS run_resume (\n  id            INTEGER PRIMARY KEY AUTOINCREMENT,\n  run           INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  task_ref      INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  request_id    TEXT NOT NULL UNIQUE,\n  requested_by  TEXT NOT NULL,\n  requested_via TEXT NOT NULL CHECK (requested_via IN ('cli','web','chat')),\n  requested_at  TEXT NOT NULL,\n  sent_at       TEXT,\n  ended_at      TEXT\n);\nCREATE INDEX IF NOT EXISTS run_resume_by_run ON run_resume (run, id);\n";
+/** v136: a run's own "Show commands in the live view" answer, captured once before its live file opens (live-detail.ts).
+ * Absent, unreadable or anything but 1 means off. */
+export declare const RUN_LIVE_DETAIL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS run_live_detail (\n  run         INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,\n  commands    INTEGER NOT NULL CHECK (commands IN (0,1)),\n  captured_at TEXT NOT NULL\n);\n-- The Agents view's Live grid (docs/plans/agents-view.md \u00A72.5): every role's running runs and its recently ended ones.\n-- (id > 0 keeps them to the grid's own query, which names it: no other query's plan is offered them.)\nCREATE INDEX IF NOT EXISTS run_live_open ON run (id) WHERE outcome IS NULL AND id > 0;\nCREATE INDEX IF NOT EXISTS run_live_recent ON run (finished_at) WHERE outcome IS NOT NULL AND id > 0;\n";
 /** A project's "Show commands in the live view" (live-detail.ts): absent means off. */
 export declare const LIVE_DETAIL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS live_detail_setting (\n  repo       TEXT PRIMARY KEY,\n  commands   INTEGER NOT NULL CHECK (commands IN (0,1)),\n  updated_by TEXT NOT NULL,\n  updated_at TEXT NOT NULL\n);\n-- Every run a steering note reached, kept as it happens (live-notes.ts): a\n-- note's own attached/mailed fields move to the next attempt, this does not.\nCREATE TABLE IF NOT EXISTS steer_note_run (\n  note INTEGER NOT NULL REFERENCES task_steer(id) ON DELETE CASCADE,\n  run  INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  how  TEXT NOT NULL CHECK (how IN ('attached','mailed','read')),\n  at   TEXT NOT NULL,\n  PRIMARY KEY (note, run, how)\n);\nCREATE INDEX IF NOT EXISTS steer_note_run_by_run ON steer_note_run (run, note);\n";
 export declare const CHAT_APPROVAL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS chat_approval_setting (\n  approver             TEXT NOT NULL,\n  scope                TEXT NOT NULL,\n  enabled              INTEGER NOT NULL CHECK (enabled IN (0,1)),\n  full_access          INTEGER NOT NULL DEFAULT 0 CHECK (full_access IN (0,1)),\n  attempt_cap_microusd INTEGER CHECK (attempt_cap_microusd IS NULL OR attempt_cap_microusd >= 0),\n  generation           INTEGER NOT NULL,\n  digest               TEXT NOT NULL,\n  updated_by           TEXT NOT NULL,\n  updated_at           TEXT NOT NULL,\n  PRIMARY KEY (approver, scope)\n);\n";
@@ -183,7 +186,7 @@ export type SealedLedgerEntry = LedgerEntry & {
         hash: string;
     } | null;
 };
-export declare const SCHEMA_VERSION = 135;
+export declare const SCHEMA_VERSION = 136;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export declare const V118_MERGED_TABLES: Readonly<Record<string, CredentialKind>>;
 /**
@@ -2354,6 +2357,9 @@ export declare class Store {
     sealScopeApproval(taskId: string, by: string, now: Date, mutation?: Mutation, basis?: {
         kind: "mode" | "chat" | "grant" | "schedule";
         modeDigest: string;
+        /** A chat seal of a deploy gate: the release card it came from (chat-management.md §0a.5). */
+        card?: "release";
+        cardDigest?: string;
     }, approverKind?: ApproverKind): boolean;
     /** Whether this task's scope carries a LIVE seal: approved, and the
      * approved digest is the current one (a rewritten scope unseals). The
@@ -7132,6 +7138,11 @@ export declare class Store {
         error: string;
     }, now: Date): boolean;
     private bumpPushFailures;
+    /** Which conversation a page's first send started (quiet page visits): recorded with the start, in the same
+     * transaction, so a retry of that send never starts another, even after a restart or once that one has ended. */
+    leadStartReceipt(approver: string, request: string): {
+        session: number;
+    } | null;
     /** A chat send receipt contains no message text. The session is part of
      * its namespace; callers must prove that session before reading it. */
     leadRequestReceipt(session: number, request: string): {
@@ -7744,3 +7755,25 @@ export declare function currentReleaseIssuer(): ReleaseIssuer;
  * that can't be read — is not proof, and the operation stays for a person.
  */
 export declare function releaseIssuerGone(op: ReleaseOperation): boolean;
+/**
+ * Capture a run's live-view answer once, before its live file opens: the first capture stands (a second never changes
+ * it). Returns the answer now saved for the run; any failure, or a saved row that isn't plainly 1, is commands off.
+ */
+export declare function captureRunLiveDetail(store: Store, runId: number, commands: boolean, now: Date): boolean;
+/** Whether a run's live view may show commands: only its own captured answer, and only when that is plainly 1. Absent
+ * (a run from before v136, or one whose capture failed), unreadable or anything else is off. */
+export declare function runLiveCommands(store: Store, runId: number): boolean;
+/** One run as the Agents view's Live grid reads it (docs/plans/agents-view.md §2.5). */
+export type AgentsLiveRun = Run & {
+    taskId: string;
+    title: string;
+    repo: string | null;
+    builtIn: boolean;
+};
+/**
+ * The Live grid's runs: every role's running run (no outcome yet) and every run that ended at or after `endedSince`,
+ * newest first — all of them (no cutoff before the caller's visibility filter: a viewer's agent is never hidden behind
+ * others'). Two indexed reads (run_live_open, run_live_recent), never a scan of all runs.
+ * Visibility is the caller's: it filters each by the console's ceiling and the viewer's access.
+ */
+export declare function agentsLiveRuns(store: Store, endedSince: Date): AgentsLiveRun[];

package/dist/store.js

@@ -443,6 +443,19 @@ CREATE TABLE IF NOT EXISTS run_resume (
 );
 CREATE INDEX IF NOT EXISTS run_resume_by_run ON run_resume (run, id);
 `;
+/** v136: a run's own "Show commands in the live view" answer, captured once before its live file opens (live-detail.ts).
+ * Absent, unreadable or anything but 1 means off. */
+export const RUN_LIVE_DETAIL_SCHEMA = `
+CREATE TABLE IF NOT EXISTS run_live_detail (
+  run         INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,
+  commands    INTEGER NOT NULL CHECK (commands IN (0,1)),
+  captured_at TEXT NOT NULL
+);
+-- The Agents view's Live grid (docs/plans/agents-view.md §2.5): every role's running runs and its recently ended ones.
+-- (id > 0 keeps them to the grid's own query, which names it: no other query's plan is offered them.)
+CREATE INDEX IF NOT EXISTS run_live_open ON run (id) WHERE outcome IS NULL AND id > 0;
+CREATE INDEX IF NOT EXISTS run_live_recent ON run (finished_at) WHERE outcome IS NOT NULL AND id > 0;
+`;
 /** A project's "Show commands in the live view" (live-detail.ts): absent means off. */
 export const LIVE_DETAIL_SCHEMA = `
 CREATE TABLE IF NOT EXISTS live_detail_setting (
@@ -737,7 +750,10 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // release_operation), each release check attempt's intended mode, sealed before it runs (release_check_attempt), the
 // nightly full check on main and its open failures (nightly_check, main_check_failure), and a scope's release terms
 // (task_scope.release_terms_json; saved rows read NULL: no release terms).
-export const SCHEMA_VERSION = 135;
+// v136 adds, and changes no saved row: each run's own "Show commands in the live view" answer, captured once before its
+// live file opens (run_live_detail; docs/plans/agents-view.md §2.4). Saved runs have none, which every reader takes as
+// commands off: permission is never recovered from a transcript or the project's current setting.
+export const SCHEMA_VERSION = 136;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -870,7 +886,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -4219,6 +4235,8 @@ CREATE INDEX IF NOT EXISTS run_checkpoint_by_task ON run_checkpoint (task_ref, i
         for (const [column, { definition }] of Object.entries(columns))
             addColumn(db, table, column, definition);
     }
+    // v136: each run's own live-view answer (a new table only; saved runs have none: commands off).
+    db.exec(RUN_LIVE_DETAIL_SCHEMA);
     // Keep the epoch until reclamation succeeds, including a retry after compaction already committed. A new file has
     // nothing to reclaim.
     if (!fresh)
@@ -6989,6 +7007,12 @@ export class Store {
             const terms = storedReleaseTerms(working["release_terms_json"]);
             if (!terms.ok)
                 return false;
+            // A DEPLOY GATE FROM CHAT (chat-management.md §0a.5): a signed candidate or release terms seal from chat only
+            // with the release card's evidence (its act and card digest), never through the plain plan card or a generic
+            // one. Read from the raw row, so a terms column that doesn't parse is a deploy gate too.
+            const deployGate = (typeof working["candidate"] === "string" && working["candidate"] !== "") || working["release_terms_json"] != null;
+            if (deployGate && basis?.kind === "chat" && !(basis.card === "release" && typeof basis.cardDigest === "string" && /^[0-9a-f]{64}$/.test(basis.cardDigest)))
+                return false;
             if (terms.terms !== null && basis !== undefined && basis.kind !== "chat")
                 return false;
             if (terms.terms !== null && releaseSealProblem(this, terms.terms) !== null)
@@ -19151,6 +19175,13 @@ export class Store {
             .run(pairId);
     }
     // ---- idempotency --------------------------------------------------------
+    /** Which conversation a page's first send started (quiet page visits): recorded with the start, in the same
+     * transaction, so a retry of that send never starts another, even after a restart or once that one has ended. */
+    leadStartReceipt(approver, request) {
+        const row = this.db.prepare("SELECT result FROM mutation WHERE idempotency_key = ? AND operation = 'mate-start'")
+            .get(`mate-start:${approver}:${request}`);
+        return row === undefined ? null : parseStoreColumn("mutation.result", row["result"]);
+    }
     /** A chat send receipt contains no message text. The session is part of
      * its namespace; callers must prove that session before reading it. */
     leadRequestReceipt(session, request) {
@@ -20740,3 +20771,51 @@ function processStartedAt(pid) {
         return null;
     }
 }
+// A run's own "Show commands in the live view" answer (schema v136, docs/plans/agents-view.md §2.4). Free functions over
+// the store, kept together at the end.
+/**
+ * Capture a run's live-view answer once, before its live file opens: the first capture stands (a second never changes
+ * it). Returns the answer now saved for the run; any failure, or a saved row that isn't plainly 1, is commands off.
+ */
+export function captureRunLiveDetail(store, runId, commands, now) {
+    try {
+        store.handle.prepare("INSERT OR IGNORE INTO run_live_detail (run, commands, captured_at) VALUES (?, ?, ?)").run(runId, commands ? 1 : 0, now.toISOString());
+    }
+    catch {
+        return false;
+    }
+    return runLiveCommands(store, runId);
+}
+/** Whether a run's live view may show commands: only its own captured answer, and only when that is plainly 1. Absent
+ * (a run from before v136, or one whose capture failed), unreadable or anything else is off. */
+export function runLiveCommands(store, runId) {
+    try {
+        const row = store.handle.prepare("SELECT commands FROM run_live_detail WHERE run = ?").get(runId);
+        return row !== undefined && row["commands"] === 1;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The Live grid's runs: every role's running run (no outcome yet) and every run that ended at or after `endedSince`,
+ * newest first — all of them (no cutoff before the caller's visibility filter: a viewer's agent is never hidden behind
+ * others'). Two indexed reads (run_live_open, run_live_recent), never a scan of all runs.
+ * Visibility is the caller's: it filters each by the console's ceiling and the viewer's access.
+ */
+export function agentsLiveRuns(store, endedSince) {
+    const rows = store.handle.prepare(`SELECT run.*, task_ref.external_id AS live_task_id, task_ref.repo AS live_task_repo, task.title AS live_task_title, task_ref.backend AS live_task_backend
+       FROM (SELECT id FROM run INDEXED BY run_live_open WHERE outcome IS NULL AND id > 0
+             UNION SELECT id FROM run INDEXED BY run_live_recent WHERE outcome IS NOT NULL AND id > 0 AND finished_at >= ?) AS picked
+       JOIN run ON run.id = picked.id
+       JOIN task_ref ON task_ref.id = run.task_ref
+       LEFT JOIN task ON task_ref.backend = ? AND task.id = task_ref.external_id
+      ORDER BY run.id DESC`).all(endedSince.toISOString(), BUILT_IN);
+    return rows.map(row => ({
+        ...readRun(row),
+        taskId: String(row["live_task_id"]),
+        builtIn: row["live_task_backend"] === BUILT_IN,
+        title: row["live_task_title"] === null || row["live_task_title"] === undefined ? String(row["live_task_id"]) : String(row["live_task_title"]),
+        repo: row["live_task_repo"] === null || row["live_task_repo"] === undefined ? null : String(row["live_task_repo"]),
+    }));
+}