toolroll 0.9.84 → 0.9.85

package/dist/store.js

@@ -1,3 +1,5 @@
+import { verifyResultImage } from "./chat-evidence.js";
+import { parseFeedbackImage } from "./result-review.js";
 import { mintSecret } from "./secret-mint.js";
 import { WRITES_DEFAULT } from "./writes-mode.js";
 import { checkAccessOf, widerThan } from "./check-access.js";
@@ -107,6 +109,8 @@ import { configBase, envValue, namedPath } from "./names.js";
 import { PULL_REQUEST_SCHEMA } from "./pull-request-schema.js";
 import { chatTurnAmountOf, combineReportedModels, providerTurnsOf, reportedCostUsdOf, reportedModelOf, runAmountOf } from "./reported-usage.js";
 import { usageOf } from "./run-efficiency.js";
+import { YOUIYOUX_FILED_VIA } from "./contracts/youiyoux-request.js";
+import { shownTermsDigest } from "./chat-terms.js";
 // PR #263 follow-up: the built-ins the Store money seal uses, captured as this module is evaluated, so code that later
 // replaces `Object.defineProperty` and the like can't fool the seal or the lock (lockStoreMoneyMethods refuses when
 // they've been replaced). The four sealed method references are recorded once, at the seal, in SEALED_MONEY_METHODS.
@@ -717,6 +721,60 @@ export const V141_ADDED_COLUMNS = Object.freeze({
     },
     chat_turn: { billing_reported: { definition: "TEXT CHECK (billing_reported IS NULL OR billing_reported IN ('subscription','api-key'))", saved: "NULL" } },
 });
+/** v142 (youiyoux-intake.ts): youiyoux change requests as tasks. `youiyoux_intake` is one row per project the intake
+ * has looked at: a person's on/off choice (`enabled` NULL: automatic, on while the project uses youiyoux) and the last
+ * pass's answer (whether the project uses youiyoux, how many request files couldn't be read, and the problem, if any).
+ * `youiyoux_request` is one row per request taken, keyed by project and request id: the task it became (NULL: left
+ * out, `note` says why), never filed again, the status last written beside it, with the console address its links
+ * named ('' for none), and where the person pointed (route, component, file:line), cleaned, for the task page. An
+ * options request (`kind`) also keeps the options file its agent writes (`proposal`, p-<its hex>), set when filed and
+ * never read from the request again: whether it went to the project's main checkout from which result (`proposal_state`,
+ * `proposal_run`, and why not in `proposal_note`; `taken`: a file was already there, so it was left and is never read
+ * for a decision), the digest of what was copied apart from what a decision changes (`proposal_digest`), and what a
+ * person decided on it in youiyoux's hub (`decided`, `decided_note`: what Toolroll did about it). New tables only. */
+export const V142_SCHEMA = `
+CREATE TABLE IF NOT EXISTS youiyoux_intake (
+  repo        TEXT PRIMARY KEY,
+  enabled     INTEGER CHECK (enabled IS NULL OR enabled IN (0, 1)),
+  uses        INTEGER NOT NULL DEFAULT 0 CHECK (uses IN (0, 1)),
+  changed_by  TEXT,
+  changed_at  TEXT,
+  checked_at  TEXT,
+  invalid     INTEGER NOT NULL DEFAULT 0 CHECK (invalid >= 0),
+  problem     TEXT
+);
+CREATE TABLE IF NOT EXISTS youiyoux_request (
+  repo          TEXT NOT NULL,
+  request       TEXT NOT NULL CHECK (length(request) = 12 AND request GLOB 'r-[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]'),
+  task_id       TEXT,
+  note          TEXT,
+  filed_at      TEXT NOT NULL,
+  status        TEXT CHECK (status IS NULL OR status IN ('queued','needs-you','building','ready','done','failed','stopped')),
+  detail        TEXT,
+  status_at     TEXT,
+  written_at    TEXT,
+  written_base  TEXT,
+  write_problem TEXT,
+  route         TEXT,
+  component     TEXT,
+  source_at     TEXT,
+  kind          TEXT NOT NULL DEFAULT 'change' CHECK (kind IN ('change','options')),
+  proposal      TEXT CHECK (proposal IS NULL OR (length(proposal) = 12 AND proposal GLOB 'p-[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]')),
+  proposal_state TEXT CHECK (proposal_state IS NULL OR proposal_state IN ('copied','taken','missing','unsafe','retry')),
+  proposal_digest TEXT CHECK (proposal_digest IS NULL OR (length(proposal_digest) = 64 AND proposal_digest NOT GLOB '*[^0-9a-f]*')),
+  proposal_run  INTEGER,
+  proposal_note TEXT,
+  proposal_at   TEXT,
+  decided       TEXT CHECK (decided IS NULL OR decided IN ('chosen','dismissed')),
+  decided_at    TEXT,
+  decided_note  TEXT,
+  PRIMARY KEY (repo, request),
+  UNIQUE (task_id),
+  CHECK ((kind = 'options') = (proposal IS NOT NULL)),
+  CHECK (proposal_state IS NULL OR kind = 'options'),
+  CHECK (decided IS NULL OR coalesce(proposal_state = 'copied' AND proposal_digest IS NOT NULL, 0))
+);
+`;
 /** A project's "Show commands in the live view" (live-detail.ts): absent means off. */
 export const LIVE_DETAIL_SCHEMA = `
 CREATE TABLE IF NOT EXISTS live_detail_setting (
@@ -1030,7 +1088,11 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // v141 adds, and changes no saved row: the eval set's records (docs/plans/evals-nightly.md, part C) — campaigns,
 // attempts, each attempt's provider dispatches, the baseline pin and eval debt (V141_SCHEMA) — and how a run's or chat
 // request's billing was known (V141_ADDED_COLUMNS; saved rows NULL: unknown).
-export const SCHEMA_VERSION = 141;
+// v142 adds, and changes no saved row: youiyoux change requests as tasks (V142_SCHEMA, new tables only) — each
+// project's intake choice and last answer, and each request taken, with the task it became.
+// v143 adds, and changes no saved row: optional exact-screenshot context on result feedback
+// (diff_comment.image_json, V143_ADDED_COLUMNS; saved notes read NULL and keep their file/line target).
+export const SCHEMA_VERSION = 143;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -1163,7 +1225,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -1299,6 +1361,10 @@ export const V140_ADDED_COLUMNS = Object.freeze({
         reported_cost_usd: { definition: "REAL CHECK (reported_cost_usd IS NULL OR reported_cost_usd >= 0)", saved: "NULL" },
     },
 });
+/** v143: optional screenshot context on result feedback; existing feedback stays unchanged (saved rows read NULL). */
+export const V143_ADDED_COLUMNS = Object.freeze({
+    diff_comment: { image_json: { definition: "TEXT", saved: "NULL" } },
+});
 /**
  * v135: one approval per release (docs/plans/release-once.md). `release_authority` is the single source of truth for a
  * release a person approved: one row per generation, changed only by compare-and-swap on `rev`, with a lease whose
@@ -4549,6 +4615,13 @@ CREATE INDEX IF NOT EXISTS run_checkpoint_by_task ON run_checkpoint (task_ref, i
         for (const [column, { definition }] of Object.entries(columns))
             addColumn(db, table, column, definition);
     }
+    // v142: youiyoux change requests as tasks (new tables only).
+    db.exec(V142_SCHEMA);
+    // v143: optional exact-screenshot context on result feedback (V143_ADDED_COLUMNS: saved notes read NULL).
+    for (const [table, columns] of Object.entries(V143_ADDED_COLUMNS)) {
+        for (const [column, { definition }] of Object.entries(columns))
+            addColumn(db, table, column, definition);
+    }
     // Keep the epoch until reclamation succeeds, including a retry after compaction already committed. A new file has
     // nothing to reclaim.
     if (!fresh)
@@ -7282,6 +7355,14 @@ export class Store {
                     .get(taskId);
                 if (writtenByLead !== undefined)
                     return false;
+                // THE OUTSIDE-REQUEST QUARANTINE (youiyoux-intake.ts): a task filed from a youiyoux change request is text
+                // anyone who can write the project's folder wrote, so only a person who read every word of it approves it.
+                // Its provenance is immutable, so no road around this exists. A mode, a grant, a schedule, auto-check and
+                // auto-green (approvals no person read) never seal it. A person's own ceremony does. So does their paired-
+                // chat tap, only with the digest of every word the card showed (`terms`, chat-terms.ts), recomputed below
+                // from the live scope: a card that cut a word, or terms that changed since, seal nothing.
+                if (basis.kind !== "chat" && this.filedViaOf(taskId) === YOUIYOUX_FILED_VIA)
+                    return false;
                 // CHECK ACCESS (v132, check-access.ts): a scope whose checks reach beyond the fence (sign-ins, or no sandbox at
                 // all) seals only on a person's password ceremony — never a mode, a grant, a chat confirmation or a carry.
                 const profileText = this.db.prepare("SELECT profile_json FROM task_scope WHERE task_id = ?").get(taskId)?.["profile_json"];
@@ -7348,6 +7429,10 @@ export class Store {
                 return false;
             if (deployGate && basis?.kind === "chat" && !(basis.card === "release" && typeof basis.cardDigest === "string" && /^[0-9a-f]{64}$/.test(basis.cardDigest)))
                 return false;
+            // The outside-request quarantine's chat road (above): the card showed every word of these live terms.
+            if (basis?.kind === "chat" && this.filedViaOf(taskId) === YOUIYOUX_FILED_VIA
+                && !(basis.card === "terms" && typeof basis.cardDigest === "string" && basis.cardDigest === shownTermsDigest(readScope(working))))
+                return false;
             // AUTOMATIC RELEASE SEALS (auto-approve-green.md): only on a release task (a candidate and release terms signed
             // in), only naming the evidence row the plane wrote for exactly this task, kind, digest and candidate.
             const automatic = basis?.kind === "auto-check" || basis?.kind === "auto-green";
@@ -9535,13 +9620,21 @@ export class Store {
         if (artifact === undefined || artifact.kind !== "terminal-diff") {
             throw new Error(`artifact ${args.artifactId} is not run ${args.runId}'s terminal diff — comments bind to the exact bytes reviewed`);
         }
+        const image = parseFeedbackImage(args.image);
+        if (image === false)
+            throw new Error("Invalid feedback image.");
+        if (image !== null) {
+            const shot = this.artifactForRun(args.runId, image.artifact);
+            if (image.run !== args.runId || shot?.kind !== "screenshot" || shot.sha256 !== image.sha256)
+                throw new Error("The feedback image does not belong to this result.");
+        }
         // The unique index is the real concurrent guard (audit C-9): a race on
         // the same source key lands in DO NOTHING, not in a thrown constraint.
         const inserted = this.db
-            .prepare(`INSERT INTO diff_comment (artifact, artifact_sha, run, path, line, note, author, created_at, source_key)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+            .prepare(`INSERT INTO diff_comment (artifact, artifact_sha, run, path, line, note, author, created_at, source_key, image_json)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
          ON CONFLICT (source_key) WHERE source_key IS NOT NULL DO NOTHING`)
-            .run(args.artifactId, artifact.sha256, args.runId, args.path, args.line, args.note, args.author, now.toISOString(), args.sourceKey ?? null);
+            .run(args.artifactId, artifact.sha256, args.runId, args.path, args.line, args.note, args.author, now.toISOString(), args.sourceKey ?? null, image === null ? null : JSON.stringify(image));
         return Number(inserted.changes) === 0 ? null : Number(inserted.lastInsertRowid);
     }
     /** Live (unsuperseded, unconsumed) comments on a run's terminal diff. */
@@ -10229,6 +10322,19 @@ export class Store {
         const row = this.db.prepare("SELECT flow, card, card_entry, source_json FROM task_source WHERE task_id = ?").get(taskId);
         return row === undefined ? null : { flow: Number(row["flow"]), card: Number(row["card"]), entry: Number(row["card_entry"]), sourceJson: String(row["source_json"]) };
     }
+    /** v142: where a task filed from a youiyoux change or options request came from, as kept when it was filed
+     * (youiyoux-intake.ts; a revision reads its first version's): the request, its kind, and where the person pointed. Null for every other task. */
+    youiyouxOriginOf(taskId) {
+        const text = (value) => typeof value === "string" && value !== "" ? value : null;
+        let id = taskId;
+        for (let hop = 0; id !== null && hop < 20; hop++) {
+            const row = this.db.prepare("SELECT request, kind, route, component, source_at FROM youiyoux_request WHERE task_id = ?").get(id);
+            if (row !== undefined)
+                return { request: String(row["request"]), kind: row["kind"] === "options" ? "options" : "change", route: text(row["route"]), component: text(row["component"]), at: text(row["source_at"]) };
+            id = this.lookupRef(id)?.revisionOf ?? null;
+        }
+        return null;
+    }
     // ---- the revision boundary: ONE field-by-field policy -------------------
     /**
      * Seal a revision in ONE transaction (Codex M5-M8 audit, C-3; contract
@@ -10320,7 +10426,14 @@ export class Store {
                     if (ids.size !== args.commentIds.length || live.length !== ids.size) {
                         throw new RevisionRaced("this annotation batch is no longer whole — read the current comments before sealing it");
                     }
-                    const exactComment = (one) => ({ id: one["id"], path: one["path"], line: one["line"], note: one["note"], author: one["author"], createdAt: one["createdAt"] });
+                    for (const one of live) {
+                        if (one.image == null)
+                            continue;
+                        const image = sourceRef.repo === null ? null : verifyResultImage(this, args.brief.evidenceRoot, [sourceRef.repo], { taskId: args.source.task, ...one.image });
+                        if (one.image.run !== sourceRun.id || image === null || !image.ok)
+                            return refuse("brief-custody", "A feedback screenshot is unavailable or changed. The notes were not consumed.");
+                    }
+                    const exactComment = (one) => ({ id: one["id"], path: one["path"], line: one["line"], note: one["note"], author: one["author"], createdAt: one["createdAt"], image: one["image"] ?? null });
                     const expected = live.map(one => exactComment({ ...one }));
                     const described = Array.isArray(named.comments) && named.comments.every(one => one !== null && typeof one === "object" && !Array.isArray(one))
                         ? named.comments.map(one => exactComment(one)) : null;
@@ -20632,6 +20745,7 @@ function readDiffComment(row) {
         id: Number(row["id"]),
         artifact: Number(row["artifact"]),
         artifactSha: String(row["artifact_sha"]),
+        image: readFeedbackImage(row["image_json"]),
         run: Number(row["run"]),
         path: row["path"] === null ? null : String(row["path"]),
         line: row["line"] === null ? null : Number(row["line"]),
@@ -21510,3 +21624,48 @@ export function lockStoreMoneyMethods(store, prototype = Store.prototype) {
             throw new Error(`Store.${name} couldn't be locked`);
     }
 }
+/** A saved note's screenshot reference (v143), or null; a damaged one refuses rather than reading as none. */
+function readFeedbackImage(value) {
+    const image = parseFeedbackImage(value);
+    if (image === false)
+        throw new Error("The saved feedback image is damaged.");
+    return image;
+}
+/** Takes a saved note's screenshot off without losing the note or its history (v143). Fail closed, in one write
+ * transaction: the note must be live and unconsumed on this run, its screenshot must be genuinely unusable right now
+ * (`unusable` is result-actions.ts feedbackImageProblem, re-read inside the transaction, never the page's say-so), and
+ * the change is recorded in the action ledger under the person who made it. The note is superseded by an exact
+ * imageless copy; the original stays in history. The caller has already proved the person may request changes on
+ * this run (the same authority that seals any saved note into a revision); that standing is re-proved here too. */
+export function dropFeedbackImage(store, runId, commentId, actor, unusable, now) {
+    return store.transact(() => {
+        // The person's standing is re-read under the write lock: a revocation, a downgrade or a lost project committed
+        // after the request was admitted refuses here (check and write together).
+        const run = store.getRun(runId);
+        const repo = run === null ? null : store.refById(run.taskRef)?.repo ?? null;
+        const account = store.accountOf(actor);
+        if (run === null || account === null || account.revokedAt !== null || account.role !== "approver" || !store.accountCanAccess(actor, repo)) {
+            return { ok: false, reason: "not-authorized" };
+        }
+        const live = store.handle.prepare(`SELECT id, image_json FROM diff_comment WHERE id = ? AND run = ? AND superseded_by IS NULL AND consumed_by IS NULL
+      AND reviewer_run IS NULL AND image_json IS NOT NULL`).get(commentId, runId);
+        if (live === undefined)
+            return { ok: false, reason: "not-found" };
+        const image = readFeedbackImage(live["image_json"]);
+        if (image === null)
+            return { ok: false, reason: "not-found" };
+        const problem = unusable(image);
+        if (problem === null)
+            return { ok: false, reason: "image-usable" };
+        const copy = store.handle.prepare(`INSERT INTO diff_comment (artifact, artifact_sha, run, path, line, note, author, created_at, reviewer_run, severity)
+      SELECT artifact, artifact_sha, run, path, line, note, author, ?, reviewer_run, severity FROM diff_comment WHERE id = ?`).run(now.toISOString(), commentId);
+        const id = Number(copy.lastInsertRowid);
+        const moved = store.handle.prepare("UPDATE diff_comment SET superseded_by = ? WHERE id = ? AND superseded_by IS NULL AND consumed_by IS NULL").run(id, commentId);
+        if (Number(moved.changes) !== 1)
+            throw new Error("The saved note changed while its screenshot was being removed.");
+        store.recordAction({ at: now.toISOString(), actor, repo,
+            taskId: store.externalIdFor(run.taskRef) ?? null, runId, action: "feedback screenshot removed", outcome: "recorded", source: "work",
+            detail: `note ${commentId} kept as note ${id} without screenshot ${image.artifact}: ${problem}` });
+        return { ok: true, id };
+    });
+}

package/dist/task-source.d.ts

@@ -51,8 +51,20 @@ export type TaskOrigin = {
         url: string | null;
         host: string | null;
     } | null;
+    /** A youiyoux change or options request (youiyoux-intake.ts): its id, its kind, and where the person pointed. */
+    request?: {
+        id: string;
+        kind: "change" | "options";
+        route: string | null;
+        component: string | null;
+        at: string | null;
+    } | null;
 };
-/** A task's origin, or null when it came from neither a flow nor an outside event. */
+/** A task's origin, or null when it came from neither a flow, an outside event nor a youiyoux request. */
 export declare function originOf(store: Store, taskId: string, canSee: (repo: string) => boolean): TaskOrigin | null;
+/** A youiyoux request by its kind: "youiyoux change request r-…" or "youiyoux options request r-…". */
+export declare function requestName(request: NonNullable<TaskOrigin["request"]>): string;
+/** Where a youiyoux request pointed, in words: "Button on /flows (src/button.tsx:12)". */
+export declare function requestWords(request: NonNullable<TaskOrigin["request"]>): string;
 /** The one line an approval shows about an outside event that started its work: context, never a term agreed to. */
 export declare function originNote(origin: TaskOrigin | null | undefined): string | null;

package/dist/task-source.js

@@ -71,8 +71,11 @@ export function cardReference(source) {
     const snapshot = snapshotOf(source ?? null);
     return snapshot === null ? "" : referenceWords(snapshot);
 }
-/** A task's origin, or null when it came from neither a flow nor an outside event. */
+/** A task's origin, or null when it came from neither a flow, an outside event nor a youiyoux request. */
 export function originOf(store, taskId, canSee) {
+    const request = store.youiyouxOriginOf(taskId);
+    if (request !== null)
+        return { flow: null, source: null, request: { id: request.request, kind: request.kind, route: request.route, component: request.component, at: request.at } };
     const kept = store.taskSourceOf(taskId);
     const flowId = kept?.flow ?? Number(/^flow:(\d+)$/.exec(store.filedViaOf(taskId) ?? "")?.[1] ?? NaN);
     const snapshot = kept === null ? null : readSnapshot(kept.sourceJson);
@@ -84,8 +87,21 @@ export function originOf(store, taskId, canSee) {
         source: snapshot === null ? null : { label: snapshot.label, proved: provedWords(snapshot), url: snapshot.external.url, host: hostOf(snapshot.external.url) },
     };
 }
+/** A youiyoux request by its kind: "youiyoux change request r-…" or "youiyoux options request r-…". */
+export function requestName(request) {
+    return `youiyoux ${request.kind === "options" ? "options" : "change"} request ${request.id}`;
+}
+/** Where a youiyoux request pointed, in words: "Button on /flows (src/button.tsx:12)". */
+export function requestWords(request) {
+    const what = [request.component, request.route === null ? null : `on ${request.route}`].filter(one => one !== null).join(" ");
+    return `${what === "" ? "" : what}${request.at === null ? "" : `${what === "" ? "" : " "}(${request.at})`}`;
+}
 /** The one line an approval shows about an outside event that started its work: context, never a term agreed to. */
 export function originNote(origin) {
+    if (origin?.request != null) {
+        const where = requestWords(origin.request);
+        return `From ${requestName(origin.request)}${where === "" ? "" : `: ${where}`}. Whoever can write the project's folder wrote these words; read them all before you approve.`;
+    }
     if (origin?.source == null)
         return null;
     const where = origin.source.host === null ? "" : ` · ${origin.source.host}`;

package/dist/telegram-lead.js

@@ -1,5 +1,5 @@
 import { CHAT_ACTIONS, sharedActionAllowsChallenge, sharedActionPayload } from "./chat-actions.js";
-import { taskInCeiling, mirrorToTaskChat, couldNotAnswerText, channelRepos as telegramConversationRepos, resolveChannelLead as resolveTelegramLead, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText } from "./chat-channel.js";
+import { taskInCeiling, mirrorToTaskChat, couldNotAnswerText, channelRepos as telegramConversationRepos, resolveChannelLead as resolveTelegramLead, NO_PHONE_LINK, NO_TASK_LINK, phoneProposalLink, confirmedLink, phoneProposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText } from "./chat-channel.js";
 export { channelRepos as telegramConversationRepos, resolveChannelLead as resolveTelegramLead, tooLongText, whichTaskText, replyContextFor, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText, CHAT_ACTION_PARITY as TELEGRAM_ACTION_PARITY, parityGaps } from "./chat-channel.js";
 /**
  * The paired phone as one more way to use the same assistant.
@@ -207,7 +207,7 @@ export function applyProposalTap(store, binding, token, message, repos, options,
         return { effects, confirmed: false, ignored: true };
     }
     const who = verified.who;
-    const preview = proposalPreview(store, proposal, actionRepos, "telegram");
+    const preview = phoneProposalPreview(store, proposal, actionRepos);
     const origin = options.phoneOrigin?.() ?? null;
     if (preview.closed) {
         store.consumeTelegramProposalActions(proposal.id, now);
@@ -239,7 +239,7 @@ export function applyProposalTap(store, binding, token, message, repos, options,
         // A forged keyboard on a handoff card: nothing acts; the card is
         // repainted with its current link (or the honest absence of one).
         store.consumeTelegramProposalActions(proposal.id, now);
-        const wanted = proposalLink(store, proposal, actionRepos, "telegram");
+        const wanted = phoneProposalLink(store, proposal, actionRepos, "telegram");
         const link = phoneLinkButton(origin, wanted);
         ack(link === null ? "this step finishes on the computer" : "open the button below to finish this step");
         edit(handoffCardText(preview.text, linkNote(origin, wanted)), keyboardWith(null, link));
@@ -545,7 +545,7 @@ async function runTelegramConversation(row, args) {
                 // or went away carries the current truth, never a stored URL.
                 const proposal = part.kind === "card" && part.proposal !== null ? store.getLeadProposal(part.proposal) : null;
                 const origin = proposal === null ? null : options.phoneOrigin?.() ?? null;
-                const wanted = proposal === null ? null : proposalLink(store, proposal, repos);
+                const wanted = proposal === null ? null : phoneProposalLink(store, proposal, repos);
                 const keyboard = keyboardWith(part.keyboard, phoneLinkButton(origin, wanted));
                 // The lead's own words carry their bold anchors and labelled links as entities, never as Markdown characters.
                 const voiced = part.kind === "reply" ? telegramReply(part.text) : null;
@@ -625,7 +625,7 @@ async function runTelegramConversation(row, args) {
                 for (const image of selected)
                     parts.push({ kind: "image", text: image.caption, taskId: image.taskId, run: image.run, artifact: image.artifact, sha256: image.sha256 });
                 for (const proposal of proposals) {
-                    const preview = proposalPreview(store, proposal, repos, "telegram");
+                    const preview = phoneProposalPreview(store, proposal, repos);
                     const keyboard = preview.buttons ? mintCardTokens(store, binding, proposal.id, now).keyboard : null;
                     parts.push({ kind: "card", text: preview.text, proposal: proposal.id, keyboard });
                 }
@@ -763,11 +763,13 @@ async function runTelegramConversation(row, args) {
         react: () => transport("setMessageReaction", { chat_id: chatId, message_id: Number(row.messageId), reaction: [{ type: "emoji", emoji: WARM_EMOJI }] }),
         typing: () => transport("sendChatAction", { chat_id: chatId, action: "typing" }),
     });
+    const replyImage = row.replyTo === null ? undefined : store.telegramMessageBindings(binding, row.replyTo).find(one => one.taskId === row.taskId && one.run === row.sourceRun && one.image !== undefined)?.image;
     let outcome;
     try {
         outcome = await runLeadTurn({
             store, who, session, thread, config, key: null, message: row.text, requestId: row.request,
             ...(row.context === null ? {} : { context: row.context }),
+            ...(replyImage === undefined ? {} : { replyImage }),
             ...(options.subscriptionRunner === undefined ? {} : { subscriptionRunner: options.subscriptionRunner }),
             clock, evidenceRoot: options.evidenceRoot, revalidate, mediaDelivery: "documents", channel: "telegram", onProgress: warm.onProgress,
         });

package/dist/telegram.js

@@ -1852,7 +1852,7 @@ function applyConversation(context, update, effects) {
         if (tasks.length === 1) {
             taskId = tasks[0];
             sourceRun = bindings.find(one => one.run !== null)?.run ?? null;
-            context_ = replyContextFor(taskId, sourceRun);
+            context_ = replyContextFor(taskId, sourceRun, bindings.find(one => one.image !== undefined)?.image);
         }
     }
     // No reply target: the task this chat chose to talk about, if any. The

package/dist/toolroll-update.js

@@ -37,7 +37,7 @@ import { removeTerminalUpdateGate } from "./terminal-catalog.js";
 import { assertCodingUpdateStopped, backupCodingCatalog, codingCatalogExists, releaseStaleCodingOwner, removeCodingUpdateGate } from "./coding-update.js";
 import { installLaunchdService, launchdPlist, stopLaunchdService, writeFileDurably } from "./daemon.js";
 import { NAME } from "./names.js";
-import { orphanKey, updateSafeSchema, V117_RENAMED_COLUMNS, V117_RENAMED_TABLES, V118_MERGED_TABLES, V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS, V125_ADDED_COLUMNS, V126_ADDED_COLUMNS, V128_ADDED_COLUMNS, V129_ADDED_COLUMNS, V134_ADDED_COLUMNS, V135_ADDED_COLUMNS, V138_ADDED_COLUMNS } from "./store.js";
+import { orphanKey, updateSafeSchema, V117_RENAMED_COLUMNS, V117_RENAMED_TABLES, V118_MERGED_TABLES, V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS, V125_ADDED_COLUMNS, V126_ADDED_COLUMNS, V128_ADDED_COLUMNS, V129_ADDED_COLUMNS, V134_ADDED_COLUMNS, V135_ADDED_COLUMNS, V138_ADDED_COLUMNS, V143_ADDED_COLUMNS } from "./store.js";
 import { isNewer, REGISTRY } from "./releases.js";
 import { markNeverIndex } from "./never-index.js";
 import { readRuntimeUpdateJournal, RUNTIME_PHASES, RUNTIME_UPDATE_STEPS, stagedStartedAt, updaterStartingOf } from "./contracts/update-journal.js";
@@ -409,7 +409,7 @@ const HISTORY_RULES = {
     // v126: a receipt's state, acceptance time and held item, a trigger's credential generation and turned-away count,
     // and who made a card read none, 0, or none. A table with an earlier rule (flow_trigger's v115 move) keeps it too.
     // v128: a lead message's pending flag reads waiting exactly for a team queue's unadmitted operator message.
-    ...Object.fromEntries(Object.entries(addedColumns(V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS, V125_ADDED_COLUMNS, V126_ADDED_COLUMNS, V128_ADDED_COLUMNS, V129_ADDED_COLUMNS, V134_ADDED_COLUMNS, V135_ADDED_COLUMNS, V138_ADDED_COLUMNS))
+    ...Object.fromEntries(Object.entries(addedColumns(V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS, V125_ADDED_COLUMNS, V126_ADDED_COLUMNS, V128_ADDED_COLUMNS, V129_ADDED_COLUMNS, V134_ADDED_COLUMNS, V135_ADDED_COLUMNS, V138_ADDED_COLUMNS, V143_ADDED_COLUMNS))
         .map(([table, rule]) => [table, { ...EARLIER_RULES[table], ...rule }])),
 };
 /** The tables a migration may remove whole (v115's removed features). */

package/dist/webhooks.d.ts

@@ -35,6 +35,12 @@ export declare function effectivePrimary(env: Record<string, string | undefined>
     legacyWarning?: string;
 };
 export declare function loadConsoleUrl(env: Record<string, string | undefined>, dir: string): string | null;
+/** Where `up` last served its console, kept beside the database so `onboard` names the same address (operate.ts). */
+export declare const UP_CONSOLE_FILE = "up-console.json";
+export declare function readUpConsoleUrl(dir: string): string | null;
+/** This machine's own console, where `up` last served it: only a plain http address on a loopback name (127.0.0.1,
+ * localhost, ::1), never a host guessed from it; null otherwise. */
+export declare function localConsoleUrl(dir: string): string | null;
 /**
  * The origin a phone link may open, or null. The SAME console-url setting
  * chat links use — read again on every call, never cached, so a changed or

package/dist/webhooks.js

@@ -107,6 +107,31 @@ export function loadConsoleUrl(env, dir) {
     const configured = envValue(env, "CONSOLE_URL") ?? readTrimmed(join(dir, CONSOLE_FILE));
     return configured === undefined || configured === null || configured === "" ? null : configured.replace(/\/+$/, "");
 }
+/** Where `up` last served its console, kept beside the database so `onboard` names the same address (operate.ts). */
+export const UP_CONSOLE_FILE = "up-console.json";
+export function readUpConsoleUrl(dir) {
+    try {
+        const parsed = JSON.parse(readFileSync(join(dir, UP_CONSOLE_FILE), "utf8"));
+        return typeof parsed.url === "string" && /^https?:\/\/[^\s]+$/.test(parsed.url) ? parsed.url.replace(/\/+$/, "") : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** This machine's own console, where `up` last served it: only a plain http address on a loopback name (127.0.0.1,
+ * localhost, ::1), never a host guessed from it; null otherwise. */
+export function localConsoleUrl(dir) {
+    const served = readUpConsoleUrl(dir);
+    if (served === null)
+        return null;
+    try {
+        const url = new URL(served);
+        return url.protocol === "http:" && isLoopbackHost(url.hostname) && url.hostname !== "0.0.0.0" && url.hostname !== "[::]" ? served : null;
+    }
+    catch {
+        return null;
+    }
+}
 /** A dotted IPv4 that names this machine or no machine: loopback, unspecified. */
 function isLocalIpv4(address) {
     return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(address) || address === "0.0.0.0";

package/dist/work-index.d.ts

@@ -114,6 +114,10 @@ export type WorkStateRow = {
     members: number[];
 };
 export declare function workStateRows(store: Store, now: Date, access: WorkSummaryAccess): WorkStateRow[];
+/** Activity uses the Tasks list's exact family admission and saved completion rules.
+ * Only the requested project enters the projection. The extra row signals truncation;
+ * attempts are aggregated in SQLite, never loaded as an unbounded history. */
+export declare function workOutcomeRows(store: Store, now: Date, access: WorkSummaryAccess, project: string, since: string, limit: number): Record<string, unknown>[];
 /** Families whose headline is Ready for review, newest first: the Tasks
  * list's own rows, so a completed family (root or any revision), a failed
  * check and a superseded version never count. */

package/dist/work-index.js

@@ -453,6 +453,38 @@ export function workStateRows(store, now, access) {
         leadClaim: n(row, 'lead_claim') === 1, liveRun: row['live_run'] == null ? null : n(row, 'live_run'), unfinished: row['unfinished'] == null ? null : n(row, 'unfinished'),
         resultRun: row['result_id'] == null ? null : n(row, 'result_id'), waits: Number(row['rank']) === 2, version: String(row['version']), at: String(row['ask_at'] ?? ''), askRun: row['ask_run'] == null ? null : n(row, 'ask_run'), members: JSON.parse(String(row['members'] ?? '[]')).map(Number) }));
 }
+/** Activity uses the Tasks list's exact family admission and saved completion rules.
+ * Only the requested project enters the projection. The extra row signals truncation;
+ * attempts are aggregated in SQLite, never loaded as an unbounded history. */
+export function workOutcomeRows(store, now, access, project, since, limit) {
+    return store.handle.prepare(`${registerValidators(store)}, selected AS MATERIALIZED (
+    SELECT * FROM ranked WHERE code='ready-to-check' OR code='history-problem'
+      OR (code='complete' AND checked_at >= $since AND checked_at <= $now)
+    ORDER BY sort_at DESC,root_ref DESC LIMIT $outcomeLimit
+  ), amounts AS (
+    -- reported-usage.ts runAmountOf, row for row: only evidenced billing on a run whose cost was reported is known;
+    -- an API run counts its priced spend as dollars (a safe integer), a subscription run its reported cost as usage,
+    -- never dollars. TOTAL sums as a float, so no family's sum can overflow.
+    SELECT m.root_ref,r.cost_usd,s.microusd,
+      CASE WHEN r.billing_basis IS NOT 'evidence' OR COALESCE(r.cost_unknown,1)<>0 THEN 'unknown'
+        WHEN s.billing='subscription' THEN 'subscription'
+        WHEN s.billing='api-key' AND typeof(s.microusd)='integer' AND s.microusd>=0 AND s.microusd<=9007199254740991 THEN 'api'
+        ELSE 'unknown' END amount
+    FROM selected f JOIN members m ON m.root_ref=f.root_ref JOIN run r ON r.task_ref=m.ref_id LEFT JOIN run_spend s ON s.run=r.id
+  ), attempts AS (
+    SELECT root_ref,COUNT(*) runs,COUNT(CASE WHEN amount='api' THEN 1 END) api_runs,
+      TOTAL(CASE WHEN amount='api' THEN microusd END) api_microusd,
+      COUNT(CASE WHEN amount='subscription' THEN 1 END) subscription_runs,
+      SUM(CASE WHEN amount='subscription' AND typeof(cost_usd) IN ('integer','real') AND cost_usd>=0 THEN cost_usd END) subscription_usd
+    FROM amounts GROUP BY root_ref
+  ) SELECT f.root_id,f.id task_id,f.root_title title,f.code,f.finished_at,f.result_id,f.result_role,
+    f.version_count,f.checked_at,f.checked_actor,f.checked_detail,
+    (SELECT lead FROM task_act WHERE task_ref=f.root_ref AND act='completed' AND at=f.checked_at ORDER BY id DESC LIMIT 1) completed_by_lead,
+    (SELECT status FROM run_check WHERE run=f.result_id) check_status,
+    COALESCE(a.runs,0) runs,COALESCE(a.api_runs,0) api_runs,a.api_microusd,COALESCE(a.subscription_runs,0) subscription_runs,a.subscription_usd
+    FROM selected f LEFT JOIN attempts a ON a.root_ref=f.root_ref ORDER BY f.sort_at DESC,f.root_ref DESC`)
+        .all({ ...parameters(now, access, { project }, custodyReadings(store)), $since: since, $outcomeLimit: limit + 1 });
+}
 /** Families whose headline is Ready for review, newest first: the Tasks
  * list's own rows, so a completed family (root or any revision), a failed
  * check and a superseded version never count. */