toolroll 0.9.82 → 0.9.84

package/dist/server/settings.js

@@ -9,6 +9,7 @@ import { CONNECT_CALLBACK, connectionsOf, finishConnect, localConnectOf, oneClic
 import { learningView } from "../project-learning.js";
 import { skillTestResult } from "../project-skills.js";
 import { discoverTools, projectToolsOf } from "../project-tools.js";
+import { lookProjectMcp } from "../folder-look.js";
 import { publishingOf } from '../pull-request-flow.js';
 import { skillTestFeedbackHtml } from "../skills-ui.js";
 import { labelOf, nameOf } from "../subagent-admin.js";
@@ -25,7 +26,7 @@ import { modeTermsFromJson } from "../modes.js";
 import { envValue } from "../names.js";
 import { REMOTE_MESSAGES } from "../operate-remote.js";
 import { canonicalProject, projectName } from "../project.js";
-import { ALL_CREDENTIAL_ENV } from "../provider.js";
+import { ALL_CREDENTIAL_ENV, MONEY_CAPABILITIES } from "../provider.js";
 import { updateChecksOff } from "../releases.js";
 import { authenticateAccount } from "../scope.js";
 import { budgetLabel, monthOf } from "../spend.js";
@@ -34,7 +35,7 @@ import { handlersOf } from './handler-registry.js';
 import { refuse, screen } from "./chrome.js";
 import { HANDOFF_STYLE, redirect, respond, safeReturn, sayTo, signInSpent, startedHere } from "./http.js";
 import { html, htmlString, joinHtml, postForm, reauth } from "../html.js";
-import { browserCaller } from "./session.js";
+import { browserCaller, sessionWithinLifetime } from "./session.js";
 /** settings handlers, moved without changing their route bodies. */
 import { DEFAULT_ACCENT, normalHex } from "../accent-colors.js";
 import { resolvePhaseAgent } from "../agentconfig.js";
@@ -73,6 +74,9 @@ import { startConnect } from "../mcp-connect.js";
 import { decideProposal, listProposals, memoryStatus } from "../memory-pass.js";
 import { checkModels, isNewModel, modelOptions, modelWords, RUNTIME_TOOLS, runtimeStates, seenModels, setWatch, updateRuntime, watchState } from "../model-catalog.js";
 import { modelsHtml, modelsScript } from "../models-ui.js";
+import { ALL_SLOTS, applyModelChoices, browserWords, checkScope, DEFAULT_PRESET, isPresetName, newerModels, PRESETS, presetChange, presetInUse, previewModelChange, recentRuns, rowAt, slotKey, SLOTS, slotWords, stateDigest, switchChange } from "../model-choices.js";
+import { HEADROOM_FIVE_HOUR_LIMIT, HEADROOM_WEEKLY_LIMIT, exactModelId } from "../phase-routing.js";
+import { RISKY_MEANS, SIZE_MEANS, SIZING_CLAUDE_MODEL } from "../task-sizing.js";
 import { CHAT_APPROVE_ALL, MODE_MAX_DAYS, modeDigestOf, modeTermsJson, modeWords, presetTerms } from "../modes.js";
 import { monitoringChange, readMonitoring, saveMonitoring } from "../monitoring-settings.js";
 import { monitoringHtml, signingSecretHtml } from "../monitoring-ui.js";
@@ -108,7 +112,9 @@ import { addProjectInstructions, ASSISTANTS, detectPreparation, modelChoices, pr
 import { skillsHtml, skillsScript } from "../skills-ui.js";
 import { checkSlackCredentials, clearSlackCredentials, loadSlackCredentials, saveSlackCredentials, SLACK_MANIFEST, SlackError } from "../slack-api.js";
 import { slackSettingsHtml } from "../slack-settings.js";
-import { spendCsv, spendHtml } from "../spend-ui.js";
+import { spendHtml, spendSettingsHtml } from "../spend-ui.js";
+import { spendReport, spendReportCsv, spendRows } from "../spend-report.js";
+import { limitsHtml, limitsView } from "../limits-ui.js";
 import { budgetStates, monthNamed, spendItems, usd as spendUsd, subagentNames as subagentNamesOf } from "../spend.js";
 import { removeSsoSettings, saveSsoSettings, SSO_CALLBACK, ssoChangeWords } from "../sso-settings.js";
 import { ssoSettingsHtml } from "../sso-ui.js";
@@ -132,8 +138,9 @@ import { personChip, ROLE_TITLES } from "./chrome.js";
 import { chatReturnWithSaid, goOutside } from "./http.js";
 import { leadSettingsHtml, notificationProjects, SETTINGS_AUTOSAVE_SCRIPT, settingsPage, settingsWorkers, telegramDeliveryWords, telegramTrouble } from "./render-settings.js";
 export function createSettingsHandlers(runtime) {
-    const { store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, connectionKnown, lastChecks, checkRelease, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, chatCatalogKnown, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, authenticateCredential, deletedRepos, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, defaultProject, googleVisits } = runtime;
-    // v105: what agent work cost, by month, and the monthly budgets. An instance operator's page.
+    const { identities, store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, connectionKnown, lastChecks, checkRelease, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, chatCatalogKnown, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, authenticateCredential, deletedRepos, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, googleVisits } = runtime;
+    // What agent work cost, by month: API dollars, plan usage and unknown cost apart (spend-report.ts). An instance
+    // operator's page. Its limits show read-only; they change on Settings → Spend.
     async function spendPage(ctx) {
         const { url, who, response, now } = ctx;
         const current = monthOf(now);
@@ -141,26 +148,17 @@ export function createSettingsHandlers(runtime) {
         const month = asked === null ? current : monthNamed(asked);
         if (month === null)
             return refuse(response, who, 400, "Choose a month like 2026-09.", "/spend");
-        const items = spendItems(store.handle, month.from, month.to);
-        const subagents = store.subagents([...new Set([...managedRepos(), ...store.knownRepos()])]);
+        const rows = spendRows(store.handle, month.from, month.to);
         const subagentNames = subagentNamesOf(store.handle);
         if (url.searchParams.get("format") === "csv") {
             response.writeHead(200, { "content-type": "text/csv; charset=utf-8", "content-disposition": `attachment; filename="standing-orders-spend-${month.name}.csv"`, "cache-control": "no-store", "x-content-type-options": "nosniff" });
-            return void response.end(spendCsv(items, subagentNames));
+            return void response.end(spendReportCsv(rows, subagentNames));
         }
         const shift = (by) => { const at = new Date(`${month.name}-01T00:00:00.000Z`); at.setUTCMonth(at.getUTCMonth() + by); return at.toISOString().slice(0, 7); };
-        const projects = consoleProjects();
-        const people = store.accountFacts().filter(one => one.revokedAt === null).map(one => one.name);
-        const view = {
-            month: month.name, previous: shift(-1), next: month.name === current.name ? null : shift(1),
-            items, budgets: budgetStates(store.budgets(), items), subagentNames, csrf: who.via === "cookie" ? who.session.csrf : "",
-            targets: [
-                { value: "installation:*", label: "Everything", group: "Everything" },
-                ...projects.map(repo => ({ value: `project:${repo}`, label: projectName(repo), group: "Projects" })),
-                ...people.map(name => ({ value: `person:${name}`, label: name, group: "People" })),
-                ...subagents.map(one => ({ value: `subagent:${one.id}`, label: `${subagentNames.get(one.id) ?? one.handle} (${projectName(one.repo)})`, group: "Subagents" })),
-            ],
-        };
+        // Limits read what the budget gate counts today (spend.ts spendItems), for the current month.
+        const budgets = month.name === current.name ? budgetStates(store.budgets(), spendItems(store.handle, current.from, current.to)) : null;
+        const windows = month.name !== current.name ? html `` : limitsHtml(limitsView(store.providerLimits(), [], { project: projectName, subagent: id => subagentNames.get(id) ?? `Subagent ${id}` }, now));
+        const view = { month: month.name, previous: shift(-1), next: month.name === current.name ? null : shift(1), report: spendReport(rows), budgets, windows, subagentNames };
         return sendScreen(response, 200, screen("Spend", spendHtml(view, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }), { chrome: chromeFor(null, "spend") }));
     }
     async function modePage(ctx) {
@@ -247,7 +245,13 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const instructions = previewProjectInstructions(project);
         // The model list as last loaded; Refresh models posts, and the background checks keep it current.
         const catalog = asked === "openrouter" ? modelCatalog.known(readProviderKey("openrouter", providerHome)) ?? { ok: false, problem: "The model list has not loaded yet." } : null;
-        const inputs = { provider: asked, model: saved?.provider === asked ? saved.model ?? "" : models[0]?.value ?? "", command: setup?.command ?? (saved === null ? preparation?.command ?? "" : ""), seconds: String((setup?.timeoutMs ?? 300_000) / 1000) };
+        // With nothing saved, setup preselects what the installation builds routine tasks with, else "Sized by job"'s
+        // routine builder (Sonnet 5.5) for Claude: an exact id, never a floating name.
+        const installationBuild = store.phaseConfig(INSTALLATION_SCOPE, "build");
+        const routineDefault = PRESETS[DEFAULT_PRESET].rows["build"] ?? "";
+        const preselected = installationBuild?.provider === asked && installationBuild.model !== null && models.some(one => one.value === installationBuild.model) ? installationBuild.model
+            : asked === "claude" && models.some(one => one.value === routineDefault) ? routineDefault : models[0]?.value ?? "";
+        const inputs = { provider: asked, model: saved?.provider === asked ? saved.model ?? "" : preselected, command: setup?.command ?? (saved === null ? preparation?.command ?? "" : ""), seconds: String((setup?.timeoutMs ?? 300_000) / 1000) };
         return sendScreen(response, 200, screen("Project setup", controlSetupHtml({ repo: project, csrf: who.via === "cookie" ? who.session.csrf : "", provider: asked, inputs, models, connection, catalog, task, preparation,
             instructions: instructions.ok ? { installed: instructions.installed } : { installed: false, message: instructions.message } }), { chrome: chromeFor(project, "settings"), ...(catalog === null ? {} : { functional: { script: openRouterPickerScript() } }) }));
     };
@@ -300,7 +304,9 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const now = clock();
         // The page shows the last check and when it ran (docs/plans/get-side-effects.md): Check now, or the watch loop's
         // automatic checks, fetch the lists and may queue a notice; opening the page never does.
-        const view = modelsView(who.role === "approver", who.via === "cookie" ? who.session.csrf : "", now, url.searchParams.get("said"), url.searchParams.get("problem"));
+        // Only an instance operator changes models (docs/plans/spend-dashboard.md D4); a preset or a switch is previewed
+        // here, read-only, and applied by its own password-checked POST.
+        const view = modelsView(who.via === "cookie" && store.isInstanceOperator(who.name), who.via === "cookie" ? who.session.csrf : "", now, url.searchParams.get("said"), url.searchParams.get("problem"), url.searchParams);
         return sendScreen(response, 200, screen("Models", html `<p><a href="/settings">Settings</a></p><h1>Models</h1>${modelsHtml(view)}`, { chrome: chromeFor(project, "settings"), functional: { script: modelsScript() } }));
     }
     async function skillsPage(ctx) {
@@ -866,7 +872,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
     async function spendBudget(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.spendBudget);
-        const back = sayTo(response, "/spend");
+        const back = sayTo(response, "/settings/spend");
         if (!authenticateApprover(who, body.get("password") ?? "").ok)
             return back("problem", "Enter your Toolroll password to change a budget.");
         const target = /^(installation|project|person|subagent):(.+)$/.exec(body.get("target") ?? "");
@@ -1547,7 +1553,15 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
                 const wanted = body.getAll("import");
                 if (wanted.length === 0)
                     return back("problem", "Choose at least one tool to add.");
-                const found = discoverTools(repo, await codexServers(repo), toolHome);
+                // The project's own .mcp.json read now, off the console's thread (folder-look.ts).
+                let projectConfig;
+                if (options.identities !== undefined) {
+                    const looked = await lookProjectMcp(repo);
+                    if (!looked.ok)
+                        return back("problem", "This project's folder didn't answer. It may be on a drive that's disconnected, or waiting on macOS. Try again in a moment.");
+                    projectConfig = looked.value;
+                }
+                const found = discoverTools(repo, await codexServers(repo), toolHome, process.env, projectConfig);
                 const added = [], problems = [];
                 for (const one of wanted) {
                     const match = found.find(tool => tool.spec.name === one);
@@ -1639,38 +1653,6 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
             const updated = await updateRuntime(store, tool, who.name, now, modelSeams);
             return back(updated.message, !updated.ok);
         }
-        if (action === "agent") {
-            const phase = body.get("phase") ?? "", agent = body.get("agent") ?? "";
-            if (!["plan", "build", "review", "repair"].includes(phase))
-                return back("Choose a role.", true);
-            const role = ROLE_TITLES[phase];
-            if (agent === "inherit") {
-                if (phase !== "repair")
-                    return back("Choose a model.", true);
-                store.clearPhaseConfig(INSTALLATION_SCOPE, "repair");
-                return back("Repairs now use the builder's agent.");
-            }
-            const split = agent.indexOf("|");
-            const provider = split < 0 ? "" : agent.slice(0, split), model = split < 0 ? "" : agent.slice(split + 1);
-            if (!isProviderId(provider) || !validModelId(model))
-                return back("Choose a model from the list.", true);
-            const valid = validateSpec({ provider, model });
-            if (!valid.ok)
-                return back(valid.problem, true);
-            if (phase === "review" && provider === "gemini")
-                return back("Gemini cannot review yet. Choose Claude or Codex.", true);
-            const build = store.phaseConfig(INSTALLATION_SCOPE, "build");
-            if (phase === "repair" && build !== null && build.provider !== provider)
-                return back(`Repairs must use the builder's provider (${build.provider}).`, true);
-            store.setPhaseConfig(INSTALLATION_SCOPE, phase, provider, model, who.name, now);
-            const repair = store.phaseConfig(INSTALLATION_SCOPE, "repair");
-            let extra = "";
-            if (phase === "build" && repair !== null && repair.provider !== provider) {
-                store.clearPhaseConfig(INSTALLATION_SCOPE, "repair");
-                extra = " Repairs now follow the builder.";
-            }
-            return back(`${role} now uses ${modelWords(store, provider, model)} for new tasks.${extra}`);
-        }
         return refuse(response, who, 404, "No such models action.", "/settings/models");
     };
     async function knowledgeRefresh(ctx) {
@@ -1804,7 +1786,8 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         const nonceKey = `project-setup:${project}`;
         if (step === "preview") {
             const nonce = mintApprovalNonce(who.name, nonceKey, preview.fingerprint);
-            return sendScreen(response, 200, screen("Approve project setup", setupPreviewHtml(inputs, { csrf, repo: project, fingerprint: preview.fingerprint, nonce }), { chrome: chromeFor(project, "settings") }));
+            const models = preview.models === null ? null : { label: PRESETS[DEFAULT_PRESET].label, rows: preview.models.rows.map(row => ({ role: slotWords(row.slot), model: row.after?.model ?? (row.slot.phase === "repair" ? "same as the builder" : "not set") })) };
+            return sendScreen(response, 200, screen("Approve project setup", setupPreviewHtml(inputs, { csrf, repo: project, fingerprint: preview.fingerprint, nonce }, models), { chrome: chromeFor(project, "settings") }));
         }
         if (who.via === "cookie" && !consumeApprovalNonce(body.get("nonce") ?? "", who.name, nonceKey, body.get("fingerprint") ?? ""))
             return refuse(response, who, 409, "This setup preview expired. Review it again.", "/control");
@@ -1887,7 +1870,9 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         if (["scope", "full-access", "cap-usd", "nonce", "digest", "token"].some(key => body.getAll(key).length > 1))
             return refuse(response, who, 400, "Submit one value for each field.", "/settings");
         const given = (body.get("scope") ?? "all").trim();
-        const scope = given === "all" || given === "" ? CHAT_APPROVAL_ALL : canonicalProject(given) ?? given;
+        const scope = given === "all" || given === "" ? CHAT_APPROVAL_ALL : identities.vouched(given, consoleProjects) ?? null;
+        if (scope === null)
+            return refuse(response, who, 403, "That isn't one of your projects.", "/settings");
         if (scope !== CHAT_APPROVAL_ALL && !(visible(scope) && store.accountCanAccess(who.name, scope)))
             return refuse(response, who, 403, "That isn't one of your projects.", "/settings");
         const where = scope === CHAT_APPROVAL_ALL ? "all your projects" : projectName(scope);
@@ -2229,7 +2214,7 @@ ${postForm("/settings/chat-approval/save", html `\
             const existing = loadBotToken({}, options.telegramTokenFile);
             const hasEnv = (envValue(process.env, "TELEGRAM_TOKEN") ?? "") !== "";
             const csrf = who.via === "cookie" ? who.session.csrf : "";
-            return sendScreen(response, 400, settingsPage(chromeFor(who.via === "cookie" ? who.session.project : defaultProject, "settings"), existing, hasEnv, csrf, saved.message, options.configDir === undefined ? null : effectivePrimary(process.env, options.configDir, loadBotToken(process.env, options.telegramTokenFile) !== null), null, null, null, {
+            return sendScreen(response, 400, settingsPage(chromeFor(who.via === "cookie" ? who.session.project : runtime.defaultProject, "settings"), existing, hasEnv, csrf, saved.message, options.configDir === undefined ? null : effectivePrimary(process.env, options.configDir, loadBotToken(process.env, options.telegramTokenFile) !== null), null, null, null, {
                 ...store.permissionDefault(),
                 canManage: who.role === "approver",
             }));
@@ -2422,8 +2407,9 @@ ${modeWords(terms)
         store.setChatConfig({ provider, model: "default", dailyTurns: 50, weeklyCeilingMicrousd: 0, priceInMicrousd: 0, priceOutMicrousd: 0 }, who.name, now);
         return redirect(response, "/chat");
     }
-    /** Settings → Models, read from the saved catalog and the installation's role rows. */
-    function modelsView(canManage, csrf, now, said, problem) {
+    /** Settings → Models, read from the saved catalog and the role rows at the scope being edited (the installation,
+     * or one project and what it inherits). */
+    function modelsView(canManage, csrf, now, said, problem, query = new URLSearchParams()) {
         const runtimes = runtimeStates(store);
         const installed = new Set(runtimes.map(one => one.tool));
         const openrouter = (readProviderKey("openrouter", providerHome) ?? process.env["OPENROUTER_API_KEY"] ?? "") !== "";
@@ -2433,23 +2419,74 @@ ${modeWords(terms)
             { label: "Gemini", provider: "gemini", on: installed.has("gemini") },
             { label: "OpenRouter", provider: "openrouter", on: openrouter },
         ];
-        const build = store.phaseConfig(INSTALLATION_SCOPE, "build");
-        const roles = ["plan", "build", "review", "repair"].map(phase => {
-            const row = store.phaseConfig(INSTALLATION_SCOPE, phase);
-            const groups = makers.filter(one => one.on && !(phase === "review" && one.provider === "gemini") && !(phase === "repair" && build !== null && one.provider !== build.provider))
+        const projects = consoleProjects();
+        const asked = query.get("scope") ?? INSTALLATION_SCOPE;
+        const scope = asked !== INSTALLATION_SCOPE && projects.includes(asked) ? asked : INSTALLATION_SCOPE;
+        const repo = scope === INSTALLATION_SCOPE ? null : scope;
+        const said_ = (pair) => `${ASSISTANTS[pair.provider]?.name ?? pair.provider} · ${modelWords(store, pair.provider, pair.model)}`;
+        const build = resolvePhaseAgent(store, "build", repo, {});
+        const roles = SLOTS.map(slot => {
+            const own = rowAt(store, scope, slot);
+            const inherited = repo === null ? null : rowAt(store, INSTALLATION_SCOPE, slot);
+            const unset = repo !== null ? (inherited === null ? "Same as the installation (not set)" : `Same as the installation (${inherited.model ?? inherited.provider})`)
+                : slot.phase === "repair" ? "Same as the builder" : slot.phase === "review" ? "Same as the planner"
+                    : slot.tier === "light" ? "Not set: small tasks use the routine builder" : slot.tier === "strong" ? "Not set: uses the routine one" : "Not set";
+            const words = own !== null ? said_(own) : inherited !== null ? `Inherits the installation's: ${said_(inherited)}`
+                : slot.phase === "repair" ? "Follows the builder" : slot.phase === "review" ? "Follows the planner" : slot.tier !== "routine" ? "Uses the routine one" : "Not set";
+            const groups = makers.filter(one => one.on && !(slot.phase === "review" && one.provider === "gemini") && !(slot.phase === "repair" && build.ok && one.provider !== build.spec.provider))
                 .map(one => ({ label: one.label, provider: one.provider, options: modelOptions(store, one.provider, now, providerHome) }));
-            return {
-                phase, label: ROLE_TITLES[phase], groups, ...(phase === "repair" ? { inherit: true } : {}),
-                current: row === null ? (phase === "repair" ? "inherit" : "") : `${row.provider}|${row.model ?? ""}`,
-                words: row === null ? (phase === "repair" ? "Same as the builder" : "Not set") : `${ASSISTANTS[row.provider]?.name ?? row.provider} · ${modelWords(store, row.provider, row.model)}`,
-            };
+            return { key: slotKey(slot), label: slotWords(slot), current: own === null ? "" : `${own.provider}|${own.model ?? ""}`, words, unset, groups, tier: slot.tier !== "routine" };
         });
+        const inUse = presetInUse(store, scope);
+        const unchosen = repo === null && ALL_SLOTS.every(slot => rowAt(store, INSTALLATION_SCOPE, slot) === null);
+        const checked = checkScope(store, repo);
+        // A preset or a switch, previewed: the exact rows it moves, with what a change of provider brings along.
+        const pairWords = (pair, slot) => pair === null ? (repo !== null ? "same as the installation" : slot.phase === "repair" ? "same as the builder" : slot.phase === "review" ? "same as the planner" : slot.tier === "light" ? "routine builder" : slot.tier === "strong" ? "routine one" : "not set") : (pair.model ?? `${pair.provider} default`);
+        const switchFrom = query.get("switch"), switchTo = query.get("to");
+        const presetAsked = query.get("preset");
+        // The rows, what they inherit, and both digests come from one snapshot (model-choices.ts previewModelChange).
+        const previewOf = (title, change, hidden) => {
+            const snapshot = previewModelChange(store, scope, change);
+            const rows = snapshot.rows.map(row => {
+                const notes = [];
+                const was = row.before?.provider ?? row.inherited?.provider ?? null;
+                if (row.after !== null && was !== null && was !== row.after.provider && isProviderId(row.after.provider)) {
+                    const name = ASSISTANTS[row.after.provider].name;
+                    notes.push(`Billed the way ${name} is signed in on this computer.`);
+                    notes.push(MONEY_CAPABILITIES[row.after.provider].nativeDollarCapFlag === null ? `${name} can't hold a per-task dollar cap.` : `${name} can hold a per-task dollar cap.`);
+                    notes.push(`Builds reach ${name}'s hosts instead of ${ASSISTANTS[was]?.name ?? was}'s.`);
+                }
+                return { role: slotWords(row.slot), before: pairWords(row.before, row.slot), after: pairWords(row.after, row.slot), notes };
+            });
+            return { title, rows, hidden: { scope, digest: snapshot.state, change: snapshot.change, ...hidden } };
+        };
+        const preview = !canManage ? null
+            : isPresetName(presetAsked) ? previewOf(`Use ${PRESETS[presetAsked].label}`, presetChange(presetAsked), { preset: presetAsked })
+                : switchFrom !== null && switchTo !== null && exactModelId(switchFrom) && exactModelId(switchTo) ? previewOf(`Switch to ${switchTo}`, switchChange(store, scope, switchFrom, switchTo), { switch: switchFrom, to: switchTo })
+                    // A new installation with nothing chosen yet opens on the default, ready to apply.
+                    : unchosen ? previewOf(`Start with ${PRESETS[DEFAULT_PRESET].label}`, presetChange(DEFAULT_PRESET), { preset: DEFAULT_PRESET })
+                        : null;
         const chat = store.getChatConfig();
         const chatName = chat === null ? "" : chat.provider === "claude-subscription" ? "Claude membership" : chat.provider === "codex-subscription" ? "Codex membership" : chat.provider === "anthropic-api" ? "Anthropic API" : "OpenRouter";
+        const capital = (words) => `${words.charAt(0).toUpperCase()}${words.slice(1)}`;
+        const alsoSet = store.listPhaseTierAlternates(INSTALLATION_SCOPE).length + (repo === null ? 0 : store.listPhaseTierAlternates(repo).length) > 0;
         return {
             runtimes, watch: watchState(store), roles, csrf, canManage, said, problem,
             chat: chat === null ? null : { words: `Leads and chat use ${chatName} · ${modelWords(store, chat.provider, chat.model)}` },
             fresh: ["claude", "codex", "gemini"].flatMap(source => seenModels(store, source)).filter(model => isNewModel(model, now)).slice(0, 12),
+            scope: { value: scope, label: repo === null ? "All projects" : projectName(repo), digest: stateDigest(store, scope),
+                options: [{ value: INSTALLATION_SCOPE, label: "All projects" }, ...projects.map(one => ({ value: one, label: projectName(one) }))] },
+            inUse: unchosen ? "nothing chosen yet" : inUse === null ? null : PRESETS[inUse].label,
+            presets: ["sized", "opus"].map(name => ({ name, label: PRESETS[name].label, words: PRESETS[name].words, inUse: inUse === name, recommended: name === DEFAULT_PRESET })),
+            newer: newerModels(store, scope).map(one => ({ from: one.from, to: one.to.id, name: one.to.name, roles: one.slots.map(slotWords).join(", ").toLowerCase() })),
+            preview, unresolved: checked.kind === "ok" ? null : checked.kind === "incomplete" ? `some roles have no model yet. Choose them above, or use ${PRESETS[DEFAULT_PRESET].label}.` : browserWords(checked.problem),
+            sizing: { small: capital(SIZE_MEANS.small), routine: capital(SIZE_MEANS.medium), large: SIZE_MEANS.large, risky: RISKY_MEANS,
+                classifier: readProviderKey("openrouter", providerHome) !== null ? "A quick AI check (Jev, through your OpenRouter key) reads its title and description." : `A quick AI check (${SIZING_CLAUDE_MODEL}, on this computer's Claude sign-in) reads its title and description.` },
+            routing: `When a task is filed and Claude has used over ${HEADROOM_FIVE_HOUR_LIMIT}% of its 5-hour window or ${HEADROOM_WEEKLY_LIMIT}% of its week, ${alsoSet ? "the other provider you set for that size is preferred if it has more room" : "an alternate provider with more room would be preferred, but none is set"}; with no room anywhere, the first choice is kept. This is a preference at filing time, not a limit.`,
+            recent: recentRuns(store).map(one => ({ taskId: one.taskId, runId: one.runId, role: one.role,
+                chosen: one.chosen === null ? "its default" : /^(opus|sonnet|haiku|fable)$/.test(one.chosen) ? `floating ${one.chosen}` : one.chosen,
+                ranOn: one.ranOn ?? "not reported" })),
+            waiting: canManage ? store.scopesAwaitingApproval(null, 10, admissionList()).map(one => ({ taskId: one.taskId, title: one.title })) : [],
         };
     }
     /** Google's redirect back: the code becomes a saved refresh token, and a page sends the person back to Settings. */
@@ -2535,6 +2572,7 @@ ${modeWords(terms)
     }
     const registrations = handlersOf("settings", {
         "spend": spendPage,
+        "settings.spend": spendSettingsPage,
         "mode": modePage,
         "control": controlPage("setup"),
         "control.connection": controlPage("connection"),
@@ -2612,7 +2650,8 @@ ${modeWords(terms)
         "settings.models-check": modelsAct("check"),
         "settings.models-watch": modelsAct("watch"),
         "settings.models-update": modelsAct("update"),
-        "settings.models-agent": modelsAct("agent"),
+        "settings.models-agent": modelsSave,
+        "settings.models-apply": modelsApply,
         "settings.models-act": modelsAct("other"),
         "settings.knowledge-refresh": knowledgeRefresh,
         "settings.knowledge-proposal": knowledgeProposal,
@@ -2772,5 +2811,106 @@ ${modeWords(terms)
         const changed = setReleaseApproval(store, repo, true, who.name, now);
         return back("said", changed.changed ? "Releases approve themselves once CI and the release check pass." : "Saved.");
     }
+    // Settings → Spend: the monthly limits editor and the models in use. An instance operator's page; changing a limit
+    // posts to /spend/budget with a step-up.
+    async function spendSettingsPage(ctx) {
+        const { url, response, now } = ctx;
+        const current = monthOf(now);
+        const subagents = store.subagents([...new Set([...managedRepos(), ...store.knownRepos()])]);
+        const subagentNames = subagentNamesOf(store.handle);
+        const projects = consoleProjects();
+        const people = store.accountFacts().filter(one => one.revokedAt === null).map(one => one.name);
+        const models = ["plan", "build", "review"].map(phase => {
+            const agent = resolvePhaseAgent(store, phase, null, {});
+            return { role: phase === "plan" ? "Planner" : phase === "build" ? "Builder" : "Reviewer", model: agent.ok ? `${agent.spec.provider} · ${agent.spec.model ?? "its default model"}` : "Not set" };
+        });
+        const view = {
+            budgets: budgetStates(store.budgets(), spendItems(store.handle, current.from, current.to)), subagentNames, models,
+            targets: [
+                { value: "installation:*", label: "Everything", group: "Everything" },
+                ...projects.map(repo => ({ value: `project:${repo}`, label: projectName(repo), group: "Projects" })),
+                ...people.map(name => ({ value: `person:${name}`, label: name, group: "People" })),
+                ...subagents.map(one => ({ value: `subagent:${one.id}`, label: `${subagentNames.get(one.id) ?? one.handle} (${projectName(one.repo)})`, group: "Subagents" })),
+            ],
+        };
+        return sendScreen(response, 200, screen("Spend settings", spendSettingsHtml(view, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }), { chrome: chromeFor(null, "settings") }));
+    }
+    // Settings → Models (docs/plans/spend-dashboard.md, slice 3): the one editor. Both posts are an instance operator's,
+    // browser-only step-ups: the password (or a Passwordless session, or an identity-provider re-check) is proved here,
+    // and model-choices.ts re-proves the same session, credential generation and operator standing inside the one
+    // transaction that checks the form against what is stored, validates the result and writes and ledgers every row.
+    function modelsAuthority(who, method) {
+        const session = who.session;
+        return { actor: who.name, generation: session.generation, method, live: () => sessions.holds(session) && sessions.savedNow(session) && sessionWithinLifetime(session, Date.now()) };
+    }
+    function modelsBack(response, scope) {
+        return sayTo(response, `/settings/models${scope === INSTALLATION_SCOPE ? "" : `?scope=${encodeURIComponent(scope)}`}`);
+    }
+    function modelsSaid(result, what) {
+        if (!result.ok)
+            return { key: "problem", words: browserWords(result.problem) };
+        const count = result.diff.length;
+        const done = count === 0 ? "Nothing changed." : `${what}: ${count} change${count === 1 ? "" : "s"} saved for tasks filed from now on.`;
+        return { key: "said", words: result.unresolved === null ? done : `${done} Some roles have no model yet, so new tasks can't be filed here.` };
+    }
+    /** One save of the whole editor: every role at the scope, sets and clears, as one change. */
+    async function modelsSave(ctx) {
+        const { response, now, posted } = ctx;
+        const who = browserCaller(ctx.who);
+        const body = readForm(posted, CONSOLE_FORMS.modelsChange);
+        const scope = body.get("scope") ?? INSTALLATION_SCOPE;
+        const back = modelsBack(response, scope);
+        if (["scope", "password", "digest", ...SLOTS.map(slotKey)].some(field => body.sent.getAll(field).length > 1))
+            return back("problem", "That form was sent twice over. Nothing changed.");
+        const proved = authenticateApprover(who, body.get("password") ?? "");
+        if (!proved.ok)
+            return back("problem", "Enter your Toolroll password to change models.");
+        const change = [];
+        for (const slot of SLOTS) {
+            const value = body.sent.get(slotKey(slot));
+            if (value === null)
+                continue;
+            if (value === "clear") {
+                change.push({ slot, to: null });
+                continue;
+            }
+            const split = value.indexOf("|");
+            if (split < 1)
+                return back("problem", "Choose a model from the list. Nothing changed.");
+            change.push({ slot, to: { provider: value.slice(0, split), model: value.slice(split + 1) } });
+        }
+        // Repairs resume the builder's session: a builder moved to another provider takes repair with it.
+        const builder = change.find(one => one.slot.phase === "build" && one.slot.tier === "routine")?.to ?? null;
+        const repair = change.findIndex(one => one.slot.phase === "repair");
+        let follows = false;
+        if (builder !== null && repair >= 0 && change[repair].to !== null && change[repair].to.provider !== builder.provider) {
+            change[repair] = { slot: change[repair].slot, to: null };
+            follows = true;
+        }
+        const result = applyModelChoices(store, { scope, change, expected: { state: body.get("digest") ?? "" }, strict: true, knownProject: repo => consoleProjects().includes(repo) }, modelsAuthority(who, proved.method), now);
+        const said = modelsSaid(result, scope === INSTALLATION_SCOPE ? "All projects" : projectName(scope));
+        return back(said.key, follows && result.ok ? `${said.words} Repairs now follow the builder.` : said.words);
+    }
+    /** A preset or a switch, applied exactly as previewed: the change's own digest rides the form. */
+    async function modelsApply(ctx) {
+        const { response, now, posted } = ctx;
+        const who = browserCaller(ctx.who);
+        const body = readForm(posted, CONSOLE_FORMS.modelsChange);
+        const scope = body.get("scope") ?? INSTALLATION_SCOPE;
+        const back = modelsBack(response, scope);
+        if (["scope", "password", "digest", "preset", "switch", "to", "change"].some(field => body.sent.getAll(field).length > 1))
+            return back("problem", "That form was sent twice over. Nothing changed.");
+        const proved = authenticateApprover(who, body.get("password") ?? "");
+        if (!proved.ok)
+            return back("problem", "Enter your Toolroll password to change models.");
+        const preset = body.get("preset"), from = body.get("switch"), to = body.get("to");
+        const change = isPresetName(preset) ? presetChange(preset)
+            : from !== null && to !== null && exactModelId(from) && exactModelId(to) ? switchChange(store, scope, from, to) : null;
+        if (change === null)
+            return back("problem", "Choose a preset or a newer model. Nothing changed.");
+        const result = applyModelChoices(store, { scope, change, expected: { state: body.get("digest") ?? "", change: body.get("change") ?? "" }, strict: true, knownProject: repo => consoleProjects().includes(repo) }, modelsAuthority(who, proved.method), now);
+        const said = modelsSaid(result, isPresetName(preset) ? PRESETS[preset].label : `Switched to ${to}`);
+        return back(said.key, said.words);
+    }
     return { registrations, modelsView };
 }

package/dist/server/signup-gate.d.ts

@@ -0,0 +1,9 @@
+import type { IncomingMessage } from "node:http";
+export declare const SIGNUP_COOKIE = "so-signup";
+/** A fresh Set-Cookie value for the page that shows the form. */
+export declare function signupCookie(secure: string): string;
+/** Whether this post came from the console's own first-account page. */
+export declare function signupFromHere(request: IncomingMessage, allowedHost: (host: string | undefined) => boolean): boolean;
+/** The typed code against the printed one, in constant time over fixed-length digests: any input (empty, too long,
+ * non-ASCII) is an ordinary wrong code, never a throw. */
+export declare function setupCodeMatches(typed: string, printed: string): boolean;

package/dist/server/signup-gate.js

@@ -0,0 +1,40 @@
+/** The first-account form's same-site gate and setup-code comparison (Settings revamp S3, Codex round 1).
+ *
+ * The form is signed out, so it has no session CSRF token. Instead, the page that shows it sets a signed, HttpOnly,
+ * SameSite=Strict cookie scoped to /signup; a browser never sends it on a post from another site. A post must carry
+ * it, and its provenance must name this console: same-origin Fetch Metadata, or an Origin (or Referer) on an allowed
+ * host. Neither (`Origin: null`, nothing else) fails closed; the form's page is served `Referrer-Policy: same-origin`
+ * so its own post carries the real Origin. A refusal here never spends a setup-code try. */
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+export const SIGNUP_COOKIE = "so-signup";
+const SECRET = randomBytes(32);
+const NONCE = /^[A-Za-z0-9_-]{24}$/;
+const macOf = (nonce) => createHmac("sha256", SECRET).update(`signup:${nonce}`).digest();
+/** A fresh Set-Cookie value for the page that shows the form. */
+export function signupCookie(secure) {
+    const nonce = randomBytes(18).toString("base64url");
+    return `${SIGNUP_COOKIE}=${nonce}.${macOf(nonce).toString("base64url")}; HttpOnly; SameSite=Strict; Path=/signup${secure}`;
+}
+/** Whether this post came from the console's own first-account page. */
+export function signupFromHere(request, allowedHost) {
+    const site = request.headers["sec-fetch-site"];
+    if (site !== undefined && site !== "same-origin" && site !== "none")
+        return false;
+    const origin = request.headers.origin, referer = request.headers.referer;
+    const named = typeof origin === "string" && origin !== "null" ? origin : typeof referer === "string" ? referer : null;
+    if (named !== null && !allowedHost(named.replace(/^https?:\/\//, "").split("/")[0]))
+        return false;
+    if (site !== "same-origin" && named === null)
+        return false;
+    const held = new RegExp(`(?:^|;\\s*)${SIGNUP_COOKIE}=([^;.]*)\\.([^;]*)`).exec(request.headers.cookie ?? "");
+    if (held === null || !NONCE.test(held[1]))
+        return false;
+    const given = Buffer.from(held[2], "base64url"), wanted = macOf(held[1]);
+    return given.length === wanted.length && timingSafeEqual(given, wanted);
+}
+/** The typed code against the printed one, in constant time over fixed-length digests: any input (empty, too long,
+ * non-ASCII) is an ordinary wrong code, never a throw. */
+export function setupCodeMatches(typed, printed) {
+    const digest = (text) => createHash("sha256").update(text, "utf8").digest();
+    return typed !== "" && timingSafeEqual(digest(typed), digest(printed));
+}

package/dist/server/tasks.js

@@ -27,7 +27,8 @@ import { codingWorkspaceHtml, codingWorkspaceScript } from '../coding-ui.js';
 import { CodingActionError } from '../coding-workspace.js';
 import { checkResponse, CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
 import { hasForbiddenControls, validateNote } from "../decision.js";
-import { diagnoseTaskDispatch } from "../dispatch.js";
+import { builderReadyFor, diagnoseTaskDispatch, firstRunBuilderRepo } from "../dispatch.js";
+import { withBuilderStep } from "../first-run.js";
 import { evidencePack, evidencePackHtml } from "../evidence-pack.js";
 import { readVerifiedArtifact, readVerifiedReport, writeEvidenceFile } from "../evidence.js";
 import { computeGaps } from "../gaps.js";
@@ -72,7 +73,7 @@ import { ACCEPT_ANYWAY_NEEDS_REASON, editorFileHref, proofBundleView, rankReview
 import { approvalFormDigest, approveRefusalWords, checkProgressHtml, consentDoorOf, decisionPage, nonceHashOf, PermissionsWouldChange, requirementsFromEditor, resumeDigestOf, taskOf } from "./render-tasks.js";
 import {} from "./session.js";
 export function createTasksHandlers(runtime) {
-    const { store, peekSay, peekCache, PEEK_CACHE_TTL_MS, peekInFlight, PEEK_GLOBAL_INFLIGHT, peekBySession, PEEK_SESSION_INFLIGHT, clock, peekName, PEEK_FRAGMENT_BYTES, peekEvict, evidenceRoot, sendScreen, chromeFor, visible, consumeApprovalNonce, authenticateApprover, options, mintApprovalNonce, taskScreen, unscopedMode, admissionList, planViewOf, revisionViewOf, runIsTaskResult, leadPrincipal, familyOf, armTaskResume, runIsLive, revisionLedgerOf, resultDetailOf, reviewFactsFor, taskRepoOf, runVisible, restricted, codingActorAllowed, codingProjectAllowed, managedRepos, routeViewOf, workAccess, firstRunStepsNow, revisionDocOf, failureOf, dockedConversation, planContractViewOf, familiesInView, explainAttempt, taskChatFocus, familyTasksInView, liveCeiling, projectOf, ceiling, bustBadge, revisionDestination } = runtime;
+    const { identities, store, peekSay, peekCache, PEEK_CACHE_TTL_MS, peekInFlight, PEEK_GLOBAL_INFLIGHT, peekBySession, PEEK_SESSION_INFLIGHT, clock, peekName, PEEK_FRAGMENT_BYTES, peekEvict, evidenceRoot, sendScreen, chromeFor, visible, consumeApprovalNonce, authenticateApprover, options, mintApprovalNonce, taskScreen, unscopedMode, admissionList, planViewOf, revisionViewOf, runIsTaskResult, leadPrincipal, familyOf, armTaskResume, runIsLive, revisionLedgerOf, resultDetailOf, reviewFactsFor, taskRepoOf, runVisible, restricted, codingActorAllowed, codingProjectAllowed, managedRepos, routeViewOf, workAccess, firstRunStepsNow, revisionDocOf, failureOf, dockedConversation, planContractViewOf, familiesInView, explainAttempt, taskChatFocus, familyTasksInView, liveCeiling, projectOf, ceiling, bustBadge, revisionDestination } = runtime;
     /** A row admitted the address but its path parameter does not parse: the console's unknown page. */
     function noPage(who, response) {
         return refuse(response, who, 404, "There's no page at this address.", "/chat");
@@ -175,7 +176,8 @@ export function createTasksHandlers(runtime) {
             })),
             cancelledBlockers: cancelled,
             gaps: project === null ? [] : computeGaps(store, project, now).filter(gap => gap.unblocks.length > 0).slice(0, 10),
-            wizard: firstRunStepsNow(now),
+            // The builder step speaks for the same project as Chat's (firstRunBuilderRepo), as dispatch decides.
+            wizard: withBuilderStep(firstRunStepsNow(now), builderReadyFor(store, firstRunBuilderRepo(store, project, visible, managedRepos()), now)),
             worker: (() => {
                 // The one fact the inbox must never hide (install review): with
                 // no worker answering, nothing here will ever build, and every
@@ -1020,10 +1022,16 @@ export function createTasksHandlers(runtime) {
         }
         let repo = effective;
         let admitted = unscopedMode ? null : admissionList() ?? [];
+        // What this filing is decided on: re-checked inside the write below, after every await (project-identity.ts).
+        const decidedOn = identities.generation();
         const rootMode = !unscopedMode && ceiling.roots.length > 0;
         if (rootMode && effective !== "") {
-            const canonical = (await authorizedProject(liveCeiling(), effective)) ? canonicalProject(effective) : null;
-            if (canonical === null || canonical === undefined) {
+            // Resolved off the console's thread (project-identity.ts), then proved against the ceiling as that identity.
+            const resolved = await identities.resolveNow(effective);
+            if (resolved === "no-answer")
+                return newTaskScreen(ctx, 503, `${effective} didn't answer — its folder may be on a drive that's disconnected, or waiting on macOS; try again in a moment`, draft);
+            const canonical = resolved !== null && (await authorizedProject(liveCeiling(), resolved)) ? resolved : null;
+            if (canonical === null) {
                 return newTaskScreen(ctx, 403, `${effective} is outside what this server was configured to show`, draft);
             }
             repo = canonical;
@@ -1048,6 +1056,10 @@ export function createTasksHandlers(runtime) {
         const after = (body.get("after") ?? "").trim();
         let chainProblem = null;
         const made = store.transact(() => {
+            // A project folder's identity changed while this request waited (a root or link now leads elsewhere): what was
+            // proved above may no longer hold, so nothing is filed on it.
+            if (identities.generation() !== decidedOn || (rootMode && repo !== "" && !visible(repo)))
+                return null;
             const filed = fileTaskProposal(store, {
                 ...(id === "" ? {} : { id }),
                 title,
@@ -1079,6 +1091,8 @@ export function createTasksHandlers(runtime) {
                 applyModeToNewFiling(store, filed.id, who.name, now);
             return filed;
         });
+        if (made === null)
+            return newTaskScreen(ctx, 409, "a project folder changed while this was being filed — check the project and send it again", draft);
         if (!made.ok) {
             return newTaskScreen(ctx, made.reason === "backlog-full" ? 429 : 400, made.message, { title, goal, not: notThis, touches: body.get("touches") ?? "", acceptance: body.get("acceptance") ?? "", values: body.sent });
         }

package/dist/settings-kit-script.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The settings kit's one script (docs/plans/settings-revamp.md §4), shipped as a page's functional script beside kit
+ * forms (settings-kit.ts). Without it every kit form works as today: the proof field shows inline and Save posts.
+ *
+ * With it, a kit form that asks for a proof:
+ * - moves its server-written proof field into the `<dialog>` inside the same form (the field never leaves the form);
+ * - opens the dialog on submit instead of posting, remembering the pressed button;
+ * - Confirm (its button, or Enter in the field) posts the form with that button (`requestSubmit(submitter)`, after the
+ *   submit event that asked has finished), so its name=value and every hidden term go along unchanged; Cancel (or
+ *   Escape) closes it and posts nothing, and focus returns to the button;
+ * - once a kit form posts, it is pending: further submits are dropped and its Save and Confirm are disabled (after the
+ *   post has taken their values), until the page is shown again or the post was cancelled — never on a timer;
+ * - asks for nothing when the proof was left out (Passwordless) — there is no dialog then — and shows the
+ *   identity-provider link when the sign-in swapped the field.
+ * Each section's Save bar names what changed. The script never reads or sets a field's value except to check that a
+ * required proof isn't empty; the server still proves everything.
+ */
+export declare const SETTINGS_KIT_SCRIPT = "(function(){\nif(window.__soKit)return;window.__soKit=1;\nvar d=document;d.documentElement.classList.add(\"kit-js\");\nfunction label(el){var l=el.labels&&el.labels[0];if(!l&&el.closest)l=el.closest(\"fieldset\")&&el.closest(\"fieldset\").querySelector(\"legend\");return l?(l.textContent||\"\").replace(/\\s+/g,\" \").trim():(el.name||\"\");}\nfunction prep(f){if(f.__kit)return;f.__kit=1;\nvar bar=f.querySelector(\"[data-kit-state]\");if(bar&&bar.textContent===\"\")bar.textContent=bar.getAttribute(\"data-idle\")||\"\";\nif(!f.hasAttribute(\"data-kit-step-up\"))return;\nvar dl=f.querySelector(\"[data-kit-dialog]\"),p=f.querySelector(\":scope>[data-kit-proof]\");\nif(!dl||!p||typeof dl.showModal!==\"function\"){f.removeAttribute(\"data-kit-step-up\");return;}\ndl.querySelector(\"[data-kit-slot]\").appendChild(p);\np.querySelectorAll(\"[required]\").forEach(function(i){i.removeAttribute(\"required\");i.setAttribute(\"data-kit-required\",\"\");});\ndl.addEventListener(\"close\",function(){if(f.__kitSent)return;var back=f.__kitBy||f.querySelector(\".kit-save\");if(back&&back.focus)back.focus();});}\nfunction scan(root){if(root.querySelectorAll)root.querySelectorAll(\"form.kit-form\").forEach(prep);}\nscan(d);\nif(typeof MutationObserver!==\"undefined\")new MutationObserver(function(list){list.forEach(function(m){m.addedNodes.forEach(function(n){if(n.nodeType===1){if(n.matches&&n.matches(\"form.kit-form\"))prep(n);scan(n);}});});}).observe(d.documentElement,{childList:true,subtree:true});\nfunction asks(dl){var slot=dl.querySelector(\"[data-kit-slot]\");return !!slot.querySelector(\"input:not([type=hidden]),a,.sso-step-up\");}\nfunction confirm(f){var dl=f.querySelector(\"[data-kit-dialog]\"),miss=null;\ndl.querySelectorAll(\"[data-kit-required]\").forEach(function(i){if(!miss&&i.value===\"\")miss=i;});\nif(miss){miss.setCustomValidity(\"Enter your password.\");miss.reportValidity();miss.focus();return;}\nvar by=f.__kitBy&&f.__kitBy.form===f?f.__kitBy:null;f.__kitSent=1;dl.close();\nsetTimeout(function(){f.__kitGo=1;try{by?f.requestSubmit(by):f.requestSubmit();}finally{f.__kitGo=0;}},0);}\nfunction buttons(f){return f.querySelectorAll(\".kit-save,[data-kit-confirm]\");}\nfunction release(f){f.__kitPending=0;f.__kitSent=0;buttons(f).forEach(function(b){b.disabled=false;});}\nfunction latch(f,e){f.__kitPending=1;setTimeout(function(){if(e.defaultPrevented){release(f);return;}\nbuttons(f).forEach(function(b){b.disabled=true;});},0);}\naddEventListener(\"pageshow\",function(){d.querySelectorAll(\"form.kit-form\").forEach(release);});\nd.addEventListener(\"submit\",function(e){var f=e.target;if(!f||!f.classList||!f.classList.contains(\"kit-form\"))return;prep(f);\nif(f.__kitPending){e.preventDefault();e.stopImmediatePropagation();return;}\nvar dl=f.hasAttribute(\"data-kit-step-up\")?f.querySelector(\"[data-kit-dialog]\"):null;\nif(f.__kitGo||!dl||!asks(dl)){latch(f,e);return;}\ne.preventDefault();e.stopImmediatePropagation();\nif(dl.open){confirm(f);return;}\nf.__kitBy=e.submitter||null;f.__kitSent=0;dl.showModal();\nvar first=dl.querySelector(\"[data-kit-slot] input:not([type=hidden]),[data-kit-slot] a\")||dl.querySelector(\"[data-kit-confirm]\");if(first)first.focus();},true);\nd.addEventListener(\"click\",function(e){var b=e.target&&e.target.closest?e.target.closest(\"[data-kit-confirm],[data-kit-cancel]\"):null;if(!b)return;\nvar dl=b.closest(\"[data-kit-dialog]\"),f=dl&&dl.closest(\"form\");if(!f)return;e.preventDefault();\nif(b.hasAttribute(\"data-kit-cancel\")){dl.close();return;}confirm(f);});\nd.addEventListener(\"input\",function(e){var t=e.target;if(t&&t.setCustomValidity&&t.hasAttribute&&t.hasAttribute(\"data-kit-required\"))t.setCustomValidity(\"\");},true);\nfunction changed(e){var t=e.target,f=t&&t.form;if(!f||!f.classList.contains(\"kit-form\")||t.closest(\"[data-kit-dialog]\")||t.type===\"hidden\")return;prep(f);\nvar bar=f.querySelector(\"[data-kit-save-bar]\"),state=f.querySelector(\"[data-kit-state]\");if(!bar||!state)return;\nf.__kitChanged=f.__kitChanged||[];var name=label(t);if(name&&f.__kitChanged.indexOf(name)<0)f.__kitChanged.push(name);\nbar.setAttribute(\"data-changed\",\"\");state.textContent=\"Changed: \"+f.__kitChanged.join(\", \");}\nd.addEventListener(\"input\",changed);d.addEventListener(\"change\",changed);\n})();";
+/** The pages that wear the settings frame: one column, no Crew sheet, a breadcrumb under Settings. Here (not in
+ * settings-kit.ts) so the browser bundle reads it without the server's form contracts. */
+export declare function isSettingsFrame(pathname: string): boolean;