toolroll 0.9.85 → 0.9.87

package/dist/release.js

@@ -81,6 +81,13 @@ export const REQUIRED_PR_CHECKS_WORKFLOW = {
 export const PROTECTION_REPORT_ONLY_CHECKS = [];
 /** The checks main's protection must require at minimum: every required check that isn't report-only. */
 export const PROTECTION_MINIMUM_CHECKS = REQUIRED_PR_CHECKS.filter(name => !PROTECTION_REPORT_ONLY_CHECKS.includes(name));
+/**
+ * Pull-request checks a release never waits for or fails on, by exact name and the workflow file that defines them:
+ * youiyoux's UI drift check (src/design/KIT.md), which fails a pull request that adds design drift but says nothing
+ * about whether a build is safe to release. Only a GitHub Actions run of that name from that workflow is left out; the
+ * same name from anywhere else is judged like any other check. Never a required check.
+ */
+export const ADVISORY_PR_CHECKS = { "youiyoux · UI drift": ".github/workflows/youiyoux.yml" };
 /** The checks a release's publication waits for on its tag (.github/workflows/publish.yml, docs/plans/test-matrix.md):
  * the release proof (the tagged tree passed every REQUIRED_PR_CHECKS check on its pull request, read from GitHub) and
  * the publish job that needs it. The tag runs no tests again. Nothing else reported on the merge commit (main-push.yml)
@@ -130,7 +137,7 @@ export function landedWords(landed) {
 }
 const branchFile = (branch) => branch.replace(/[^A-Za-z0-9._-]+/g, "_");
 export const journalFile = (stateDir, branch) => join(stateDir, "releases", `${branchFile(branch)}.json`);
-export const resumeCommand = (branch, checkout) => `toolroll release ${branch} --repo ${checkout}`;
+export const resumeCommand = (branch, checkout) => `toolroll release ${releaseBranchArg(branch)} --repo ${checkout}`;
 /** Whole or not at all: a private temp file, synced, renamed into place, its folder synced. */
 export function writeJournal(file, journal) {
     mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
@@ -232,7 +239,18 @@ export async function runRelease(options, adapters) {
     let freshApproval = false;
     let supersededTask = null;
     const save = () => { journal.updatedAt = adapters.now().toISOString(); writeJournal(file, journal); };
-    const advance = (next) => { journal.step = next; journal.stopped = null; save(); };
+    /** Tell the progress record about a step (v146). Never throws and never waits: the release goes on whatever it says. */
+    const mark = (at, state, detail = null) => {
+        const j = journal;
+        if (j === null || adapters.progress === undefined || at === "done")
+            return;
+        try {
+            adapters.progress({ taskId: j.task.id, tag: j.tag, version: j.packageVersion, pr: j.pr, step: at, state, at: adapters.now(), detail });
+        }
+        catch { /* best effort */ }
+    };
+    const advance = (next) => { const was = journal.step; journal.step = next; journal.stopped = null; save(); if (was !== next)
+        mark(was, "done"); };
     const intend = (at) => { journal.intents[at] = adapters.now().toISOString(); save(); };
     const recoverDeploy = async () => {
         const j = journal;
@@ -266,13 +284,18 @@ export async function runRelease(options, adapters) {
                 unreachable = networkWords(error);
                 answer = null;
             }
-            if (answer !== null)
+            if (answer !== null) {
+                if (said && journal !== null)
+                    mark(journal.step, "running");
                 return answer;
+            }
             if (adapters.now().getTime() >= deadline)
                 throw new Stop("timeout", `Still waiting for ${what} after ${limits[at]} minutes${unreachable === null ? "" : ` (GitHub last didn't answer: ${unreachable})`}.`);
             if (!said) {
                 say(`  waiting for ${what} (up to ${limits[at]} min)`);
                 said = true;
+                if (journal !== null)
+                    mark(journal.step, "waiting", `waiting for ${what}`);
             }
             await adapters.sleep(pollMs);
         }
@@ -584,6 +607,8 @@ export async function runRelease(options, adapters) {
         const watch = async (action) => { if (rel !== undefined)
             await identity(action, true); };
         const restart = async (head) => {
+            // The step this commit was at ends here: the release goes on with the new commit (and, filed again, a new task).
+            mark(j.step, "failed", `${j.branch} moved to ${head.slice(0, 7)}`);
             const tree = await adapters.repo.tree(head);
             if (rel !== undefined && j.authority && epoch !== null) {
                 say(`  ${j.branch} moved to ${head.slice(0, 7)}: checking whether the approval carries`);
@@ -663,7 +688,7 @@ export async function runRelease(options, adapters) {
             }
             const verdict = prChecksVerdict(runs, j.candidate.sha, REQUIRED_PR_CHECKS, { workflow: REQUIRED_PR_CHECKS_WORKFLOW });
             if (verdict.state === "failed") {
-                throw new Stop("ci-failed", `GitHub's checks failed on ${j.candidate.sha.slice(0, 7)}: ${verdict.failed.join(", ")}. ${nothing}. ${j.approval === null ? "" : `The approval covers ${j.candidate.sha.slice(0, 7)} only. `}Rerun the failed job on GitHub and run \`${resume}\` again, or fix the branch and release the new commit with \`toolroll release ${j.branch} --repo ${j.checkout} --new\`.`);
+                throw new Stop("ci-failed", `GitHub's checks failed on ${j.candidate.sha.slice(0, 7)}: ${verdict.failed.join(", ")}. ${nothing}. ${j.approval === null ? "" : `The approval covers ${j.candidate.sha.slice(0, 7)} only. `}Rerun the failed job on GitHub and run \`${resume}\` again, or fix the branch and release the new commit with \`toolroll release ${releaseBranchArg(j.branch)} --repo ${j.checkout} --new\`.`);
             }
             if (verdict.state !== "passed")
                 return false;
@@ -739,6 +764,7 @@ export async function runRelease(options, adapters) {
         while (j.step !== "done" && homebrewLeft === null) {
             step = j.step;
             say(`• ${j.step}`);
+            mark(j.step, "running");
             try {
                 switch (j.step) {
                     case "gate": {
@@ -1217,6 +1243,7 @@ export async function runRelease(options, adapters) {
                         save();
                         if (progress.state === "pending" || progress.state === "failed") {
                             homebrewLeft = { state: progress.state, why: progress.why };
+                            mark("homebrew", progress.state === "failed" ? "failed" : "waiting", progress.why);
                             break;
                         }
                         advance("done");
@@ -1254,6 +1281,7 @@ export async function runRelease(options, adapters) {
                 save();
             }
             catch { /* the stop is still reported */ }
+            mark(journal.step, "failed", stop.message);
         }
         return { ok: false, reason: stop.reason, message: stop.message, step: journal?.step ?? step, journal, file, resume };
     }
@@ -1441,6 +1469,10 @@ export function prChecksVerdict(runs, head, required, options = {}) {
     const failed = [], waiting = [], failures = [];
     const valid = [];
     for (const run of runs) {
+        // youiyoux's drift check from its own workflow neither holds nor fails a release (ADVISORY_PR_CHECKS).
+        const advisory = Object.hasOwn(ADVISORY_PR_CHECKS, run.name) ? ADVISORY_PR_CHECKS[run.name] : undefined;
+        if (advisory !== undefined && !required.includes(run.name) && run.app === "github-actions" && workflowIs(run.workflowPath, advisory))
+            continue;
         if (run.head !== head) {
             failed.push(`${run.name} (reported for ${run.head == null ? "no commit" : run.head.slice(0, 7)}, not ${head.slice(0, 7)})`);
             continue;
@@ -1577,3 +1609,7 @@ export function workflowIs(path, file) {
     const ref = path.startsWith(`${file}@`) ? path.slice(file.length + 1) : "";
     return /^[A-Za-z0-9._+/-]+$/.test(ref) && !/\.ya?ml$/i.test(ref);
 }
+/** The words `toolroll release` reads as its own (release-cli.ts), never as a branch: such a branch is named with --branch. */
+const RELEASE_WORDS = new Set(["status", "nightly", "carry", "revoke", "ask-every-commit", "unsandboxed-carry", "auto-approve", "publish-ok"]);
+/** How a person names this branch to `toolroll release` again. */
+export function releaseBranchArg(branch) { return RELEASE_WORDS.has(branch) ? `--branch ${branch}` : branch; }

package/dist/releases.js

@@ -129,7 +129,7 @@ export function notifySecurityRelease(store, release, current, updateCommand, no
             dedupeKey: `release:security:${newer.version}:${recipient}`,
             kind: "security-release",
             pushClass: "attention",
-            link: "/settings#updates",
+            link: "/settings/system#updates",
             subject: `Toolroll ${newer.version} is a security release`,
             body: `This computer runs ${current}. Update with \`${updateCommand}\`. Notes: ${newer.url}`,
             recipient,

package/dist/request-budget-ui.d.ts

@@ -5,8 +5,10 @@
  */
 import type { ApiTokenRow, Database } from "./store.js";
 import { type Html } from "./html.js";
-export declare const REQUEST_LIMITS_CSS: string;
+/** The old card look; the section is built from the kit now. Kept for chrome.ts, which still concatenates it. */
+export declare const REQUEST_LIMITS_CSS = "";
 /** "120 requests a minute · 10,000 a day" for one token's line. */
 export declare function tokenLimitWords(db: Database, token: ApiTokenRow): string;
-/** The operator's disclosure: everyone's tokens, or one token. Blank fields use the default shown. */
+/** The operator's section: everyone's tokens, or one token. Blank fields use the default shown. Saving takes the
+ * operator's password (or Passwordless, or a fresh identity-provider sign-in). */
 export declare function requestLimitsHtml(db: Database, tokens: readonly ApiTokenRow[], now: number): Html;

package/dist/request-budget-ui.js

@@ -1,31 +1,42 @@
-import { html, postForm, reauth } from "./html.js";
+import { html, joinHtml } from "./html.js";
+import { btn, disclose, formRow, input, note, select, settingsSection } from "./server/kit.js";
+import { kitSectionForm } from "./settings-kit.js";
 import { effectiveLimits, limitOverrides, PER_DAY_MAX, PER_MINUTE_MAX, REQUEST_BUDGET_DEFAULTS } from "./request-budget.js";
 const n = (value) => value.toLocaleString("en-US");
-export const REQUEST_LIMITS_CSS = `.credentials .limits{display:grid;gap:14px}.credentials .limits form{display:grid;gap:10px}.credentials .limits label{display:grid;gap:6px}` +
-    `.credentials .limits input,.credentials .limits select{box-sizing:border-box;width:100%;min-width:0}.credentials .limits .pair{display:grid;grid-template-columns:1fr 1fr;gap:10px}.credentials .limits .actions{display:flex;flex-wrap:wrap;gap:8px}` +
-    `.credentials .limits h3{font-size:.95rem;margin:4px 0 0}@media(max-width:600px){.credentials .limits .pair{grid-template-columns:1fr}.credentials .limits input,.credentials .limits select{font-size:16px}}`;
+/** The old card look; the section is built from the kit now. Kept for chrome.ts, which still concatenates it. */
+export const REQUEST_LIMITS_CSS = "";
 /** "120 requests a minute · 10,000 a day" for one token's line. */
 export function tokenLimitWords(db, token) {
     const limits = effectiveLimits(db, token.id, token.access);
     return `${n(limits.perMinute)} requests a minute · ${n(limits.perDay)} a day`;
 }
-/** The operator's disclosure: everyone's tokens, or one token. Blank fields use the default shown. */
+/** The operator's section: everyone's tokens, or one token. Blank fields use the default shown. Saving takes the
+ * operator's password (or Passwordless, or a fresh identity-provider sign-in). */
 export function requestLimitsHtml(db, tokens, now) {
     const overrides = limitOverrides(db);
     const everyone = overrides.get("*") ?? { readPerMinute: null, actPerMinute: null, perDay: null };
-    const field = (name, label, value, placeholder, max) => html `<label>${label}<input type="number" name="${name}" min="1" max="${max}" step="1" inputmode="numeric" value="${value === null ? "" : value}" placeholder="${placeholder}"></label>`;
-    const password = html `${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label>`)}`;
-    const buttons = html `<div class="actions"><button name="action" value="save">Save limits</button><button class="secondary" name="action" value="clear">Use defaults</button></div>`;
+    const number = (id, name, label, value, placeholder, max) => input({ id, name, type: "number", value: value === null ? "" : String(value), attrs: { min: 1, max, step: 1, inputmode: "numeric", placeholder, "aria-label": label } });
+    const installation = kitSectionForm({ proof: "request-limits", action: "/settings/request-limits", id: "limits-everyone", gate: true, hidden: { target: "*", action: "save" },
+        save: { label: "Save limits" }, confirm: "Change request limits for everyone's tokens",
+        body: joinHtml([
+            formRow("Read tokens, a minute", `Default ${n(REQUEST_BUDGET_DEFAULTS.read)}.`, number("limits-read", "read-per-minute", "Read tokens, a minute", everyone.readPerMinute, String(REQUEST_BUDGET_DEFAULTS.read), PER_MINUTE_MAX)),
+            formRow("Act tokens, a minute", `Default ${n(REQUEST_BUDGET_DEFAULTS.act)}.`, number("limits-act", "act-per-minute", "Act tokens, a minute", everyone.actPerMinute, String(REQUEST_BUDGET_DEFAULTS.act), PER_MINUTE_MAX)),
+            formRow("Each token, a day", `Default ${n(REQUEST_BUDGET_DEFAULTS.day)}.`, number("limits-day", "per-day", "Each token, a day", everyone.perDay, String(REQUEST_BUDGET_DEFAULTS.day), PER_DAY_MAX)),
+        ]) });
+    const reset = kitSectionForm({ proof: "request-limits", action: "/settings/request-limits", id: "limits-everyone-clear", hidden: { target: "*", action: "clear" },
+        save: { label: "Use defaults for everyone", variant: "outline" }, confirm: "Put everyone's tokens back on the default limits", body: html `` });
     const live = tokens.filter(one => one.revokedAt === null && Date.parse(one.expiresAt) > now);
-    const installation = postForm("/settings/request-limits", html `\
-<h3>Everyone's tokens</h3><div class="pair">${field("read-per-minute", "Read tokens, a minute", everyone.readPerMinute, String(REQUEST_BUDGET_DEFAULTS.read), PER_MINUTE_MAX)}\
-${field("act-per-minute", "Act tokens, a minute", everyone.actPerMinute, String(REQUEST_BUDGET_DEFAULTS.act), PER_MINUTE_MAX)}</div>\
-${field("per-day", "Each token, a day", everyone.perDay, String(REQUEST_BUDGET_DEFAULTS.day), PER_DAY_MAX)}${password}${buttons}`, { hidden: { target: "*" } });
-    const one = live.length === 0 ? "" : postForm("/settings/request-limits", html `\
-<h3>One token</h3><label>Token<select name="target">${live.map(row => {
-        const set = overrides.get(row.id);
-        return html `<option value="${row.id}">${row.name} (${row.account}, ${row.access === "act" ? "act" : "read"})${set === undefined ? "" : " · own limits"}</option>`;
-    })}</select></label>\
-<div class="pair">${field("per-minute", "A minute", null, "Everyone's", PER_MINUTE_MAX)}${field("per-day", "A day", null, "Everyone's", PER_DAY_MAX)}</div>${password}${buttons}`);
-    return html `<details class="card"><summary>Request limits</summary><div class="limits">${installation}${one}</div></details>`;
+    const one = live.length === 0 ? "" : disclose("Limits for one token", kitSectionForm({ proof: "request-limits", action: "/settings/request-limits", id: "limits-one",
+        save: { label: "Save limits", name: "action", value: "save" }, confirm: "Change one token's request limits",
+        body: joinHtml([
+            formRow("Token", null, select({ id: "limits-target", name: "target", label: "Token", wide: true, items: live.map(row => {
+                    const set = overrides.get(row.id);
+                    return [row.id, `${row.name} (${row.account}, ${row.access === "act" ? "act" : "read"})${set === undefined ? "" : " · own limits"}`];
+                }) })),
+            formRow("A minute", "Blank uses everyone's.", number("limits-one-minute", "per-minute", "A minute", null, "Everyone's", PER_MINUTE_MAX)),
+            formRow("A day", "Blank uses everyone's.", number("limits-one-day", "per-day", "A day", null, "Everyone's", PER_DAY_MAX)),
+            html `<div class="k-acts">${btn("Use everyone's limits", { sm: true, type: "submit", attrs: { name: "action", value: "clear" } })}</div>`,
+        ]) }));
+    return settingsSection({ id: "request-limits", title: "Request limits", lead: "How many requests each API token may make. A token over its limit is refused until the minute or day resets, and nothing it asked for runs.",
+        body: joinHtml([installation, reset, one, note("Only an instance operator sees and changes these.")]) });
 }

package/dist/result-follow-ups.js

@@ -2,6 +2,7 @@ import { checkoutRunner, ranAtLine, widestRan } from "./invoke.js";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { refArchived } from "./task-archive.js";
 import { belongsToRelease } from "./release-authority.js";
 import { run as execRun } from "./exec.js";
 import { hardenedGit } from "./teardown-git.js";
@@ -126,6 +127,9 @@ function checkTarget(store, runId, level) {
         return refuse("no-commit", "This result has no finished commit to check.");
     if (ref.repo === null)
         return refuse("unplaced", "This result isn't in a project, so there is no check to run.");
+    // A put-away task (v145) runs no checks: asked for or already waiting, it is refused until restored.
+    if (refArchived(store, ref.id))
+        return refuse("archived", "This task is put away. Restore it first.");
     const chosen = checkCommandFor(store, ref.repo, level);
     if (chosen.command === null)
         return refuse("no-check", `${ref.repo} has no approved ${level === "quick" ? "quick or full" : "full"} check. Set one in Settings → Projects → Checks.`);

package/dist/retention-ui.d.ts

@@ -1,11 +1,12 @@
 /**
  * Settings → Retention (v105): how long each kind of data is kept, and what
  * the next daily sweep would remove. An instance operator's page; changes
- * take a step-up.
+ * take a step-up. Built from the revamp kit; the Settings frame adds the title.
  */
 import { type Html } from "./html.js";
 import { type RetentionCount, type RetentionKind, type RetentionPeriods } from "./retention.js";
-export declare const RETENTION_CSS: string;
+/** The page is kit pieces now; nothing of the old look is left. Kept as an export for the shared stylesheet. */
+export declare const RETENTION_CSS = "";
 /** `chosen`: the kinds someone chose a period for; the rest keep their default. */
 export type RetentionView = {
     periods: RetentionPeriods;
@@ -14,7 +15,7 @@ export type RetentionView = {
     lastSweep: string | null;
     csrf: string;
 };
-export declare function retentionHtml(view: RetentionView, notice: {
+export declare function retentionHtml(view: RetentionView, said: {
     said?: string | null;
     problem?: string | null;
 }): Html;

package/dist/retention-ui.js

@@ -1,16 +1,15 @@
 /**
  * Settings → Retention (v105): how long each kind of data is kept, and what
  * the next daily sweep would remove. An instance operator's page; changes
- * take a step-up.
+ * take a step-up. Built from the revamp kit; the Settings frame adds the title.
  */
-import { html, postForm, reauth } from "./html.js";
+import { html, joinHtml } from "./html.js";
 import { bytesWords } from "./storage.js";
 import { RETENTION_KINDS, countWords, periodChoices, periodLabel } from "./retention.js";
-export const RETENTION_CSS = `.retention{max-width:720px;min-width:0}.retention-next{margin:0 0 16px}` +
-    `.retention form{display:grid;gap:0}.retention .kind{display:grid;grid-template-columns:minmax(0,1fr) 11rem;gap:4px 16px;align-items:center;padding:12px 0;border-bottom:1px solid var(--border)}` +
-    `.retention .kind .name{font-weight:500;font-size:.875rem}.retention .kind .meta{grid-column:1;margin:0}.retention .kind select{grid-column:2;grid-row:1/span 2;width:100%;min-height:44px}` +
-    `.retention .step-up{display:grid;gap:4px;font-size:.8125rem;margin:16px 0 8px;max-width:20rem}.retention .step-up input{min-height:44px}.retention button{justify-self:start;min-height:44px}` +
-    `@media (max-width:560px){.retention .kind{grid-template-columns:minmax(0,1fr)}.retention .kind select{grid-column:1;grid-row:auto}}`;
+import { formRow, infoLine, note, notice, select, settingsSection } from "./server/kit.js";
+import { kitSectionForm } from "./settings-kit.js";
+/** The page is kit pieces now; nothing of the old look is left. Kept as an export for the shared stylesheet. */
+export const RETENTION_CSS = "";
 const listWords = (parts) => parts.length < 2 ? parts.join("") : `${parts.slice(0, -1).join(", ")} and ${parts.at(-1)}`;
 /** The next sweep in a line: what goes and about how much space, or that nothing is due. */
 function nextWords(view) {
@@ -22,14 +21,18 @@ function nextWords(view) {
     const bytes = due.reduce((sum, one) => sum + one.bytes, 0);
     return `The next daily sweep removes ${listWords(due.map(countWords))} (about ${bytesWords(bytes)}).`;
 }
-export function retentionHtml(view, notice) {
-    const note = notice.problem ? html `<p class="problem" role="alert">${notice.problem}</p>` : notice.said ? html `<p role="status">${notice.said}</p>` : "";
+export function retentionHtml(view, said) {
     const rows = RETENTION_KINDS.map(({ kind, label, detail }) => {
         const current = view.periods[kind];
         const chosen = view.chosen.includes(kind);
-        const options = periodChoices(kind, current).map(days => html `<option value="${days === null ? "forever" : days}"${days === current ? html ` selected` : ""}>${periodLabel(kind, days, chosen || days !== current)}</option>`);
-        return html `<div class="kind" data-kind="${kind}"><label class="name" for="keep-${kind}">${label}</label><p class="meta">${detail}</p><select id="keep-${kind}" name="${kind}">${options}</select></div>`;
+        const items = periodChoices(kind, current).map(days => [days === null ? "forever" : String(days), periodLabel(kind, days, chosen || days !== current)]);
+        return formRow(label, detail, select({ id: `keep-${kind}`, name: kind, label, current: current === null ? "forever" : String(current), items }), "inline");
     });
     const last = view.lastSweep === null ? "" : ` Last sweep ${view.lastSweep.slice(0, 10)}.`;
-    return html `<article class="retention">${note}<p class="retention-next" data-retention-next>${nextWords(view)}${last}</p>${postForm("/settings/retention", html `${rows}${reauth(html `<label class="step-up">Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}<button type="submit">Save</button>`)}<p class="meta">Never removed: the action ledger, and anything a task still needs (unfinished tasks, results Ready for review, anything on hold).</p></article>`;
+    return settingsSection({ id: "retention", title: "How long data is kept", lead: html `<span data-retention-next>${nextWords(view)}${last}</span>`,
+        body: joinHtml([
+            said.problem ? notice(said.problem) : said.said ? infoLine(said.said) : "",
+            kitSectionForm({ proof: "retention", action: "/settings/retention", id: "retention-form", gate: true, body: joinHtml(rows) }),
+            note("Never removed: the action ledger, and anything a task still needs (unfinished tasks, results Ready for review, anything on hold)."),
+        ]) });
 }

package/dist/scope.d.ts

@@ -597,6 +597,11 @@ export type ApproveResult = {
  | {
     ok: false;
     reason: "machine-proof";
+}
+/** v145 (task-tidy.md): the task is put away; it is restored before anyone can approve it. */
+ | {
+    ok: false;
+    reason: "archived";
 };
 /**
  * Whether this name-and-token pair is a person the store knows. Shared by
@@ -999,3 +1004,6 @@ export declare function releaseApprovalOf(store: Store, taskId: string, _now?: D
     ok: false;
     why: string;
 };
+/** When a password typed at `at` (ISO) stops standing in, for a page's words (ISO); null when `at` isn't a time. Words
+ * only: freshnessFor decides whether it stands in, at the moment of use. */
+export declare function freshUntil(at: string): string | null;

package/dist/scope.js

@@ -48,6 +48,7 @@ import { z } from "zod";
 import {} from "./contracts/acceptance-terms.js";
 import { parseContract } from "./contracts/contract.js";
 import { readAcceptance, readScopeTerms, storedRubricSchema } from "./contracts/scope.js";
+import { taskArchived } from "./task-archive.js";
 import { releaseCiHoldOf, releaseCiHoldWords } from "./release-ci-hold.js";
 import { NO_READINESS, exactModelId, legOf, projectRoute, routeDigestOf, routeFromJson, routeJsonProblem, routeWords, } from "./phase-routing.js";
 /** Same shape as a runner's credential, for the same reasons. */
@@ -1074,6 +1075,9 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         const scope = store.getScope(taskId);
         if (scope === null)
             return { ok: false, reason: "no-scope" };
+        // A put-away task (v145) is restored first; sealScopeApproval refuses it too, on every road.
+        if (taskArchived(store, taskId))
+            return { ok: false, reason: "archived" };
         // The digest is required, not optional. An operator reads a scope, somebody
         // rewrites it, and an approval that did not name what it saw would agree to
         // the new one in silence — which is the whole failure this guards.
@@ -1472,6 +1476,9 @@ export function liveReleaseOf(store, taskId, action, now = new Date()) {
         return { applies: false };
     const { authority: a, carry } = found;
     const refuse = (why) => ({ applies: true, ok: false, why, authority: a });
+    // A put-away task (v145, task-tidy.md), or a put-away anchor, deploys, merges and carries nothing: restore it first.
+    if (taskArchived(store, taskId) || taskArchived(store, a.anchorTask))
+        return refuse("the release task is put away");
     const newest = newestReleaseGeneration(store, a.repo, a.version, a.pr);
     if (newest === null || newest.id !== a.id)
         return refuse("a newer approval of this release replaced this one");
@@ -1603,3 +1610,9 @@ export function releaseApprovalOf(store, taskId, _now = new Date()) {
     const auto = autoReleaseApprovalOf(store, taskId, "auto-green");
     return auto.ok ? { ok: true, by: auto.by, at: auto.at, method: "auto-green" } : auto;
 }
+/** When a password typed at `at` (ISO) stops standing in, for a page's words (ISO); null when `at` isn't a time. Words
+ * only: freshnessFor decides whether it stands in, at the moment of use. */
+export function freshUntil(at) {
+    const ms = Date.parse(at);
+    return Number.isFinite(ms) ? new Date(ms + FRESH_WINDOW_MS).toISOString() : null;
+}

package/dist/serve.d.ts

@@ -7,6 +7,5 @@ export { TASK_COMPOSER_MODES, type TaskComposerMode } from "./server/render-chat
 export { inboxFingerprints, parseInboxTab, queueScript, type InboxTab } from "./server/render-pages.js";
 export { ssoStepUps, wrongHostPage } from "./server/render-people.js";
 export { diffFileAnchor, editorFileHref, needActionOf, orderChangedFiles, plainConclusionOf, rankReviewQueue, reviewFilePriority, reviewPriorityOf, runFactsFragment, withinSignedTouches, type ReviewFileRow, type ReviewPriority, type ReviewQueueFacts } from "./server/render-results.js";
-export { settingsGroups, settingsTiles } from "./server/render-settings.js";
 export { decisionAnswerScript, earlierVersionsWords, revisionLineageWords, type RouteView } from "./server/render-tasks.js";
 export { SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH, type DecisionServer } from "./server/session.js";

package/dist/serve.js

@@ -157,9 +157,11 @@ import { chromeScript, DEMO_BANNER, DEMO_BANNER_SHORT, focusDocument, KBD_HELP,
 import { BODY_CAP, form, loginHref, matchTaskPath, page, projectChatHref, redactedPath, redirect, respond, safeReturn, SHUTDOWN_WAIT_MS, taskChatHref } from "./server/http.js";
 import { decisionsFor, LEAD_BY_DEFAULT_FACT, leadBrowserMessages, leadChatVersion, NOT_STARTED_SESSION, TASK_COMPOSER_MODES, teamProposalCardParts } from "./server/render-chat.js";
 import {} from "./server/render-pages.js";
-import { ssoStepUps, wrongHostPage } from "./server/render-people.js";
+import { serverErrorPage, ssoStepUps, wrongHostPage } from "./server/render-people.js";
 import { NO_PROJECT, NO_TOUCH_FRAGMENTS, NONCE_CAP, NONCE_TTL_MS, PersistentSessions, SESSION_ABSOLUTE_MS, SESSION_IDLE_MS, sessionWithinLifetime, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH } from "./server/session.js";
 import { createTasksHandlers } from './server/tasks.js';
+import { KIT_BEHAVIOR_MARKUP, KIT_STANDALONE_SCRIPT } from './server/kit-standalone.js';
+import { createWelcomeHandlers } from './server/welcome.js';
 import { DEFAULT_GUARD_POLICY, passwordGuardOf, provenPasswordAccount, SourceBudget, withPasswordSource } from "./sign-in-guard.js";
 import { sourceKey } from "./source-key.js";
 import { readSsoSettings } from "./sso-settings.js";
@@ -670,14 +672,26 @@ export function createDecisionServer(options) {
         // A GET or HEAD only reads (docs/plans/get-side-effects.md): store reads that would tidy up as they go don't.
         const answer = () => handle(request, response);
         void withPasswordSource(joinSourceOf(request), () => request.method === "GET" || request.method === "HEAD" ? asReadOnlyRequest(answer) : answer()).catch(error => {
-            // Every unhandled error is logged (v99): the path and the message, never the request's body or query.
-            logEvent("error", "serve.error", { method: request.method, path: redactedPath(new URL(request.url ?? "/", "http://placeholder").pathname), error: error instanceof Error ? error.message : String(error) });
+            // Every unhandled error is logged (v99): the path and the message, never the request's body or query. The reference
+            // is what a person's error page shows, so the log line can be found from it.
+            const reference = `err_${randomBytes(4).toString("hex")}`;
+            logEvent("error", "serve.error", { method: request.method, path: redactedPath(new URL(request.url ?? "/", "http://placeholder").pathname), error: error instanceof Error ? error.message : String(error), reference });
             if (envValue(process.env, "SERVE_DEBUG") === "1")
                 console.error("SERVE ERROR:", error);
             if (!response.headersSent) {
                 const updating = error instanceof Error && error.message.includes(UPDATE_PAUSED);
                 if (updating)
                     response.setHeader("Retry-After", "5");
+                // A browser asking for a page gets a page (Wave E): what happened, whether anything changed, the reference. It
+                // holds no error text. Everything else keeps the plain answer.
+                if (/\btext\/html\b/.test(String(request.headers.accept ?? "")) && (request.method === "GET" || request.method === "POST")) {
+                    const read = request.method === "GET";
+                    const at = new URL(request.url ?? "/", "http://placeholder");
+                    try {
+                        return page(response, updating ? 503 : 500, serverErrorPage({ updating, read, reference, at: new Date(), retry: read ? at.pathname + at.search : null }));
+                    }
+                    catch { /* the plain answer below */ }
+                }
                 respond(response, updating ? 503 : 500, "text/plain; charset=utf-8", updating ? UPDATE_PAUSED : "something broke");
             }
             else {
@@ -1058,6 +1072,19 @@ export function createDecisionServer(options) {
             }
             project = wanted;
         }
+        // Home (UI revamp wave B) shows every project unless its address names one (proved the same way), and the rail's
+        // and the dock's Needs-you count follow that same one scope.
+        if (route.id === 'home') {
+            const wanted = url.searchParams.get('project');
+            if (wanted !== null && (url.searchParams.getAll('project').length !== 1 || !visible(wanted) ||
+                ![...managedRepos(), ...store.listProjects().map(one => one.path)].includes(wanted))) {
+                return refuse(response, who, 404, 'That project is not available in this workspace.', '/');
+            }
+            project = wanted;
+        }
+        // All projects, asked for by name on Tasks (its project filter): the rolled-up list, admission-bound as ever.
+        if (route.id === 'work' && url.searchParams.get('all') === '1' && !url.searchParams.has('project') && url.searchParams.getAll('all').length === 1)
+            project = null;
         // Every page's Tasks count covers this one project view, whatever project the page itself shows.
         const facts = requestContext.getStore();
         if (facts !== undefined)
@@ -1618,8 +1645,22 @@ export function createDecisionServer(options) {
                 catchUpHtml: extras.catchUpHtml === undefined ? '' : htmlString(extras.catchUpHtml), controlsHtml: extras.controlsHtml === undefined ? '' : htmlString(extras.controlsHtml), notices, view: extras.view ?? null,
                 ...(s.chrome.demo ? { demo: { text: DEMO_BANNER, short: DEMO_BANNER_SHORT } } : {}),
                 pageHtml: extras.pageHtml === undefined ? (conversation === null ? pageHtml : null) : extras.pageHtml === null ? null : htmlString(extras.pageHtml),
-                navigation: [...browserNavigationOf(currentPath, s.chrome.project, needsYou, tasksProject, s.chrome.inboxLabel), { label: 'Workspace tools', href: '/menu', active: path.pathname === '/menu' }],
+                navigation: browserNavigationOf(currentPath, s.chrome.project, needsYou, tasksProject, s.chrome.inboxLabel),
+                // The one Needs-you count (tasks only), with the scope it covers: the Tasks list's own count for this project
+                // view (or every project), so the rail, the phone header and Home all read the same number.
+                needsYou: { count: needsYou, saturated: s.chrome.inboxSaturated === true, scope: tasksProject ?? null,
+                    label: s.chrome.inboxLabel ?? `${needsYou} ${needsYou === 1 ? 'needs' : 'need'} you`,
+                    // Every project, said by name (all=1), so a session's own open project never narrows the list the count opens.
+                    href: tasksProject === null ? '/work?all=1&view=needs-you' : `/work?project=${encodeURIComponent(tasksProject)}&view=needs-you` },
                 chats,
+                // The same count per project (the rail's project rows), read from the same work index totals.
+                ...(() => { if (sensitive)
+                    return {}; try {
+                    return { needsYouByProject: projectCounts(clock()).map(one => ({ path: one.repo, count: one.totals['needs-you'] })) };
+                }
+                catch {
+                    return {};
+                } })(),
                 ...(s.refreshSeconds === undefined ? {} : { refreshSeconds: Math.max(5, Math.floor(s.refreshSeconds)) }),
                 ...(s.chrome.signIn === undefined ? {} : { signIn: s.chrome.signIn }),
                 ...(s.chrome.update === undefined ? {} : { update: s.chrome.update }),
@@ -1662,7 +1703,10 @@ export function createDecisionServer(options) {
         const functional = s.functional?.script ?? "";
         // Sensitive pages strip the palette and keys but keep the sidebar toggle.
         const sensitiveChrome = sensitive && s.chrome !== undefined ? sidebarScript() : "";
-        const script = functional + (chromeLayer ? chromeScript() + WORKSPACE_MOTION_SCRIPT : sensitiveChrome);
+        // Kit markup the workspace bundle would have wired (a composer, an overlay, a switch, an idea) gets the kit's own small
+        // behaviour here (kit-standalone.ts); never on a sensitive page, which carries no chrome additions.
+        const kitBehavior = chromeLayer && KIT_BEHAVIOR_MARKUP.test(htmlString(s.body)) ? KIT_STANDALONE_SCRIPT : "";
+        const script = functional + (chromeLayer ? chromeScript() + WORKSPACE_MOTION_SCRIPT + kitBehavior : sensitiveChrome);
         const nonce = script === "" ? undefined : randomBytes(16).toString("base64");
         const body = chromeLayer
             ? html `${s.body}\n${paletteTagCached(s.chrome?.project ?? null)}\n${KBD_HELP}`
@@ -1774,7 +1818,7 @@ export function createDecisionServer(options) {
                 const update = updateFacts();
                 if (update === null || !update.newer || update.release === null || facts.updateSeen === update.release.version)
                     return {};
-                return { update: { version: update.release.version, security: update.release.security, href: "/settings#updates", dismissHref: "/settings/updates/dismiss" } };
+                return { update: { version: update.release.version, security: update.release.security, href: "/settings/system#updates", dismissHref: "/settings/updates/dismiss" } };
             })(),
             ...(() => {
                 const databaseFile = store.databaseFile();
@@ -2301,6 +2345,7 @@ export function createDecisionServer(options) {
         ...tasksHandlers.registrations, ...flowsHandlers.registrations, ...chatHandlers.registrations,
         ...settingsHandlers.registrations, ...peopleHandlers.registrations, ...pagesHandlers.registrations,
         ...remoteHandlers.registrations, ...liveHandlers.registrations, ...terminalHandlers.registrations, ...createSweepHandlers(handlerRuntime).registrations,
+        ...createWelcomeHandlers(handlerRuntime).registrations,
     ]);
     /** The row's role, after admission and before its one handler. */
     function dispatchConsole(route, ctx) {
@@ -2333,7 +2378,6 @@ export { TASK_COMPOSER_MODES } from "./server/render-chat.js";
 export { inboxFingerprints, parseInboxTab, queueScript } from "./server/render-pages.js";
 export { ssoStepUps, wrongHostPage } from "./server/render-people.js";
 export { diffFileAnchor, editorFileHref, needActionOf, orderChangedFiles, plainConclusionOf, rankReviewQueue, reviewFilePriority, reviewPriorityOf, runFactsFragment, withinSignedTouches } from "./server/render-results.js";
-export { settingsGroups, settingsTiles } from "./server/render-settings.js";
 export { decisionAnswerScript, earlierVersionsWords, revisionLineageWords } from "./server/render-tasks.js";
 export { SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH } from "./server/session.js";
 /**

package/dist/server/agents-computers.d.ts

@@ -0,0 +1,9 @@
+import type { BrowserAgentPhase, BrowserAgentsSystem, BrowserComputers } from "../browser-workspace.js";
+import type { Store, WorktreeRow } from "../store.js";
+/** Every registered computer that isn't retired, plus a retired one still holding reserved work, as Agents lists it. */
+export declare function computersOf(store: Store, now: Date, visible: (repo: string | null) => boolean, manage: boolean): BrowserComputers;
+/** Which provider and model runs each phase for the open project (or the installation), and where that choice comes from. */
+export declare function phasesOf(store: Store, project: string | null): BrowserAgentPhase[];
+/** The rest of what /system showed: its workspaces, the background service on the open project, notifications waiting
+ * to go out and external work. */
+export declare function systemOf(store: Store, project: string | null, worktreeShown: (tree: WorktreeRow) => boolean, visible: (repo: string | null) => boolean): BrowserAgentsSystem;

package/dist/server/agents-computers.js

@@ -0,0 +1,67 @@
+/**
+ * The Agents page's installation parts (UI revamp wave B): the computers that build (what /fleet showed), which model
+ * runs each phase and the rest of what /system showed. Saved facts only, filtered through the caller's `visible`, for
+ * a person with access to the whole installation; nothing here grants an act (register, retire, move and note keep
+ * their own handlers and checks).
+ */
+import { INSTALLATION_SCOPE, resolvePhaseAgent } from "../agentconfig.js";
+import { agentModelName } from "../model-names.js";
+import { projectName } from "../project.js";
+import { isAlive } from "../runner.js";
+import { taskHref } from "./http.js";
+/** Every registered computer that isn't retired, plus a retired one still holding reserved work, as Agents lists it. */
+export function computersOf(store, now, visible, manage) {
+    const queued = store.fleetQueue(now);
+    const claims = store.liveClaims(null, now);
+    const owned = new Set(queued.map(one => one.assignedRunner).filter((one) => one !== null));
+    const runners = store.listRunners().filter(one => one.retiredAt === null || owned.has(one.name));
+    const list = runners.map(runner => {
+        const live = claims.filter(claim => claim.runner === runner.name);
+        const shown = live.filter(claim => visible(claim.repo ?? null));
+        const alive = isAlive(runner, now);
+        return {
+            name: runner.name, host: runner.host, capacity: runner.capacity, retired: runner.retiredAt !== null,
+            state: !alive ? "offline" : live.length > 0 ? "building" : "idle",
+            building: shown.map(claim => ({ taskId: claim.taskId, title: store.getTask(claim.taskId)?.title ?? claim.taskId, href: taskHref(claim.taskId),
+                project: claim.repo == null ? null : projectName(claim.repo) })),
+            hidden: live.length - shown.length,
+            heardAt: runner.heartbeatAt, registeredAt: runner.registeredAt,
+            projects: runner.repos.filter(repo => visible(repo)).map(repo => projectName(repo)),
+            note: runner.queueNote ?? null,
+            reserved: queued.filter(one => one.assignedRunner === runner.name && visible(one.repo))
+                .map(one => ({ id: one.id, title: one.title, href: taskHref(one.id), project: one.repo === null ? null : projectName(one.repo), taken: one.taken })),
+        };
+    });
+    return { list, manage, queueRevision: store.queueRevision(), shared: queued.filter(one => one.assignedRunner === null && visible(one.repo)).length };
+}
+const PHASES = ["plan", "build", "repair", "review"];
+/** Which provider and model runs each phase for the open project (or the installation), and where that choice comes from. */
+export function phasesOf(store, project) {
+    return PHASES.map(phase => {
+        const answer = resolvePhaseAgent(store, phase, project, {});
+        const row = (project === null ? null : store.phaseConfig(project, phase)) ?? store.phaseConfig(INSTALLATION_SCOPE, phase);
+        const by = row?.updatedBy == null ? "" : ` by ${row.updatedBy}`;
+        if (!answer.ok)
+            return { phase, model: null, problem: answer.problem, source: "", noDollars: false };
+        const source = answer.source === "project" ? `Chosen for this project${by}`
+            : answer.source === "installation" ? `Set for the whole installation${by}` : "The default: nothing chosen";
+        return { phase, model: agentModelName(answer.spec.provider, answer.spec.model ?? null), problem: null, source, noDollars: answer.spec.provider !== "claude" };
+    });
+}
+/** The rest of what /system showed: its workspaces, the background service on the open project, notifications waiting
+ * to go out and external work. */
+export function systemOf(store, project, worktreeShown, visible) {
+    const workspaces = store.listWorktrees().filter(worktreeShown).map(tree => {
+        const leased = tree.leasedAt !== null && tree.releasedAt === null;
+        return { name: tree.path.split("/").pop() ?? tree.path, branch: tree.branch, state: leased ? "building" : tree.verified ? "free" : "needs review" };
+    });
+    const episode = project === null ? null : store.latestWatchEpisode(project);
+    const service = episode === null ? null : { running: episode.endedAt === null, at: episode.endedAt ?? episode.startedAt, built: episode.built, broke: episode.broke };
+    const external = store.listGrants()
+        .filter(one => one.dispatch === true && one.remoteRepo != null && visible(one.repo))
+        .map(one => {
+        const open = store.listNotifications("all").find(n => n.kind === "sync-failed" && n.resolvedAt === null && n.dedupeKey.startsWith(`sync:${one.remoteRepo}:`))?.subject ?? null;
+        return { repo: String(one.remoteRepo), state: one.dispatchBlocked != null ? "Dispatch blocked: the tracker connection needs repair (toolroll sync says why)" : open !== null ? `Sync failing: ${open}` : "Syncing normally" };
+    });
+    return { workspaces, service, outbox: store.pendingForAttention().length, external };
+}