toolroll 0.9.83 → 0.9.84

package/dist/project-identity.d.ts

@@ -2,7 +2,8 @@
  * Project identities as the console uses them, without touching a person's folders on its thread.
  *
  * A project's identity is its real path (project.ts canonicalProject). Resolving one reads the folder, and a folder can
- * stop answering (folder-look.ts), so the console never resolves one on a page or at startup on its own thread:
+ * stop answering (folder-look.ts), so the console never resolves one on a page or at startup on its own thread, and
+ * never waits for one before it answers:
  *
  * - `hot` (display and grouping only): the last answer, else the path as saved. Nothing is started by asking.
  * - `strict` (visibility and authorization): only a resolved identity; an unknown one fails closed until the next
@@ -10,7 +11,8 @@
  * - `vouched` (a path a request names): only a path whose identity is known, or one that is exactly a saved identity.
  *   Anything else is refused this time and resolved by the next background pass, never resolved inline.
  * - `resolveNow` (an action that needs a path checked now, a POST): resolved off the thread under the look's deadline.
- * - `refresh` (the console's start and its background pass): resolves what was asked about and what has gone stale.
+ * - `refresh` (the console's background pass, the first started right after it listens): resolves what was asked about
+ *   and what has gone stale. The console answers before any of it does; until a path answers it fails closed.
  *
  * An embedder or test that passes no identities gets `syncProjectIdentities`: the old synchronous reads, unchanged.
  */
@@ -31,7 +33,12 @@ export type ProjectIdentities = {
     resolveNow: (path: string) => Promise<string | null | "no-answer">;
     /** Resolve `paths`, everything asked about since, and answers older than a minute. False when some didn't answer. */
     refresh: (paths: Iterable<string>) => Promise<boolean>;
+    /** Moves whenever a known identity changes or goes: a decision made before an await is re-checked against it right
+     * before its write. */
+    generation: () => number;
 };
+/** How many folders a pass looks at side by side when they're looked at one by one (within FOLDER_LOOK_CHILDREN). */
+export declare const IDENTITY_LOOKS = 4;
 export declare function projectIdentities(look?: FolderLookOptions, now?: () => number): ProjectIdentities;
 /** The synchronous reads, as before: for embedders and tests that pass no identities. */
 export declare function syncProjectIdentities(): ProjectIdentities;

package/dist/project-identity.js

@@ -2,7 +2,8 @@
  * Project identities as the console uses them, without touching a person's folders on its thread.
  *
  * A project's identity is its real path (project.ts canonicalProject). Resolving one reads the folder, and a folder can
- * stop answering (folder-look.ts), so the console never resolves one on a page or at startup on its own thread:
+ * stop answering (folder-look.ts), so the console never resolves one on a page or at startup on its own thread, and
+ * never waits for one before it answers:
  *
  * - `hot` (display and grouping only): the last answer, else the path as saved. Nothing is started by asking.
  * - `strict` (visibility and authorization): only a resolved identity; an unknown one fails closed until the next
@@ -10,7 +11,8 @@
  * - `vouched` (a path a request names): only a path whose identity is known, or one that is exactly a saved identity.
  *   Anything else is refused this time and resolved by the next background pass, never resolved inline.
  * - `resolveNow` (an action that needs a path checked now, a POST): resolved off the thread under the look's deadline.
- * - `refresh` (the console's start and its background pass): resolves what was asked about and what has gone stale.
+ * - `refresh` (the console's background pass, the first started right after it listens): resolves what was asked about
+ *   and what has gone stale. The console answers before any of it does; until a path answers it fails closed.
  *
  * An embedder or test that passes no identities gets `syncProjectIdentities`: the old synchronous reads, unchanged.
  */
@@ -19,27 +21,86 @@ import { lookIdentities } from "./folder-look.js";
 import { canonicalProject } from "./project.js";
 /** How long an answer stands before the background pass resolves the path again. */
 const STALE_MS = 60_000;
+/** How many folders a pass looks at side by side when they're looked at one by one (within FOLDER_LOOK_CHILDREN). */
+export const IDENTITY_LOOKS = 4;
 export function projectIdentities(look = {}, now = Date.now) {
+    /** Each answer with when the look that answered it started (folder-look.ts `started`, kept across joined looks): an
+     * answer from a look started earlier never overwrites one from a look started later. */
     const answers = new Map();
     const wanted = new Set();
+    /** Paths whose last look didn't answer: looked at only on their own (joining a look still under way), never in a
+     * batch, so one folder that never answers holds one child, not one per differently made-up batch. */
+    const suspect = new Set();
+    let generation = 0;
     const known = (path) => answers.get(resolve(path))?.real;
-    const store = (found) => {
+    const put = (key, real, at, seq) => {
+        const before = answers.get(key);
+        // A known identity that changes (or goes) moves authority: anything decided on the old one is out of date.
+        if (before !== undefined && before.real !== real)
+            generation++;
+        answers.set(key, { real, at, seq });
+    };
+    const store = (found, seq) => {
         const at = now();
         for (const [path, real] of found) {
-            answers.set(resolve(path), { real, at });
-            wanted.delete(resolve(path));
+            const key = resolve(path);
+            // Superseded: a later lookup already answered for this path. Its real path's entry goes with it.
+            if ((answers.get(key)?.seq ?? -1) > seq)
+                continue;
+            put(key, real, at, seq);
+            wanted.delete(key);
             // A real path is its own identity.
-            if (real !== null)
-                answers.set(real, { real, at });
+            if (real !== null && (answers.get(real)?.seq ?? -1) <= seq)
+                put(real, real, at, seq);
         }
     };
     const resolveNow = async (path) => {
-        const looked = await lookIdentities([resolve(path)], look);
-        if (!looked.ok)
+        const key = resolve(path);
+        const looked = await lookIdentities([key], look);
+        if (!looked.ok) {
+            suspect.add(key);
             return "no-answer";
-        store(looked.value);
-        return looked.value.get(resolve(path)) ?? null;
+        }
+        suspect.delete(key);
+        // No start known: older than every answer, so it only fills what nothing answered yet.
+        store(looked.value, looked.started ?? 0);
+        return answers.get(key)?.real ?? null;
+    };
+    const refreshNow = async (paths) => {
+        const at = now();
+        const due = new Set(wanted);
+        for (const one of paths) {
+            const key = resolve(one);
+            const answer = answers.get(key);
+            if (answer === undefined || at - answer.at >= STALE_MS)
+                due.add(key);
+        }
+        for (const [key, answer] of answers)
+            if (at - answer.at >= STALE_MS)
+                due.add(key);
+        if (due.size === 0)
+            return true;
+        const alone = [...due].filter(one => suspect.has(one));
+        const batched = [...due].filter(one => !suspect.has(one));
+        if (batched.length > 0) {
+            const batch = await lookIdentities(batched, look);
+            if (batch.ok)
+                store(batch.value, batch.started ?? 0);
+            else
+                alone.push(...batched);
+        }
+        // One folder that doesn't answer mustn't hold the others: each on its own, a few at a time (inside the looks'
+        // child cap, leaving room for a person's actions), each under its deadline, each stored as soon as it answers.
+        let missed = false;
+        const worker = async () => {
+            for (let one = alone.shift(); one !== undefined; one = alone.shift())
+                if (await resolveNow(one) === "no-answer")
+                    missed = true;
+        };
+        await Promise.all(Array.from({ length: Math.min(IDENTITY_LOOKS, alone.length) }, worker));
+        return !missed;
     };
+    let passes = Promise.resolve();
     return {
         hot: path => {
             const key = resolve(path);
@@ -68,28 +129,13 @@ export function projectIdentities(look = {}, now = Date.now) {
             return undefined;
         },
         resolveNow,
-        refresh: async (paths) => {
-            const at = now();
-            const due = new Set(wanted);
-            for (const one of paths) {
-                const key = resolve(one);
-                const answer = answers.get(key);
-                if (answer === undefined || at - answer.at >= STALE_MS)
-                    due.add(key);
-            }
-            for (const [key, answer] of answers)
-                if (at - answer.at >= STALE_MS)
-                    due.add(key);
-            if (due.size === 0)
-                return true;
-            const batch = await lookIdentities([...due], look);
-            if (batch.ok) {
-                store(batch.value);
-                return true;
-            }
-            // One folder that doesn't answer mustn't hold the others: each on its own, in parallel (the looks are capped).
-            const each = await Promise.all([...due].map(one => resolveNow(one)));
-            return each.every(one => one !== "no-answer");
+        generation: () => generation,
+        refresh: paths => {
+            // One pass at a time: a pass asked for while another runs waits for it, then resolves only what is still due.
+            const asked = [...paths];
+            const pass = passes.then(() => refreshNow(asked));
+            passes = pass.then(() => undefined, () => undefined);
+            return pass;
         },
     };
 }
@@ -101,6 +147,7 @@ export function syncProjectIdentities() {
         strict: path => canonicalProject(path),
         vouched: path => canonicalProject(path) ?? undefined,
         resolveNow: async (path) => canonicalProject(path),
+        generation: () => 0,
         refresh: async () => true,
     };
 }

package/dist/project-knowledge.d.ts

@@ -22,18 +22,18 @@ export type KnowledgeView = ReturnType<typeof knowledgeView>;
 export declare function knowledgeVersion(store: Store, repo: string, actor: string, revision: number): Knowledge;
 /** Chat reads only an admitted project. Keep the full source in the project UI. */
 export declare function conversationKnowledge(store: Store, repo: string, actor: string, reference?: string, decision?: number): {
-    history?: never;
+    title?: never;
     revision: number;
     stale: boolean;
     notice: string;
     decision?: never;
-    title?: never;
     content?: never;
+    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
 } | {
-    history?: never;
+    title?: never;
     stale?: never;
     decision: {
         repo: string;
@@ -50,27 +50,27 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
         id: number;
     };
     notice: string;
-    title?: never;
     content?: never;
     revision?: never;
+    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
 } | {
-    history?: never;
     stale?: never;
     decision?: never;
     revision: number;
     title: string;
     content: string;
     notice: string;
+    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
 } | {
+    title?: never;
     stale?: never;
     decision?: never;
-    title?: never;
     content?: never;
     revision: number;
     history: {

package/dist/serve.js

@@ -146,6 +146,7 @@ import { createChatHandlers } from './server/chat.js';
 import { createLiveHandlers } from './server/live.js';
 import { createTerminalHandlers, terminalHostFor } from './server/terminals.js';
 import { passwordlessOn } from './passwordless.js';
+import { keepTypedFields, openProjectFor, settingsCrumbs } from './settings-kit.js';
 import { createSweepHandlers } from './server/sweeps.js';
 import { createFlowsHandlers } from './server/flows.js';
 import { createPagesHandlers } from './server/pages.js';
@@ -200,7 +201,7 @@ export function createDecisionServer(options) {
         get managedRepos() { return managedRepos; },
         get ceiling() { return ceiling; },
         get allowedHost() { return allowedHost; },
-        get defaultProject() { return defaultProject; },
+        get defaultProject() { return defaultProject(); },
         get actionTarget() { return actionTarget; },
         get team() { return team; },
         get joinSourceOf() { return joinSourceOf; },
@@ -453,15 +454,14 @@ export function createDecisionServer(options) {
     };
     let joinGlobal = { tokens: 30, refilledAt: Date.now() };
     const approvalNonces = new Map();
-    // Resolve startup authority once. Missing paths remain restrictive.
-    // Native additions come only from the controller after its admission checks.
-    const { ceiling: startCeiling, unresolved: unresolvedRepos } = resolveCeiling([...(options.repo === undefined ? [] : [options.repo]), ...(options.repos ?? [])], options.projectRoots ?? [], options.identities === undefined ? undefined : identities.known);
-    const ceiling = { ...startCeiling, canon: identities.strict };
-    /** The project every fresh session opens with: the sole configured repo, else none. */
-    const defaultProject = ceiling.repos.length === 1 && ceiling.roots.length === 0 ? ceiling.repos[0] : null;
+    // Startup authority: the configured repos and roots as their identities say (startupCeiling). Missing or unresolved
+    // paths remain restrictive. Native additions come only from the controller after its admission checks.
+    const { ceiling, unresolved: unresolvedRepos, defaultProject, configured, configuredPaths } = startupCeiling([...(options.repo === undefined ? [] : [options.repo]), ...(options.repos ?? [])], options.projectRoots ?? [], options.identities === undefined ? undefined : identities, identities.strict);
     /** No ceiling configured at all: the legacy trust-everything mode, named. */
     // An `up` console (it is handed its admitted set) is never unscoped: with every saved project away it is empty.
-    const unscopedMode = ceiling.repos.length === 0 && ceiling.roots.length === 0 && options.admittedRepos === undefined;
+    // Judged by what was configured, never by what has resolved so far: a console whose folders haven't answered yet is
+    // scoped and empty, not unscoped.
+    const unscopedMode = !configured && options.admittedRepos === undefined;
     /** Per-row visibility under the ceiling — the authorization question for reads. */
     /** The exact repositories this console serves now: `up`'s live admitted set when it supplies one, else startup's. */
     const exactRepos = () => options.admittedRepos?.() ?? ceiling.repos;
@@ -889,6 +889,7 @@ export function createDecisionServer(options) {
             browser: who.via === 'cookie',
             // Passwordless (read once for rendering; every act proves it again at the act): ceremony fields render as nothing.
             passwordless: who.via === 'cookie' && passwordlessOn(store),
+            openProject: who.via === 'cookie' ? who.session.project : null,
             // v100: signed in with the identity provider: its label, and whether it checked them recently enough to stand in for a password.
             // Cockpit B2: "fresh" is an explicit re-check made on request and not yet spent (read live; one step-up uses it).
             sso: who.via === 'cookie' && who.session.sso !== undefined ? { label: ssoSettings()?.label ?? "your identity provider",
@@ -1327,8 +1328,8 @@ export function createDecisionServer(options) {
             return { ok: false, code: "demo", why: "this is a demo database — chat cannot contact an external model" };
         if (unscopedMode)
             return { ok: false, code: "unscoped", why: "chat needs at least one added project" };
-        if (options.currentRepos === undefined && unresolvedRepos.length > 0) {
-            return { ok: false, code: "unresolved", why: "a configured project path did not resolve at startup — fix it and restart before chat will run" };
+        if (options.currentRepos === undefined && unresolvedRepos().length > 0) {
+            return { ok: false, code: "unresolved", why: "a configured project folder hasn't been found yet — chat runs once it answers; if its path is wrong, fix it and restart" };
         }
         if (managedRepos().length === 0)
             return { ok: false, code: "empty", why: "add a project first — chat will include it automatically" };
@@ -1483,13 +1484,20 @@ export function createDecisionServer(options) {
         const ssoFacts = requestContext.getStore()?.sso;
         if (ssoFacts !== undefined) {
             const back = requestContext.getStore()?.returnTo ?? "/";
-            s = { ...s, body: ssoStepUps(s.body, ssoFacts, back), ...(s.workspace?.pageHtml == null ? {} : { workspace: { ...s.workspace, pageHtml: ssoStepUps(s.workspace.pageHtml, ssoFacts, back) } }) };
+            // A typed-only proof (settings-kit.ts) stays a password field: its handler takes nothing else.
+            s = { ...s, body: keepTypedFields(s.body, ssoStepUps, ssoFacts, back), ...(s.workspace?.pageHtml == null ? {} : { workspace: { ...s.workspace, pageHtml: keepTypedFields(s.workspace.pageHtml, ssoStepUps, ssoFacts, back) } }) };
             if (s.workspace?.view?.kind === "flow")
                 s = { ...s, workspace: { ...s.workspace, view: { ...s.workspace.view, stepUp: { label: ssoFacts.label, fresh: ssoFacts.fresh, confirmHref: `/login/sso?reauth=1&return=${encodeURIComponent(back)}` } } } };
         }
         // D5: team chat (the central team service) is deprecated; /chat?team=1 still opens this release, but nothing links to it.
         const sensitive = authored || s.forceSensitive === true;
         const requestFacts = requestContext.getStore();
+        // The settings frame (settings-kit.ts): its breadcrumb, for the shell and the workspace alike.
+        if (s.chrome !== undefined && s.chrome.crumbs === undefined) {
+            const crumbs = settingsCrumbs(new URL(requestFacts?.returnTo ?? '/', 'http://standing-orders.local').pathname, s.title, htmlString(s.body));
+            if (crumbs !== undefined)
+                s = { ...s, chrome: { ...s.chrome, crumbs } };
+        }
         if (requestFacts?.browser && s.chrome && !s.forceSensitive && (requestFacts.workspaceRead || browserAssetsAvailable())) {
             const path = new URL(requestFacts.returnTo, 'http://standing-orders.local');
             path.searchParams.delete('format');
@@ -1564,6 +1572,10 @@ export function createDecisionServer(options) {
             const request = requestFacts.workspaceRequest;
             const workspace = {
                 version: 1, path: currentPath, title: s.title, user: requestFacts.actor ?? '', csrf: requestFacts.csrf, sensitive,
+                // The project picker names the open project; the settings frame carries its breadcrumb.
+                // Only a project this person may see now: never the raw saved path (settings-kit.ts openProjectFor).
+                openProject: openProjectFor(requestFacts.openProject ?? null, s.chrome.project, s.chrome.projects ?? []),
+                ...(s.chrome.crumbs === undefined ? {} : { crumbs: s.chrome.crumbs }),
                 ...(requestFacts.passwordless === true ? { passwordless: true } : {}),
                 ...(requestFacts.actor ? { leadName: leadNameOf(store, requestFacts.actor) } : {}),
                 refreshUrl: path.pathname + path.search,
@@ -1966,7 +1978,7 @@ export function createDecisionServer(options) {
                             waits.push(connectionCheck(provider).catch(() => undefined));
                     }
                     // Project identities, resolved off the thread: what pages asked about, and answers gone stale.
-                    waits.push(identities.refresh([...exactRepos(), ...(options.currentRepos?.() ?? []), ...store.listProjects().map(one => one.path), ...store.knownRepos(), ...ceiling.roots]));
+                    waits.push(identities.refresh([...configuredPaths, ...exactRepos(), ...(options.currentRepos?.() ?? []), ...store.listProjects().map(one => one.path), ...store.knownRepos()]));
                     integrations.refreshIfDue();
                     const sso = ssoSettings();
                     if (sso !== null && (ssoProvider === null || ssoProvider.issuer !== sso.issuer || Date.now() - ssoProvider.at >= 10 * 60_000))
@@ -2204,7 +2216,7 @@ export function createDecisionServer(options) {
         get providerFor() { return providerFor; },
         get providerKnown() { return providerKnown; },
         get connectVisits() { return connectVisits; },
-        get defaultProject() { return defaultProject; },
+        get defaultProject() { return defaultProject(); },
         get googleVisits() { return googleVisits; },
         get setupAttemptsLeft() { return setupAttemptsLeft; },
         set setupAttemptsLeft(value) { setupAttemptsLeft = value; },
@@ -2324,3 +2336,38 @@ export { diffFileAnchor, editorFileHref, needActionOf, orderChangedFiles, plainC
 export { settingsGroups, settingsTiles } from "./server/render-settings.js";
 export { decisionAnswerScript, earlierVersionsWords, revisionLineageWords } from "./server/render-tasks.js";
 export { SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH } from "./server/session.js";
+/**
+ * The console's configured repos and roots. Without identities (embedders and tests) they resolve once, synchronously,
+ * as before. With them, the console resolves them in the background after it listens (operate.ts startConsole), so
+ * each is read from the last answer: a configured path counts by its real path from the moment its folder answers,
+ * and until then only by its spelling, which the strict `canon` never matches for an unresolved row.
+ */
+function startupCeiling(repos, roots, identities, canon) {
+    const configured = repos.length > 0 || roots.length > 0;
+    const configuredPaths = [...repos, ...roots];
+    if (identities === undefined) {
+        const once = resolveCeiling(repos, roots);
+        return {
+            ceiling: { ...once.ceiling, canon },
+            unresolved: () => once.unresolved,
+            defaultProject: () => once.ceiling.repos.length === 1 && once.ceiling.roots.length === 0 ? once.ceiling.repos[0] : null,
+            configured,
+            configuredPaths,
+        };
+    }
+    // Only resolved entries authorize: an unresolved configured path is in no list, so it matches nothing (not even its
+    // own spelling) and is no session's default until its folder answers.
+    const resolved = (paths) => [...new Set(paths.flatMap(path => { const real = identities.known(path); return typeof real === "string" ? [real] : []; }))];
+    const ceiling = {
+        get repos() { return resolved(repos); },
+        get roots() { return resolved(roots); },
+        canon,
+    };
+    return {
+        ceiling,
+        unresolved: () => [...repos, ...roots].filter(path => typeof identities.known(path) !== "string"),
+        defaultProject: () => repos.length === 1 && roots.length === 0 ? resolved(repos)[0] ?? null : null,
+        configured,
+        configuredPaths,
+    };
+}

package/dist/server/chat.js

@@ -12,10 +12,10 @@ import { CHAT_ACTIONS, mintSharedActionReview, sharedActionPayload, sharedAction
 import { CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
 import { buildDataDocument, composeRequest, isSubscriptionChatProvider, parseAssistantEnvelope, performChatRequest, plausibleChatKey, priceOf, settleForPrice, TURN_WALL_CLOCK_MS, worstCaseForPrice } from "../converse.js";
 import { DEMO_CHAT_SCRIPT, demoChatHtml, demoThreadHtml } from "../demo-chat.js";
-import { withDispatchDiagnoses } from "../dispatch.js";
+import { builderReadyFor, firstRunBuilderRepo, withDispatchDiagnoses } from "../dispatch.js";
 import { readVerifiedArtifact, scanForSecrets } from "../evidence.js";
 import { run as execRun } from "../exec.js";
-import { findFirstTasks, firstTaskSuggestions, HOW_IT_WORKS, SANDBOX_COMMAND } from "../first-run.js";
+import { findFirstTasks, firstTaskSuggestions, HOW_IT_WORKS, SANDBOX_COMMAND, withBuilderStep } from "../first-run.js";
 import { leadBriefHtml } from '../lead-context.js';
 import { configureLeadFollow, leadFollowStatus } from '../lead-follow.js';
 import { leadActivity } from "../lead-voice.js";
@@ -1158,11 +1158,12 @@ export function createChatHandlers(runtime) {
     }
     /** Chat's first run: the steps, first tasks until the first task exists, and the sandbox while no agent is signed in. */
     function chatFirstRun(now, project) {
-        const steps = firstRunStepsNow(now);
+        const repo = project ?? managedRepos()[0] ?? null;
+        // Done only when a task in this project could start: a live builder bound to it, as dispatch decides.
+        const steps = withBuilderStep(firstRunStepsNow(now), builderReadyFor(store, firstRunBuilderRepo(store, project, visible, managedRepos()), now));
         if (steps === null)
             return undefined;
         const taskFiled = steps.find(one => one.key === "task")?.done ?? true;
-        const repo = project ?? managedRepos()[0] ?? null;
         const agent = steps.find(one => one.key === "agent");
         const lead = leadWords();
         return {

package/dist/server/chrome.d.ts

@@ -1,4 +1,5 @@
 import { type BrowserSignIn, type BrowserUpdateNotice, type BrowserWorkspace } from "../browser-workspace.js";
+import { type Crumb } from "../settings-kit.js";
 import { type Decision, type Run } from "../store.js";
 import { type tally } from "../summary.js";
 import { type ServerResponse } from "node:http";
@@ -115,6 +116,8 @@ export type Chrome = {
     csrf?: string;
     /** Where a switch made on this screen returns to. */
     returnTo?: string;
+    /** The settings frame's breadcrumb ("Settings / <page>", settings-kit.ts), set by sendScreen; absent elsewhere. */
+    crumbs?: Crumb[];
 };
 /**
  * A server-rendered region that stays current: when the page's live stream

package/dist/server/chrome.js

@@ -33,6 +33,7 @@ import { PULL_REQUEST_SETTINGS_CSS } from "../pull-request-ui.js";
 import { RECIPE_CSS } from "../recipe-ui.js";
 import { REQUEST_LIMITS_CSS } from "../request-budget-ui.js";
 import { RETENTION_CSS } from "../retention-ui.js";
+import { crumbsHtml, SETTINGS_KIT_CSS } from "../settings-kit.js";
 import { SKILLS_CSS } from "../skills-ui.js";
 import { SPEND_CSS } from "../spend-ui.js";
 import { SSO_CSS } from "../sso-ui.js";
@@ -148,7 +149,7 @@ export const INBOX_TABS_CSS = '.inbox-tabs{display:inline-flex;gap:2px;max-width
     '.inbox-ask{margin:18px 0 0}.inbox-ask>h2{display:flex;align-items:baseline;gap:8px;margin:0 0 4px;font-size:15px;font-weight:600}.inbox-ask>h2 .count{font:500 12px var(--so-mono,ui-monospace,monospace);font-variant-numeric:tabular-nums;color:var(--so-muted)}.inbox-ask h3{font-size:13px;font-weight:600;margin:12px 0 4px}' +
     '.inbox-unread{display:none;position:absolute;top:4px;right:3px;width:6px;height:6px;border-radius:50%;background:var(--so-signal)}' +
     '@media (max-width:760px){.inbox-tabs{display:flex;width:100%}.inbox-tabs a{flex:1;justify-content:center;min-height:44px;padding:0 6px}.inbox-unread{display:block}}';
-export const WORKSPACE_STYLE = styleAsset(STYLE + BRAND_MARK_CSS + INBOX_TABS_CSS + APPROVAL_RULES_CSS + SPEND_CSS + RETENTION_CSS + STORAGE_CSS + UPDATES_CSS + LIMITS_CSS + MONITORING_CSS + INTEGRATIONS_CSS + BACKUP_CSS + EXPORT_CSS + PROJECT_DELETE_CSS + POLICY_CSS + EVIDENCE_PACK_CSS + THEME_CONTROLS_CSS + CODING_CSS + CODING_SHIPPING_CSS + RECIPE_CSS + SKILLS_CSS + TOOLS_CSS + FLOWS_CSS + SUBAGENT_CSS + KITS_CSS + STARTERS_CSS + GALLERY_CSS + SSO_CSS + CREDENTIALS_CSS + REQUEST_LIMITS_CSS + PEOPLE_AUDIT_CSS + KNOWLEDGE_CSS + MODELS_CSS + CHAT_POLISH_CSS + TRANSITIONS_CSS + WORKSPACE_MOTION_CSS + ASSIGNMENT_CSS + TASK_STATUS_CSS + LEAD_CONTEXT_CSS + PULL_REQUEST_SETTINGS_CSS + CHECK_SETTINGS_CSS + DISCLOSURE_CSS + '.learning{min-width:0;overflow-wrap:anywhere}.learning .card{min-width:0}.learning code,.learning blockquote,.learning pre{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word}.learning button,.learning summary,.learning .button-link{min-height:44px}.learning button{white-space:nowrap}.learning summary{padding:12px 0;cursor:pointer}.learning form{margin:12px 0}.learning select{max-width:100%}.learning blockquote{margin:8px 0}.learning ul{padding-left:20px}');
+export const WORKSPACE_STYLE = styleAsset(STYLE + BRAND_MARK_CSS + INBOX_TABS_CSS + APPROVAL_RULES_CSS + SPEND_CSS + RETENTION_CSS + STORAGE_CSS + UPDATES_CSS + LIMITS_CSS + MONITORING_CSS + INTEGRATIONS_CSS + BACKUP_CSS + EXPORT_CSS + PROJECT_DELETE_CSS + POLICY_CSS + EVIDENCE_PACK_CSS + THEME_CONTROLS_CSS + CODING_CSS + CODING_SHIPPING_CSS + RECIPE_CSS + SKILLS_CSS + TOOLS_CSS + FLOWS_CSS + SUBAGENT_CSS + KITS_CSS + STARTERS_CSS + GALLERY_CSS + SSO_CSS + CREDENTIALS_CSS + REQUEST_LIMITS_CSS + PEOPLE_AUDIT_CSS + KNOWLEDGE_CSS + MODELS_CSS + CHAT_POLISH_CSS + TRANSITIONS_CSS + WORKSPACE_MOTION_CSS + ASSIGNMENT_CSS + TASK_STATUS_CSS + LEAD_CONTEXT_CSS + PULL_REQUEST_SETTINGS_CSS + CHECK_SETTINGS_CSS + DISCLOSURE_CSS + SETTINGS_KIT_CSS + '.learning{min-width:0;overflow-wrap:anywhere}.learning .card{min-width:0}.learning code,.learning blockquote,.learning pre{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word}.learning button,.learning summary,.learning .button-link{min-height:44px}.learning button{white-space:nowrap}.learning summary{padding:12px 0;cursor:pointer}.learning form{margin:12px 0}.learning select{max-width:100%}.learning blockquote{margin:8px 0}.learning ul{padding-left:20px}');
 /**
  * A server-rendered region that stays current: when the page's live stream
  * says something changed (GET /live, live-bus.ts), fetch this page's own
@@ -579,8 +580,10 @@ ${update === undefined ? "" : html `<div class="banner update-banner" data-updat
 ${postForm(update.dismissHref, html `<button type="submit">Dismiss</button>`, { attrs: { class: "inline" }, hidden: { version: update.version } })}</div>`}`;
     // The scope bar sits between the banners and the main/split body, so it
     // can never disappear with a responsive pane (portfolio arc §1).
+    // The settings frame's breadcrumb sits above the page's own h1 (its only h1).
+    const crumbs = chrome.crumbs === undefined ? "" : crumbsHtml(chrome.crumbs);
     const content = chrome.listPane === undefined
-        ? html `<div class="content">${demoBanner}${scopeBar}<main>${main}</main></div>`
+        ? html `<div class="content">${demoBanner}${scopeBar}${crumbs}<main>${main}</main></div>`
         : html `<div class="content">${demoBanner}${scopeBar}<div class="split">\
 <div class="list-pane">${chrome.listPane}</div>\
 <div class="detail"><main>${main}</main></div>\

package/dist/server/console.css

@@ -265,12 +265,15 @@
   .project-card .project-name:focus-visible { outline: 2px solid var(--ring); outline-offset: 2px; border-radius: .375rem; }
 
   label { display: block; font-size: 0.8125rem; font-weight: 500; margin: .75rem 0 0; color: var(--foreground); }
-  input[type=text], input[type=password], input[type=number], input[type=url], input[type=email], input[type=search], input[type=time], textarea, select {
-    width: 100%; margin: .35rem 0 0; padding: .45rem .7rem; font: 400 0.875rem/1.4 var(--font-sans);
+  :where(input[type=text], input[type=password], input[type=number], input[type=url], input[type=email], input[type=search], input[type=time], textarea, select) {
+    width: 100%; margin: .35rem 0 0; padding: .45rem .7rem;
     color: var(--foreground); background: var(--card); min-height: 2.125rem;
     border: 1px solid var(--input); border-radius: calc(var(--radius) - 3px);
     transition: border-color .15s, box-shadow .15s;
   }
+  /* The box above is in :where() so a surface's own rules (the workspace's 44px phone targets) win; the type keeps
+     its old weight, so the phone's 16px rule still loses to it as before. */
+  input[type=text], input[type=password], input[type=number], input[type=url], input[type=email], input[type=search], input[type=time], textarea, select { font: 400 0.875rem/1.4 var(--font-sans); }
   @media (hover: hover) and (pointer: fine) { input:hover, textarea:hover, select:hover { border-color: var(--muted-foreground); } }
   input[type=number] { font-family: var(--font-mono); font-variant-numeric: tabular-nums; }
   input[type=radio], input[type=checkbox] { accent-color: var(--ring); }

package/dist/server/flows.js

@@ -839,6 +839,7 @@ export function createFlowsHandlers(runtime) {
             if (body.get("repo") !== project || (who.via === "cookie" && body.get("projectRevision") !== String(who.session.projectRevision)))
                 throw new RecipeError("The open project changed. Reopen this recipe in the intended project.", 409);
             const rootMode = !unscopedMode && ceiling.roots.length > 0;
+            const decidedOn = identities.generation();
             if (rootMode) {
                 // A mutation's target is resolved now, off the console's thread, and must still be the project it names.
                 const resolved = await identities.resolveNow(project);
@@ -852,6 +853,9 @@ export function createFlowsHandlers(runtime) {
                 throw new RecipeError(rechecked.message, rechecked.status);
             if (projectOf(who, request) !== project)
                 throw new RecipeError("The open project changed. Preview the intended project again.", 409);
+            // An identity that changed during the awaits above undoes what they proved.
+            if (identities.generation() !== decidedOn)
+                throw new RecipeError("A project folder changed while this was being checked. Try again.", 409);
             const revision = who.via === "cookie" ? who.session.projectRevision : 0;
             if (step === "prepare") {
                 const id = body.get("recipe") ?? "", version = body.get("recipeRevision") ?? "";

package/dist/server/http.d.ts

@@ -226,6 +226,7 @@ export declare function matchTaskPath(pathname: string, suffixPattern: string):
     verb: string;
 } | null;
 export declare function taskHref(taskId: string): string;
+export declare function runHref(runId: number): string;
 export declare const SAFETY: {
     readonly "Content-Security-Policy": "default-src 'none'; style-src 'self' 'unsafe-inline'; font-src 'self'; manifest-src 'self'; worker-src 'self'; img-src 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'";
     readonly "X-Content-Type-Options": "nosniff";

package/dist/server/http.js

@@ -51,6 +51,9 @@ export function matchTaskPath(pathname, suffixPattern) {
 export function taskHref(taskId) {
     return `/t/${encodeURIComponent(taskId)}`;
 }
+export function runHref(runId) {
+    return `/r/${Math.trunc(runId)}`;
+}
 // ---- rendering -------------------------------------------------------------
 export const SAFETY = {
     "Content-Security-Policy": "default-src 'none'; style-src 'self' 'unsafe-inline'; font-src 'self'; manifest-src 'self'; worker-src 'self'; img-src 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
@@ -64,10 +67,13 @@ export function respond(response, status, type, body) {
     // writeHead's headers would otherwise win.
     const own = response.getHeader("content-security-policy");
     const cache = response.getHeader("cache-control");
+    // The first-account form's page sends `same-origin` so its own post names this console (signup-gate.ts).
+    const referrer = response.getHeader("referrer-policy");
     response.writeHead(status, {
         ...SAFETY,
         ...(own === undefined ? {} : { "content-security-policy": own }),
         ...(cache === undefined ? {} : { "Cache-Control": cache }),
+        ...(referrer === "same-origin" ? { "Referrer-Policy": "same-origin" } : {}),
         "Content-Type": type,
     });
     response.end(isHtml(body) ? htmlString(body) : body);