toolroll 0.9.73 → 0.9.74

package/dist/browser-workspace.d.ts

@@ -211,6 +211,10 @@ export type BrowserTasksView = {
     newTask: BrowserLink;
     /** v105: subscription windows and monthly budgets, one tile each (an instance operator's; null when there are none). */
     limits: BrowserLimits | null;
+    /** The stored-state filter (Any state, Queued, Running, Done, Failed, Cancelled), each a real link starting on page one. */
+    states?: (BrowserLink & {
+        active: boolean;
+    })[];
 };
 /** One limit: a plan's usage window ("Claude · 5-hour, 48%") or a monthly budget ("shop · Budget, $4.20 of $10"). */
 export type BrowserTaskGroup = WorkIndexGroup;
@@ -1445,6 +1449,8 @@ export type BrowserAgentsView = {
     selected: BrowserAgentDetail | null;
     /** Shown when nothing is on the board. */
     empty: string | null;
+    /** The Live grid (?view=live): every running agent's live output, watching only. */
+    live?: boolean;
 };
 export type BrowserView = BrowserTasksView | BrowserSettingsView | BrowserTaskView | BrowserProjectsView | BrowserResultView | BrowserFlowView | BrowserAgentsView;
 export type BrowserWorkspace = {

package/dist/builder.js

@@ -1240,7 +1240,7 @@ export async function build(store, request) {
     // Every streaming transport emits events now (peek); a file that cannot
     // open is a null, and a null never costs a build.
     // What the agent did last rides the same stream into one row (live tasks).
-    const liveLog = withAgentTurns(withRunActivity(openLiveLog(root, request.runId, liveLogContext(store, taskRef, worktree)), store, request.runId, clock), (state, at) => { if (attemptKey !== null)
+    const liveLog = withAgentTurns(withRunActivity(openLiveLog(root, request.runId, liveLogContext(store, request.runId, taskRef, worktree, clock())), store, request.runId, clock), (state, at) => { if (attemptKey !== null)
         recordAgentTurn(store, { run: request.runId, attemptKey, state, at }); }, clock, (open, at) => { if (attemptKey !== null)
         noteOpenTool(store, request.runId, attemptKey, open, at); });
     // The retry base (steering fix for run 1465's proof): the SAME pinned

package/dist/chat-continuity.js

@@ -125,6 +125,8 @@ export const CHAT_CONTINUITY_SCRIPT = String.raw `
         if(got===null)return;
         var data=got.data||{};
         if(data.ok===true){
+          // A conversation shown before it existed (session 0) is started by its first send: that is this one.
+          if(session==='0'&&typeof data.session==='number'&&data.session>0)adopt(String(data.session));
           if(String(data.session)!==session){changed();return;}
           say(data.queued===true?'Queued. It goes to the lead after the reply in progress.':'Sent. Waiting for the reply…');later(300);return;
         }
@@ -273,6 +275,9 @@ export const CHAT_CONTINUITY_SCRIPT = String.raw `
     }
     return true;
   }
+  // The conversation this page's first send started: its binding and its draft move to it (a reload restores from there).
+  function adopt(started){session=started;document.querySelectorAll('form[action="/chat"] [name="request-session"]').forEach(function(bound){bound.value=started;});
+    try{sessionStorage.removeItem(key);}catch(e){}key='standing-orders:chat-draft:'+session+':'+task;save();}
   function later(ms){if(stale)return;clearTimeout(timer);timer=setTimeout(check,ms);}
   async function check(){
     if(polling||stale)return;
@@ -289,6 +294,11 @@ export const CHAT_CONTINUITY_SCRIPT = String.raw `
       if(!r.ok)throw new Error('connection');
       var data=await r.json();
       if(!valid(data))throw new Error('response');
+      // Not started yet (session 0): only this send's own receipt in the started conversation proves it is the one.
+      if(session==='0'&&typeof data.session==='number'&&data.session>0&&asked&&data.received===true)adopt(String(data.session));
+      // A poll that lands while the first send is on its way decides nothing: that send's answer (or the poll it
+      // asks for afterwards, with its request) says whether the started conversation is this page's.
+      if(session==='0'&&sending&&data.session!==null&&String(data.session)!=='0'){later(1000);return;}
       if(data.session===null||String(data.session)!==session){changed();return;}
       // A late answer for another lens never lands here; the poll goes on.
       if(data.task!==task){later(5000);return;}

package/dist/chat-quiet.js

@@ -101,7 +101,7 @@ export function quietCardView(store, taskRefs, now, root, viewer) {
     const heading = `${lines.length} tasks`;
     const projects = [...new Set(lines.map(one => projectLabel(one.project)))];
     const text = [heading, ...lines.map(one => `${one.icon} ${phoneText(one.title, 60)} · ${one.status}`), "", projects.join(", ")].join("\n");
-    return { text, entities: [{ type: "bold", offset: 0, length: heading.length }], link: { label: "Open tasks", path: "/tasks" } };
+    return { text, entities: [{ type: "bold", offset: 0, length: heading.length }], link: { label: "Open tasks", path: "/work" } };
 }
 /** Facts that carry their own controls or must stand alone (a security alert, a decision, a flow card, a
  * screenshot, an acceptance packet) are never folded into a batch. */
@@ -176,7 +176,7 @@ export function finishedView(store, batch, now, root, viewer) {
         return null;
     const text = batchLine(lines.map(one => one.fact));
     if (lines.length > 1)
-        return { text, entities: [], link: { label: "Open", path: "/tasks" } };
+        return { text, entities: [], link: { label: "Open", path: "/work" } };
     const target = lines[0].target ?? null;
     return { text, entities: [], link: lines[0].link, ...(lines[0].also.length === 0 ? {} : { also: lines[0].also }), ...(target === null ? {} : { target }) };
 }
@@ -242,7 +242,7 @@ export function enqueueEveningDigests(store, now, root) {
             if (body === null)
                 return;
             if (store.enqueueNotification({ dedupeKey: `digest:evening:${person.account}:${day}`, kind: "evening-digest", subject: "Evening digest", body,
-                link: "/tasks", source: { installation: true }, recipient: person.account }, now))
+                link: "/work", source: { installation: true }, recipient: person.account }, now))
                 queued++;
         });
     }

package/dist/deploy-gate.js

@@ -18,8 +18,11 @@ export function deploymentGate(store, input) {
     if (run === null || ref === null || head === null)
         return refuse(`Run ${input.runId} is not a built candidate.`);
     // `task regate` reruns the approved check on the last built commit and records no-change: a candidate only for that commit.
-    const regated = run.outcome === "no-change" && scope?.candidate === head &&
-        store.runsFor(run.taskRef).find(one => one.id < input.runId && one.role === "builder" && one.outcome === "built")?.headRevision === head;
+    // A prepared candidate's build records a commit of its own holding exactly the candidate's tree; its rerun under the same
+    // signed scope is the same check of that commit (the digest is held to the approved one below).
+    const built = store.runsFor(run.taskRef).find(one => one.id < input.runId && one.role === "builder" && one.outcome === "built");
+    const regated = run.outcome === "no-change" && built?.headRevision === head &&
+        (scope?.candidate === head || ((scope?.candidate ?? null) !== null && built.scopeDigest === run.scopeDigest));
     if (run.role !== "builder" || !(run.outcome === "built" || regated))
         return refuse(`Run ${input.runId} is not a built candidate at ${head.slice(0, 7)}.`);
     if (scope === null || scope.approvedDigest !== scope.digest || scope.digest !== run.scopeDigest)

package/dist/desktop-update.d.ts

@@ -94,6 +94,7 @@ export declare function prepareDesktopUpdate(stateDir: string, installed: string
 export declare function sqliteLock(file: string, busyTimeoutMs?: number): DatabaseSync | null;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
+    version?: never;
     active: boolean;
     phase: string;
     detail: string;
@@ -107,7 +108,6 @@ export declare function desktopUpdateStatus(stateDir: string): {
     wasRunning?: never;
     backupPath?: never;
     updateId?: never;
-    version?: never;
     buildId?: never;
     workDir?: never;
 } | {

package/dist/dispose.js

@@ -23,7 +23,7 @@ import { nightlyTaskRef, releaseTaskRef } from "./store.js";
 import {} from "./proof.js";
 import { verificationEvidence, failedVerificationEvidence } from "./verification-evidence.js";
 import { classifyGateFailure, describeGateFailure, gateFailureSummary } from "./gate-failure.js";
-import { propose, approve } from "./scope.js";
+import { propose, approve, liveReleaseOf } from "./scope.js";
 import { headWithin } from "./names.js";
 /** The reasons tick classifies as the attempt itself breaking. */
 const TICK_FAILURE_REASONS = new Set([
@@ -456,6 +456,35 @@ export function regateTask(store, taskId, now, approval) {
         return { ok: false, reason: "no-attempt", message: `${taskId} has no scope` };
     const head = last.headRevision;
     const actor = approval.kind === "operator" ? approval.name : `mode ${approval.name}`;
+    // A prepared candidate (a release gate, the nightly check) already names the approved commit, and the builder loads
+    // exactly its tree on every attempt. The rerun keeps that scope and its approval as they are: nothing is proposed or
+    // sealed again, so a regate can never swap the approved commit, its release terms or the person's yes for others
+    // (2026-10-27: a regate rewrote release-0.9.73's candidate to its own build commit and the release refused it).
+    if ((scope.candidate ?? null) !== null || (scope.releaseTerms ?? null) !== null) {
+        const candidate = scope.candidate ?? null;
+        if (candidate === null || scope.approvedDigest !== scope.digest || last.scopeDigest !== scope.digest) {
+            return { ok: false, reason: "not-approved", message: `${taskId}'s approved commit or scope changed since attempt #${last.id}, or its approval no longer stands; approve its scope again instead` };
+        }
+        // A release's task runs again only while its one approval still stands for it (the dispatch would refuse it anyway).
+        const release = liveReleaseOf(store, taskId, "dispatch", now);
+        if (release.applies && !release.ok)
+            return { ok: false, reason: "not-approved", message: `${taskId} can't run again: ${release.why}` };
+        // Any other seal stands only while its authority does (an expired mode, a revoked approver): the queue would never
+        // dispatch it, so the regate says so instead of queueing a rerun that can't start.
+        if (!store.modeApprovalLive(ref.id, now))
+            return { ok: false, reason: "not-approved", message: `${taskId}'s approval no longer stands; approve its scope again instead` };
+        return store.transact(() => {
+            if (store.getTask(taskId)?.state !== "queued") {
+                const queued = store.requeueTask(taskId, actor, now);
+                if (!queued.ok) {
+                    const why = { claimed: "claimed", "accepted-result": "accepted-result", published: "published" };
+                    return { ok: false, reason: why[queued.reason] ?? "not-rejected", message: `${taskId} could not be queued again: ${queued.reason}` };
+                }
+            }
+            store.addRunNote(last.id, "Toolroll", `The check will run again on the approved commit ${candidate.slice(0, 7)}, under the same approval, as a new attempt, ${approval.kind === "operator" ? `on ${approval.name}'s say-so` : "automatically once, because the failure was outside this change"}.`, now);
+            return { ok: true, run: last.id, head: candidate };
+        });
+    }
     return store.transact(() => {
         const proposed = propose(store, {
             taskId, goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd,
@@ -520,7 +549,11 @@ export function maybeTriggerRepair(store, repo, evidenceRoot, sourceRunId, verdi
     // to a person. No repair draft, no third pass, on either road.
     {
         const rerunTask = store.refById(run.taskRef)?.externalId ?? "";
-        if (run.headRevision && store.getScope(rerunTask)?.candidate === run.headRevision && store.builderAttemptsAt(run.taskRef, run.headRevision) >= 2) {
+        // A prepared candidate's attempts each record their own commit of the candidate's tree, so a rerun under the same
+        // approved scope is the same commit's check even when its head isn't the candidate itself.
+        const rerunScope = store.getScope(rerunTask);
+        const sameCommit = rerunScope !== null && (rerunScope.candidate === run.headRevision || ((rerunScope.candidate ?? null) !== null && rerunScope.digest === run.scopeDigest));
+        if (run.headRevision && sameCommit && store.builderAttemptsAt(run.taskRef, run.headRevision) >= 2) {
             const contradicted = cause === "review";
             store.enqueueNotification({ source: { run: sourceRunId }, dedupeKey: `regate-failed:${sourceRunId}`, kind: "repair-evidence", pushClass: "attention",
                 subject: contradicted ? "The rerun on the same commit was contradicted by its review" : "The project check failed again on the same commit",

package/dist/exec.js

@@ -16,6 +16,7 @@ import { jsonlDiscriminants } from "./jsonl-discriminants.js";
 import { createContainer, currentContainment } from "./containment.js";
 import { claudeLimitsOf, noteLimits } from "./provider-limits.js";
 import { sleep as defaultSleep } from "./sleep.js";
+import { primaryResultEvent, topLevelEvent } from "./stream-scope.js";
 /** Shell convention for "could not be executed": the refusal before any target ran. */
 export const CONTAINMENT_REFUSED_CODE = 126;
 /** Live provider children, for the deterministic stop. Registered only when `processGroup` was set. */
@@ -1760,23 +1761,17 @@ function syntheticMessageLine(content, truncated) {
  *
  *   - a bounded identity witness for `system`/`init`: the first init signal,
  *     the first usable session id, and one conflicting id
- *   - the FIRST primary `result` event, selected STRUCTURALLY (finding 10):
- *     origin absent or `origin.kind === "human"` — an allowlist, so a
- *     background task's result (or any future origin kind) can never be
- *     mistaken for the main query's accounting. Later results are dropped.
+ *   - the FIRST primary `result` event, selected STRUCTURALLY (finding 10;
+ *     stream-scope.ts `primaryResultEvent`): top-level, and origin absent or
+ *     `origin.kind === "human"` — an allowlist, so a subagent's or background
+ *     task's result (or any future origin kind) can never be mistaken for the
+ *     main query's accounting. Later results are dropped. A subagent's init
+ *     never enters the identity witness.
  *
  * The result's stdout is the retained lines joined — a synthetic, bounded
  * envelope `claudeParse` reads exactly like test fixtures. Timeout,
  * process-group, kill, and spawn semantics match `runStreamJsonl`.
  */
-function primaryResultOrigin(event) {
-    const origin = event["origin"];
-    if (origin === undefined || origin === null)
-        return true;
-    if (typeof origin === "object" && String(origin["kind"] ?? "") === "human")
-        return true;
-    return false; // task-notification, channel, peer, coordinator, unknown: never the envelope
-}
 /** The usage fields Claude reports per message (not per session): a live session's account adds them up. */
 const LIVE_SUMMED_USAGE = ["input_tokens", "output_tokens", "cache_creation_input_tokens", "cache_read_input_tokens"];
 /**
@@ -1934,7 +1929,10 @@ export function runClaudeStreamJsonl(file, args, options = {}) {
             if (event === null || typeof event !== "object")
                 return;
             const type = String(event["type"] ?? "");
-            if (type === "system" && String(event["subtype"] ?? "") === "init") {
+            // A subagent's init, words and result are not the session's (stream-scope.ts): they never witness its identity,
+            // name its session, fire its receipt or stand as its result. They still reach the observers below, which filter
+            // for themselves.
+            if (type === "system" && String(event["subtype"] ?? "") === "init" && topLevelEvent(event)) {
                 if (initLine === null)
                     initLine = line;
                 const id = transportSessionId(event["session_id"]);
@@ -1963,15 +1961,14 @@ export function runClaudeStreamJsonl(file, args, options = {}) {
                 // Top-level only (finding 11): assistant events carry no origin;
                 // parent_tool_use_id is the correlation field, and a subagent's
                 // words prove nothing about the main prompt.
-                const parent = event["parent_tool_use_id"];
-                if (parent === undefined || parent === null)
+                if (topLevelEvent(event))
                     fireReceipt();
             }
             else if (type === "rate_limit_event") {
                 // v105: the plan's usage windows, as Claude says them each turn (the Tasks page's limits).
                 noteLimits(claudeLimitsOf(event));
             }
-            else if (type === "result" && (resultLine === null || live !== null) && primaryResultOrigin(event)) {
+            else if (type === "result" && (resultLine === null || live !== null) && primaryResultEvent(event)) {
                 // A live session ends a turn with a result each time: the run's account is the last one, with every main
                 // result's usage and turns added up (account). After an oversized main result the retained result stays the
                 // fail-closed overflow, but later results still count toward its cost.

package/dist/first-run.d.ts

@@ -77,10 +77,13 @@ export declare function firstResultWords(since: string, at: string): string | nu
 export declare const JOURNEY_STEPS: readonly [readonly ["plan", "Plan"], readonly ["approve", "You approve"], readonly ["build", "Build"], readonly ["checks", "Checks"], readonly ["ready", "Ready"]];
 export type JourneyKey = (typeof JOURNEY_STEPS)[number][0];
 /** `stuck`: the step it stopped at (Failed, Stopped, or waiting on something other than the approval). */
+/** `skipped`: a stage the task went past without it happening (its checks didn't run or couldn't be read). `needsYou`:
+ * the current or stuck step waits on a person, so it is the one step drawn amber. */
 export type JourneyStep = {
     key: JourneyKey;
     label: string;
-    state: "done" | "current" | "stuck" | "todo";
+    state: "done" | "current" | "stuck" | "skipped" | "todo";
+    needsYou?: true;
 };
 /**
  * Where the first task stands on Plan → You approve → Build → Checks → Ready, from the one stage every surface reads
@@ -91,4 +94,17 @@ export declare function firstTaskJourney(read: {
     stage: "queued" | "planning" | "needs-you" | "waiting" | "building" | "checking" | "reviewing" | "finished" | "complete" | "failed" | "stopped";
     need?: string | undefined;
 }, approved: boolean, built?: boolean): JourneyStep[];
+/** What a task's checks recorded, for its road: `null` when nothing says (the step is then shown skipped, never done). */
+export type RoadChecks = "passed" | "running" | "failed" | "not-run" | "unread" | null;
+/**
+ * Any task's road (the read-only stepper on its page, after ReUI's Stepper): the first task's five steps, told only
+ * from recorded facts. You approve is done only when the plan was approved (a rewritten plan waiting on approval
+ * stands there again); a task that never needed one shows it skipped. Checks is done only when a check passed; a
+ * running, failed, missing or unread check says so, and with no checks fact it is skipped. A research report has
+ * no Checks step: a report stopped there stops at Ready. The step that waits on a person carries `needsYou`.
+ */
+export declare function taskRoad(read: Parameters<typeof firstTaskJourney>[0], approved: boolean, built: boolean, facts: {
+    report?: boolean;
+    checks?: RoadChecks;
+}): JourneyStep[];
 export {};

package/dist/first-run.js

@@ -141,3 +141,41 @@ export function firstTaskJourney(read, approved, built = false) {
     return JOURNEY_STEPS.map(([key, label], index) => ({ key, label,
         state: index < at.index ? "done" : index === at.index ? (at.stuck ? "stuck" : "current") : "todo" }));
 }
+/**
+ * Any task's road (the read-only stepper on its page, after ReUI's Stepper): the first task's five steps, told only
+ * from recorded facts. You approve is done only when the plan was approved (a rewritten plan waiting on approval
+ * stands there again); a task that never needed one shows it skipped. Checks is done only when a check passed; a
+ * running, failed, missing or unread check says so, and with no checks fact it is skipped. A research report has
+ * no Checks step: a report stopped there stops at Ready. The step that waits on a person carries `needsYou`.
+ */
+export function taskRoad(read, approved, built, facts) {
+    const replan = read.stage === "needs-you" && read.need === "replan";
+    const plainApproved = approved && !replan;
+    let steps = firstTaskJourney(replan ? { stage: "needs-you", need: "approval" } : read, plainApproved, built);
+    steps = steps.map(step => {
+        if (step.key === "approve" && step.state === "done" && !plainApproved)
+            return { ...step, state: "skipped" };
+        if (step.key !== "checks" || (step.state !== "done" && step.state !== "current"))
+            return step;
+        // At Checks now: only a recorded failure or a running check changes how it reads.
+        if (step.state === "current")
+            return facts.checks === "failed" ? { ...step, state: "stuck", label: "Checks failed" } : facts.checks === "running" ? { ...step, label: "Checks running" } : step;
+        switch (facts.checks ?? null) {
+            case "passed": return step;
+            case "running": return { ...step, state: "current", label: "Checks running" };
+            case "failed": return { ...step, state: "stuck", label: "Checks failed" };
+            case "not-run": return { ...step, state: "skipped", label: "Checks not run" };
+            case "unread": return { ...step, state: "skipped", label: "Checks unread" };
+            default: return { ...step, state: "skipped" };
+        }
+    });
+    if (facts.report === true) {
+        const checks = steps.find(step => step.key === "checks");
+        if (checks !== undefined && (checks.state === "current" || checks.state === "stuck")) {
+            steps = steps.map(step => step.key === "ready" ? { ...step, state: checks.state } : step);
+        }
+        steps = steps.filter(step => step.key !== "checks");
+    }
+    const waiting = read.stage === "needs-you";
+    return steps.map(step => waiting && (step.state === "current" || step.state === "stuck") ? { ...step, needsYou: true } : step);
+}

package/dist/invoke.d.ts

@@ -190,3 +190,16 @@ export declare function checkoutRunner(store: Store, repo: string, checkout: str
 export declare function checkoutSandboxOf(store: Store, repo: string, runIds: readonly number[]): LaunchSandbox;
 /** The digest of a launch's whole fence (its denied paths and grants, canonical), as stamped on its run (C11). */
 export declare function fenceDigest(fence: readonly string[], grants: FenceGrants): string;
+/** What a Claude turn's own stream says about how it billed (v105). */
+export type ClaudeBillingSeen = {
+    keySource: string | null;
+    model: string | null;
+    planWindows: boolean;
+    answered: boolean;
+};
+/**
+ * One stream event's billing observation: the key source and model from the session's own init, plan windows from a
+ * rate-limit event, and whether the main query answered. The session's own events only (stream-scope.ts): a
+ * subagent's init, rate-limit event or result says nothing about this turn's billing.
+ */
+export declare function observeClaudeBilling(seen: ClaudeBillingSeen, event: Record<string, unknown>): void;

package/dist/invoke.js

@@ -44,6 +44,7 @@ import { buildCacheEnv, buildCacheFolder, grantFolder, writeAllowlist, WRITES_DE
 import { proxyEnv, providerOnlyNetwork, repositoryEcosystems, resolveNetwork, startEgressProxy } from "./egress.js";
 import { claudeConfigDir, claudeDefaults, codexDefaults, codexHomeDir, isolatedCodexHome } from "./provider-home.js";
 import { billingOf, claudeBillingFrom, seenBilling } from "./spend.js";
+import { primaryResultEvent, topLevelEvent } from "./stream-scope.js";
 /** "Within seconds": how soon a silent failed run must end for its stderr to
  * be read for the sign-in signal. */
 const AUTH_EARLY_EXIT_MS = 30_000;
@@ -507,18 +508,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         ...(workspace === null ? {} : { cwd: workspace }),
         // v105: how the CLI really billed this turn (its key source, its plan's windows), read off its own stream.
         onStreamEvent: event => {
-            if (event["type"] === "system" && event["subtype"] === "init") {
-                if (typeof event["apiKeySource"] === "string")
-                    billingSeen.keySource = event["apiKeySource"].slice(0, 80);
-                if (typeof event["model"] === "string")
-                    billingSeen.model = event["model"].slice(0, 200);
-            }
-            else if (event["type"] === "rate_limit_event") {
-                billingSeen.planWindows = true;
-            }
-            else if (event["type"] === "result" && event["is_error"] !== true && event["subtype"] === "success") {
-                billingSeen.answered = true;
-            }
+            observeClaudeBilling(billingSeen, event);
             runOptions.onStreamEvent?.(event);
         },
         owner: runOwnerTag(store, runId),
@@ -1303,3 +1293,22 @@ export function checkoutSandboxOf(store, repo, runIds) {
 export function fenceDigest(fence, grants) {
     return createHash("sha256").update(`toolroll:fence:${canonicalJson({ fence: [...fence], grants: grants })}`).digest("hex").slice(0, 32);
 }
+/**
+ * One stream event's billing observation: the key source and model from the session's own init, plan windows from a
+ * rate-limit event, and whether the main query answered. The session's own events only (stream-scope.ts): a
+ * subagent's init, rate-limit event or result says nothing about this turn's billing.
+ */
+export function observeClaudeBilling(seen, event) {
+    if (event["type"] === "system" && event["subtype"] === "init" && topLevelEvent(event)) {
+        if (typeof event["apiKeySource"] === "string")
+            seen.keySource = event["apiKeySource"].slice(0, 80);
+        if (typeof event["model"] === "string")
+            seen.model = event["model"].slice(0, 200);
+    }
+    else if (event["type"] === "rate_limit_event" && topLevelEvent(event)) {
+        seen.planWindows = true;
+    }
+    else if (primaryResultEvent(event) && event["is_error"] !== true && event["subtype"] === "success") {
+        seen.answered = true;
+    }
+}

package/dist/knowledge-ui.d.ts

@@ -1,6 +1,9 @@
 import { type KnowledgeDraft, type KnowledgeSelection, type KnowledgeView } from './project-knowledge.js';
 import { type Html } from './html.js';
-export declare const KNOWLEDGE_CSS = ".knowledge{max-width:780px;min-width:0;overflow-wrap:anywhere}.knowledge .card{padding:20px;min-width:0;margin:16px 0}.knowledge h2{margin:0 0 12px}.knowledge form{display:grid;gap:12px;margin:0}.knowledge label{display:grid;gap:6px}.knowledge textarea,.knowledge input,.knowledge select{box-sizing:border-box;width:100%;min-width:0;max-width:100%}.knowledge textarea{resize:vertical;min-height:110px}.knowledge button,.knowledge summary,.knowledge .button-link{min-height:44px}.knowledge button{justify-self:start;white-space:nowrap}.knowledge summary{padding:12px 0;cursor:pointer}.knowledge pre{white-space:pre-wrap;overflow-wrap:anywhere;font:inherit}.knowledge .knowledge-actions{display:flex;gap:12px;flex-wrap:wrap}.knowledge .meta{font-size:.86rem}.knowledge .knowledge-source{display:block}.knowledge details+details{border-top:1px solid var(--so-line)}.memory-stats{display:flex;flex-wrap:wrap;gap:.4rem}.memory-stats span{padding:.15rem .55rem;border-radius:.375rem;background:var(--so-neutral-soft);color:var(--so-neutral-ink)}@media(max-width:600px){.knowledge .card{padding:16px}.knowledge h2{font-size:1.1rem}}";
+/** A section as a frame (after ReUI's Frame, MIT): its heading on the raised well, its body one paper panel. The
+ * cards inside become hairline-divided rows of that panel, never cards in a card. */
+export declare function framedSection(heading: string, body: Html | string, extra?: string): Html;
+export declare const KNOWLEDGE_CSS = ".knowledge{max-width:780px;min-width:0;overflow-wrap:anywhere}.knowledge .card{padding:20px;min-width:0;margin:16px 0}.knowledge h2{margin:0 0 12px}.knowledge form{display:grid;gap:12px;margin:0}.knowledge label{display:grid;gap:6px}.knowledge textarea,.knowledge input,.knowledge select{box-sizing:border-box;width:100%;min-width:0;max-width:100%}.knowledge textarea{resize:vertical;min-height:110px}.knowledge button,.knowledge summary,.knowledge .button-link{min-height:44px}.knowledge button{justify-self:start;white-space:nowrap}.knowledge summary{padding:12px 0;cursor:pointer}.knowledge pre{white-space:pre-wrap;overflow-wrap:anywhere;font:inherit}.knowledge .knowledge-actions{display:flex;gap:12px;flex-wrap:wrap}.knowledge .meta{font-size:.86rem}.knowledge .knowledge-source{display:block}.knowledge details+details{border-top:1px solid var(--so-line)}.memory-stats{display:flex;flex-wrap:wrap;gap:.4rem}.memory-stats span+span::before{content:\"\u00B7\";margin-right:.4rem}.knowledge.frame{margin:0 0 16px}.knowledge.frame>.frame-head h2,.knowledge.frame>summary.frame-head{margin:0;font-size:13px;font-weight:600;line-height:1.4}.knowledge.frame>summary.frame-head{min-height:44px;padding:4px 10px}.knowledge.frame>.frame-panel{min-width:0}.knowledge.frame>.frame-panel>:first-child{margin-top:0}.knowledge.frame>.frame-panel>:last-child{margin-bottom:0}.knowledge .frame-panel>details.card,.knowledge .frame-panel .learning .card{margin:0;padding:0;border:0;border-radius:0;background:none;box-shadow:none}.knowledge .frame-panel>details.card+details.card,.knowledge .frame-panel .learning .card+.card{border-top:1px solid var(--so-line);padding-top:4px}.knowledge.frame>summary.frame-head{justify-content:flex-start}.knowledge form.field-row{grid-template-columns:minmax(0,1fr) auto;align-items:end}.knowledge form.field-row>label,.knowledge form.field-row :is(input,select,button){margin:0}@media(max-width:600px){.knowledge .card{padding:16px}.knowledge h2{font-size:1.1rem}}";
 export declare function knowledgeHtml(view: KnowledgeView, csrf: string, canManage: boolean, draft?: KnowledgeDraft, error?: string): Html;
 export declare function knowledgeContextHtml(snapshot: KnowledgeSelection | null): Html | '';
 import type { Decision, MemoryHit } from './project-memory.js';

package/dist/knowledge-ui.js

@@ -2,7 +2,12 @@ import { STALE_KNOWLEDGE } from './project-knowledge.js';
 import { html, postForm } from './html.js';
 // Hidden fields as they always were: a missing value is an empty field.
 const fields = (data) => Object.fromEntries(Object.entries(data).map(([k, v]) => [k, String(v ?? '')]));
-export const KNOWLEDGE_CSS = `.knowledge{max-width:780px;min-width:0;overflow-wrap:anywhere}.knowledge .card{padding:20px;min-width:0;margin:16px 0}.knowledge h2{margin:0 0 12px}.knowledge form{display:grid;gap:12px;margin:0}.knowledge label{display:grid;gap:6px}.knowledge textarea,.knowledge input,.knowledge select{box-sizing:border-box;width:100%;min-width:0;max-width:100%}.knowledge textarea{resize:vertical;min-height:110px}.knowledge button,.knowledge summary,.knowledge .button-link{min-height:44px}.knowledge button{justify-self:start;white-space:nowrap}.knowledge summary{padding:12px 0;cursor:pointer}.knowledge pre{white-space:pre-wrap;overflow-wrap:anywhere;font:inherit}.knowledge .knowledge-actions{display:flex;gap:12px;flex-wrap:wrap}.knowledge .meta{font-size:.86rem}.knowledge .knowledge-source{display:block}.knowledge details+details{border-top:1px solid var(--so-line)}.memory-stats{display:flex;flex-wrap:wrap;gap:.4rem}.memory-stats span{padding:.15rem .55rem;border-radius:.375rem;background:var(--so-neutral-soft);color:var(--so-neutral-ink)}@media(max-width:600px){.knowledge .card{padding:16px}.knowledge h2{font-size:1.1rem}}`;
+/** A section as a frame (after ReUI's Frame, MIT): its heading on the raised well, its body one paper panel. The
+ * cards inside become hairline-divided rows of that panel, never cards in a card. */
+export function framedSection(heading, body, extra = '') {
+    return html `<section class="${`knowledge frame${extra ? ` ${extra}` : ''}`}"><div class="frame-head"><h2>${heading}</h2></div><div class="frame-panel">${body}</div></section>`;
+}
+export const KNOWLEDGE_CSS = `.knowledge{max-width:780px;min-width:0;overflow-wrap:anywhere}.knowledge .card{padding:20px;min-width:0;margin:16px 0}.knowledge h2{margin:0 0 12px}.knowledge form{display:grid;gap:12px;margin:0}.knowledge label{display:grid;gap:6px}.knowledge textarea,.knowledge input,.knowledge select{box-sizing:border-box;width:100%;min-width:0;max-width:100%}.knowledge textarea{resize:vertical;min-height:110px}.knowledge button,.knowledge summary,.knowledge .button-link{min-height:44px}.knowledge button{justify-self:start;white-space:nowrap}.knowledge summary{padding:12px 0;cursor:pointer}.knowledge pre{white-space:pre-wrap;overflow-wrap:anywhere;font:inherit}.knowledge .knowledge-actions{display:flex;gap:12px;flex-wrap:wrap}.knowledge .meta{font-size:.86rem}.knowledge .knowledge-source{display:block}.knowledge details+details{border-top:1px solid var(--so-line)}.memory-stats{display:flex;flex-wrap:wrap;gap:.4rem}.memory-stats span+span::before{content:"·";margin-right:.4rem}.knowledge.frame{margin:0 0 16px}.knowledge.frame>.frame-head h2,.knowledge.frame>summary.frame-head{margin:0;font-size:13px;font-weight:600;line-height:1.4}.knowledge.frame>summary.frame-head{min-height:44px;padding:4px 10px}.knowledge.frame>.frame-panel{min-width:0}.knowledge.frame>.frame-panel>:first-child{margin-top:0}.knowledge.frame>.frame-panel>:last-child{margin-bottom:0}.knowledge .frame-panel>details.card,.knowledge .frame-panel .learning .card{margin:0;padding:0;border:0;border-radius:0;background:none;box-shadow:none}.knowledge .frame-panel>details.card+details.card,.knowledge .frame-panel .learning .card+.card{border-top:1px solid var(--so-line);padding-top:4px}.knowledge.frame>summary.frame-head{justify-content:flex-start}.knowledge form.field-row{grid-template-columns:minmax(0,1fr) auto;align-items:end}.knowledge form.field-row>label,.knowledge form.field-row :is(input,select,button){margin:0}@media(max-width:600px){.knowledge .card{padding:16px}.knowledge h2{font-size:1.1rem}}`;
 export function knowledgeHtml(view, csrf, canManage, draft, error) {
     const manage = canManage && !!csrf;
     const base = { repo: view.repo, identity: view.identity, revision: view.revision };
@@ -18,7 +23,7 @@ export function knowledgeHtml(view, csrf, canManage, draft, error) {
     }
     const instructions = html `<pre class="knowledge-instructions">${view.knowledge.instructions || 'No project instructions yet.'}</pre>`;
     const editor = manage ? html `<details class="knowledge-editor"${draft?.instructions !== undefined ? html ` open` : ''}><summary>${view.knowledge.instructions ? 'Edit instructions' : 'Add instructions'}</summary>${form('instructions', html `<textarea aria-label="Project instructions" name="instructions" rows="5" maxlength="4000" placeholder="Goals, preferences, and what good work looks like…">${draft?.instructions ?? view.knowledge.instructions}</textarea><button>Save instructions</button>`)}</details>` : '';
-    return html `<section class="knowledge knowledge-library">${error ? html `<p class="problem" role="alert">${error}</p>` : ''}<section class="knowledge-intro"><h2>Instructions</h2>${instructions}${editor}</section><section><h2>References</h2>${refs.length ? refs : html `<p class="meta">Add a spec, design guide, or useful project document.</p>`}${manage ? html `<details class="card"${draft?.title && !draft.id ? html ` open` : ''}><summary>Add reference</summary>${form('save', referenceFields(draft?.id ? {} : draft ?? {}))}</details>` : ''}</section>${history.length ? html `<details><summary>Change history</summary><ol>${history}</ol></details>` : ''}</section>`;
+    return html `<section class="knowledge knowledge-library">${error ? html `<p class="problem" role="alert">${error}</p>` : ''}${framedSection('Instructions', html `${instructions}${editor}`, 'knowledge-intro')}${framedSection('References', html `${refs.length ? refs : html `<p class="meta">Add a spec, design guide, or useful project document.</p>`}${manage ? html `<details class="card"${draft?.title && !draft.id ? html ` open` : ''}><summary>Add reference</summary>${form('save', referenceFields(draft?.id ? {} : draft ?? {}))}</details>` : ''}`)}${history.length ? html `<details class="knowledge frame"><summary class="frame-head">Change history</summary><div class="frame-panel"><ol>${history}</ol></div></details>` : ''}</section>`;
 }
 export function knowledgeContextHtml(snapshot) {
     if (!snapshot)
@@ -32,17 +37,17 @@ export function decisionsHtml(repo, decisions, csrf, canManage, draft, error) {
     const form = (action, body, extra = {}) => postForm('/settings/knowledge/decision', body, { hidden: fields({ ...base, action, ...extra }) });
     const rows = decisions.map(d => html `<details class="card decision" id="decision-${d.id}"><summary><strong>${d.claim}</strong> <span class="meta">#${d.id} · ${d.decidedBy} · ${d.decidedAt.slice(0, 10)}</span></summary><p>${d.why}</p><p class="meta">${d.sourceKind}${d.sourceRef ? ` · ${d.sourceRef}` : ''}${d.supersedes === null ? '' : ` · replaces #${d.supersedes}`}</p>${manage ? form('retire', html `<label>Why it no longer holds<input name="reason" maxlength="500" required></label><button type="submit">Retire</button>`, { decision: d.id }) : ''}</details>`);
     const add = manage ? html `<details class="knowledge-editor"${draft?.claim !== undefined ? html ` open` : ''}><summary>Record a decision</summary>${form('record', html `<label>The choice, in one sentence<input name="claim" maxlength="240" value="${draft?.claim}" required></label><label>Why<textarea name="why" rows="3" maxlength="2000" required>${draft?.why}</textarea></label><button type="submit">Record</button>`)}</details>` : '';
-    return html `<section class="knowledge"><h2>Decisions</h2>${error ? html `<p class="problem" role="alert">${error}</p>` : ''}${rows.length ? rows : html `<p class="meta">No decisions yet. The lead suggests one when a conversation settles a choice.</p>`}${add}</section>`;
+    return framedSection('Decisions', html `${error ? html `<p class="problem" role="alert">${error}</p>` : ''}${rows.length ? rows : html `<p class="meta">No decisions yet. The lead suggests one when a conversation settles a choice.</p>`}${add}`);
 }
 export function memorySearchHtml(repo, query, hits) {
     const kind = (h) => h.kind === 'decision' ? html `<a href="#decision-${h.ref}">decision #${h.ref}</a>` : h.kind === 'conversation' ? 'conversation' : h.kind;
     const results = hits === null ? '' : hits.length === 0 ? html `<p class="meta">Nothing in project memory matches.</p>` : html `<ul class="memory-hits">${hits.map(h => html `<li><strong>${kind(h)}</strong> · ${h.title}<br><span class="meta">${h.snippet}</span></li>`)}</ul>`;
-    return html `<section class="knowledge memory-search"><form method="get" action="/settings/knowledge"><input type="hidden" name="repo" value="${repo}"><label>Search project memory<input name="memory" value="${query}" maxlength="300" placeholder="Search decisions, references, lessons…" type="search" autocomplete="off"></label><button type="submit">Search</button></form>${results}</section>`;
+    return framedSection('Search project memory', html `<form class="field-row" method="get" action="/settings/knowledge"><input type="hidden" name="repo" value="${repo}"><label><span class="visually-hidden">Search project memory</span><input name="memory" value="${query}" maxlength="300" placeholder="Search decisions, references, lessons…" type="search" autocomplete="off"></label><button type="submit">Search</button></form>${results}`, 'memory-search');
 }
 export function proposalsHtml(repo, proposals, status, csrf, canManage) {
     const manage = canManage && !!csrf;
     const line = status === null ? '' : html `<p class="meta memory-stats"><span>${status.sessions.analyzed}/${status.sessions.total} sessions read${status.sessions.failed ? ` · ${status.sessions.failed} failed` : ''}</span><span>${status.openGaps} open gap${status.openGaps === 1 ? '' : 's'}</span><span>Instructions ${status.instructionBytes}/${status.budgetBytes} bytes</span></p><details class="settings-more"><summary>Read new sessions</summary><p class="meta">Run <code>toolroll memory propose --repo ${repo}</code> on this computer.</p></details>`;
     const decide = (p, decision, label) => postForm('/settings/knowledge/proposal', html `<button type="submit">${label}</button>`, { attrs: { class: 'inline' }, hidden: fields({ repo, proposal: p.id, decision }) });
     const cards = proposals.map(p => html `<details class="card proposal" open><summary><strong>${p.title}</strong> <span class="meta">#${p.id} · ${p.kind} · ${p.sessions} sessions</span></summary><p>${p.rationale}</p>${p.beforeText ? html `<pre class="knowledge-instructions">- ${p.beforeText}</pre>` : ''}${p.afterText ? html `<pre class="knowledge-instructions">+ ${p.afterText}</pre>` : ''}<ul class="memory-evidence">${p.evidence.map(ev => html `<li>“${ev.quote.slice(0, 200)}” <span class="meta">${ev.session.split(':')[0] ?? ''}</span></li>`)}</ul>${manage ? html `${decide(p, 'accept', 'Accept')} ${decide(p, 'reject', 'Reject')}` : ''}</details>`);
-    return html `<section class="knowledge"><h2>Proposed from sessions</h2>${line}${cards.length ? cards : html `<p class="meta">Nothing to review. Suggestions appear when the same mistake shows up in two sessions.</p>`}</section>`;
+    return framedSection('Proposed from sessions', html `${line}${cards.length ? cards : html `<p class="meta">Nothing to review. Suggestions appear when the same mistake shows up in two sessions.</p>`}`);
 }

package/dist/lead-progress.d.ts

@@ -20,11 +20,14 @@ export type LeadProgress = {
     step: number;
     id: string;
     outcome: LeadToolOutcome;
-} | {
+}
+/** `final`: the provider's finished answer for this step, sent once and secret-checked whole. */
+ | {
     kind: "text";
     turn: number;
     step: number;
     text: string;
+    final?: true;
 };
 export type LeadToolOutcome = {
     state: "succeeded";

package/dist/lead-progress.js

@@ -1,6 +1,7 @@
 /** Live progress of one lead turn (chat streaming): what the lead is doing
  * and the reply as it is written. Nothing here is durable or authoritative —
  * the finished turn's saved message and cards remain the record. */
+import { topLevelEvent } from "./stream-scope.js";
 /** Plain words for each tool the lead uses, as the person watching reads them. */
 const TOOL_LABELS = {
     get_brief: "Catching up on your work",
@@ -127,7 +128,8 @@ export function claudeStreamReader(onText, capBytes = 1_048_576) {
             catch {
                 continue;
             }
-            if (!record(event) || event["type"] !== "stream_event" || !record(event["event"]))
+            // A subagent's frames (parent_tool_use_id set) are not the lead's reply: they never start, feed or end it.
+            if (!record(event) || !topLevelEvent(event) || event["type"] !== "stream_event" || !record(event["event"]))
                 continue;
             const inner = event["event"];
             if (inner["type"] === "content_block_start") {

package/dist/lead.js

@@ -486,6 +486,10 @@ export async function runLeadTurn(input) {
             return fail("malformed-reply", LEAD_FAILURE_COPY.unreadableUnknownCost, true);
         }
         const answer = result.answer;
+        // The streamed reply's finished text, once, secret-checked whole: only now may its last word show live.
+        if (!direct && input.onProgress !== undefined && !controller.signal.aborted && answer.text !== "" && scanForSecrets(answer.text).length === 0) {
+            progress({ kind: "text", turn: turnId, step: steps, text: answer.text, final: true });
+        }
         // Usage that cannot be true — more input tokens than bytes sent — is a
         // malformed reply with unknown cost, never a number to settle by.
         if (direct && answer.tokensIn > requestBytes) {

package/dist/live-bus.d.ts

@@ -128,6 +128,8 @@ export type LiveRoomOptions = {
     /** A room whose read is costly reads at most once per this window after a signal; every viewer is still re-proved
      * the moment a signal arrives (and again at the read). */
     readSettleMs?: number;
+    /** Told when a room's last viewer has left and the room is gone (state kept per room can go with it). */
+    onEmpty?: (key: unknown) => void;
 };
 /**
  * Rooms of open pages that hear the bus. `presence` says who else is here, as

package/dist/live-bus.js

@@ -309,6 +309,7 @@ export function createLiveRooms(fingerprint, presence, options = {}) {
         if (room.reading !== null)
             clearTimeout(room.reading);
         rooms.delete(key);
+        options.onEmpty?.(key);
         if (rooms.size === 0 && unsubscribe !== null) {
             unsubscribe();
             unsubscribe = null;

package/dist/live-children-read.d.ts

@@ -0,0 +1,52 @@
+import { type LiveRecord } from "./live-records.js";
+export declare const CURSOR_CAP: number;
+/** Longer than any real key block: past this much of a stream's text with no END marker, its key state is known again. */
+export declare const UNKNOWN_KEY_BYTES: number;
+export type ChildView = {
+    k: "child";
+    s: number;
+    at?: string;
+    parent: string | null;
+    via?: number;
+    desc?: string;
+} | {
+    k: "end";
+    s: number;
+    at?: string;
+    ok: boolean | null;
+} | {
+    k: "over";
+}
+/** The file stopped at its size cap: nothing more will be written. */
+ | {
+    k: "cap";
+} | (LiveRecord & {
+    s: number;
+});
+export type ChildWindow = {
+    ok: true;
+    records: ChildView[];
+    cursor: string;
+    /** A cursor was given but didn't hold (forged, stale, another run's or file's): this read started over. */
+    restarted: boolean;
+    /** Output before this read's start isn't shown (the read began at a checkpoint, or waits for one). */
+    earlier: boolean;
+    /** Records that failed a check: counted, never shown. */
+    quarantined: number;
+    /** Lines too long to show that were skipped. */
+    skipped: number;
+    /** More is already written: read again. */
+    more: boolean;
+} | {
+    ok: false;
+    reason: "missing" | "unavailable";
+};
+/** Seal a reader's state under the caller's key (the same form for the run's own file and its subagents'). */
+export declare function sealCursor(state: object, key: Buffer): string;
+/** A sealed state's object when the seal holds and it is within the cap; null otherwise (the caller re-checks it). */
+export declare function openCursor(cursor: string, key: Buffer): Record<string, unknown> | null;
+/** One window of a run's subagents' file. `commands` is the run's own captured answer (store.ts runLiveCommands). */
+export declare function readChildWindow(root: string, runId: number, cursor: string | null, options: {
+    key: Buffer;
+    commands: boolean;
+}): ChildWindow;