toolroll 0.9.83 → 0.9.84

package/dist/server/route-table.js

@@ -133,12 +133,15 @@ get("pages", "workbench", "/workbench", free);
 get("tasks", "board", "/board", { limited: "collection" });
 get("tasks", "review", "/review", { limited: "collection" });
 get("settings", "spend", "/spend", { ...free, ...anyOperator("An instance operator sees spend.", "/") });
+get("settings", "settings.spend", "/settings/spend", { ...free, ...anyOperator("An instance operator sets spending limits.", "/settings") });
 get("pages", "ledger", "/ledger", { limited: "unscoped", ...free });
 get("pages", "activity", "/activity");
 get("tasks", "done", "/done", { limited: "collection" });
 get("settings", "mode", "/mode");
 get("people", "people.page", "/people", { limited: "unscoped", ...free });
 get("pages", "system", "/system");
+// Where every "Connect a builder" leads: read-only, open to a project-limited person (the handler shows only a visible project).
+get("pages", "start-builder", "/start-builder", { limited: "unscoped", ...free });
 get("tasks", "tasks", "/tasks", { limited: "collection", ...free }); // a redirect to /work now: never sent to the project opener first
 get("tasks", "queue", "/queue");
 get("pages", "peek", "/peek", free);
@@ -334,8 +337,12 @@ for (const one of ["policy", "approval", "request-limits", "sessions", "sign-in"
 }
 post("settings", "settings.flows-on", "/settings/flows/on", { limited: "collection", ...approver("An approver switches starter flows on.", "/settings/flows") });
 const MODELS = approver("Sign in as an approver to change models.", "/settings/models");
-for (const one of ["check", "watch", "update", "agent"])
+for (const one of ["check", "watch", "update"])
     post("settings", `settings.models-${one}`, `/settings/models/${one}`, MODELS);
+// Changing which model a role uses: an instance operator's browser step-up (the handler proves the password, or the
+// Passwordless session; model-choices.ts re-proves the session and standing inside its one transaction).
+for (const one of ["agent", "apply"])
+    post("settings", `settings.models-${one}`, `/settings/models/${one}`, { scope: "step-up", ...operator("An instance operator changes models.", "/settings/models") });
 // Any other models action answers the models area's own refusal.
 post("settings", "settings.models-act", "^\\/settings\\/models\\/.*$", { sample: "/settings/models/unknown", ...MODELS });
 post("settings", "settings.knowledge-refresh", "/settings/knowledge/refresh", { project: "form", limited: "unscoped", ...approver("Sign in as an approver to refresh project context.", "/settings/knowledge") });

package/dist/server/settings.d.ts

@@ -2,7 +2,7 @@ import type { ServerRuntime } from './runtime.js';
 import { type RoleView } from "../models-ui.js";
 export declare function createSettingsHandlers(runtime: ServerRuntime): {
     registrations: import("./handler-registry.js").Registration[];
-    modelsView: (canManage: boolean, csrf: string, now: Date, said: string | null, problem: string | null) => {
+    modelsView: (canManage: boolean, csrf: string, now: Date, said: string | null, problem: string | null, query?: URLSearchParams) => {
         runtimes: import("../model-catalog.js").RuntimeState[];
         watch: import("../model-catalog.js").WatchState;
         roles: RoleView[];
@@ -14,5 +14,62 @@ export declare function createSettingsHandlers(runtime: ServerRuntime): {
             words: string;
         } | null;
         fresh: import("../model-catalog.js").SeenModel[];
+        scope: {
+            value: string;
+            label: string;
+            digest: string;
+            options: {
+                value: string;
+                label: string;
+            }[];
+        };
+        inUse: string | null;
+        presets: {
+            name: "opus" | "sized";
+            label: string;
+            words: string;
+            inUse: boolean;
+            recommended: boolean;
+        }[];
+        newer: {
+            from: string;
+            to: string;
+            name: string;
+            roles: string;
+        }[];
+        preview: {
+            title: string;
+            rows: {
+                role: string;
+                before: string;
+                after: string;
+                notes: string[];
+            }[];
+            hidden: {
+                scope: string;
+                digest: string;
+                change: string;
+            };
+        } | null;
+        unresolved: string | null;
+        sizing: {
+            small: string;
+            routine: string;
+            large: string;
+            risky: string;
+            classifier: string;
+        };
+        routing: string;
+        recent: {
+            taskId: string;
+            runId: number;
+            role: string;
+            chosen: string;
+            ranOn: string;
+        }[];
+        waiting: {
+            taskId: string;
+            title: string;
+        }[];
     };
 };

package/dist/server/settings.js

@@ -26,7 +26,7 @@ import { modeTermsFromJson } from "../modes.js";
 import { envValue } from "../names.js";
 import { REMOTE_MESSAGES } from "../operate-remote.js";
 import { canonicalProject, projectName } from "../project.js";
-import { ALL_CREDENTIAL_ENV } from "../provider.js";
+import { ALL_CREDENTIAL_ENV, MONEY_CAPABILITIES } from "../provider.js";
 import { updateChecksOff } from "../releases.js";
 import { authenticateAccount } from "../scope.js";
 import { budgetLabel, monthOf } from "../spend.js";
@@ -35,7 +35,7 @@ import { handlersOf } from './handler-registry.js';
 import { refuse, screen } from "./chrome.js";
 import { HANDOFF_STYLE, redirect, respond, safeReturn, sayTo, signInSpent, startedHere } from "./http.js";
 import { html, htmlString, joinHtml, postForm, reauth } from "../html.js";
-import { browserCaller } from "./session.js";
+import { browserCaller, sessionWithinLifetime } from "./session.js";
 /** settings handlers, moved without changing their route bodies. */
 import { DEFAULT_ACCENT, normalHex } from "../accent-colors.js";
 import { resolvePhaseAgent } from "../agentconfig.js";
@@ -74,6 +74,9 @@ import { startConnect } from "../mcp-connect.js";
 import { decideProposal, listProposals, memoryStatus } from "../memory-pass.js";
 import { checkModels, isNewModel, modelOptions, modelWords, RUNTIME_TOOLS, runtimeStates, seenModels, setWatch, updateRuntime, watchState } from "../model-catalog.js";
 import { modelsHtml, modelsScript } from "../models-ui.js";
+import { ALL_SLOTS, applyModelChoices, browserWords, checkScope, DEFAULT_PRESET, isPresetName, newerModels, PRESETS, presetChange, presetInUse, previewModelChange, recentRuns, rowAt, slotKey, SLOTS, slotWords, stateDigest, switchChange } from "../model-choices.js";
+import { HEADROOM_FIVE_HOUR_LIMIT, HEADROOM_WEEKLY_LIMIT, exactModelId } from "../phase-routing.js";
+import { RISKY_MEANS, SIZE_MEANS, SIZING_CLAUDE_MODEL } from "../task-sizing.js";
 import { CHAT_APPROVE_ALL, MODE_MAX_DAYS, modeDigestOf, modeTermsJson, modeWords, presetTerms } from "../modes.js";
 import { monitoringChange, readMonitoring, saveMonitoring } from "../monitoring-settings.js";
 import { monitoringHtml, signingSecretHtml } from "../monitoring-ui.js";
@@ -109,7 +112,9 @@ import { addProjectInstructions, ASSISTANTS, detectPreparation, modelChoices, pr
 import { skillsHtml, skillsScript } from "../skills-ui.js";
 import { checkSlackCredentials, clearSlackCredentials, loadSlackCredentials, saveSlackCredentials, SLACK_MANIFEST, SlackError } from "../slack-api.js";
 import { slackSettingsHtml } from "../slack-settings.js";
-import { spendCsv, spendHtml } from "../spend-ui.js";
+import { spendHtml, spendSettingsHtml } from "../spend-ui.js";
+import { spendReport, spendReportCsv, spendRows } from "../spend-report.js";
+import { limitsHtml, limitsView } from "../limits-ui.js";
 import { budgetStates, monthNamed, spendItems, usd as spendUsd, subagentNames as subagentNamesOf } from "../spend.js";
 import { removeSsoSettings, saveSsoSettings, SSO_CALLBACK, ssoChangeWords } from "../sso-settings.js";
 import { ssoSettingsHtml } from "../sso-ui.js";
@@ -133,8 +138,9 @@ import { personChip, ROLE_TITLES } from "./chrome.js";
 import { chatReturnWithSaid, goOutside } from "./http.js";
 import { leadSettingsHtml, notificationProjects, SETTINGS_AUTOSAVE_SCRIPT, settingsPage, settingsWorkers, telegramDeliveryWords, telegramTrouble } from "./render-settings.js";
 export function createSettingsHandlers(runtime) {
-    const { identities, store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, connectionKnown, lastChecks, checkRelease, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, chatCatalogKnown, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, authenticateCredential, deletedRepos, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, defaultProject, googleVisits } = runtime;
-    // v105: what agent work cost, by month, and the monthly budgets. An instance operator's page.
+    const { identities, store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, connectionKnown, lastChecks, checkRelease, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, chatCatalogKnown, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, authenticateCredential, deletedRepos, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, googleVisits } = runtime;
+    // What agent work cost, by month: API dollars, plan usage and unknown cost apart (spend-report.ts). An instance
+    // operator's page. Its limits show read-only; they change on Settings → Spend.
     async function spendPage(ctx) {
         const { url, who, response, now } = ctx;
         const current = monthOf(now);
@@ -142,26 +148,17 @@ export function createSettingsHandlers(runtime) {
         const month = asked === null ? current : monthNamed(asked);
         if (month === null)
             return refuse(response, who, 400, "Choose a month like 2026-09.", "/spend");
-        const items = spendItems(store.handle, month.from, month.to);
-        const subagents = store.subagents([...new Set([...managedRepos(), ...store.knownRepos()])]);
+        const rows = spendRows(store.handle, month.from, month.to);
         const subagentNames = subagentNamesOf(store.handle);
         if (url.searchParams.get("format") === "csv") {
             response.writeHead(200, { "content-type": "text/csv; charset=utf-8", "content-disposition": `attachment; filename="standing-orders-spend-${month.name}.csv"`, "cache-control": "no-store", "x-content-type-options": "nosniff" });
-            return void response.end(spendCsv(items, subagentNames));
+            return void response.end(spendReportCsv(rows, subagentNames));
         }
         const shift = (by) => { const at = new Date(`${month.name}-01T00:00:00.000Z`); at.setUTCMonth(at.getUTCMonth() + by); return at.toISOString().slice(0, 7); };
-        const projects = consoleProjects();
-        const people = store.accountFacts().filter(one => one.revokedAt === null).map(one => one.name);
-        const view = {
-            month: month.name, previous: shift(-1), next: month.name === current.name ? null : shift(1),
-            items, budgets: budgetStates(store.budgets(), items), subagentNames, csrf: who.via === "cookie" ? who.session.csrf : "",
-            targets: [
-                { value: "installation:*", label: "Everything", group: "Everything" },
-                ...projects.map(repo => ({ value: `project:${repo}`, label: projectName(repo), group: "Projects" })),
-                ...people.map(name => ({ value: `person:${name}`, label: name, group: "People" })),
-                ...subagents.map(one => ({ value: `subagent:${one.id}`, label: `${subagentNames.get(one.id) ?? one.handle} (${projectName(one.repo)})`, group: "Subagents" })),
-            ],
-        };
+        // Limits read what the budget gate counts today (spend.ts spendItems), for the current month.
+        const budgets = month.name === current.name ? budgetStates(store.budgets(), spendItems(store.handle, current.from, current.to)) : null;
+        const windows = month.name !== current.name ? html `` : limitsHtml(limitsView(store.providerLimits(), [], { project: projectName, subagent: id => subagentNames.get(id) ?? `Subagent ${id}` }, now));
+        const view = { month: month.name, previous: shift(-1), next: month.name === current.name ? null : shift(1), report: spendReport(rows), budgets, windows, subagentNames };
         return sendScreen(response, 200, screen("Spend", spendHtml(view, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }), { chrome: chromeFor(null, "spend") }));
     }
     async function modePage(ctx) {
@@ -248,7 +245,13 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const instructions = previewProjectInstructions(project);
         // The model list as last loaded; Refresh models posts, and the background checks keep it current.
         const catalog = asked === "openrouter" ? modelCatalog.known(readProviderKey("openrouter", providerHome)) ?? { ok: false, problem: "The model list has not loaded yet." } : null;
-        const inputs = { provider: asked, model: saved?.provider === asked ? saved.model ?? "" : models[0]?.value ?? "", command: setup?.command ?? (saved === null ? preparation?.command ?? "" : ""), seconds: String((setup?.timeoutMs ?? 300_000) / 1000) };
+        // With nothing saved, setup preselects what the installation builds routine tasks with, else "Sized by job"'s
+        // routine builder (Sonnet 5.5) for Claude: an exact id, never a floating name.
+        const installationBuild = store.phaseConfig(INSTALLATION_SCOPE, "build");
+        const routineDefault = PRESETS[DEFAULT_PRESET].rows["build"] ?? "";
+        const preselected = installationBuild?.provider === asked && installationBuild.model !== null && models.some(one => one.value === installationBuild.model) ? installationBuild.model
+            : asked === "claude" && models.some(one => one.value === routineDefault) ? routineDefault : models[0]?.value ?? "";
+        const inputs = { provider: asked, model: saved?.provider === asked ? saved.model ?? "" : preselected, command: setup?.command ?? (saved === null ? preparation?.command ?? "" : ""), seconds: String((setup?.timeoutMs ?? 300_000) / 1000) };
         return sendScreen(response, 200, screen("Project setup", controlSetupHtml({ repo: project, csrf: who.via === "cookie" ? who.session.csrf : "", provider: asked, inputs, models, connection, catalog, task, preparation,
             instructions: instructions.ok ? { installed: instructions.installed } : { installed: false, message: instructions.message } }), { chrome: chromeFor(project, "settings"), ...(catalog === null ? {} : { functional: { script: openRouterPickerScript() } }) }));
     };
@@ -301,7 +304,9 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const now = clock();
         // The page shows the last check and when it ran (docs/plans/get-side-effects.md): Check now, or the watch loop's
         // automatic checks, fetch the lists and may queue a notice; opening the page never does.
-        const view = modelsView(who.role === "approver", who.via === "cookie" ? who.session.csrf : "", now, url.searchParams.get("said"), url.searchParams.get("problem"));
+        // Only an instance operator changes models (docs/plans/spend-dashboard.md D4); a preset or a switch is previewed
+        // here, read-only, and applied by its own password-checked POST.
+        const view = modelsView(who.via === "cookie" && store.isInstanceOperator(who.name), who.via === "cookie" ? who.session.csrf : "", now, url.searchParams.get("said"), url.searchParams.get("problem"), url.searchParams);
         return sendScreen(response, 200, screen("Models", html `<p><a href="/settings">Settings</a></p><h1>Models</h1>${modelsHtml(view)}`, { chrome: chromeFor(project, "settings"), functional: { script: modelsScript() } }));
     }
     async function skillsPage(ctx) {
@@ -867,7 +872,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
     async function spendBudget(ctx) {
         const { who, response, now, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.spendBudget);
-        const back = sayTo(response, "/spend");
+        const back = sayTo(response, "/settings/spend");
         if (!authenticateApprover(who, body.get("password") ?? "").ok)
             return back("problem", "Enter your Toolroll password to change a budget.");
         const target = /^(installation|project|person|subagent):(.+)$/.exec(body.get("target") ?? "");
@@ -1648,38 +1653,6 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
             const updated = await updateRuntime(store, tool, who.name, now, modelSeams);
             return back(updated.message, !updated.ok);
         }
-        if (action === "agent") {
-            const phase = body.get("phase") ?? "", agent = body.get("agent") ?? "";
-            if (!["plan", "build", "review", "repair"].includes(phase))
-                return back("Choose a role.", true);
-            const role = ROLE_TITLES[phase];
-            if (agent === "inherit") {
-                if (phase !== "repair")
-                    return back("Choose a model.", true);
-                store.clearPhaseConfig(INSTALLATION_SCOPE, "repair");
-                return back("Repairs now use the builder's agent.");
-            }
-            const split = agent.indexOf("|");
-            const provider = split < 0 ? "" : agent.slice(0, split), model = split < 0 ? "" : agent.slice(split + 1);
-            if (!isProviderId(provider) || !validModelId(model))
-                return back("Choose a model from the list.", true);
-            const valid = validateSpec({ provider, model });
-            if (!valid.ok)
-                return back(valid.problem, true);
-            if (phase === "review" && provider === "gemini")
-                return back("Gemini cannot review yet. Choose Claude or Codex.", true);
-            const build = store.phaseConfig(INSTALLATION_SCOPE, "build");
-            if (phase === "repair" && build !== null && build.provider !== provider)
-                return back(`Repairs must use the builder's provider (${build.provider}).`, true);
-            store.setPhaseConfig(INSTALLATION_SCOPE, phase, provider, model, who.name, now);
-            const repair = store.phaseConfig(INSTALLATION_SCOPE, "repair");
-            let extra = "";
-            if (phase === "build" && repair !== null && repair.provider !== provider) {
-                store.clearPhaseConfig(INSTALLATION_SCOPE, "repair");
-                extra = " Repairs now follow the builder.";
-            }
-            return back(`${role} now uses ${modelWords(store, provider, model)} for new tasks.${extra}`);
-        }
         return refuse(response, who, 404, "No such models action.", "/settings/models");
     };
     async function knowledgeRefresh(ctx) {
@@ -1813,7 +1786,8 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         const nonceKey = `project-setup:${project}`;
         if (step === "preview") {
             const nonce = mintApprovalNonce(who.name, nonceKey, preview.fingerprint);
-            return sendScreen(response, 200, screen("Approve project setup", setupPreviewHtml(inputs, { csrf, repo: project, fingerprint: preview.fingerprint, nonce }), { chrome: chromeFor(project, "settings") }));
+            const models = preview.models === null ? null : { label: PRESETS[DEFAULT_PRESET].label, rows: preview.models.rows.map(row => ({ role: slotWords(row.slot), model: row.after?.model ?? (row.slot.phase === "repair" ? "same as the builder" : "not set") })) };
+            return sendScreen(response, 200, screen("Approve project setup", setupPreviewHtml(inputs, { csrf, repo: project, fingerprint: preview.fingerprint, nonce }, models), { chrome: chromeFor(project, "settings") }));
         }
         if (who.via === "cookie" && !consumeApprovalNonce(body.get("nonce") ?? "", who.name, nonceKey, body.get("fingerprint") ?? ""))
             return refuse(response, who, 409, "This setup preview expired. Review it again.", "/control");
@@ -2240,7 +2214,7 @@ ${postForm("/settings/chat-approval/save", html `\
             const existing = loadBotToken({}, options.telegramTokenFile);
             const hasEnv = (envValue(process.env, "TELEGRAM_TOKEN") ?? "") !== "";
             const csrf = who.via === "cookie" ? who.session.csrf : "";
-            return sendScreen(response, 400, settingsPage(chromeFor(who.via === "cookie" ? who.session.project : defaultProject, "settings"), existing, hasEnv, csrf, saved.message, options.configDir === undefined ? null : effectivePrimary(process.env, options.configDir, loadBotToken(process.env, options.telegramTokenFile) !== null), null, null, null, {
+            return sendScreen(response, 400, settingsPage(chromeFor(who.via === "cookie" ? who.session.project : runtime.defaultProject, "settings"), existing, hasEnv, csrf, saved.message, options.configDir === undefined ? null : effectivePrimary(process.env, options.configDir, loadBotToken(process.env, options.telegramTokenFile) !== null), null, null, null, {
                 ...store.permissionDefault(),
                 canManage: who.role === "approver",
             }));
@@ -2433,8 +2407,9 @@ ${modeWords(terms)
         store.setChatConfig({ provider, model: "default", dailyTurns: 50, weeklyCeilingMicrousd: 0, priceInMicrousd: 0, priceOutMicrousd: 0 }, who.name, now);
         return redirect(response, "/chat");
     }
-    /** Settings → Models, read from the saved catalog and the installation's role rows. */
-    function modelsView(canManage, csrf, now, said, problem) {
+    /** Settings → Models, read from the saved catalog and the role rows at the scope being edited (the installation,
+     * or one project and what it inherits). */
+    function modelsView(canManage, csrf, now, said, problem, query = new URLSearchParams()) {
         const runtimes = runtimeStates(store);
         const installed = new Set(runtimes.map(one => one.tool));
         const openrouter = (readProviderKey("openrouter", providerHome) ?? process.env["OPENROUTER_API_KEY"] ?? "") !== "";
@@ -2444,23 +2419,74 @@ ${modeWords(terms)
             { label: "Gemini", provider: "gemini", on: installed.has("gemini") },
             { label: "OpenRouter", provider: "openrouter", on: openrouter },
         ];
-        const build = store.phaseConfig(INSTALLATION_SCOPE, "build");
-        const roles = ["plan", "build", "review", "repair"].map(phase => {
-            const row = store.phaseConfig(INSTALLATION_SCOPE, phase);
-            const groups = makers.filter(one => one.on && !(phase === "review" && one.provider === "gemini") && !(phase === "repair" && build !== null && one.provider !== build.provider))
+        const projects = consoleProjects();
+        const asked = query.get("scope") ?? INSTALLATION_SCOPE;
+        const scope = asked !== INSTALLATION_SCOPE && projects.includes(asked) ? asked : INSTALLATION_SCOPE;
+        const repo = scope === INSTALLATION_SCOPE ? null : scope;
+        const said_ = (pair) => `${ASSISTANTS[pair.provider]?.name ?? pair.provider} · ${modelWords(store, pair.provider, pair.model)}`;
+        const build = resolvePhaseAgent(store, "build", repo, {});
+        const roles = SLOTS.map(slot => {
+            const own = rowAt(store, scope, slot);
+            const inherited = repo === null ? null : rowAt(store, INSTALLATION_SCOPE, slot);
+            const unset = repo !== null ? (inherited === null ? "Same as the installation (not set)" : `Same as the installation (${inherited.model ?? inherited.provider})`)
+                : slot.phase === "repair" ? "Same as the builder" : slot.phase === "review" ? "Same as the planner"
+                    : slot.tier === "light" ? "Not set: small tasks use the routine builder" : slot.tier === "strong" ? "Not set: uses the routine one" : "Not set";
+            const words = own !== null ? said_(own) : inherited !== null ? `Inherits the installation's: ${said_(inherited)}`
+                : slot.phase === "repair" ? "Follows the builder" : slot.phase === "review" ? "Follows the planner" : slot.tier !== "routine" ? "Uses the routine one" : "Not set";
+            const groups = makers.filter(one => one.on && !(slot.phase === "review" && one.provider === "gemini") && !(slot.phase === "repair" && build.ok && one.provider !== build.spec.provider))
                 .map(one => ({ label: one.label, provider: one.provider, options: modelOptions(store, one.provider, now, providerHome) }));
-            return {
-                phase, label: ROLE_TITLES[phase], groups, ...(phase === "repair" ? { inherit: true } : {}),
-                current: row === null ? (phase === "repair" ? "inherit" : "") : `${row.provider}|${row.model ?? ""}`,
-                words: row === null ? (phase === "repair" ? "Same as the builder" : "Not set") : `${ASSISTANTS[row.provider]?.name ?? row.provider} · ${modelWords(store, row.provider, row.model)}`,
-            };
+            return { key: slotKey(slot), label: slotWords(slot), current: own === null ? "" : `${own.provider}|${own.model ?? ""}`, words, unset, groups, tier: slot.tier !== "routine" };
         });
+        const inUse = presetInUse(store, scope);
+        const unchosen = repo === null && ALL_SLOTS.every(slot => rowAt(store, INSTALLATION_SCOPE, slot) === null);
+        const checked = checkScope(store, repo);
+        // A preset or a switch, previewed: the exact rows it moves, with what a change of provider brings along.
+        const pairWords = (pair, slot) => pair === null ? (repo !== null ? "same as the installation" : slot.phase === "repair" ? "same as the builder" : slot.phase === "review" ? "same as the planner" : slot.tier === "light" ? "routine builder" : slot.tier === "strong" ? "routine one" : "not set") : (pair.model ?? `${pair.provider} default`);
+        const switchFrom = query.get("switch"), switchTo = query.get("to");
+        const presetAsked = query.get("preset");
+        // The rows, what they inherit, and both digests come from one snapshot (model-choices.ts previewModelChange).
+        const previewOf = (title, change, hidden) => {
+            const snapshot = previewModelChange(store, scope, change);
+            const rows = snapshot.rows.map(row => {
+                const notes = [];
+                const was = row.before?.provider ?? row.inherited?.provider ?? null;
+                if (row.after !== null && was !== null && was !== row.after.provider && isProviderId(row.after.provider)) {
+                    const name = ASSISTANTS[row.after.provider].name;
+                    notes.push(`Billed the way ${name} is signed in on this computer.`);
+                    notes.push(MONEY_CAPABILITIES[row.after.provider].nativeDollarCapFlag === null ? `${name} can't hold a per-task dollar cap.` : `${name} can hold a per-task dollar cap.`);
+                    notes.push(`Builds reach ${name}'s hosts instead of ${ASSISTANTS[was]?.name ?? was}'s.`);
+                }
+                return { role: slotWords(row.slot), before: pairWords(row.before, row.slot), after: pairWords(row.after, row.slot), notes };
+            });
+            return { title, rows, hidden: { scope, digest: snapshot.state, change: snapshot.change, ...hidden } };
+        };
+        const preview = !canManage ? null
+            : isPresetName(presetAsked) ? previewOf(`Use ${PRESETS[presetAsked].label}`, presetChange(presetAsked), { preset: presetAsked })
+                : switchFrom !== null && switchTo !== null && exactModelId(switchFrom) && exactModelId(switchTo) ? previewOf(`Switch to ${switchTo}`, switchChange(store, scope, switchFrom, switchTo), { switch: switchFrom, to: switchTo })
+                    // A new installation with nothing chosen yet opens on the default, ready to apply.
+                    : unchosen ? previewOf(`Start with ${PRESETS[DEFAULT_PRESET].label}`, presetChange(DEFAULT_PRESET), { preset: DEFAULT_PRESET })
+                        : null;
         const chat = store.getChatConfig();
         const chatName = chat === null ? "" : chat.provider === "claude-subscription" ? "Claude membership" : chat.provider === "codex-subscription" ? "Codex membership" : chat.provider === "anthropic-api" ? "Anthropic API" : "OpenRouter";
+        const capital = (words) => `${words.charAt(0).toUpperCase()}${words.slice(1)}`;
+        const alsoSet = store.listPhaseTierAlternates(INSTALLATION_SCOPE).length + (repo === null ? 0 : store.listPhaseTierAlternates(repo).length) > 0;
         return {
             runtimes, watch: watchState(store), roles, csrf, canManage, said, problem,
             chat: chat === null ? null : { words: `Leads and chat use ${chatName} · ${modelWords(store, chat.provider, chat.model)}` },
             fresh: ["claude", "codex", "gemini"].flatMap(source => seenModels(store, source)).filter(model => isNewModel(model, now)).slice(0, 12),
+            scope: { value: scope, label: repo === null ? "All projects" : projectName(repo), digest: stateDigest(store, scope),
+                options: [{ value: INSTALLATION_SCOPE, label: "All projects" }, ...projects.map(one => ({ value: one, label: projectName(one) }))] },
+            inUse: unchosen ? "nothing chosen yet" : inUse === null ? null : PRESETS[inUse].label,
+            presets: ["sized", "opus"].map(name => ({ name, label: PRESETS[name].label, words: PRESETS[name].words, inUse: inUse === name, recommended: name === DEFAULT_PRESET })),
+            newer: newerModels(store, scope).map(one => ({ from: one.from, to: one.to.id, name: one.to.name, roles: one.slots.map(slotWords).join(", ").toLowerCase() })),
+            preview, unresolved: checked.kind === "ok" ? null : checked.kind === "incomplete" ? `some roles have no model yet. Choose them above, or use ${PRESETS[DEFAULT_PRESET].label}.` : browserWords(checked.problem),
+            sizing: { small: capital(SIZE_MEANS.small), routine: capital(SIZE_MEANS.medium), large: SIZE_MEANS.large, risky: RISKY_MEANS,
+                classifier: readProviderKey("openrouter", providerHome) !== null ? "A quick AI check (Jev, through your OpenRouter key) reads its title and description." : `A quick AI check (${SIZING_CLAUDE_MODEL}, on this computer's Claude sign-in) reads its title and description.` },
+            routing: `When a task is filed and Claude has used over ${HEADROOM_FIVE_HOUR_LIMIT}% of its 5-hour window or ${HEADROOM_WEEKLY_LIMIT}% of its week, ${alsoSet ? "the other provider you set for that size is preferred if it has more room" : "an alternate provider with more room would be preferred, but none is set"}; with no room anywhere, the first choice is kept. This is a preference at filing time, not a limit.`,
+            recent: recentRuns(store).map(one => ({ taskId: one.taskId, runId: one.runId, role: one.role,
+                chosen: one.chosen === null ? "its default" : /^(opus|sonnet|haiku|fable)$/.test(one.chosen) ? `floating ${one.chosen}` : one.chosen,
+                ranOn: one.ranOn ?? "not reported" })),
+            waiting: canManage ? store.scopesAwaitingApproval(null, 10, admissionList()).map(one => ({ taskId: one.taskId, title: one.title })) : [],
         };
     }
     /** Google's redirect back: the code becomes a saved refresh token, and a page sends the person back to Settings. */
@@ -2546,6 +2572,7 @@ ${modeWords(terms)
     }
     const registrations = handlersOf("settings", {
         "spend": spendPage,
+        "settings.spend": spendSettingsPage,
         "mode": modePage,
         "control": controlPage("setup"),
         "control.connection": controlPage("connection"),
@@ -2623,7 +2650,8 @@ ${modeWords(terms)
         "settings.models-check": modelsAct("check"),
         "settings.models-watch": modelsAct("watch"),
         "settings.models-update": modelsAct("update"),
-        "settings.models-agent": modelsAct("agent"),
+        "settings.models-agent": modelsSave,
+        "settings.models-apply": modelsApply,
         "settings.models-act": modelsAct("other"),
         "settings.knowledge-refresh": knowledgeRefresh,
         "settings.knowledge-proposal": knowledgeProposal,
@@ -2783,5 +2811,106 @@ ${modeWords(terms)
         const changed = setReleaseApproval(store, repo, true, who.name, now);
         return back("said", changed.changed ? "Releases approve themselves once CI and the release check pass." : "Saved.");
     }
+    // Settings → Spend: the monthly limits editor and the models in use. An instance operator's page; changing a limit
+    // posts to /spend/budget with a step-up.
+    async function spendSettingsPage(ctx) {
+        const { url, response, now } = ctx;
+        const current = monthOf(now);
+        const subagents = store.subagents([...new Set([...managedRepos(), ...store.knownRepos()])]);
+        const subagentNames = subagentNamesOf(store.handle);
+        const projects = consoleProjects();
+        const people = store.accountFacts().filter(one => one.revokedAt === null).map(one => one.name);
+        const models = ["plan", "build", "review"].map(phase => {
+            const agent = resolvePhaseAgent(store, phase, null, {});
+            return { role: phase === "plan" ? "Planner" : phase === "build" ? "Builder" : "Reviewer", model: agent.ok ? `${agent.spec.provider} · ${agent.spec.model ?? "its default model"}` : "Not set" };
+        });
+        const view = {
+            budgets: budgetStates(store.budgets(), spendItems(store.handle, current.from, current.to)), subagentNames, models,
+            targets: [
+                { value: "installation:*", label: "Everything", group: "Everything" },
+                ...projects.map(repo => ({ value: `project:${repo}`, label: projectName(repo), group: "Projects" })),
+                ...people.map(name => ({ value: `person:${name}`, label: name, group: "People" })),
+                ...subagents.map(one => ({ value: `subagent:${one.id}`, label: `${subagentNames.get(one.id) ?? one.handle} (${projectName(one.repo)})`, group: "Subagents" })),
+            ],
+        };
+        return sendScreen(response, 200, screen("Spend settings", spendSettingsHtml(view, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }), { chrome: chromeFor(null, "settings") }));
+    }
+    // Settings → Models (docs/plans/spend-dashboard.md, slice 3): the one editor. Both posts are an instance operator's,
+    // browser-only step-ups: the password (or a Passwordless session, or an identity-provider re-check) is proved here,
+    // and model-choices.ts re-proves the same session, credential generation and operator standing inside the one
+    // transaction that checks the form against what is stored, validates the result and writes and ledgers every row.
+    function modelsAuthority(who, method) {
+        const session = who.session;
+        return { actor: who.name, generation: session.generation, method, live: () => sessions.holds(session) && sessions.savedNow(session) && sessionWithinLifetime(session, Date.now()) };
+    }
+    function modelsBack(response, scope) {
+        return sayTo(response, `/settings/models${scope === INSTALLATION_SCOPE ? "" : `?scope=${encodeURIComponent(scope)}`}`);
+    }
+    function modelsSaid(result, what) {
+        if (!result.ok)
+            return { key: "problem", words: browserWords(result.problem) };
+        const count = result.diff.length;
+        const done = count === 0 ? "Nothing changed." : `${what}: ${count} change${count === 1 ? "" : "s"} saved for tasks filed from now on.`;
+        return { key: "said", words: result.unresolved === null ? done : `${done} Some roles have no model yet, so new tasks can't be filed here.` };
+    }
+    /** One save of the whole editor: every role at the scope, sets and clears, as one change. */
+    async function modelsSave(ctx) {
+        const { response, now, posted } = ctx;
+        const who = browserCaller(ctx.who);
+        const body = readForm(posted, CONSOLE_FORMS.modelsChange);
+        const scope = body.get("scope") ?? INSTALLATION_SCOPE;
+        const back = modelsBack(response, scope);
+        if (["scope", "password", "digest", ...SLOTS.map(slotKey)].some(field => body.sent.getAll(field).length > 1))
+            return back("problem", "That form was sent twice over. Nothing changed.");
+        const proved = authenticateApprover(who, body.get("password") ?? "");
+        if (!proved.ok)
+            return back("problem", "Enter your Toolroll password to change models.");
+        const change = [];
+        for (const slot of SLOTS) {
+            const value = body.sent.get(slotKey(slot));
+            if (value === null)
+                continue;
+            if (value === "clear") {
+                change.push({ slot, to: null });
+                continue;
+            }
+            const split = value.indexOf("|");
+            if (split < 1)
+                return back("problem", "Choose a model from the list. Nothing changed.");
+            change.push({ slot, to: { provider: value.slice(0, split), model: value.slice(split + 1) } });
+        }
+        // Repairs resume the builder's session: a builder moved to another provider takes repair with it.
+        const builder = change.find(one => one.slot.phase === "build" && one.slot.tier === "routine")?.to ?? null;
+        const repair = change.findIndex(one => one.slot.phase === "repair");
+        let follows = false;
+        if (builder !== null && repair >= 0 && change[repair].to !== null && change[repair].to.provider !== builder.provider) {
+            change[repair] = { slot: change[repair].slot, to: null };
+            follows = true;
+        }
+        const result = applyModelChoices(store, { scope, change, expected: { state: body.get("digest") ?? "" }, strict: true, knownProject: repo => consoleProjects().includes(repo) }, modelsAuthority(who, proved.method), now);
+        const said = modelsSaid(result, scope === INSTALLATION_SCOPE ? "All projects" : projectName(scope));
+        return back(said.key, follows && result.ok ? `${said.words} Repairs now follow the builder.` : said.words);
+    }
+    /** A preset or a switch, applied exactly as previewed: the change's own digest rides the form. */
+    async function modelsApply(ctx) {
+        const { response, now, posted } = ctx;
+        const who = browserCaller(ctx.who);
+        const body = readForm(posted, CONSOLE_FORMS.modelsChange);
+        const scope = body.get("scope") ?? INSTALLATION_SCOPE;
+        const back = modelsBack(response, scope);
+        if (["scope", "password", "digest", "preset", "switch", "to", "change"].some(field => body.sent.getAll(field).length > 1))
+            return back("problem", "That form was sent twice over. Nothing changed.");
+        const proved = authenticateApprover(who, body.get("password") ?? "");
+        if (!proved.ok)
+            return back("problem", "Enter your Toolroll password to change models.");
+        const preset = body.get("preset"), from = body.get("switch"), to = body.get("to");
+        const change = isPresetName(preset) ? presetChange(preset)
+            : from !== null && to !== null && exactModelId(from) && exactModelId(to) ? switchChange(store, scope, from, to) : null;
+        if (change === null)
+            return back("problem", "Choose a preset or a newer model. Nothing changed.");
+        const result = applyModelChoices(store, { scope, change, expected: { state: body.get("digest") ?? "", change: body.get("change") ?? "" }, strict: true, knownProject: repo => consoleProjects().includes(repo) }, modelsAuthority(who, proved.method), now);
+        const said = modelsSaid(result, isPresetName(preset) ? PRESETS[preset].label : `Switched to ${to}`);
+        return back(said.key, said.words);
+    }
     return { registrations, modelsView };
 }

package/dist/server/signup-gate.d.ts

@@ -0,0 +1,9 @@
+import type { IncomingMessage } from "node:http";
+export declare const SIGNUP_COOKIE = "so-signup";
+/** A fresh Set-Cookie value for the page that shows the form. */
+export declare function signupCookie(secure: string): string;
+/** Whether this post came from the console's own first-account page. */
+export declare function signupFromHere(request: IncomingMessage, allowedHost: (host: string | undefined) => boolean): boolean;
+/** The typed code against the printed one, in constant time over fixed-length digests: any input (empty, too long,
+ * non-ASCII) is an ordinary wrong code, never a throw. */
+export declare function setupCodeMatches(typed: string, printed: string): boolean;

package/dist/server/signup-gate.js

@@ -0,0 +1,40 @@
+/** The first-account form's same-site gate and setup-code comparison (Settings revamp S3, Codex round 1).
+ *
+ * The form is signed out, so it has no session CSRF token. Instead, the page that shows it sets a signed, HttpOnly,
+ * SameSite=Strict cookie scoped to /signup; a browser never sends it on a post from another site. A post must carry
+ * it, and its provenance must name this console: same-origin Fetch Metadata, or an Origin (or Referer) on an allowed
+ * host. Neither (`Origin: null`, nothing else) fails closed; the form's page is served `Referrer-Policy: same-origin`
+ * so its own post carries the real Origin. A refusal here never spends a setup-code try. */
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+export const SIGNUP_COOKIE = "so-signup";
+const SECRET = randomBytes(32);
+const NONCE = /^[A-Za-z0-9_-]{24}$/;
+const macOf = (nonce) => createHmac("sha256", SECRET).update(`signup:${nonce}`).digest();
+/** A fresh Set-Cookie value for the page that shows the form. */
+export function signupCookie(secure) {
+    const nonce = randomBytes(18).toString("base64url");
+    return `${SIGNUP_COOKIE}=${nonce}.${macOf(nonce).toString("base64url")}; HttpOnly; SameSite=Strict; Path=/signup${secure}`;
+}
+/** Whether this post came from the console's own first-account page. */
+export function signupFromHere(request, allowedHost) {
+    const site = request.headers["sec-fetch-site"];
+    if (site !== undefined && site !== "same-origin" && site !== "none")
+        return false;
+    const origin = request.headers.origin, referer = request.headers.referer;
+    const named = typeof origin === "string" && origin !== "null" ? origin : typeof referer === "string" ? referer : null;
+    if (named !== null && !allowedHost(named.replace(/^https?:\/\//, "").split("/")[0]))
+        return false;
+    if (site !== "same-origin" && named === null)
+        return false;
+    const held = new RegExp(`(?:^|;\\s*)${SIGNUP_COOKIE}=([^;.]*)\\.([^;]*)`).exec(request.headers.cookie ?? "");
+    if (held === null || !NONCE.test(held[1]))
+        return false;
+    const given = Buffer.from(held[2], "base64url"), wanted = macOf(held[1]);
+    return given.length === wanted.length && timingSafeEqual(given, wanted);
+}
+/** The typed code against the printed one, in constant time over fixed-length digests: any input (empty, too long,
+ * non-ASCII) is an ordinary wrong code, never a throw. */
+export function setupCodeMatches(typed, printed) {
+    const digest = (text) => createHash("sha256").update(text, "utf8").digest();
+    return typed !== "" && timingSafeEqual(digest(typed), digest(printed));
+}

package/dist/server/tasks.js

@@ -27,7 +27,8 @@ import { codingWorkspaceHtml, codingWorkspaceScript } from '../coding-ui.js';
 import { CodingActionError } from '../coding-workspace.js';
 import { checkResponse, CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
 import { hasForbiddenControls, validateNote } from "../decision.js";
-import { diagnoseTaskDispatch } from "../dispatch.js";
+import { builderReadyFor, diagnoseTaskDispatch, firstRunBuilderRepo } from "../dispatch.js";
+import { withBuilderStep } from "../first-run.js";
 import { evidencePack, evidencePackHtml } from "../evidence-pack.js";
 import { readVerifiedArtifact, readVerifiedReport, writeEvidenceFile } from "../evidence.js";
 import { computeGaps } from "../gaps.js";
@@ -175,7 +176,8 @@ export function createTasksHandlers(runtime) {
             })),
             cancelledBlockers: cancelled,
             gaps: project === null ? [] : computeGaps(store, project, now).filter(gap => gap.unblocks.length > 0).slice(0, 10),
-            wizard: firstRunStepsNow(now),
+            // The builder step speaks for the same project as Chat's (firstRunBuilderRepo), as dispatch decides.
+            wizard: withBuilderStep(firstRunStepsNow(now), builderReadyFor(store, firstRunBuilderRepo(store, project, visible, managedRepos()), now)),
             worker: (() => {
                 // The one fact the inbox must never hide (install review): with
                 // no worker answering, nothing here will ever build, and every
@@ -1020,6 +1022,8 @@ export function createTasksHandlers(runtime) {
         }
         let repo = effective;
         let admitted = unscopedMode ? null : admissionList() ?? [];
+        // What this filing is decided on: re-checked inside the write below, after every await (project-identity.ts).
+        const decidedOn = identities.generation();
         const rootMode = !unscopedMode && ceiling.roots.length > 0;
         if (rootMode && effective !== "") {
             // Resolved off the console's thread (project-identity.ts), then proved against the ceiling as that identity.
@@ -1052,6 +1056,10 @@ export function createTasksHandlers(runtime) {
         const after = (body.get("after") ?? "").trim();
         let chainProblem = null;
         const made = store.transact(() => {
+            // A project folder's identity changed while this request waited (a root or link now leads elsewhere): what was
+            // proved above may no longer hold, so nothing is filed on it.
+            if (identities.generation() !== decidedOn || (rootMode && repo !== "" && !visible(repo)))
+                return null;
             const filed = fileTaskProposal(store, {
                 ...(id === "" ? {} : { id }),
                 title,
@@ -1083,6 +1091,8 @@ export function createTasksHandlers(runtime) {
                 applyModeToNewFiling(store, filed.id, who.name, now);
             return filed;
         });
+        if (made === null)
+            return newTaskScreen(ctx, 409, "a project folder changed while this was being filed — check the project and send it again", draft);
         if (!made.ok) {
             return newTaskScreen(ctx, made.reason === "backlog-full" ? 429 : 400, made.message, { title, goal, not: notThis, touches: body.get("touches") ?? "", acceptance: body.get("acceptance") ?? "", values: body.sent });
         }