toolroll 0.9.83 → 0.9.85

package/dist/result-actions.js

@@ -1,13 +1,33 @@
+import { verifyResultImage } from "./chat-evidence.js";
 /** Shared result-to-revision action for the result form and chat.
  * The caller authenticates; this service checks project access and the exact
  * displayed note batch, then uses the existing atomic revision/approval boundary.
  */
 import { createHash, randomBytes } from "node:crypto";
 import { EVIDENCE_CAPS, readVerifiedArtifact, writeEvidenceFile } from "./evidence.js";
-import { isRevisionFeedback, parseRevisionBatch, revisionSourceOf, commentSourceKey, REQUEST_TOKEN } from "./result-review.js";
+import { parseFeedbackImage, sameFeedbackImage, isRevisionFeedback, parseRevisionBatch, revisionSourceOf, commentSourceKey, REQUEST_TOKEN } from "./result-review.js";
 import { validateNote, hasForbiddenControls } from "./decision.js";
 import { TASK_TEXT_LIMITS, validateTaskText } from "./task-text.js";
 import { modeFilingCoverage } from "./scope.js";
+/** Re-prove image custody and current result at each write. No file paths supplied by callers. */
+export function feedbackImageProblem(store, root, runId, image) {
+    if (image == null)
+        return null;
+    const parsed = parseFeedbackImage(image);
+    if (!parsed || image.run !== runId)
+        return "Choose a screenshot from this result. Your draft is unchanged.";
+    const run = store.getRun(runId);
+    const task = run === null ? null : store.externalIdFor(run.taskRef);
+    const repo = run === null ? null : store.refById(run.taskRef)?.repo;
+    if (!task || !repo)
+        return "This screenshot is no longer available. Your draft is unchanged.";
+    const family = store.taskFamilyOf(task, [repo], false);
+    const latest = store.runsFor(run.taskRef).find(one => ["builder", "repair", "scout"].includes(one.role) && one.outcome !== null);
+    if (family?.problem !== null || family.current.id !== task || latest?.id !== runId)
+        return "A newer result is current. Open it before commenting on a screenshot. Your draft is unchanged.";
+    const verified = verifyResultImage(store, root, [repo], { taskId: task, ...image });
+    return verified.ok ? null : "This screenshot is unavailable or changed. Restore it or remove it from your feedback. Your draft is unchanged.";
+}
 /** One user action: add the typed change and seal exactly the displayed
  * saved notes. A refusal rolls back the note; a replay returns the same task. */
 export function requestResultChanges(store, evidenceRoot, input, now) {
@@ -15,8 +35,8 @@ export function requestResultChanges(store, evidenceRoot, input, now) {
         return store.transact(() => store.savepoint(() => {
             const fail = (status, message) => { throw new ChangeRequestRefusal(status, message); };
             if (!input.note.trim()) {
-                if (input.path.trim() || input.line.trim())
-                    return fail(400, "Describe the change before attaching a file or line.");
+                if (input.path.trim() || input.line.trim() || input.image != null)
+                    return fail(400, "Describe the change before attaching an image, file or line.");
                 if (!input.batch)
                     return fail(400, "Describe a change or use a saved note.");
                 return createResultRevision(store, evidenceRoot, input, now);
@@ -43,13 +63,19 @@ export function requestResultChanges(store, evidenceRoot, input, now) {
             if (!artifact || !readVerifiedArtifact(evidenceRoot, artifact).ok)
                 return fail(409, "The saved changes could not be verified. Restore the result before requesting changes.");
             const sourceKey = commentSourceKey(input.actor, input.request);
-            let noteId = store.addDiffComment({ artifactId: artifact.id, runId: run.id, path, line, note: valid.note, author: input.actor, sourceKey }, now);
-            if (noteId === null) {
-                const earlier = store.diffCommentBySourceKey(sourceKey);
-                if (!earlier || earlier.run !== run.id || earlier.path !== path || earlier.line !== line || earlier.note !== valid.note)
-                    return fail(409, "This submission already saved different feedback. Reopen the result and try again.");
-                noteId = earlier.id;
+            const earlier = store.diffCommentBySourceKey(sourceKey);
+            if (earlier && (earlier.run !== run.id || earlier.path !== path || earlier.line !== line || earlier.note !== valid.note || !sameFeedbackImage(earlier.image, input.image)))
+                return fail(409, "This submission already saved different feedback. Reopen the result and try again.");
+            // An exact consumed replay only returns its existing revision. Every new
+            // use proves the image before insertion, so malformed targets refuse cleanly.
+            if (earlier?.consumedBy == null) {
+                const problem = feedbackImageProblem(store, evidenceRoot, run.id, input.image);
+                if (problem !== null)
+                    return fail(409, problem);
             }
+            const noteId = earlier?.id ?? store.addDiffComment({ artifactId: artifact.id, runId: run.id, path, line, note: valid.note, author: input.actor, sourceKey, image: input.image ?? null }, now);
+            if (noteId === null)
+                return fail(409, "This feedback changed while saving. Your draft is unchanged; reopen the result.");
             const result = createResultRevision(store, evidenceRoot, { ...input, batch: [...new Set([...batch, noteId])].sort((a, b) => a - b).join(",") }, now);
             if (!result.ok)
                 return fail(result.status, result.message);
@@ -141,6 +167,11 @@ export function createResultRevision(store, evidenceRoot, input, now) {
         }
         if (batch.some(one => !isRevisionFeedback(one)))
             return fail(409, "Review observations are not requested changes. Use Request change to add your feedback first.");
+        for (const one of batch) {
+            const problem = feedbackImageProblem(store, evidenceRoot, id, one.image);
+            if (problem !== null)
+                return fail(409, problem);
+        }
         const comments = batch;
         // Keep the subject recognizable, including when revising a revision.
         // Reserve the suffix before truncating, at whole grapheme boundaries.
@@ -180,6 +211,7 @@ export function createResultRevision(store, evidenceRoot, input, now) {
                 note: one.note,
                 author: one.author,
                 createdAt: one.createdAt,
+                ...(one.image == null ? {} : { image: one.image }),
             })),
         };
         const briefBytes = Buffer.from(JSON.stringify(brief, null, 2), "utf8");

package/dist/result-review.d.ts

@@ -19,6 +19,14 @@
  * selected tab, and the reading position in this tab's sessionStorage,
  * keyed by the server-named account, the task, and the run. */
 import { type ResultFacts, type PublicationFacts, type DisplayStatus } from "./workspace-ui.js";
+/** Optional context for feedback. The sealed diff remains the revision authority. */
+export type FeedbackImage = {
+    run: number;
+    artifact: number;
+    sha256: string;
+};
+export declare function parseFeedbackImage(value: unknown): FeedbackImage | null | false;
+export declare function sameFeedbackImage(a: FeedbackImage | null | undefined, b: FeedbackImage | null | undefined): boolean;
 /** Add re-read evidence health to the existing result/review projection.
  * This is presentation only: the recorded verdict and acceptance stay intact. */
 export declare function evidenceResultStatusOf(result: ResultFacts, publication: PublicationFacts, evidence: EvidenceHealth): DisplayStatus;
@@ -49,6 +57,7 @@ export type ResultScreenshot = {
     path: string;
     caption: string;
     artifactId: number;
+    sha256?: string;
     problem: string | null;
 };
 export type ResultEvidenceInput = {

package/dist/result-review.js

@@ -19,6 +19,26 @@
  * selected tab, and the reading position in this tab's sessionStorage,
  * keyed by the server-named account, the task, and the run. */
 import { resultStatusOf } from "./workspace-ui.js";
+export function parseFeedbackImage(value) {
+    if (value === undefined || value === null || value === "")
+        return null;
+    try {
+        const image = typeof value === "string" ? JSON.parse(value) : value;
+        if (image === null || typeof image !== "object" || Array.isArray(image)
+            || !Number.isSafeInteger(image.run) || image.run < 1
+            || !Number.isSafeInteger(image.artifact) || image.artifact < 1
+            || typeof image.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(image.sha256)
+            || Object.keys(image).some(key => !["run", "artifact", "sha256"].includes(key)))
+            return false;
+        return { run: image.run, artifact: image.artifact, sha256: image.sha256 };
+    }
+    catch {
+        return false;
+    }
+}
+export function sameFeedbackImage(a, b) {
+    return (a == null && b == null) || (a != null && b != null && a.run === b.run && a.artifact === b.artifact && a.sha256 === b.sha256);
+}
 /** Add re-read evidence health to the existing result/review projection.
  * This is presentation only: the recorded verdict and acceptance stay intact. */
 export function evidenceResultStatusOf(result, publication, evidence) {
@@ -155,6 +175,8 @@ export function resultFactsFromHtml(html) {
  * page. Matched exactly — never a bare open redirect. */
 export function resultReturnTarget(raw, runId, tasks = []) {
     if (raw !== null && raw !== undefined) {
+        if (raw === `/r/${runId}?record=1`)
+            return raw;
         const review = /^\/review\?result=[A-Za-z0-9._~%-]{1,200}(?:&run=([0-9]{1,15}))?(?:&tab=(?:summary|changes|checks))?$/.exec(raw);
         if (review !== null && (review[1] === undefined || Number(review[1]) === runId))
             return raw;
@@ -299,6 +321,22 @@ export const RESULT_REVIEW_SCRIPT = String.raw `
   document.addEventListener('click',function(ev){var link=ev.target&&ev.target.closest?ev.target.closest('a[href="#request-changes"]'):null;if(link)openForm();});
   if(form){
     var noteBox=form.querySelector('[name=note]'),pathBox=form.querySelector('[name=path]'),lineBox=form.querySelector('[name=line]'),pin=form.querySelector('details.result-pin');
+    var imageBox=form.querySelector('[name=image]'),imagePreview=form.querySelector('[data-feedback-image]');
+    function showImage(){
+      if(!imageBox||!imagePreview)return;
+      imagePreview.hidden=!imageBox.value;
+      var img=imagePreview.querySelector('img'),caption=imagePreview.querySelector('figcaption'),selected=null;
+      document.querySelectorAll('[data-comment-image]').forEach(function(button){if(button.getAttribute('data-comment-image')===imageBox.value)selected=button;});
+      img.hidden=!selected;
+      if(selected){var identity=JSON.parse(imageBox.value);img.src='/r/'+identity.run+'/evidence/'+identity.artifact;img.alt=selected.getAttribute('data-image-caption');caption.textContent=img.alt+' · Screenshot '+identity.artifact;}
+      else{img.removeAttribute('src');caption.textContent='This screenshot is unavailable. Restore it or remove it from your feedback.';}
+    }
+    document.addEventListener('click',function(event){
+      var button=event.target&&event.target.closest?event.target.closest('[data-comment-image],[data-remove-image]'):null;
+      if(!button||!imageBox)return;
+      event.preventDefault();imageBox.value=button.getAttribute('data-comment-image')||'';showImage();openForm();save();
+      if(noteBox){noteBox.dispatchEvent(new Event('input',{bubbles:true}));noteBox.scrollIntoView({block:'center',behavior:'instant'});noteBox.focus();}
+    });
     var limit=document.getElementById('comment-note-limit'),requestBox=form.querySelector('[name=request]');
     function updateActions(){
       var typed=!!(noteBox&&noteBox.value.trim()),batch=form.querySelector('[name=batch]');
@@ -333,7 +371,7 @@ export const RESULT_REVIEW_SCRIPT = String.raw `
     // A fresh request identity: 16 random bytes as hex, the server's own shape.
     function mint(){var bytes=new Uint8Array(16);try{crypto.getRandomValues(bytes);}catch(e){for(var i=0;i<16;i++)bytes[i]=Math.floor(Math.random()*256);}
       var hex='';for(var j=0;j<16;j++)hex+=(bytes[j]<16?'0':'')+bytes[j].toString(16);return hex;}
-    function payload(){return JSON.stringify([noteBox?noteBox.value:'',pathBox?pathBox.value:'',lineBox?lineBox.value:'']);}
+    function payload(){return JSON.stringify([noteBox?noteBox.value:'',pathBox?pathBox.value:'',lineBox?lineBox.value:'',imageBox?imageBox.value:'']);}
     // What the current token was last submitted with; null = never sent.
     var sent=null,bound=null;
     // The server refused this token for a different note or another result:
@@ -347,7 +385,7 @@ export const RESULT_REVIEW_SCRIPT = String.raw `
       var focusNote=function(){setTimeout(function(){noteBox.focus({preventScroll:true});},0);};
       if(document.readyState==='complete')focusNote();else window.addEventListener('load',focusNote);
     }
-    if(saved&&typeof saved.note==='string'&&saved.note.length<=2000){
+    if(saved&&typeof saved.note==='string'&&saved.note.length<=(noteBox?noteBox.maxLength:4000)){
       if(noteBox&&!noteBox.value)noteBox.value=saved.note;
       if(saved.note)openForm();
       if(pathBox&&!pathBox.value&&typeof saved.path==='string')pathBox.value=saved.path;
@@ -355,7 +393,9 @@ export const RESULT_REVIEW_SCRIPT = String.raw `
       if(pin&&(pathBox&&pathBox.value||lineBox&&lineBox.value))pin.open=true;
       if(typeof saved.request==='string'&&/^[a-f0-9]{32}$/.test(saved.request)&&requestBox)requestBox.value=saved.request;
       if(typeof saved.sent==='string')sent=saved.sent;
-      bound=JSON.stringify([saved.note,saved.path||'',saved.line||'']);
+      if(imageBox&&typeof saved.image==='string'&&saved.image.length<250)imageBox.value=saved.image;
+      showImage();
+      bound=JSON.stringify([saved.note,saved.path||'',saved.line||'',saved.image||'']);
       if(noteBox)noteBox.dispatchEvent(new Event('input'));
     }
     function save(){
@@ -365,8 +405,8 @@ export const RESULT_REVIEW_SCRIPT = String.raw `
       var current=payload();
       if((bound!==null&&current!==bound)||(sent!==null&&current!==sent)){sent=null;if(requestBox)requestBox.value=mint();}
       bound=current;
-      if(!note&&!path&&!line){write(draftKey,null);return;}
-      write(draftKey,{note:note,path:path,line:line,request:requestBox?requestBox.value:'',sent:sent,at:Date.now()});
+      if(!note&&!path&&!line&&!(imageBox&&imageBox.value)){write(draftKey,null);return;}
+      write(draftKey,{note:note,path:path,line:line,image:imageBox?imageBox.value:'',request:requestBox?requestBox.value:'',sent:sent,at:Date.now()});
       if(!storage&&limit)limit.textContent='Draft stays on this page only. Browser storage is unavailable.';
     }
     form.addEventListener('input',save);

package/dist/serve.js

@@ -146,6 +146,7 @@ import { createChatHandlers } from './server/chat.js';
 import { createLiveHandlers } from './server/live.js';
 import { createTerminalHandlers, terminalHostFor } from './server/terminals.js';
 import { passwordlessOn } from './passwordless.js';
+import { keepTypedFields, openProjectFor, settingsCrumbs } from './settings-kit.js';
 import { createSweepHandlers } from './server/sweeps.js';
 import { createFlowsHandlers } from './server/flows.js';
 import { createPagesHandlers } from './server/pages.js';
@@ -200,7 +201,7 @@ export function createDecisionServer(options) {
         get managedRepos() { return managedRepos; },
         get ceiling() { return ceiling; },
         get allowedHost() { return allowedHost; },
-        get defaultProject() { return defaultProject; },
+        get defaultProject() { return defaultProject(); },
         get actionTarget() { return actionTarget; },
         get team() { return team; },
         get joinSourceOf() { return joinSourceOf; },
@@ -453,15 +454,14 @@ export function createDecisionServer(options) {
     };
     let joinGlobal = { tokens: 30, refilledAt: Date.now() };
     const approvalNonces = new Map();
-    // Resolve startup authority once. Missing paths remain restrictive.
-    // Native additions come only from the controller after its admission checks.
-    const { ceiling: startCeiling, unresolved: unresolvedRepos } = resolveCeiling([...(options.repo === undefined ? [] : [options.repo]), ...(options.repos ?? [])], options.projectRoots ?? [], options.identities === undefined ? undefined : identities.known);
-    const ceiling = { ...startCeiling, canon: identities.strict };
-    /** The project every fresh session opens with: the sole configured repo, else none. */
-    const defaultProject = ceiling.repos.length === 1 && ceiling.roots.length === 0 ? ceiling.repos[0] : null;
+    // Startup authority: the configured repos and roots as their identities say (startupCeiling). Missing or unresolved
+    // paths remain restrictive. Native additions come only from the controller after its admission checks.
+    const { ceiling, unresolved: unresolvedRepos, defaultProject, configured, configuredPaths } = startupCeiling([...(options.repo === undefined ? [] : [options.repo]), ...(options.repos ?? [])], options.projectRoots ?? [], options.identities === undefined ? undefined : identities, identities.strict);
     /** No ceiling configured at all: the legacy trust-everything mode, named. */
     // An `up` console (it is handed its admitted set) is never unscoped: with every saved project away it is empty.
-    const unscopedMode = ceiling.repos.length === 0 && ceiling.roots.length === 0 && options.admittedRepos === undefined;
+    // Judged by what was configured, never by what has resolved so far: a console whose folders haven't answered yet is
+    // scoped and empty, not unscoped.
+    const unscopedMode = !configured && options.admittedRepos === undefined;
     /** Per-row visibility under the ceiling — the authorization question for reads. */
     /** The exact repositories this console serves now: `up`'s live admitted set when it supplies one, else startup's. */
     const exactRepos = () => options.admittedRepos?.() ?? ceiling.repos;
@@ -889,6 +889,7 @@ export function createDecisionServer(options) {
             browser: who.via === 'cookie',
             // Passwordless (read once for rendering; every act proves it again at the act): ceremony fields render as nothing.
             passwordless: who.via === 'cookie' && passwordlessOn(store),
+            openProject: who.via === 'cookie' ? who.session.project : null,
             // v100: signed in with the identity provider: its label, and whether it checked them recently enough to stand in for a password.
             // Cockpit B2: "fresh" is an explicit re-check made on request and not yet spent (read live; one step-up uses it).
             sso: who.via === 'cookie' && who.session.sso !== undefined ? { label: ssoSettings()?.label ?? "your identity provider",
@@ -1327,8 +1328,8 @@ export function createDecisionServer(options) {
             return { ok: false, code: "demo", why: "this is a demo database — chat cannot contact an external model" };
         if (unscopedMode)
             return { ok: false, code: "unscoped", why: "chat needs at least one added project" };
-        if (options.currentRepos === undefined && unresolvedRepos.length > 0) {
-            return { ok: false, code: "unresolved", why: "a configured project path did not resolve at startup — fix it and restart before chat will run" };
+        if (options.currentRepos === undefined && unresolvedRepos().length > 0) {
+            return { ok: false, code: "unresolved", why: "a configured project folder hasn't been found yet — chat runs once it answers; if its path is wrong, fix it and restart" };
         }
         if (managedRepos().length === 0)
             return { ok: false, code: "empty", why: "add a project first — chat will include it automatically" };
@@ -1483,13 +1484,20 @@ export function createDecisionServer(options) {
         const ssoFacts = requestContext.getStore()?.sso;
         if (ssoFacts !== undefined) {
             const back = requestContext.getStore()?.returnTo ?? "/";
-            s = { ...s, body: ssoStepUps(s.body, ssoFacts, back), ...(s.workspace?.pageHtml == null ? {} : { workspace: { ...s.workspace, pageHtml: ssoStepUps(s.workspace.pageHtml, ssoFacts, back) } }) };
+            // A typed-only proof (settings-kit.ts) stays a password field: its handler takes nothing else.
+            s = { ...s, body: keepTypedFields(s.body, ssoStepUps, ssoFacts, back), ...(s.workspace?.pageHtml == null ? {} : { workspace: { ...s.workspace, pageHtml: keepTypedFields(s.workspace.pageHtml, ssoStepUps, ssoFacts, back) } }) };
             if (s.workspace?.view?.kind === "flow")
                 s = { ...s, workspace: { ...s.workspace, view: { ...s.workspace.view, stepUp: { label: ssoFacts.label, fresh: ssoFacts.fresh, confirmHref: `/login/sso?reauth=1&return=${encodeURIComponent(back)}` } } } };
         }
         // D5: team chat (the central team service) is deprecated; /chat?team=1 still opens this release, but nothing links to it.
         const sensitive = authored || s.forceSensitive === true;
         const requestFacts = requestContext.getStore();
+        // The settings frame (settings-kit.ts): its breadcrumb, for the shell and the workspace alike.
+        if (s.chrome !== undefined && s.chrome.crumbs === undefined) {
+            const crumbs = settingsCrumbs(new URL(requestFacts?.returnTo ?? '/', 'http://standing-orders.local').pathname, s.title, htmlString(s.body));
+            if (crumbs !== undefined)
+                s = { ...s, chrome: { ...s.chrome, crumbs } };
+        }
         if (requestFacts?.browser && s.chrome && !s.forceSensitive && (requestFacts.workspaceRead || browserAssetsAvailable())) {
             const path = new URL(requestFacts.returnTo, 'http://standing-orders.local');
             path.searchParams.delete('format');
@@ -1564,6 +1572,10 @@ export function createDecisionServer(options) {
             const request = requestFacts.workspaceRequest;
             const workspace = {
                 version: 1, path: currentPath, title: s.title, user: requestFacts.actor ?? '', csrf: requestFacts.csrf, sensitive,
+                // The project picker names the open project; the settings frame carries its breadcrumb.
+                // Only a project this person may see now: never the raw saved path (settings-kit.ts openProjectFor).
+                openProject: openProjectFor(requestFacts.openProject ?? null, s.chrome.project, s.chrome.projects ?? []),
+                ...(s.chrome.crumbs === undefined ? {} : { crumbs: s.chrome.crumbs }),
                 ...(requestFacts.passwordless === true ? { passwordless: true } : {}),
                 ...(requestFacts.actor ? { leadName: leadNameOf(store, requestFacts.actor) } : {}),
                 refreshUrl: path.pathname + path.search,
@@ -1966,7 +1978,7 @@ export function createDecisionServer(options) {
                             waits.push(connectionCheck(provider).catch(() => undefined));
                     }
                     // Project identities, resolved off the thread: what pages asked about, and answers gone stale.
-                    waits.push(identities.refresh([...exactRepos(), ...(options.currentRepos?.() ?? []), ...store.listProjects().map(one => one.path), ...store.knownRepos(), ...ceiling.roots]));
+                    waits.push(identities.refresh([...configuredPaths, ...exactRepos(), ...(options.currentRepos?.() ?? []), ...store.listProjects().map(one => one.path), ...store.knownRepos()]));
                     integrations.refreshIfDue();
                     const sso = ssoSettings();
                     if (sso !== null && (ssoProvider === null || ssoProvider.issuer !== sso.issuer || Date.now() - ssoProvider.at >= 10 * 60_000))
@@ -2204,7 +2216,7 @@ export function createDecisionServer(options) {
         get providerFor() { return providerFor; },
         get providerKnown() { return providerKnown; },
         get connectVisits() { return connectVisits; },
-        get defaultProject() { return defaultProject; },
+        get defaultProject() { return defaultProject(); },
         get googleVisits() { return googleVisits; },
         get setupAttemptsLeft() { return setupAttemptsLeft; },
         set setupAttemptsLeft(value) { setupAttemptsLeft = value; },
@@ -2324,3 +2336,38 @@ export { diffFileAnchor, editorFileHref, needActionOf, orderChangedFiles, plainC
 export { settingsGroups, settingsTiles } from "./server/render-settings.js";
 export { decisionAnswerScript, earlierVersionsWords, revisionLineageWords } from "./server/render-tasks.js";
 export { SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH } from "./server/session.js";
+/**
+ * The console's configured repos and roots. Without identities (embedders and tests) they resolve once, synchronously,
+ * as before. With them, the console resolves them in the background after it listens (operate.ts startConsole), so
+ * each is read from the last answer: a configured path counts by its real path from the moment its folder answers,
+ * and until then only by its spelling, which the strict `canon` never matches for an unresolved row.
+ */
+function startupCeiling(repos, roots, identities, canon) {
+    const configured = repos.length > 0 || roots.length > 0;
+    const configuredPaths = [...repos, ...roots];
+    if (identities === undefined) {
+        const once = resolveCeiling(repos, roots);
+        return {
+            ceiling: { ...once.ceiling, canon },
+            unresolved: () => once.unresolved,
+            defaultProject: () => once.ceiling.repos.length === 1 && once.ceiling.roots.length === 0 ? once.ceiling.repos[0] : null,
+            configured,
+            configuredPaths,
+        };
+    }
+    // Only resolved entries authorize: an unresolved configured path is in no list, so it matches nothing (not even its
+    // own spelling) and is no session's default until its folder answers.
+    const resolved = (paths) => [...new Set(paths.flatMap(path => { const real = identities.known(path); return typeof real === "string" ? [real] : []; }))];
+    const ceiling = {
+        get repos() { return resolved(repos); },
+        get roots() { return resolved(roots); },
+        canon,
+    };
+    return {
+        ceiling,
+        unresolved: () => [...repos, ...roots].filter(path => typeof identities.known(path) !== "string"),
+        defaultProject: () => repos.length === 1 && roots.length === 0 ? resolved(repos)[0] ?? null : null,
+        configured,
+        configuredPaths,
+    };
+}

package/dist/server/chat.js

@@ -12,10 +12,10 @@ import { CHAT_ACTIONS, mintSharedActionReview, sharedActionPayload, sharedAction
 import { CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
 import { buildDataDocument, composeRequest, isSubscriptionChatProvider, parseAssistantEnvelope, performChatRequest, plausibleChatKey, priceOf, settleForPrice, TURN_WALL_CLOCK_MS, worstCaseForPrice } from "../converse.js";
 import { DEMO_CHAT_SCRIPT, demoChatHtml, demoThreadHtml } from "../demo-chat.js";
-import { withDispatchDiagnoses } from "../dispatch.js";
+import { builderReadyFor, firstRunBuilderRepo, withDispatchDiagnoses } from "../dispatch.js";
 import { readVerifiedArtifact, scanForSecrets } from "../evidence.js";
 import { run as execRun } from "../exec.js";
-import { findFirstTasks, firstTaskSuggestions, HOW_IT_WORKS, SANDBOX_COMMAND } from "../first-run.js";
+import { findFirstTasks, firstTaskSuggestions, HOW_IT_WORKS, SANDBOX_COMMAND, withBuilderStep } from "../first-run.js";
 import { leadBriefHtml } from '../lead-context.js';
 import { configureLeadFollow, leadFollowStatus } from '../lead-follow.js';
 import { leadActivity } from "../lead-voice.js";
@@ -1158,11 +1158,12 @@ export function createChatHandlers(runtime) {
     }
     /** Chat's first run: the steps, first tasks until the first task exists, and the sandbox while no agent is signed in. */
     function chatFirstRun(now, project) {
-        const steps = firstRunStepsNow(now);
+        const repo = project ?? managedRepos()[0] ?? null;
+        // Done only when a task in this project could start: a live builder bound to it, as dispatch decides.
+        const steps = withBuilderStep(firstRunStepsNow(now), builderReadyFor(store, firstRunBuilderRepo(store, project, visible, managedRepos()), now));
         if (steps === null)
             return undefined;
         const taskFiled = steps.find(one => one.key === "task")?.done ?? true;
-        const repo = project ?? managedRepos()[0] ?? null;
         const agent = steps.find(one => one.key === "agent");
         const lead = leadWords();
         return {

package/dist/server/chrome.d.ts

@@ -1,4 +1,5 @@
 import { type BrowserSignIn, type BrowserUpdateNotice, type BrowserWorkspace } from "../browser-workspace.js";
+import { type Crumb } from "../settings-kit.js";
 import { type Decision, type Run } from "../store.js";
 import { type tally } from "../summary.js";
 import { type ServerResponse } from "node:http";
@@ -115,6 +116,8 @@ export type Chrome = {
     csrf?: string;
     /** Where a switch made on this screen returns to. */
     returnTo?: string;
+    /** The settings frame's breadcrumb ("Settings / <page>", settings-kit.ts), set by sendScreen; absent elsewhere. */
+    crumbs?: Crumb[];
 };
 /**
  * A server-rendered region that stays current: when the page's live stream

package/dist/server/chrome.js

@@ -33,6 +33,7 @@ import { PULL_REQUEST_SETTINGS_CSS } from "../pull-request-ui.js";
 import { RECIPE_CSS } from "../recipe-ui.js";
 import { REQUEST_LIMITS_CSS } from "../request-budget-ui.js";
 import { RETENTION_CSS } from "../retention-ui.js";
+import { crumbsHtml, SETTINGS_KIT_CSS } from "../settings-kit.js";
 import { SKILLS_CSS } from "../skills-ui.js";
 import { SPEND_CSS } from "../spend-ui.js";
 import { SSO_CSS } from "../sso-ui.js";
@@ -148,7 +149,7 @@ export const INBOX_TABS_CSS = '.inbox-tabs{display:inline-flex;gap:2px;max-width
     '.inbox-ask{margin:18px 0 0}.inbox-ask>h2{display:flex;align-items:baseline;gap:8px;margin:0 0 4px;font-size:15px;font-weight:600}.inbox-ask>h2 .count{font:500 12px var(--so-mono,ui-monospace,monospace);font-variant-numeric:tabular-nums;color:var(--so-muted)}.inbox-ask h3{font-size:13px;font-weight:600;margin:12px 0 4px}' +
     '.inbox-unread{display:none;position:absolute;top:4px;right:3px;width:6px;height:6px;border-radius:50%;background:var(--so-signal)}' +
     '@media (max-width:760px){.inbox-tabs{display:flex;width:100%}.inbox-tabs a{flex:1;justify-content:center;min-height:44px;padding:0 6px}.inbox-unread{display:block}}';
-export const WORKSPACE_STYLE = styleAsset(STYLE + BRAND_MARK_CSS + INBOX_TABS_CSS + APPROVAL_RULES_CSS + SPEND_CSS + RETENTION_CSS + STORAGE_CSS + UPDATES_CSS + LIMITS_CSS + MONITORING_CSS + INTEGRATIONS_CSS + BACKUP_CSS + EXPORT_CSS + PROJECT_DELETE_CSS + POLICY_CSS + EVIDENCE_PACK_CSS + THEME_CONTROLS_CSS + CODING_CSS + CODING_SHIPPING_CSS + RECIPE_CSS + SKILLS_CSS + TOOLS_CSS + FLOWS_CSS + SUBAGENT_CSS + KITS_CSS + STARTERS_CSS + GALLERY_CSS + SSO_CSS + CREDENTIALS_CSS + REQUEST_LIMITS_CSS + PEOPLE_AUDIT_CSS + KNOWLEDGE_CSS + MODELS_CSS + CHAT_POLISH_CSS + TRANSITIONS_CSS + WORKSPACE_MOTION_CSS + ASSIGNMENT_CSS + TASK_STATUS_CSS + LEAD_CONTEXT_CSS + PULL_REQUEST_SETTINGS_CSS + CHECK_SETTINGS_CSS + DISCLOSURE_CSS + '.learning{min-width:0;overflow-wrap:anywhere}.learning .card{min-width:0}.learning code,.learning blockquote,.learning pre{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word}.learning button,.learning summary,.learning .button-link{min-height:44px}.learning button{white-space:nowrap}.learning summary{padding:12px 0;cursor:pointer}.learning form{margin:12px 0}.learning select{max-width:100%}.learning blockquote{margin:8px 0}.learning ul{padding-left:20px}');
+export const WORKSPACE_STYLE = styleAsset(STYLE + BRAND_MARK_CSS + INBOX_TABS_CSS + APPROVAL_RULES_CSS + SPEND_CSS + RETENTION_CSS + STORAGE_CSS + UPDATES_CSS + LIMITS_CSS + MONITORING_CSS + INTEGRATIONS_CSS + BACKUP_CSS + EXPORT_CSS + PROJECT_DELETE_CSS + POLICY_CSS + EVIDENCE_PACK_CSS + THEME_CONTROLS_CSS + CODING_CSS + CODING_SHIPPING_CSS + RECIPE_CSS + SKILLS_CSS + TOOLS_CSS + FLOWS_CSS + SUBAGENT_CSS + KITS_CSS + STARTERS_CSS + GALLERY_CSS + SSO_CSS + CREDENTIALS_CSS + REQUEST_LIMITS_CSS + PEOPLE_AUDIT_CSS + KNOWLEDGE_CSS + MODELS_CSS + CHAT_POLISH_CSS + TRANSITIONS_CSS + WORKSPACE_MOTION_CSS + ASSIGNMENT_CSS + TASK_STATUS_CSS + LEAD_CONTEXT_CSS + PULL_REQUEST_SETTINGS_CSS + CHECK_SETTINGS_CSS + DISCLOSURE_CSS + SETTINGS_KIT_CSS + '.learning{min-width:0;overflow-wrap:anywhere}.learning .card{min-width:0}.learning code,.learning blockquote,.learning pre{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word}.learning button,.learning summary,.learning .button-link{min-height:44px}.learning button{white-space:nowrap}.learning summary{padding:12px 0;cursor:pointer}.learning form{margin:12px 0}.learning select{max-width:100%}.learning blockquote{margin:8px 0}.learning ul{padding-left:20px}');
 /**
  * A server-rendered region that stays current: when the page's live stream
  * says something changed (GET /live, live-bus.ts), fetch this page's own
@@ -579,8 +580,10 @@ ${update === undefined ? "" : html `<div class="banner update-banner" data-updat
 ${postForm(update.dismissHref, html `<button type="submit">Dismiss</button>`, { attrs: { class: "inline" }, hidden: { version: update.version } })}</div>`}`;
     // The scope bar sits between the banners and the main/split body, so it
     // can never disappear with a responsive pane (portfolio arc §1).
+    // The settings frame's breadcrumb sits above the page's own h1 (its only h1).
+    const crumbs = chrome.crumbs === undefined ? "" : crumbsHtml(chrome.crumbs);
     const content = chrome.listPane === undefined
-        ? html `<div class="content">${demoBanner}${scopeBar}<main>${main}</main></div>`
+        ? html `<div class="content">${demoBanner}${scopeBar}${crumbs}<main>${main}</main></div>`
         : html `<div class="content">${demoBanner}${scopeBar}<div class="split">\
 <div class="list-pane">${chrome.listPane}</div>\
 <div class="detail"><main>${main}</main></div>\

package/dist/server/console.css

@@ -265,12 +265,15 @@
   .project-card .project-name:focus-visible { outline: 2px solid var(--ring); outline-offset: 2px; border-radius: .375rem; }
 
   label { display: block; font-size: 0.8125rem; font-weight: 500; margin: .75rem 0 0; color: var(--foreground); }
-  input[type=text], input[type=password], input[type=number], input[type=url], input[type=email], input[type=search], input[type=time], textarea, select {
-    width: 100%; margin: .35rem 0 0; padding: .45rem .7rem; font: 400 0.875rem/1.4 var(--font-sans);
+  :where(input[type=text], input[type=password], input[type=number], input[type=url], input[type=email], input[type=search], input[type=time], textarea, select) {
+    width: 100%; margin: .35rem 0 0; padding: .45rem .7rem;
     color: var(--foreground); background: var(--card); min-height: 2.125rem;
     border: 1px solid var(--input); border-radius: calc(var(--radius) - 3px);
     transition: border-color .15s, box-shadow .15s;
   }
+  /* The box above is in :where() so a surface's own rules (the workspace's 44px phone targets) win; the type keeps
+     its old weight, so the phone's 16px rule still loses to it as before. */
+  input[type=text], input[type=password], input[type=number], input[type=url], input[type=email], input[type=search], input[type=time], textarea, select { font: 400 0.875rem/1.4 var(--font-sans); }
   @media (hover: hover) and (pointer: fine) { input:hover, textarea:hover, select:hover { border-color: var(--muted-foreground); } }
   input[type=number] { font-family: var(--font-mono); font-variant-numeric: tabular-nums; }
   input[type=radio], input[type=checkbox] { accent-color: var(--ring); }
@@ -2727,3 +2730,15 @@ html.so-swap::view-transition-old(*):only-child { animation: so-card-out 160ms e
   html.so-swap::view-transition-group(*), html.so-swap::view-transition-new(*), html.so-swap::view-transition-old(*) { animation: none !important; }
   .worker.flash { animation: none; }
 }
+
+/* Exact-image feedback shares the existing comment form. */
+.result-image { margin: 0; min-width: 0; }
+.result-image > button { margin-top: .5rem; min-height: 44px; white-space: nowrap; }
+.feedback-image { display: flex; align-items: center; flex-wrap: wrap; gap: .75rem; margin: .5rem 0; min-width: 0; }
+.feedback-image[hidden], .feedback-image img[hidden] { display: none; }
+.feedback-image img { width: 5rem; max-height: 5rem; object-fit: contain; border: 1px solid var(--border); border-radius: var(--radius); }
+.feedback-image figcaption { flex: 1 1 12rem; overflow-wrap: anywhere; font-size: .875rem; }
+.feedback-image button { min-height: 44px; white-space: nowrap; }
+
+.result-feedback-actions { display: flex; flex-wrap: wrap; gap: .5rem; }
+.result-feedback-actions button { min-height: 44px; white-space: nowrap; }

package/dist/server/flows.js

@@ -839,6 +839,7 @@ export function createFlowsHandlers(runtime) {
             if (body.get("repo") !== project || (who.via === "cookie" && body.get("projectRevision") !== String(who.session.projectRevision)))
                 throw new RecipeError("The open project changed. Reopen this recipe in the intended project.", 409);
             const rootMode = !unscopedMode && ceiling.roots.length > 0;
+            const decidedOn = identities.generation();
             if (rootMode) {
                 // A mutation's target is resolved now, off the console's thread, and must still be the project it names.
                 const resolved = await identities.resolveNow(project);
@@ -852,6 +853,9 @@ export function createFlowsHandlers(runtime) {
                 throw new RecipeError(rechecked.message, rechecked.status);
             if (projectOf(who, request) !== project)
                 throw new RecipeError("The open project changed. Preview the intended project again.", 409);
+            // An identity that changed during the awaits above undoes what they proved.
+            if (identities.generation() !== decidedOn)
+                throw new RecipeError("A project folder changed while this was being checked. Try again.", 409);
             const revision = who.via === "cookie" ? who.session.projectRevision : 0;
             if (step === "prepare") {
                 const id = body.get("recipe") ?? "", version = body.get("recipeRevision") ?? "";

package/dist/server/http.d.ts

@@ -226,6 +226,7 @@ export declare function matchTaskPath(pathname: string, suffixPattern: string):
     verb: string;
 } | null;
 export declare function taskHref(taskId: string): string;
+export declare function runHref(runId: number): string;
 export declare const SAFETY: {
     readonly "Content-Security-Policy": "default-src 'none'; style-src 'self' 'unsafe-inline'; font-src 'self'; manifest-src 'self'; worker-src 'self'; img-src 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'";
     readonly "X-Content-Type-Options": "nosniff";

package/dist/server/http.js

@@ -51,6 +51,9 @@ export function matchTaskPath(pathname, suffixPattern) {
 export function taskHref(taskId) {
     return `/t/${encodeURIComponent(taskId)}`;
 }
+export function runHref(runId) {
+    return `/r/${Math.trunc(runId)}`;
+}
 // ---- rendering -------------------------------------------------------------
 export const SAFETY = {
     "Content-Security-Policy": "default-src 'none'; style-src 'self' 'unsafe-inline'; font-src 'self'; manifest-src 'self'; worker-src 'self'; img-src 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
@@ -64,10 +67,13 @@ export function respond(response, status, type, body) {
     // writeHead's headers would otherwise win.
     const own = response.getHeader("content-security-policy");
     const cache = response.getHeader("cache-control");
+    // The first-account form's page sends `same-origin` so its own post names this console (signup-gate.ts).
+    const referrer = response.getHeader("referrer-policy");
     response.writeHead(status, {
         ...SAFETY,
         ...(own === undefined ? {} : { "content-security-policy": own }),
         ...(cache === undefined ? {} : { "Cache-Control": cache }),
+        ...(referrer === "same-origin" ? { "Referrer-Policy": "same-origin" } : {}),
         "Content-Type": type,
     });
     response.end(isHtml(body) ? htmlString(body) : body);