toolroll 0.9.73 → 0.9.75

package/dist/server/tasks.js

@@ -1,4 +1,4 @@
-import { releaseAuthorityOfTask, revokeRelease } from "../store.js";
+import { releaseAuthorityOfTask, revokeRelease, runLiveCommands } from "../store.js";
 import { steerCapabilityOf } from "../steer-capabilities.js";
 import { canReveal, localCheckoutOf, revealInFinder } from "../checkout-proof.js";
 /** A form's way back to a flow card ("flow:<flow>:<card>"), read strictly: numbers only, never a path. */
@@ -12,7 +12,7 @@ import { handlersOf } from './handler-registry.js';
 import { closedQuestionWords } from "../decision.js";
 import { DEPRECATED_PAGE } from "../deprecations.js";
 /** tasks handlers, moved without changing their route bodies. */
-import { html, htmlString, joinHtml, textHtml } from "../html.js";
+import { html, htmlString, joinHtml, postForm, textHtml } from "../html.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { lstatSync, realpathSync } from "node:fs";
 import {} from "node:http";
@@ -64,7 +64,7 @@ import { buildProgressOf, parseWorkView } from "../workspace-ui.js";
 import { requestContext } from "./request-context.js";
 import { boardTickScript, oneLineOf, QUEUE_VIEW, refuse, regionScript, screen, transcriptScript, whenTime } from "./chrome.js";
 import { chatReturnWithSaid, matchTaskPath, redirect, respond, reviewHref, safeChatReturn, safeReturn, SAFETY, taskChatHref, taskHref } from "./http.js";
-import { boardBody, boardWorkers, donePage, inboxFingerprints, inboxPage, newTaskPage, nextPage, parseInboxTab, QUEUE_FRONT, queueBody, queueScript, TASK_STATES, tasksPage, workPage } from "./render-pages.js";
+import { boardBody, boardWorkers, donePage, inboxFingerprints, inboxPage, newTaskPage, nextPage, parseInboxTab, QUEUE_FRONT, queueBody, queueScript, TASK_STATES, workPage } from "./render-pages.js";
 import { runEfficiencyOf } from "../run-efficiency.js";
 import { ACCEPT_ANYWAY_NEEDS_REASON, editorFileHref, proofBundleView, rankReviewQueue, RESULT_REFUSALS, REVIEW_QUEUE_CAP, reviewCockpitDetailParts, reviewCockpitPage, reviewPriorityOf, runFactsFragment, runOutcomeBadge, runPage, RUNS_PAGE, runsPage, withRefusal } from "./render-results.js";
 import { approvalFormDigest, approveRefusalWords, checkProgressHtml, consentDoorOf, decisionPage, nonceHashOf, PermissionsWouldChange, requirementsFromEditor, resumeDigestOf, taskOf } from "./render-tasks.js";
@@ -75,7 +75,9 @@ export function createTasksHandlers(runtime) {
     function noPage(who, response) {
         return refuse(response, who, 404, "There's no page at this address.", "/chat");
     }
-    const showCode = (part) => async (ctx) => {
+    // `posted`: the session page's own POST (form token). A GET of changes or the shipping preview runs no git in the
+    // agent's checkout: changes go back to the session page, the preview asks for one click.
+    const showCode = (part, posted = false) => async (ctx) => {
         const { url, who, response, project } = ctx;
         if (who.via !== 'cookie' || !codingActorAllowed({ name: who.name, generation: who.session.generation }))
             return refuse(response, who, 403, 'Coding sessions require installation-wide operator access. You can manage project tasks in Work.', '/work');
@@ -86,6 +88,11 @@ export function createTasksHandlers(runtime) {
             const selected = sessionId !== null && runtime.coding ? runtime.coding.get(sessionId, actor) : null;
             if (selected && !codingProjectAllowed(selected.repo))
                 return refuse(response, who, 403, 'That project is outside your access.', '/projects');
+            if (!posted && part === 'changes' && selected)
+                return redirect(response, `/code/${selected.id}`);
+            if (!posted && part === 'ship' && selected) {
+                return sendScreen(response, 200, screen('Review for shipping', html `<section class="coding-workspace coding-handoff"><h1>Review for shipping</h1><p>${selected.title}</p>${postForm(`/code/${selected.id}/ship/preview`, html `<button type="submit">Review the committed change</button>`)}<p><a href="/code/${selected.id}">Back to coding</a></p></section>`, { chrome: chromeFor(selected.repo, 'code') }));
+            }
             if (part === 'ship' && selected) {
                 const preview = codingHandoffPreview(store, { sessionId: selected.id, actor: who.name });
                 return sendScreen(response, 200, screen('Review for shipping', codingShippingHtml(preview), { chrome: chromeFor(selected.repo, 'code') }));
@@ -207,12 +214,18 @@ export function createTasksHandlers(runtime) {
         // up like the inbox: admission binds the query and every row's repo
         // is re-proved here.
         const view = parseWorkView(url.searchParams.get("view"));
+        // The stored-state filter the old task list had (`?state=`): an unknown state is refused, as it was there.
+        const wantedState = url.searchParams.get("state");
+        if (wantedState !== null && !TASK_STATES.includes(wantedState))
+            return refuse(response, who, 400, "no such state", "/work");
+        const state = wantedState;
         const rollup = project === null && !unscopedMode;
         let work;
         try {
-            work = workIndexPage(store, now, workAccess(), { view, limit: 40, cursor: url.searchParams.get('cursor'), project, root: evidenceRoot });
+            work = workIndexPage(store, now, workAccess(), { view, limit: 40, cursor: url.searchParams.get('cursor'), project, root: evidenceRoot, ...(state === null ? {} : { state }) });
             const facts = requestContext.getStore();
-            if (facts !== undefined) {
+            // A filtered page never stands in for the counts or the Crew: those read the unfiltered work.
+            if (facts !== undefined && state === null) {
                 // These counts cover the exact admitted project lens, including
                 // unplaced tasks where permitted. Crew excludes unplaced rows.
                 if (project === null)
@@ -259,6 +272,7 @@ export function createTasksHandlers(runtime) {
             previous: url.searchParams.has('cursor'),
             multiProject: new Set(work.items.map(task => task.repo ?? "")).size > 1,
             now,
+            state,
             // v105: subscription windows and monthly budgets, for whoever runs the installation.
             limits: store.isInstanceOperator(who.name)
                 ? limitsView(store.providerLimits(), store.budgets().length === 0 ? [] : store.monthSpendCached(now).budgets, { project: projectName, subagent: id => subagentNamesOf(store.handle).get(id) ?? `Subagent ${id}` }, now)
@@ -565,24 +579,18 @@ export function createTasksHandlers(runtime) {
         const { response, project } = ctx;
         return sendScreen(response, 200, donePage(chromeFor(project, "runs"), store.listCompletedWorkScoped(project, 50), pr => store.ciFailureObserved(pr)));
     }
+    /** The old task list, retired into /work (docs/plans/reui-polish.md slice 7): its address keeps answering, as a
+     * redirect, so links and bookmarks still land. `state` carries over (an unknown one is still refused); `template`
+     * goes to the add page, which now pre-fills it. Anything else is dropped. */
     async function showTasks(ctx) {
-        const { url, who, response, project } = ctx;
+        const { url, who, response } = ctx;
         const wanted = url.searchParams.get("state");
-        if (wanted !== null && !TASK_STATES.includes(wanted)) {
-            return refuse(response, who, 400, "no such state", "/tasks");
-        }
-        // ?template=<name> pre-fills the add form from the shipped library —
-        // a pre-filled form and nothing more; the submission path is the
-        // same guarded handler either way.
-        const fromTemplate = url.searchParams.get("template");
-        const picked = fromTemplate === null ? null : templateByName(fromTemplate);
-        const prefill = picked !== null && picked.kind === "task"
-            ? {
-                title: picked.title, goal: picked.goal, not: picked.outOfScope ?? "", touches: picked.touches.join(", "),
-                acceptance: acceptanceToLines(picked.acceptance).join("\n"),
-            }
-            : null;
-        return sendScreen(response, 200, tasksPage(chromeFor(project, "tasks"), familyTasksInView(project, wanted === null ? undefined : wanted).slice(0, 200), wanted, null, project, prefill, store.permissionDefault().mode, store.qualityDefault().mode, store.replacements()));
+        if (wanted !== null && !TASK_STATES.includes(wanted))
+            return refuse(response, who, 400, "no such state", "/work");
+        const template = url.searchParams.get("template");
+        if (template !== null)
+            return redirect(response, `/tasks/new?template=${encodeURIComponent(template)}`);
+        return redirect(response, wanted === null ? "/work" : `/work?state=${encodeURIComponent(wanted)}`);
     }
     async function showQueue(ctx) {
         const { url, who, response, project } = ctx;
@@ -599,14 +607,11 @@ export function createTasksHandlers(runtime) {
         return redirect(response, QUEUE_VIEW);
     }
     async function showNewTask(ctx) {
-        const { who, response, project } = ctx;
-        const revision = who.via === "cookie" ? who.session.projectRevision : 0;
-        const chainable = store
-            .listTasksScoped(project, undefined, 100, null)
-            .filter(one => one.state !== "done" && one.state !== "cancelled" && visible(one.repo))
-            .map(one => ({ id: one.id, title: one.title }));
-        const chrome = chromeFor(project, "tasks");
-        return sendScreen(response, 200, newTaskPage(chrome, project, revision, null, chainable, store.permissionDefault().mode, store.qualityDefault().mode, chrome.projects ?? []));
+        const picked = (() => { const name = ctx.url.searchParams.get("template"); return name === null ? null : templateByName(name); })();
+        const prefill = picked !== null && picked.kind === "task"
+            ? { title: picked.title, goal: picked.goal, not: picked.outOfScope ?? "", touches: picked.touches.join(", "), acceptance: acceptanceToLines(picked.acceptance).join("\n") }
+            : null;
+        return newTaskScreen(ctx, 200, null, prefill);
     }
     async function showTask(ctx) {
         const { url, who, response } = ctx;
@@ -615,7 +620,7 @@ export function createTasksHandlers(runtime) {
             return noPage(who, response);
         const family = familyOf(task.taskId);
         if (family === null)
-            return refuse(response, who, 404, "no such task", "/tasks");
+            return refuse(response, who, 404, "no such task", "/work");
         const version = url.searchParams.get("version");
         if (version !== null && !family.versions.some(one => one.id === version))
             return refuse(response, who, 404, "That version is not available for this task.", taskHref(family.root.id));
@@ -666,12 +671,12 @@ export function createTasksHandlers(runtime) {
         const access = workAccess();
         const family = store.taskFamilyOf(evidence.taskId, access.repos, access.includeUnplaced);
         if (family === null || !visible(family.root.repo))
-            return refuse(response, who, 404, "no such task", "/tasks");
+            return refuse(response, who, 404, "no such task", "/work");
         if (evidence.taskId !== family.root.id)
             return redirect(response, `${taskHref(family.root.id)}/evidence${url.search}`);
         const pack = evidencePack(store, family.root.id, access, who.name, now, evidenceRoot);
         if (pack === null)
-            return refuse(response, who, 404, "no such task", "/tasks");
+            return refuse(response, who, 404, "no such task", "/work");
         if (url.searchParams.get("format") === "json") {
             response.writeHead(200, { "content-type": "application/json; charset=utf-8", "content-disposition": `attachment; filename="evidence-${family.root.id.replace(/[^A-Za-z0-9._-]/g, "_")}.json"`,
                 "cache-control": "no-store", "x-content-type-options": "nosniff" });
@@ -782,11 +787,13 @@ export function createTasksHandlers(runtime) {
             const tailRaw = url.searchParams.get("ktail") ?? "";
             const keys = { inKey: url.searchParams.get("inkey") === "1", tail: validKeyTail(tailRaw) ? tailRaw : "" };
             if (records) {
-                const shown = liveWindowRecords(window, keys);
+                // Command text and output only under this run's own captured answer, never the file's `open` record (v136).
+                const commands = runLiveCommands(store, found.id);
+                const shown = liveWindowRecords(window, commands, keys);
                 return respond(response, 200, "application/json", JSON.stringify({ records: shown, nextOffset: window.nextOffset, gen: window.gen, inKey: keys.inKey, keyTail: keys.tail ?? "", final, ...notesOf() }));
             }
             // The plain words, whatever the file's format; the offset moves by the bytes read even when nothing shows.
-            const lines = liveWindowLines(window, keys);
+            const lines = liveWindowLines(window, runLiveCommands(store, found.id), keys);
             return respond(response, 200, "application/json", JSON.stringify({ text: lines.length === 0 ? "" : `${lines.join("\n")}\n`, nextOffset: window.nextOffset, gen: window.gen, inKey: keys.inKey, keyTail: keys.tail ?? "", final }));
         }
         // One result page (2026-10-02): a builder's finished result opens on
@@ -978,7 +985,7 @@ export function createTasksHandlers(runtime) {
         if (who.via === "cookie") {
             const seen = body.get("projectRevision");
             if (seen !== null && seen !== String(who.session.projectRevision)) {
-                return refuse(response, who, 409, "the open project changed since this form was rendered — reload and try again", "/tasks");
+                return refuse(response, who, 409, "the open project changed since this form was rendered — reload and try again", "/tasks/new");
             }
         }
         const id = (body.get("id") ?? "").trim();
@@ -998,8 +1005,10 @@ export function createTasksHandlers(runtime) {
         // finding 1): the form's `required` is a courtesy, not the guard — a
         // direct POST with no project open must not mint an unplaced task
         // under a ceiling. Unscoped mode keeps its historic unplaced filings.
+        // A refusal from here on is the add page again with the person's own words (the old task list kept them too).
+        const draft = { title, goal: body.get("goal") ?? "", not: body.get("not") ?? "", touches: body.get("touches") ?? "", acceptance: body.get("acceptance") ?? "", values: body.sent };
         if (!unscopedMode && effective === "") {
-            return sendScreen(response, 400, tasksPage(chromeFor(project, "tasks"), familyTasksInView(project).slice(0, 200), null, "name a repository — no project is open, so the task must say where it belongs", project, null, store.permissionDefault().mode, store.qualityDefault().mode, store.replacements()));
+            return newTaskScreen(ctx, 400, "name a repository — no project is open, so the task must say where it belongs", draft);
         }
         let repo = effective;
         let admitted = unscopedMode ? null : admissionList() ?? [];
@@ -1007,7 +1016,7 @@ export function createTasksHandlers(runtime) {
         if (rootMode && effective !== "") {
             const canonical = (await authorizedProject(liveCeiling(), effective)) ? canonicalProject(effective) : null;
             if (canonical === null || canonical === undefined) {
-                return sendScreen(response, 403, tasksPage(chromeFor(project, "tasks"), familyTasksInView(project).slice(0, 200), null, `${effective} is outside what this server was configured to show`, project, null, store.permissionDefault().mode, store.qualityDefault().mode, store.replacements()));
+                return newTaskScreen(ctx, 403, `${effective} is outside what this server was configured to show`, draft);
             }
             repo = canonical;
             admitted = [canonical];
@@ -1063,7 +1072,7 @@ export function createTasksHandlers(runtime) {
             return filed;
         });
         if (!made.ok) {
-            return sendScreen(response, made.reason === "backlog-full" ? 429 : 400, tasksPage(chromeFor(project, "tasks"), familyTasksInView(project).slice(0, 200), null, made.message, project, { title, goal, not: notThis, touches: body.get("touches") ?? "", acceptance: body.get("acceptance") ?? "", values: body.sent }, store.permissionDefault().mode, store.qualityDefault().mode, store.replacements()));
+            return newTaskScreen(ctx, made.reason === "backlog-full" ? 429 : 400, made.message, { title, goal, not: notThis, touches: body.get("touches") ?? "", acceptance: body.get("acceptance") ?? "", values: body.sent });
         }
         const actionContext = requestContext.getStore();
         if (actionContext !== undefined)
@@ -1248,7 +1257,7 @@ export function createTasksHandlers(runtime) {
         const back = taskHref(act.taskId);
         const ref = store.lookupRef(act.taskId);
         if (ref === null || !visible(ref.repo))
-            return refuse(response, who, 404, "no such task", "/tasks");
+            return refuse(response, who, 404, "no such task", "/work");
         const named = (body.get("run") ?? "").trim();
         const run = /^[0-9]{1,15}$/.test(named) ? store.getRun(Number(named)) : null;
         const runTask = run === null ? null : store.externalIdFor(run.taskRef);
@@ -1283,7 +1292,7 @@ export function createTasksHandlers(runtime) {
             return taskScreen(response, who, act.taskId, "The demo merges nothing.", 403);
         const ref = store.lookupRef(act.taskId);
         if (ref === null || !visible(ref.repo))
-            return refuse(response, who, 404, "no such task", "/tasks");
+            return refuse(response, who, 404, "no such task", "/work");
         const named = (body.get("run") ?? "").trim();
         const run = /^[0-9]{1,15}$/.test(named) ? store.getRun(Number(named)) : null;
         const runTask = run === null ? null : store.externalIdFor(run.taskRef);
@@ -1733,10 +1742,10 @@ export function createTasksHandlers(runtime) {
     function taskMutation(response, who, taskId, verb, posted, now) {
         const ref = store.lookupRef(taskId);
         if (ref === null || store.getTask(taskId) === null) {
-            return refuse(response, who, 404, "no such task", "/tasks");
+            return refuse(response, who, 404, "no such task", "/work");
         }
         if (!visible(ref.repo)) {
-            return refuse(response, who, 404, "no such task", "/tasks");
+            return refuse(response, who, 404, "no such task", "/work");
         }
         switch (verb) {
             case "steer": {
@@ -2994,6 +3003,8 @@ export function createTasksHandlers(runtime) {
         "code.state": showCode("state"),
         "code.changes": showCode("changes"),
         "code.ship": showCode("ship"),
+        "code.changes-read": showCode("changes", true),
+        "code.ship-preview": showCode("ship", true),
         "code.other": showCode("unknown"),
         "inbox": showInbox,
         "work": showWork,
@@ -3065,5 +3076,21 @@ export function createTasksHandlers(runtime) {
         "session.editor-links": sessionEditorLinks,
         "incident.resolve": resolveIncident,
     });
+    /** The add page, once more: blank, from a shipped template (`?template=`, as the old task list did), or with a refused
+     * filing's own words and status (the draft keeps the project revision it was written against). */
+    function newTaskScreen(ctx, status, problem, draft) {
+        const { who, response, project } = ctx;
+        const chainable = store
+            .listTasksScoped(project, undefined, 100, null)
+            .filter(one => one.state !== "done" && one.state !== "cancelled" && visible(one.repo))
+            .map(one => ({ id: one.id, title: one.title }));
+        // A refused draft keeps the task it was to start after, even if the refreshed list no longer carries it.
+        const after = draft?.values?.get("after") ?? "";
+        if (after !== "" && !chainable.some(one => one.id === after))
+            chainable.unshift({ id: after, title: "(as submitted)" });
+        const chrome = chromeFor(project, "tasks");
+        const revision = draft?.values !== undefined ? undefined : who.via === "cookie" ? who.session.projectRevision : 0;
+        return sendScreen(response, status, newTaskPage(chrome, project, revision, problem, chainable, store.permissionDefault().mode, store.qualityDefault().mode, chrome.projects ?? [], draft));
+    }
     return { registrations, runListPane, peekFragment, taskMutation, queueRegionFor, ciFailingFor, completedRowFor, attemptRowFor, resultRowOf, reviewCockpitViewOf, decisionEvidence, runEvidence, sendArtifact, peekGuards, liveRunIds };
 }

package/dist/storage-ui.d.ts

@@ -13,6 +13,8 @@ export type StorageView = {
         schedule?: SweepSchedule;
     };
     landed?: LandedSummary;
+    /** When the checkouts were last measured, and its Check now (docs/plans/get-side-effects.md). */
+    measured?: Html;
 };
 export declare function storageHtml(view: StorageView, notice: {
     said?: string | null;

package/dist/storage-ui.js

@@ -85,5 +85,5 @@ export function storageHtml(view, notice) {
     const preview = html `<details class="clean-up" data-clean-up${notice.problem?.startsWith("Enter your Toolroll password to clean") ? html ` open` : ""}><summary>Clean up</summary><div class="preview">${plan.go.length === 0 ? html `<p>Nothing to remove now.</p>` :
         html `<h3>Removes ${plural(plan.go.length, "checkout")}, about ${bytesWords(plan.freeBytes)}</h3><p class="meta">Their branches stay, so nothing committed is lost.</p><ul class="checkouts" data-goes>${plan.go.map(one => item(one))}</ul>`}${plan.stay.length === 0 ? "" : html `<h3>Stays (${plan.stay.length})</h3><ul class="checkouts" data-stays>${plan.stay.map(one => item(one))}</ul>`}${remove}</div></details>`;
     const options = CLEANUP_CHOICES.map(one => html `<option value="${one.value}"${one.value === plan.cleanup ? html ` selected` : ""}>${one.label}</option>`);
-    return html `<section class="storage">${note}<div class="card storage-state"><h2 data-checkout-bytes="${plan.totalBytes}">Checkouts use ${bytesWords(plan.totalBytes)}</h2><p class="meta">${facts}</p><p data-clean-bytes="${plan.freeBytes}">${frees}</p>${view.sweep === undefined ? "" : sweepHtml(view.sweep)}${view.landed === undefined ? "" : landedHtml(view.landed)}${preview}</div><h2>Automatic cleanup</h2>${postForm("/settings/storage", html `<label>Remove a finished task's clean checkout<select name="cleanup">${options}</select></label><p class="meta">Its branch stays. Checkouts with changes, commits on no branch, in use, or waiting for review are kept. When a task's work is already in main, Toolroll marks it complete and removes its checkout and local branches.</p>${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}<button type="submit">Save</button>`, { attrs: { class: "setting" } })}</section>`;
+    return html `<section class="storage">${note}<div class="card storage-state"><h2 data-checkout-bytes="${plan.totalBytes}">Checkouts use ${bytesWords(plan.totalBytes)}</h2><p class="meta">${facts}</p>${view.measured ?? ""}<p data-clean-bytes="${plan.freeBytes}">${frees}</p>${view.sweep === undefined ? "" : sweepHtml(view.sweep)}${view.landed === undefined ? "" : landedHtml(view.landed)}${preview}</div><h2>Automatic cleanup</h2>${postForm("/settings/storage", html `<label>Remove a finished task's clean checkout<select name="cleanup">${options}</select></label><p class="meta">Its branch stays. Checkouts with changes, commits on no branch, in use, or waiting for review are kept. When a task's work is already in main, Toolroll marks it complete and removes its checkout and local branches.</p>${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}<button type="submit">Save</button>`, { attrs: { class: "setting" } })}</section>`;
 }

package/dist/storage.js

@@ -101,7 +101,8 @@ export function diskBytes(paths) {
     if (process.platform !== "win32") {
         for (let at = 0; at < paths.length; at += 200) {
             const batch = paths.slice(at, at + 200);
-            const du = spawnSync("du", ["-sk", ...batch], { encoding: "utf8", maxBuffer: 16 * 1024 * 1024 });
+            // Bounded: a slow disk leaves the rest unmeasured rather than holding everything up.
+            const du = spawnSync("du", ["-sk", ...batch], { encoding: "utf8", maxBuffer: 16 * 1024 * 1024, timeout: 60_000 });
             for (const line of (du.stdout ?? "").split("\n")) {
                 const match = /^(\d+)\t(.+)$/.exec(line);
                 if (match !== null && batch.includes(match[2]))

package/dist/store.d.ts

@@ -103,6 +103,9 @@ export declare const BRANCH_BASE_MOVE_SCHEMA = "\nCREATE TABLE IF NOT EXISTS bra
  * continues a paused build with a short continue frame and no note: one row per request, bound to the exact paused run;
  * sent_at when the frame was written, ended_at when the run was no longer paused to take it. */
 export declare const LIVE_STEER_SCHEMA = "\nCREATE TABLE IF NOT EXISTS run_pause (\n  id            INTEGER PRIMARY KEY AUTOINCREMENT,\n  run           INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  task_ref      INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  request_id    TEXT NOT NULL UNIQUE,\n  requested_by  TEXT NOT NULL,\n  requested_via TEXT NOT NULL CHECK (requested_via IN ('cli','web','chat')),\n  requested_at  TEXT NOT NULL,\n  note          INTEGER REFERENCES task_steer(id) ON DELETE SET NULL,\n  sent_at       TEXT,\n  paused_at     TEXT,\n  resumed_at    TEXT,\n  ended_at      TEXT\n);\nCREATE INDEX IF NOT EXISTS run_pause_by_run ON run_pause (run, id);\nCREATE TABLE IF NOT EXISTS run_resume (\n  id            INTEGER PRIMARY KEY AUTOINCREMENT,\n  run           INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  task_ref      INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  request_id    TEXT NOT NULL UNIQUE,\n  requested_by  TEXT NOT NULL,\n  requested_via TEXT NOT NULL CHECK (requested_via IN ('cli','web','chat')),\n  requested_at  TEXT NOT NULL,\n  sent_at       TEXT,\n  ended_at      TEXT\n);\nCREATE INDEX IF NOT EXISTS run_resume_by_run ON run_resume (run, id);\n";
+/** v136: a run's own "Show commands in the live view" answer, captured once before its live file opens (live-detail.ts).
+ * Absent, unreadable or anything but 1 means off. */
+export declare const RUN_LIVE_DETAIL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS run_live_detail (\n  run         INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,\n  commands    INTEGER NOT NULL CHECK (commands IN (0,1)),\n  captured_at TEXT NOT NULL\n);\n-- The Agents view's Live grid (docs/plans/agents-view.md \u00A72.5): every role's running runs and its recently ended ones.\n-- (id > 0 keeps them to the grid's own query, which names it: no other query's plan is offered them.)\nCREATE INDEX IF NOT EXISTS run_live_open ON run (id) WHERE outcome IS NULL AND id > 0;\nCREATE INDEX IF NOT EXISTS run_live_recent ON run (finished_at) WHERE outcome IS NOT NULL AND id > 0;\n";
 /** A project's "Show commands in the live view" (live-detail.ts): absent means off. */
 export declare const LIVE_DETAIL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS live_detail_setting (\n  repo       TEXT PRIMARY KEY,\n  commands   INTEGER NOT NULL CHECK (commands IN (0,1)),\n  updated_by TEXT NOT NULL,\n  updated_at TEXT NOT NULL\n);\n-- Every run a steering note reached, kept as it happens (live-notes.ts): a\n-- note's own attached/mailed fields move to the next attempt, this does not.\nCREATE TABLE IF NOT EXISTS steer_note_run (\n  note INTEGER NOT NULL REFERENCES task_steer(id) ON DELETE CASCADE,\n  run  INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  how  TEXT NOT NULL CHECK (how IN ('attached','mailed','read')),\n  at   TEXT NOT NULL,\n  PRIMARY KEY (note, run, how)\n);\nCREATE INDEX IF NOT EXISTS steer_note_run_by_run ON steer_note_run (run, note);\n";
 export declare const CHAT_APPROVAL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS chat_approval_setting (\n  approver             TEXT NOT NULL,\n  scope                TEXT NOT NULL,\n  enabled              INTEGER NOT NULL CHECK (enabled IN (0,1)),\n  full_access          INTEGER NOT NULL DEFAULT 0 CHECK (full_access IN (0,1)),\n  attempt_cap_microusd INTEGER CHECK (attempt_cap_microusd IS NULL OR attempt_cap_microusd >= 0),\n  generation           INTEGER NOT NULL,\n  digest               TEXT NOT NULL,\n  updated_by           TEXT NOT NULL,\n  updated_at           TEXT NOT NULL,\n  PRIMARY KEY (approver, scope)\n);\n";
@@ -183,7 +186,7 @@ export type SealedLedgerEntry = LedgerEntry & {
         hash: string;
     } | null;
 };
-export declare const SCHEMA_VERSION = 135;
+export declare const SCHEMA_VERSION = 136;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export declare const V118_MERGED_TABLES: Readonly<Record<string, CredentialKind>>;
 /**
@@ -2394,6 +2397,9 @@ export declare class Store {
         signedBy: string;
         absoluteExpiry: string;
     } | null;
+    /** Close every operating mode past its expiry (the background pass). Returns how many were closed. */
+    closeExpiredModes(now: Date): number;
+    private closeExpiredMode;
     /** Sign (or renew) a mode: closes any predecessor with a typed event and
      * ATOMICALLY reconciles the repo's nonterminal merge intents to the new
      * posture (F2). The caller has already run the password ceremony. */
@@ -7135,6 +7141,11 @@ export declare class Store {
         error: string;
     }, now: Date): boolean;
     private bumpPushFailures;
+    /** Which conversation a page's first send started (quiet page visits): recorded with the start, in the same
+     * transaction, so a retry of that send never starts another, even after a restart or once that one has ended. */
+    leadStartReceipt(approver: string, request: string): {
+        session: number;
+    } | null;
     /** A chat send receipt contains no message text. The session is part of
      * its namespace; callers must prove that session before reading it. */
     leadRequestReceipt(session: number, request: string): {
@@ -7747,3 +7758,25 @@ export declare function currentReleaseIssuer(): ReleaseIssuer;
  * that can't be read — is not proof, and the operation stays for a person.
  */
 export declare function releaseIssuerGone(op: ReleaseOperation): boolean;
+/**
+ * Capture a run's live-view answer once, before its live file opens: the first capture stands (a second never changes
+ * it). Returns the answer now saved for the run; any failure, or a saved row that isn't plainly 1, is commands off.
+ */
+export declare function captureRunLiveDetail(store: Store, runId: number, commands: boolean, now: Date): boolean;
+/** Whether a run's live view may show commands: only its own captured answer, and only when that is plainly 1. Absent
+ * (a run from before v136, or one whose capture failed), unreadable or anything else is off. */
+export declare function runLiveCommands(store: Store, runId: number): boolean;
+/** One run as the Agents view's Live grid reads it (docs/plans/agents-view.md §2.5). */
+export type AgentsLiveRun = Run & {
+    taskId: string;
+    title: string;
+    repo: string | null;
+    builtIn: boolean;
+};
+/**
+ * The Live grid's runs: every role's running run (no outcome yet) and every run that ended at or after `endedSince`,
+ * newest first — all of them (no cutoff before the caller's visibility filter: a viewer's agent is never hidden behind
+ * others'). Two indexed reads (run_live_open, run_live_recent), never a scan of all runs.
+ * Visibility is the caller's: it filters each by the console's ceiling and the viewer's access.
+ */
+export declare function agentsLiveRuns(store: Store, endedSince: Date): AgentsLiveRun[];

package/dist/store.js

@@ -97,6 +97,7 @@ import { REVIEW_SCHEMA, reviewSwitchWords } from "./review-switch.js";
 import { SPEND_SCHEMA, billingOf, budgetStates, canPrice, claudeMachineBilling, countsToward, filersOf, monthOf, priceWork, seenBilling as seenBillingOf, spendItems, subagentFilers, usd } from "./spend.js";
 import { DEFAULT_PERIODS, RETENTION_SCHEMA, periodWords, widenRetentionSchema } from "./retention.js";
 import { CHECKOUT_CLEANUP_SCHEMA, LANDED_CLEANUP_SCHEMA, STORAGE_SWEEP_SCHEMA, DEFAULT_CLEANUP, cleanupWords } from "./storage.js";
+import { inReadOnlyRequest } from "./read-only-request.js";
 import { IN_RANGE, LEDGER_CHAIN_SCHEMA, safeWhole, sealLedger, verifyLedgerChain } from "./ledger-chain.js";
 import { NO_RULES, filerFor, isProtectedWork, protectedChanges, rulesWords } from "./approval-policy.js";
 import { configBase, envValue, namedPath } from "./names.js";
@@ -443,6 +444,19 @@ CREATE TABLE IF NOT EXISTS run_resume (
 );
 CREATE INDEX IF NOT EXISTS run_resume_by_run ON run_resume (run, id);
 `;
+/** v136: a run's own "Show commands in the live view" answer, captured once before its live file opens (live-detail.ts).
+ * Absent, unreadable or anything but 1 means off. */
+export const RUN_LIVE_DETAIL_SCHEMA = `
+CREATE TABLE IF NOT EXISTS run_live_detail (
+  run         INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,
+  commands    INTEGER NOT NULL CHECK (commands IN (0,1)),
+  captured_at TEXT NOT NULL
+);
+-- The Agents view's Live grid (docs/plans/agents-view.md §2.5): every role's running runs and its recently ended ones.
+-- (id > 0 keeps them to the grid's own query, which names it: no other query's plan is offered them.)
+CREATE INDEX IF NOT EXISTS run_live_open ON run (id) WHERE outcome IS NULL AND id > 0;
+CREATE INDEX IF NOT EXISTS run_live_recent ON run (finished_at) WHERE outcome IS NOT NULL AND id > 0;
+`;
 /** A project's "Show commands in the live view" (live-detail.ts): absent means off. */
 export const LIVE_DETAIL_SCHEMA = `
 CREATE TABLE IF NOT EXISTS live_detail_setting (
@@ -737,7 +751,10 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // release_operation), each release check attempt's intended mode, sealed before it runs (release_check_attempt), the
 // nightly full check on main and its open failures (nightly_check, main_check_failure), and a scope's release terms
 // (task_scope.release_terms_json; saved rows read NULL: no release terms).
-export const SCHEMA_VERSION = 135;
+// v136 adds, and changes no saved row: each run's own "Show commands in the live view" answer, captured once before its
+// live file opens (run_live_detail; docs/plans/agents-view.md §2.4). Saved runs have none, which every reader takes as
+// commands off: permission is never recovered from a transcript or the project's current setting.
+export const SCHEMA_VERSION = 136;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -870,7 +887,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -4219,6 +4236,8 @@ CREATE INDEX IF NOT EXISTS run_checkpoint_by_task ON run_checkpoint (task_ref, i
         for (const [column, { definition }] of Object.entries(columns))
             addColumn(db, table, column, definition);
     }
+    // v136: each run's own live-view answer (a new table only; saved runs have none: commands off).
+    db.exec(RUN_LIVE_DETAIL_SCHEMA);
     // Keep the epoch until reclamation succeeds, including a retry after compaction already committed. A new file has
     // nothing to reclaim.
     if (!fresh)
@@ -7145,15 +7164,10 @@ export class Store {
         if (row === undefined)
             return null;
         if (Date.parse(String(row["absolute_expiry"])) <= now.getTime()) {
-            this.transact(() => {
-                this.db
-                    .prepare("UPDATE operating_mode SET revoked_at = ?, revoked_by = ?, revoke_reason = 'expired' WHERE id = ? AND revoked_at IS NULL")
-                    .run(now.toISOString(), "the-clock", Number(row["id"]));
-                this.db
-                    .prepare("INSERT INTO operating_mode_event (mode, kind, actor, at) VALUES (?, 'expired-closed', 'the-clock', ?)")
-                    .run(Number(row["id"]), now.toISOString());
-                this.reconcileIntentsForMode(String(row["repo"]), null, now);
-            });
+            // A page visit only reads (docs/plans/get-side-effects.md): it sees no mode, and the background pass or the
+            // next path that acts closes it.
+            if (!inReadOnlyRequest())
+                this.closeExpiredMode(Number(row["id"]), String(row["repo"]), now);
             return null;
         }
         return {
@@ -7165,6 +7179,34 @@ export class Store {
             absoluteExpiry: String(row["absolute_expiry"]),
         };
     }
+    /** Close every operating mode past its expiry (the background pass). Returns how many were closed. */
+    closeExpiredModes(now) {
+        // The same rows activeMode would close: unrevoked, signed by a standing approver, past their expiry.
+        const rows = this.db.prepare(`SELECT operating_mode.id, operating_mode.repo, operating_mode.absolute_expiry FROM operating_mode
+      JOIN approver ON approver.name = operating_mode.signed_by AND approver.revoked_at IS NULL AND approver.role = 'approver'
+     WHERE operating_mode.revoked_at IS NULL`).all();
+        let closed = 0;
+        for (const row of rows) {
+            if (Date.parse(String(row["absolute_expiry"])) > now.getTime())
+                continue;
+            this.closeExpiredMode(Number(row["id"]), String(row["repo"]), now);
+            closed++;
+        }
+        return closed;
+    }
+    closeExpiredMode(id, repo, now) {
+        this.transact(() => {
+            const closed = this.db
+                .prepare("UPDATE operating_mode SET revoked_at = ?, revoked_by = ?, revoke_reason = 'expired' WHERE id = ? AND revoked_at IS NULL")
+                .run(now.toISOString(), "the-clock", id);
+            if (Number(closed.changes) !== 1)
+                return;
+            this.db
+                .prepare("INSERT INTO operating_mode_event (mode, kind, actor, at) VALUES (?, 'expired-closed', 'the-clock', ?)")
+                .run(id, now.toISOString());
+            this.reconcileIntentsForMode(repo, null, now);
+        });
+    }
     /** Sign (or renew) a mode: closes any predecessor with a typed event and
      * ATOMICALLY reconciles the repo's nonterminal merge intents to the new
      * posture (F2). The caller has already run the password ceremony. */
@@ -19157,6 +19199,13 @@ export class Store {
             .run(pairId);
     }
     // ---- idempotency --------------------------------------------------------
+    /** Which conversation a page's first send started (quiet page visits): recorded with the start, in the same
+     * transaction, so a retry of that send never starts another, even after a restart or once that one has ended. */
+    leadStartReceipt(approver, request) {
+        const row = this.db.prepare("SELECT result FROM mutation WHERE idempotency_key = ? AND operation = 'mate-start'")
+            .get(`mate-start:${approver}:${request}`);
+        return row === undefined ? null : parseStoreColumn("mutation.result", row["result"]);
+    }
     /** A chat send receipt contains no message text. The session is part of
      * its namespace; callers must prove that session before reading it. */
     leadRequestReceipt(session, request) {
@@ -20746,3 +20795,51 @@ function processStartedAt(pid) {
         return null;
     }
 }
+// A run's own "Show commands in the live view" answer (schema v136, docs/plans/agents-view.md §2.4). Free functions over
+// the store, kept together at the end.
+/**
+ * Capture a run's live-view answer once, before its live file opens: the first capture stands (a second never changes
+ * it). Returns the answer now saved for the run; any failure, or a saved row that isn't plainly 1, is commands off.
+ */
+export function captureRunLiveDetail(store, runId, commands, now) {
+    try {
+        store.handle.prepare("INSERT OR IGNORE INTO run_live_detail (run, commands, captured_at) VALUES (?, ?, ?)").run(runId, commands ? 1 : 0, now.toISOString());
+    }
+    catch {
+        return false;
+    }
+    return runLiveCommands(store, runId);
+}
+/** Whether a run's live view may show commands: only its own captured answer, and only when that is plainly 1. Absent
+ * (a run from before v136, or one whose capture failed), unreadable or anything else is off. */
+export function runLiveCommands(store, runId) {
+    try {
+        const row = store.handle.prepare("SELECT commands FROM run_live_detail WHERE run = ?").get(runId);
+        return row !== undefined && row["commands"] === 1;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The Live grid's runs: every role's running run (no outcome yet) and every run that ended at or after `endedSince`,
+ * newest first — all of them (no cutoff before the caller's visibility filter: a viewer's agent is never hidden behind
+ * others'). Two indexed reads (run_live_open, run_live_recent), never a scan of all runs.
+ * Visibility is the caller's: it filters each by the console's ceiling and the viewer's access.
+ */
+export function agentsLiveRuns(store, endedSince) {
+    const rows = store.handle.prepare(`SELECT run.*, task_ref.external_id AS live_task_id, task_ref.repo AS live_task_repo, task.title AS live_task_title, task_ref.backend AS live_task_backend
+       FROM (SELECT id FROM run INDEXED BY run_live_open WHERE outcome IS NULL AND id > 0
+             UNION SELECT id FROM run INDEXED BY run_live_recent WHERE outcome IS NOT NULL AND id > 0 AND finished_at >= ?) AS picked
+       JOIN run ON run.id = picked.id
+       JOIN task_ref ON task_ref.id = run.task_ref
+       LEFT JOIN task ON task_ref.backend = ? AND task.id = task_ref.external_id
+      ORDER BY run.id DESC`).all(endedSince.toISOString(), BUILT_IN);
+    return rows.map(row => ({
+        ...readRun(row),
+        taskId: String(row["live_task_id"]),
+        builtIn: row["live_task_backend"] === BUILT_IN,
+        title: row["live_task_title"] === null || row["live_task_title"] === undefined ? String(row["live_task_id"]) : String(row["live_task_title"]),
+        repo: row["live_task_repo"] === null || row["live_task_repo"] === undefined ? null : String(row["live_task_repo"]),
+    }));
+}

package/dist/stream-scope.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Whose event is this (docs/plans/agents-view.md §2.1): Claude's `stream-json` interleaves the session's own events
+ * with its subagents', and a subagent's carry `parent_tool_use_id` (the parent's Task/Agent call). Only the session's
+ * own events drive its lifecycle, identity and accounting: the receipt, the primary result, the saved session, live
+ * input, the turn and activity marks, and the billing observations. A subagent's init, words or result prove nothing
+ * about the main query.
+ *
+ * Unknown shapes fail toward "not the parent": any present, non-null `parent_tool_use_id` (an id, `""`, a number)
+ * makes the event a subagent's. Pure, no imports: every reader shares this one copy.
+ */
+/** The session's own event: `parent_tool_use_id` absent or null. */
+export declare function topLevelEvent(event: Record<string, unknown>): boolean;
+/**
+ * The main query's `result`, selected structurally (finding 10): top-level, and its `origin` absent, null or
+ * `{kind: "human"}`. An allowlist, so a background task's result, a subagent's result, or any future origin kind is
+ * never the run's envelope.
+ */
+export declare function primaryResultEvent(event: Record<string, unknown>): boolean;

package/dist/stream-scope.js

@@ -0,0 +1,28 @@
+/**
+ * Whose event is this (docs/plans/agents-view.md §2.1): Claude's `stream-json` interleaves the session's own events
+ * with its subagents', and a subagent's carry `parent_tool_use_id` (the parent's Task/Agent call). Only the session's
+ * own events drive its lifecycle, identity and accounting: the receipt, the primary result, the saved session, live
+ * input, the turn and activity marks, and the billing observations. A subagent's init, words or result prove nothing
+ * about the main query.
+ *
+ * Unknown shapes fail toward "not the parent": any present, non-null `parent_tool_use_id` (an id, `""`, a number)
+ * makes the event a subagent's. Pure, no imports: every reader shares this one copy.
+ */
+/** The session's own event: `parent_tool_use_id` absent or null. */
+export function topLevelEvent(event) {
+    const parent = event["parent_tool_use_id"];
+    return parent === undefined || parent === null;
+}
+/**
+ * The main query's `result`, selected structurally (finding 10): top-level, and its `origin` absent, null or
+ * `{kind: "human"}`. An allowlist, so a background task's result, a subagent's result, or any future origin kind is
+ * never the run's envelope.
+ */
+export function primaryResultEvent(event) {
+    if (event["type"] !== "result" || !topLevelEvent(event))
+        return false;
+    const origin = event["origin"];
+    if (origin === undefined || origin === null)
+        return true;
+    return typeof origin === "object" && String(origin["kind"] ?? "") === "human";
+}

package/dist/subagent-work.js

@@ -235,6 +235,9 @@ function carryOut(store, flow, definition, stage, card, mate, context, answer, n
     }
     if (answer.action === "cant") {
         event("handled", `Couldn't handle “${card.title}”: ${answer.note}`);
+        // A zone that answers whoever asked tells them it couldn't, in its own words when it gave some: they always hear back.
+        if (stage.reply === true)
+            replyToAsker(store, flow, card, mate, answer.note || (answer.reason === "" ? `${context.name} couldn't handle this.` : `${context.name} couldn't handle this: ${answer.reason}`), now);
         if (stage.onFail !== null)
             store.moveFlowCard(card.id, { to: stage.onFail, outcome: "fail", actor, note: answer.note === "" ? null : note(answer.note), expectEntry: card.entry }, now);
         else