toolroll 0.9.85 → 0.9.87

package/dist/browser-workspace.js

@@ -96,16 +96,17 @@ export function browserProjectsOf(projects) {
 }
 export function browserNavigationOf(path, project = null, needsYou = 0, tasksProject = project, needsYouLabel) {
     const pathname = path.split('?')[0].split('#')[0];
-    const knowledge = pathname === '/settings/knowledge' || pathname.startsWith('/settings/knowledge/');
+    const under = (...roots) => roots.some(root => pathname === root || pathname.startsWith(`${root}/`));
+    // The rail (UI revamp, wave B): Home carries the one Needs-you count; the lead chat and an agent's question live
+    // under Home, a task's pages under Tasks, every computer and terminal under Agents, every setting under Settings.
     return [
-        { label: 'Chat', href: '/chat', active: pathname === '/chat' },
-        { label: 'Tasks', href: `/work${tasksProject === null ? '' : `?project=${encodeURIComponent(tasksProject)}`}`,
-            active: pathname === '/work' || pathname === '/tasks' || pathname.startsWith('/t/') || pathname.startsWith('/r/'),
+        { label: 'Home', href: '/', active: pathname === '/' || pathname === '/chat' || under('/d', '/activity', '/morning'),
             ...(needsYou > 0 ? { count: needsYou, ...(needsYouLabel === undefined ? {} : { countLabel: needsYouLabel }) } : {}) },
-        { label: 'Agents', href: '/agents', active: pathname === '/agents' || pathname === '/peek' },
-        { label: 'Flows', href: '/flows', active: pathname === '/flows' || pathname.startsWith('/flows/') },
-        { label: 'Projects', href: '/projects', active: pathname === '/projects' },
-        { label: 'Knowledge', href: `/settings/knowledge${project === null ? '' : `?repo=${encodeURIComponent(project)}`}`, active: knowledge },
-        { label: 'Settings', href: '/settings', active: !knowledge && (pathname === '/settings' || pathname.startsWith('/settings/')) },
+        { label: 'Tasks', href: `/work${tasksProject === null ? '' : `?project=${encodeURIComponent(tasksProject)}`}`,
+            active: under('/work', '/tasks', '/t', '/r', '/done', '/board', '/queue', '/inbox', '/review') },
+        { label: 'Flows', href: '/flows', active: under('/flows', '/recipes', '/kits', '/routines') },
+        { label: 'Agents', href: '/agents', active: under('/agents', '/peek', '/term', '/fleet', '/system', '/runs') },
+        { label: 'Projects', href: '/projects', active: under('/projects') },
+        { label: 'Settings', href: '/settings', active: under('/settings', '/spend', '/mode', '/people', '/ledger', '/menu') },
     ];
 }

package/dist/chat-actions.d.ts

@@ -153,6 +153,16 @@ export declare const CHAT_ACTIONS: {
         readonly protected: false;
         readonly password: false;
     };
+    readonly flow_browser: {
+        readonly label: "Allow browser";
+        readonly protected: true;
+        readonly password: true;
+    };
+    readonly flow_browser_off: {
+        readonly label: "Turn off browser";
+        readonly protected: false;
+        readonly password: false;
+    };
     readonly subagent_create: {
         readonly label: "Add subagent";
         readonly protected: false;
@@ -266,7 +276,7 @@ export declare function sharedActionReviewPath(id: number): string;
 export declare function mintSharedActionReview(store: Store, who: VerifiedApprover, id: number, root: string, now: Date): {
     payload: {
         version: 1;
-        operation: "decision_record" | "decision_retire" | "flow_card_add" | "flow_card_approve" | "flow_card_assign" | "flow_card_cancel" | "flow_card_choose" | "flow_card_comment" | "flow_card_move" | "flow_card_send_back" | "flow_card_watch" | "flow_create" | "flow_edit" | "flow_script_save" | "flow_starter" | "flow_trigger_add" | "flow_trigger_pause" | "flow_trigger_remove" | "flow_trigger_resume" | "kit_setup" | "knowledge_instructions" | "knowledge_remove" | "knowledge_restore" | "knowledge_save" | "lead_about_you" | "result_accept" | "scope_approve" | "skill_disable" | "skill_enable" | "skill_import" | "skill_restore" | "skill_test" | "subagent_answer" | "subagent_ask" | "subagent_create" | "subagent_memory" | "subagent_note" | "subagent_routine" | "subagent_soul" | "subagent_state" | "subagent_tools" | "subagent_undo" | "sweep_cancel_rest" | "sweep_file" | "task_cancel" | "task_resume" | "tool_add" | "tool_remove";
+        operation: "decision_record" | "decision_retire" | "flow_browser" | "flow_browser_off" | "flow_card_add" | "flow_card_approve" | "flow_card_assign" | "flow_card_cancel" | "flow_card_choose" | "flow_card_comment" | "flow_card_move" | "flow_card_send_back" | "flow_card_watch" | "flow_create" | "flow_edit" | "flow_script_save" | "flow_starter" | "flow_trigger_add" | "flow_trigger_pause" | "flow_trigger_remove" | "flow_trigger_resume" | "kit_setup" | "knowledge_instructions" | "knowledge_remove" | "knowledge_restore" | "knowledge_save" | "lead_about_you" | "result_accept" | "scope_approve" | "skill_disable" | "skill_enable" | "skill_import" | "skill_restore" | "skill_test" | "subagent_answer" | "subagent_ask" | "subagent_create" | "subagent_memory" | "subagent_note" | "subagent_routine" | "subagent_soul" | "subagent_state" | "subagent_tools" | "subagent_undo" | "sweep_cancel_rest" | "sweep_file" | "task_cancel" | "task_resume" | "tool_add" | "tool_remove";
         request: {
             [x: string]: unknown;
         };

package/dist/chat-actions.js

@@ -25,6 +25,7 @@ import { saveScript, scriptDigest, validateScript } from "./flow-scripts.js";
 import { addCardToFlow, advanceFlows, cancelFlowCard, crossProjectProblem, decideFlowCard, flowCardHref, flowCardText, flowDefinitionOf, moveCardInFlow } from "./flow-engine.js";
 import { chooseFlowCard, flowPersonOf } from "./flow-send.js";
 import { assignFlowCard, commentOnFlowCard, flowPeople, mentionsIn, watchFlowCard } from "./flow-people.js";
+import { browserViewOf, liveBrowserGrant, revokeFlowBrowser, signFlowBrowser } from "./flow-browser.js";
 import { addFlowTriggerTo, describeTrigger, readLinearKey, removeFlowTrigger, takesDeliveries, triggerConfigOf, validateTriggerConfig } from "./flow-triggers.js";
 import { describeSchedule, parseSchedule } from "./flow-schedule.js";
 import { dirname } from "node:path";
@@ -109,6 +110,10 @@ export const CHAT_ACTIONS = {
     flow_trigger_pause: { label: "Pause trigger", protected: false, password: false },
     flow_trigger_resume: { label: "Turn trigger on", protected: false, password: false },
     flow_trigger_remove: { label: "Remove trigger", protected: false, password: false },
+    // Browser use widens a flow's sandbox (flow-browser.ts): the lead may only propose it; a person allows it with their
+    // own password on the secure screen, never on a chat card or a paired phone's tap. Turning it off lowers authority.
+    flow_browser: { label: "Allow browser", protected: true, password: true },
+    flow_browser_off: { label: "Turn off browser", protected: false, password: false },
     subagent_create: { label: "Add subagent", protected: false, password: false },
     subagent_soul: { label: "Update soul file", protected: false, password: false },
     subagent_state: { label: "Change subagent", protected: false, password: false },
@@ -710,6 +715,32 @@ export function prepareSharedAction(store, who, operation, input, root, now = ne
                 terms.push("Only what happens from now on counts; nothing already there is added.");
             terms.push("Work a card starts still waits for your usual approvals.");
         }
+        else if (operation === "flow_browser" || operation === "flow_browser_off") {
+            const { flow } = flowTarget;
+            const view = browserViewOf(store, flow);
+            if (view === null)
+                throw Error(`No zone in ${flow.name} says it starts a browser. Mark its script zone first (edit the flow), then propose this.`);
+            // As on the flow page (route table: instance access), a project-limited account can't allow browser use.
+            if (operation === "flow_browser" && store.accountOf(who.name)?.projects !== null)
+                throw Error("Allowing browser use needs an account with access to every project.");
+            if (operation === "flow_browser_off") {
+                if (liveBrowserGrant(store, flow.id) === null)
+                    throw Error(`Browser use isn't allowed for ${flow.name}.`);
+                state = { flow: flow.id, grant: liveBrowserGrant(store, flow.id).id };
+                title = `Turn off browser use in ${flow.name}`;
+                terms.push(`${flow.name}'s browser zones stop and wait until a person allows browser use again.`);
+            }
+            else {
+                if (view.status === "allowed")
+                    throw Error(`${view.words}.`);
+                if (view.digest === null)
+                    throw Error(view.problem ?? "This flow's browser zones can't be approved as they are.");
+                // The approval the person reads and the one their password signs: the digest is re-derived when they confirm.
+                state = { flow: flow.id, revision: flow.revision, digest: view.digest };
+                title = `Allow browser use in ${flow.name}`;
+                terms.push(`Flow: ${flow.name} · project ${project}`, ...view.zones.map(zone => `${zone.title} runs ${zone.script} v${zone.version}\nScript digest ${zone.digest}`), "Each run of these zones starts a headless Chromium.", ...view.terms, `Approval digest ${view.digest}`);
+            }
+        }
         else if (operation === "flow_trigger_pause" || operation === "flow_trigger_resume" || operation === "flow_trigger_remove") {
             const { flow, trigger } = flowTarget;
             const config = trigger === null ? null : triggerConfigOf(trigger);
@@ -1099,6 +1130,7 @@ export function executeSharedAction(store, who, id, payload, now, options) {
     }
     // The review nonce was minted against the saved proposal's stamp: it is checked against that, whoever reviews.
     const savedStamp = payload.stamp;
+    let personProved = null;
     payload = live;
     const config = CHAT_ACTIONS[live.operation], req = live.request;
     const challenged = options.via !== "web" &&
@@ -1113,10 +1145,14 @@ export function executeSharedAction(store, who, id, payload, now, options) {
         // A scope approval proves its person inside approve() (one transaction with the seal, under the same freshness
         // rule as the task page); here an empty field is only looked at, never spent (an explicit re-check is one-use).
         const emptyApproval = payload.operation === "scope_approve" && options.review.password === "";
+        const proved = config.password && !emptyApproval ? authenticateApprover(store, who.name, options.review.password, payload.repo) : null;
+        // How the person was proved, for an approval that records it (browser use: flow-browser.ts refuses any but a person's).
+        if (proved?.ok === true)
+            personProved = proved.method;
         if (config.password &&
             (emptyApproval
                 ? !passwordlessSessionFor(store, who.name) && !ssoNowAvailable(who.name) && withFreshness("approve-standard", () => freshnessFor(who.name)) === null
-                : !authenticateApprover(store, who.name, options.review.password, payload.repo).ok))
+                : proved?.ok !== true))
             return refuse("needs-confirm", "Confirm with your password in the secure screen.");
     }
     try {
@@ -1156,6 +1192,22 @@ export function executeSharedAction(store, who, id, payload, now, options) {
                         ? {}
                         : { restore: Number(req["restore"]) }),
                 }, now);
+            else if (payload.operation === "flow_browser") {
+                // Only through the secure screen with the person's own password (protected + password above); signFlowBrowser
+                // re-reads the flow, its zones and scripts in this transaction and refuses unless they are what the card showed.
+                const flow = Number(payload.state["flow"]);
+                // signFlowBrowser re-reads the account's generation and reach in its transaction (it may have narrowed since).
+                const signed = signFlowBrowser(store, { flow, signer: actor, proof: personProved, sawDigest: String(payload.state["digest"] ?? ""), console: { generation: who.generation } }, now);
+                if (!signed.ok)
+                    throw Error(signed.message);
+                return { ok: true, taskId: null, said: "Browser allowed. Its browser zones can start Chromium now.", href: `/flows/${flow}` };
+            }
+            else if (payload.operation === "flow_browser_off") {
+                const flow = Number(payload.state["flow"]);
+                if (!revokeFlowBrowser(store, flow, actor, now))
+                    throw Error("Browser use was already off.");
+                return { ok: true, taskId: null, said: "Browser turned off. Its browser zones wait until someone allows it again.", href: `/flows/${flow}` };
+            }
             else if (payload.operation.startsWith("flow_")) {
                 const done = runFlowAction(store, payload, actor, who.repos, options.root, now);
                 return { ok: true, taskId: null, said: done.said, href: done.href };

package/dist/chat-channel.js

@@ -578,6 +578,7 @@ export const CHAT_ACTION_PARITY = {
     ask_owner: { support: "direct", how: "One question with 2-4 options and Something else, drawn as buttons under the reply; the tapped option is sent as the person's next message.", gap: null },
     search_project_memory: { support: "direct", how: "Read during a turn: one search over decisions, references, lessons and the conversations the person may read.", gap: null },
     list_tasks: { support: "direct", how: "Read during a turn.", gap: null },
+    tidy_preview: { support: "direct", how: "Read during a turn: what Put away old tasks would put away now and why. Only a person puts tasks away, on the console or with the CLI command it names.", gap: null },
     get_task: {
         support: "direct",
         how: "Read during a turn; a reply to a result message pins the exact execution.",

package/dist/chat-controls.d.ts

@@ -76,7 +76,7 @@ export declare const CHAT_CONTROLS: {
     };
     readonly providers: {
         readonly label: "Connect an agent";
-        readonly href: "/settings#providers";
+        readonly href: "/settings/agents#providers";
     };
     readonly skills: {
         readonly label: "Manage skills";

package/dist/chat-controls.js

@@ -21,7 +21,7 @@ export const CHAT_CONTROLS = {
     integrations: { label: "Set up integrations", href: "/settings/integrations" },
     settings: { label: "Open settings", href: "/settings" },
     permissions: { label: "Review permissions", href: "/settings" },
-    providers: { label: "Connect an agent", href: "/settings#providers" },
+    providers: { label: "Connect an agent", href: "/settings/agents#providers" },
     skills: { label: "Manage skills", href: "/settings/skills" },
     tools: { label: "Manage tools", href: "/settings/tools" },
     knowledge: { label: "Edit project knowledge", href: "/settings/knowledge" },

package/dist/chat-quiet.js

@@ -10,7 +10,7 @@ import { telegramProgressCard } from "./telegram-progress.js";
 import { assignmentStatusFacts, headlineEmoji, taskStatusOf } from "./task-status.js";
 import { asksToFinish, batchLine, chatText, chatTitle, factLinkLabel, mentions, READY_ACTIONS } from "./chat-voice.js";
 import { phoneText, projectLabel } from "./telegram-status.js";
-import { isLifecycleNotification } from "./store.js";
+import { isLifecycleNotification, taskArchived } from "./store.js";
 import { leadSubjectOf } from "./lead-voice.js";
 import { decideFallbackLink, decideTargetOf } from "./chat-decide.js";
 import { YOUIYOUX_CARD_KIND } from "./contracts/youiyoux-request.js";
@@ -199,7 +199,8 @@ export function eveningDigestText(store, account, now, root) {
     const visible = (row) => row.project !== null && store.accountCanAccess(account, row.project);
     const title = (taskId) => chatTitle(store, taskId);
     const finished = new Map(), failed = new Map(), waits = new Map();
-    const facts = store.taskFactsSince(recent).filter(visible);
+    // A put-away task (v145) is out of the digest too: nothing about it waits, finished or failed for anyone now.
+    const facts = store.taskFactsSince(recent).filter(visible).filter(row => row.taskId === null || !taskArchived(store, row.taskId));
     for (const row of facts) {
         if (row.createdAt < since || row.taskId === null)
             continue;

package/dist/chat-settings-page.d.ts

@@ -7,17 +7,37 @@ export type ChatSettingsOptions = {
     now?: Date;
     who?: string;
 };
-/** What differs between the Slack and Discord settings pages; everything else is one page. */
+/** What differs between the Slack, Discord and Teams settings pages; everything else is one page. */
 export type ChatSettingsPage = {
-    provider: "slack" | "discord";
+    provider: "slack" | "discord" | "teams";
     label: string;
     credentials: ChatIdentity | null;
-    /** How to create the app, shown before it is connected. */
-    setup: Html;
-    /** The connect form's fields around the password. */
-    connect: (password: Html) => Html;
-    /** The "Access and setup" paragraphs. */
-    access: Html;
+    /** One sentence on what connecting gives, shown before it is connected. */
+    intro: string;
+    /** How to create the app, as list items, shown before it is connected. */
+    steps: Html;
+    /** The connect form's own fields (the password is the kit's). */
+    fields: Html;
+    /** One line under the connect fields. */
+    fieldsNote: string;
+    /** Where the pairing message is sent ("in a direct message to your Toolroll Slack app"). */
+    pairWhere: string;
+    /** What to try once paired. */
+    tryLine: Html;
+    /** Lines shown with the connection (the Teams messaging endpoint). */
+    connection?: Html;
+    /** The status words while connected and while waiting. */
+    liveWords?: readonly [on: string, off: string];
+    /** The "Access and setup" paragraphs, if any. */
+    access?: Html;
 };
-/** Settings → Slack or Discord: connect the app once, then each teammate pairs their own account. */
+/** A secret the connect form posts (an app or bot token, a client secret): masked, never given a value, kept out of
+ * password managers. */
+export declare function chatSecretRow(options: {
+    id: string;
+    name: string;
+    label: string;
+    placeholder?: string;
+}): Html;
+/** Settings → Slack, Discord or Teams: connect the app once, then each teammate pairs their own account. */
 export declare function chatSettingsHtml(store: Store, dir: string, options: ChatSettingsOptions, page: ChatSettingsPage): Html;

package/dist/chat-settings-page.js

@@ -1,41 +1,72 @@
+import { settingsSubPage } from "./settings-groups-ui.js";
 import { loadPrimary } from "./webhooks.js";
-import { html, postForm } from "./html.js";
+import { html, joinHtml } from "./html.js";
 import { ChatState } from "./chat-delivery-state.js";
-/** Settings → Slack or Discord: connect the app once, then each teammate pairs their own account. */
+import { acts, btn, chip, codeLine, disclose, formRow, infoLine, input, note, notice, settingsSection } from "./server/kit.js";
+import { kitSectionForm, SECRET_OPT_OUTS } from "./settings-kit.js";
+/** A secret the connect form posts (an app or bot token, a client secret): masked, never given a value, kept out of
+ * password managers. */
+export function chatSecretRow(options) {
+    return formRow(options.label, null, input({ id: options.id, name: options.name, type: "password",
+        attrs: { autocomplete: "off", spellcheck: "false", "data-so-secret": true, ...SECRET_OPT_OUTS, required: true, placeholder: options.placeholder, "aria-label": options.label } }));
+}
+/** Settings → Slack, Discord or Teams: connect the app once, then each teammate pairs their own account. */
 export function chatSettingsHtml(store, dir, options, page) {
     const { provider, label, credentials } = page, state = new ChatState(store, provider), bindings = credentials ? state.bindings(credentials.installation).filter(one => state.live(one)) : [], binding = options.who === undefined ? null : bindings.find(one => one.approver === options.who) ?? null, others = bindings.length - (binding === null ? 0 : 1);
     const runtime = credentials ? state.runtime(credentials.installation) : null;
-    const now = options.now ?? new Date(), live = runtime &&
+    const now = options.now ?? new Date(), live = runtime !== null &&
         runtime.leaseUntil !== null &&
         runtime.leaseUntil > now.toISOString() &&
         runtime.connected;
-    const password = html `<label>Your Toolroll password<input style="min-height:44px" type="password" name="password" autocomplete="current-password" required></label>`;
-    const post = (action, content) => postForm(`/settings/${provider}/${action}`, content, { attrs: { class: "card" } });
-    const parts = [];
+    const route = (action) => `/settings/${provider}/${action}`;
+    const problem = options.problem ? notice(options.problem) : "";
+    const access = page.access === undefined ? "" : disclose("Access and setup", page.access);
+    const sections = [];
     if (!credentials) {
-        parts.push(html `<p>Manage projects and review results in a private ${label} conversation.</p>`, page.setup, post("connect", page.connect(password)));
+        sections.push(settingsSection({ id: "setup", title: `1. Create the ${label} app`, body: page.steps }), settingsSection({ id: "connect", title: `2. Connect ${label}`,
+            body: kitSectionForm({ proof: `${provider}-open`, action: route("connect"), id: "connect-form", save: { label: `Connect ${label}` },
+                confirm: `Connect ${label}`, body: joinHtml([page.fields, note(page.fieldsNote)]) }) }), settingsSection({ id: "pair", title: "3. Pair your account", body: note(`Once ${label} is connected, pair your own account here.`) }));
+        return settingsSubPage("alerts", label, joinHtml([problem, ...sections, access]), { lead: page.intro });
+    }
+    const [onWords, offWords] = page.liveWords ?? ["Connected", "Waiting for connection"];
+    sections.push(settingsSection({ id: "connection", title: credentials.workspace, state: html ` ${chip(live ? onWords : offWords, live ? "done" : "")}`,
+        body: joinHtml([
+            page.connection ?? "",
+            runtime?.problem ? notice(String(runtime.problem)) : "",
+            !live && !runtime?.problem ? note(`Keep Toolroll's builder running to receive ${label} messages.`) : "",
+            disclose("Connection settings", kitSectionForm({ proof: `${provider}-close`, action: route("disconnect"), id: "disconnect-form",
+                save: { label: `Disconnect ${label}`, variant: "danger" }, confirm: `Disconnect ${label}`, body: html `` })),
+        ]) }));
+    const teammates = others ? `${others} teammate${others === 1 ? " is" : "s are"}` : "";
+    if (options.code) {
+        // The code shows once, on this page only: selectable text, never in a link or an address.
+        sections.push(settingsSection({ id: "pair", title: "Pair your account", state: " · Code ready",
+            lead: `Send this ${page.pairWhere}. It expires in 10 minutes.`,
+            body: joinHtml([codeLine(`pair ${options.code}`), note("Once you've sent it, this page says your account is paired."),
+                acts(btn("Check connection", { sm: true, href: `/settings/${provider}` }))]) }));
+    }
+    else if (binding && state.live(binding)) {
+        const { pending, dropped: failed } = state.partCounts(binding.id);
+        sections.push(settingsSection({ id: "pair", title: "Your account", state: " · Paired",
+            lead: `Your ${label} account is paired.${teammates ? ` ${teammates} paired too.` : ""}`,
+            body: joinHtml([
+                pending ? infoLine(`${pending} ${pending === 1 ? "reply is" : "replies are"} waiting to send.`) : "",
+                failed ? notice(`${failed} ${failed === 1 ? "reply" : "replies"} could not be delivered. Open the saved chat to recover them.`) : "",
+                note(page.tryLine),
+                acts(btn("Open saved chat", { sm: true, href: "/chat" })),
+                loadPrimary(process.env, dir) === provider
+                    ? formRow("Task updates", null, html `<span>Sent here</span>`, "inline")
+                    : kitSectionForm({ proof: `${provider}-alerts`, action: route("alerts"), id: "alerts-form", save: { label: "Send task updates here", variant: "outline" },
+                        body: note(`Task updates aren't sent to ${label} now.`) }),
+                kitSectionForm({ proof: `${provider}-close`, action: route("unpair"), id: "unpair-form", save: { label: "Unpair my account", variant: "danger" },
+                    confirm: `Unpair your ${label} account`, body: note("Unpairing ends every open button in your chat. Teammates are unaffected.") }),
+            ]) }));
     }
     else {
-        parts.push(html `<p><strong>${credentials.workspace}</strong> · ${live ? "Connected" : "Waiting for connection"}</p>`);
-        if (runtime?.problem)
-            parts.push(html `<p role="status">${String(runtime.problem)}</p>`);
-        if (!live && !runtime?.problem)
-            parts.push(html `<p>Keep the Toolroll worker running to receive ${label} messages.</p>`);
-        if (options.code) {
-            parts.push(html `<h2>Pair your account</h2><p>Send this in a direct message to your Toolroll ${label} app. It expires in 10 minutes.</p>`, html `<label>Pairing message<input type="text" readonly value="pair ${options.code}" autocomplete="off" style="width:100%;max-width:100%;font-size:14px;min-height:44px"></label>`, html `<a class="button-link" style="min-height:44px;white-space:nowrap" href="/settings/${provider}">Check connection</a>`);
-        }
-        else if (binding && state.live(binding)) {
-            const { pending, dropped: failed } = state.partCounts(binding.id);
-            parts.push(html `<p>Your ${label} account is paired.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} paired too.` : ""}${pending ? ` ${pending} replies waiting to send.` : ""}${failed ? ` ${failed} replies could not be delivered. Open the saved chat to recover them.` : ""}</p>`, html `<p>Try “What needs my attention?” or “Show the evidence for the latest result.”</p>`, html `<p><a href="/chat">Open saved chat</a></p>`, loadPrimary(process.env, dir) === provider
-                ? html `<p>Task updates are sent here.</p>`
-                : post("alerts", html `<button type="submit">Send task updates here</button>`));
-        }
-        else {
-            parts.push(post("pair", html `<h2>Pair your account</h2><p>Your paired ${label} account can read your connected projects and confirm proposed changes. Password approvals still open in Toolroll.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} already paired.` : ""}</p>${password}<button type="submit">Create pairing code</button>`));
-        }
-        if (binding && state.live(binding) && !options.code)
-            parts.push(post("unpair", html `${password}<p class="meta">Unpairing ends every open button in your chat. Teammates are unaffected.</p><button type="submit">Unpair my account</button>`));
-        parts.push(html `<details><summary>Connection settings</summary>${post("disconnect", html `${password}<button type="submit">Disconnect ${label}</button>`)}</details>`);
+        sections.push(settingsSection({ id: "pair", title: "Pair your account", state: " · Not paired",
+            lead: `Your paired ${label} account can read your connected projects and confirm proposed changes. Password approvals still open in Toolroll.${teammates ? ` ${teammates} already paired.` : ""}`,
+            body: kitSectionForm({ proof: `${provider}-open`, action: route("pair"), id: "pair-form", native: true, save: { label: "Create pairing code" },
+                confirm: `Pair your ${label} account`, body: note("You get a one-time message to send to the app.") }) }));
     }
-    return html `<section style="max-width:42rem;overflow-wrap:anywhere"><p><a href="/settings">Settings</a></p><h1>${label}</h1>${options.problem ? html `<p class="problem" role="alert">${options.problem}</p>` : ""}${parts}<details><summary>Access and setup</summary>${page.access}</details></section>`;
+    return settingsSubPage("alerts", label, joinHtml([problem, ...sections, access]));
 }

package/dist/check-levels-ui.d.ts

@@ -28,4 +28,5 @@ export type CheckSettingsView = {
     problem: string | null;
 };
 export declare function checkSettingsHtml(view: CheckSettingsView): Html;
-export declare const CHECK_SETTINGS_CSS = "\n  .check-settings { display: grid; gap: .6rem; max-width: 40rem; }\n  .check-settings p, .check-settings h2 { margin: 0; }\n  .check-settings h2 { font-size: 1rem; }\n  .check-settings fieldset { border: 0; margin: 0; padding: 0; display: grid; gap: .25rem; }\n  .check-settings legend { font-weight: 600; margin-bottom: .25rem; }\n  .check-settings label { display: grid; gap: .25rem; }\n  .check-settings .check-choice { display: flex; align-items: flex-start; gap: .6rem; min-height: 44px; padding: .35rem 0; cursor: pointer; }\n  .check-settings .check-choice > span { display: grid; gap: .1rem; }\n  .check-settings .check-choice input { margin-top: .2rem; }\n  .check-settings input[type=password], .check-settings input[type=number], .check-settings textarea { min-height: 44px; box-sizing: border-box; width: 100%; }\n  .check-settings button { min-height: 44px; justify-self: start; }\n  .check-settings .check-command { overflow-wrap: anywhere; }\n  .check-terms { margin: 0; padding-left: 1.1rem; display: grid; gap: .25rem; }\n  @media (max-width: 480px) { .check-settings button { justify-self: stretch; } }\n  .follow-ups .follow-up-list { margin: .4rem 0; padding-left: 1.1rem; display: grid; gap: .25rem; }\n  .follow-ups .follow-up-acts, .follow-ups .follow-up-act { display: flex; flex-wrap: wrap; gap: .5rem; margin: .5rem 0 0; }\n  .follow-ups .follow-up-act { margin: 0; }\n  .follow-ups button { min-height: 44px; }\n  @media (max-width: 480px) { .follow-ups .follow-up-acts, .follow-ups .follow-up-act { display: grid; } .follow-ups .follow-up-act button { width: 100%; } }\n";
+/** The follow-up list's look (result-follow-ups.ts); the checks page itself is kit markup. */
+export declare const CHECK_SETTINGS_CSS = "\n  .follow-ups .follow-up-list { margin: .4rem 0; padding-left: 1.1rem; display: grid; gap: .25rem; }\n  .follow-ups .follow-up-acts, .follow-ups .follow-up-act { display: flex; flex-wrap: wrap; gap: .5rem; margin: .5rem 0 0; }\n  .follow-ups .follow-up-act { margin: 0; }\n  .follow-ups button { min-height: 44px; }\n  @media (max-width: 480px) { .follow-ups .follow-up-acts, .follow-ups .follow-up-act { display: grid; } .follow-ups .follow-up-act button { width: 100%; } }\n";

package/dist/check-levels-ui.js

@@ -2,72 +2,81 @@
  * words. One choice (Quick, Full, Off) and the quick command beside the full
  * one. Every change takes the password and lands in the ledger; approving a
  * command restates exactly what will run, unattended, before the yes. */
-import { html, postForm, reauth } from "./html.js";
+import { html, joinHtml } from "./html.js";
 import { CHECK_LEVELS, CHECK_LEVEL_HINTS, CHECK_LEVEL_WORDS } from "./check-levels.js";
 import { BATCH_HINT } from "./batch-policy.js";
+import { codeLine, disclose, formRow, infoLine, input, note, notice, radios, settingsSection, textarea } from "./server/kit.js";
+import { kitSectionForm } from "./settings-kit.js";
+const list = (items) => html `<ul class="k-note">${items.map(one => html `<li>${one}</li>`)}</ul>`;
 export function checkSettingsHtml(view) {
-    const post = (act, body, attrs) => postForm("/settings/checks", body, { attrs, hidden: { repo: view.repo, act } });
-    const password = html `${reauth(html `<label>Password<input type="password" name="password" autocomplete="current-password" required></label>`)}`;
-    const notes = [
-        view.said === null ? "" : html `<p class="notice" role="status">${view.said}</p>`,
-        view.problem === null ? "" : html `<p class="problem" role="alert">${view.problem}</p>`,
-    ];
-    const head = html `<p class="meta">${view.name} · <span class="mono">${view.repo}</span></p>${notes}`;
-    const command = (one) => html `<p class="mono check-command">${one.command}</p><p class="meta">Up to ${Math.round(one.timeoutMs / 1000)}s · approved by ${one.approvedBy}</p>`;
+    const form = (id, act, body, save, extra = {}) => kitSectionForm({ proof: "checks", action: "/settings/checks", id, hidden: { repo: view.repo, act, ...extra }, save, body });
+    const head = joinHtml([
+        view.problem === null ? "" : notice(view.problem),
+        view.said === null ? "" : infoLine(view.said),
+        note(html `${view.name} · <span class="k-mono">${view.repo}</span>`),
+    ]);
+    const command = (one) => joinHtml([codeLine(one.command), note(`Up to ${Math.round(one.timeoutMs / 1000)}s · approved by ${one.approvedBy}`)]);
     // Quick with no quick command runs the full check; say so where the choice is made.
     const fallsBack = view.level === "quick" && view.quick === null;
-    const current = html `<p><strong>${CHECK_LEVEL_WORDS[view.level]}</strong> · ${CHECK_LEVEL_HINTS[view.level]}</p>${fallsBack ? html `<p class="meta">No quick command yet, so builds run the full check.</p>` : ""}${view.level !== "full" && view.full !== null ? html `<p class="meta">The full check still runs when a pull request opens, and Merge waits for it.</p>` : ""}`;
-    if (!view.canChange) {
-        return html `${head}<section class="card check-settings">${current}</section>${batchHtml(view, null)}${reviewHtml(view, null)}<section class="card check-settings"><h2>Quick check</h2>${view.quick === null ? html `<p class="meta">None yet.</p>` : command(view.quick)}</section><section class="card check-settings"><h2>Full check</h2>${view.full === null ? html `<p class="meta">None yet.</p>` : command(view.full)}</section>`;
+    const levelNotes = joinHtml([
+        fallsBack ? note("No quick command yet, so builds run the full check.") : "",
+        view.level !== "full" && view.full !== null ? note("The full check still runs when a pull request opens, and Merge waits for it.") : "",
+    ]);
+    const level = settingsSection({ id: "check-level", title: "After each build", state: ` · ${CHECK_LEVEL_WORDS[view.level]}`, lead: CHECK_LEVEL_HINTS[view.level],
+        body: !view.canChange ? levelNotes : joinHtml([levelNotes, kitSectionForm({ proof: "checks", action: "/settings/checks", id: "check-level-form", gate: true,
+                hidden: { repo: view.repo, act: "level" }, confirm: "Change checks",
+                body: joinHtml([
+                    formRow("After each build", "A task can choose its own checks when it's filed. With Quick or Off, the full check runs when a pull request opens, and Merge waits for it unless you merge anyway.", radios({ name: "level", legend: "After each build", current: view.level, items: CHECK_LEVELS.map(one => ({ value: one, label: CHECK_LEVEL_WORDS[one], text: CHECK_LEVEL_HINTS[one] })) }), "wide"),
+                ]) })]) });
+    const commandForm = (id, value, submit) => form(id, "quick", joinHtml([
+        formRow("Command", null, textarea({ id: `${id}-command`, name: "command", value, rows: 2, attrs: { maxlength: 2000, spellcheck: "false", required: true, "aria-label": "Command" } }), "wide"),
+        formRow("Time limit", "Seconds, up to 3600.", input({ id: `${id}-timeout`, name: "timeout", type: "number", value: String(view.quick === null ? 180 : Math.round(view.quick.timeoutMs / 1000)),
+            attrs: { min: 1, max: 3600, required: true, "aria-label": "Time limit in seconds" } }), "inline"),
+        list(["Runs unattended right after every Quick build, in that build's checkout.", "Plain environment: no credentials.", "A failure shows on the result; nothing is blocked."]),
+    ]), { label: submit, variant: "outline" });
+    const quick = settingsSection({ id: "quick-check", title: "Quick check", state: view.quick === null ? " · None yet" : "",
+        lead: view.quick === null && view.canChange
+            ? view.suggestion === null ? "Typecheck and the tests near the change, ideally under 2 minutes." : "Suggested from the project's scripts. Edit it before approving."
+            : undefined,
+        body: view.quick === null
+            ? view.canChange ? commandForm("quick-form", view.suggestion ?? "", "Approve quick check") : ""
+            : joinHtml([command(view.quick), !view.canChange ? "" : joinHtml([
+                    disclose("Change quick check", commandForm("quick-change-form", view.quick.command, "Approve change")),
+                    disclose("Remove quick check", form("quick-clear-form", "quick-clear", note("Quick builds run the full check instead."), { label: "Remove", variant: "danger" })),
+                ])]) });
+    const full = settingsSection({ id: "full-check", title: "Full check", state: view.full === null ? " · None yet" : "",
+        body: view.full === null
+            ? joinHtml([note("Approve one from the command line:"), codeLine(`toolroll verify set --repo … --command "…"`)])
+            : command(view.full) });
+    return joinHtml([head, level, batchHtml(view), reviewHtml(view), quick, full]);
+    /** Batch checks: one state and one sentence; turning it on restates exactly what happens before the password. */
+    function batchHtml(view) {
+        const batch = view.batch;
+        if (batch === undefined)
+            return "";
+        const act = batch.on ? "Turn off" : "Turn on";
+        const terms = batch.on ? note("Each result runs its own full check again. Results already waiting are checked now.")
+            : list(["When results finish within 10 minutes of each other, they're merged in a temporary checkout and the full check runs once.",
+                "If it fails, the batch is split until the result that breaks it is found. Results that conflict are checked on their own.",
+                "Nothing is merged into a real branch. Each result still lands on its own."]);
+        return settingsSection({ id: "batch-checks", title: "Batch checks", state: html `<span data-batch-checks="${batch.on ? "on" : "off"}"> · ${batch.on ? "On" : "Off"}</span>`, lead: BATCH_HINT,
+            body: joinHtml([batch.on && view.level !== "full" ? note("Only Full checks are batched.") : "",
+                view.canChange ? disclose(act, form("batch-form", "batch", terms, { label: act, variant: "outline" }, { on: batch.on ? "0" : "1" })) : ""]) });
+    }
+    /** Automatic review: one state, one sentence, and its one change behind a disclosure (the password). */
+    function reviewHtml(view) {
+        const review = view.review;
+        if (review === undefined)
+            return "";
+        const state = review.on ? (review.source === "hands-off" ? "On while hands-off lasts" : "On") : "Off";
+        const act = review.on ? "Turn off" : "Turn on";
+        return settingsSection({ id: "automatic-review", title: "Automatic review", state: html `<span data-review-switch="${review.on ? "on" : "off"}"> · ${state}</span>`,
+            lead: "One read-only review after each build passes its checks. Only high findings send it back, once.",
+            body: view.canChange ? disclose(act, form("review-form", "review", html ``, { label: act, variant: "outline" }, { on: review.on ? "0" : "1" })) : "" });
     }
-    const choices = CHECK_LEVELS.map(level => html `<label class="check-choice"><input type="radio" name="level" value="${level}"${level === view.level ? html ` checked` : ""}><span><strong>${CHECK_LEVEL_WORDS[level]}</strong><span class="meta">${CHECK_LEVEL_HINTS[level]}</span></span></label>`);
-    const levelForm = post("level", html `<fieldset><legend>After each build</legend>${choices}</fieldset>${fallsBack ? html `<p class="meta">No quick command yet, so Quick runs the full check.</p>` : ""}<p class="meta">A task can choose its own checks when it's filed. With Quick or Off, the full check runs when a pull request opens, and Merge waits for it unless you merge anyway.</p>${password}<button type="submit">Save</button>`, { class: "card check-settings" });
-    const quickTerms = html `<ul class="check-terms"><li>Runs unattended right after every Quick build, in that build's checkout.</li><li>Plain environment: no credentials.</li><li>A failure shows on the result; nothing is blocked.</li></ul>`;
-    const quickForm = (value, submit) => post("quick", html `<label>Command<textarea name="command" rows="2" maxlength="2000" spellcheck="false" class="mono" required>${value}</textarea></label><label>Time limit (seconds)<input type="number" name="timeout" min="1" max="3600" value="${view.quick === null ? 180 : Math.round(view.quick.timeoutMs / 1000)}" required></label>${quickTerms}${password}<button type="submit">${submit}</button>`, { class: "check-settings" });
-    const quick = view.quick === null
-        ? html `<section class="card check-settings"><h2>Quick check</h2>${view.suggestion === null ? html `<p class="meta">Typecheck and the tests near the change, ideally under 2 minutes.</p>` : html `<p class="meta">Suggested from the project's scripts. Edit it before approving.</p>`}${quickForm(view.suggestion ?? "", "Approve quick check")}</section>`
-        : html `<section class="card check-settings"><h2>Quick check</h2>${command(view.quick)}<details class="settings-more"><summary>Change quick check</summary>${quickForm(view.quick.command, "Approve change")}</details><details class="settings-more"><summary>Remove quick check</summary>${post("quick-clear", html `<p class="meta">Quick builds run the full check instead.</p>${password}<button type="submit" class="danger">Remove</button>`, { class: "check-settings" })}</details></section>`;
-    const full = html `<details class="settings-more"><summary>Full check</summary><section class="card check-settings">${view.full === null ? html `<p class="meta">None yet. Approve one with <span class="mono">toolroll verify set --repo … --command "…"</span>.</p>` : command(view.full)}</section></details>`;
-    return html `${head}${levelForm}${batchHtml(view, password)}${reviewHtml(view, password)}${quick}${full}`;
-}
-/** Batch checks: one state and one sentence; turning it on restates exactly what happens, behind a disclosure with the password. */
-function batchHtml(view, password) {
-    const batch = view.batch;
-    if (batch === undefined)
-        return "";
-    const act = batch.on ? "Turn off" : "Turn on";
-    const terms = batch.on ? html `<p class="meta">Each result runs its own full check again. Results already waiting are checked now.</p>`
-        : html `<ul class="check-terms"><li>When results finish within 10 minutes of each other, they're merged in a temporary checkout and the full check runs once.</li><li>If it fails, the batch is split until the result that breaks it is found. Results that conflict are checked on their own.</li><li>Nothing is merged into a real branch. Each result still lands on its own.</li></ul>`;
-    const change = password === null ? ""
-        : html `<details class="settings-more"><summary>${act}</summary>${postForm("/settings/checks", html `${terms}${password}<button type="submit">${act}</button>`, { attrs: { class: "check-settings" }, hidden: { repo: view.repo, act: "batch", on: batch.on ? "0" : "1" } })}</details>`;
-    return html `<section class="card check-settings" data-batch-checks="${batch.on ? "on" : "off"}"><h2>Batch checks</h2><p><strong>${batch.on ? "On" : "Off"}</strong> · ${BATCH_HINT}</p>${batch.on && view.level !== "full" ? html `<p class="meta">Only Full checks are batched.</p>` : ""}${change}</section>`;
-}
-/** Automatic review: one state, one sentence, and its one change behind a disclosure (the password). */
-function reviewHtml(view, password) {
-    const review = view.review;
-    if (review === undefined)
-        return "";
-    const state = review.on ? (review.source === "hands-off" ? "On while hands-off lasts" : "On") : "Off";
-    const act = review.on ? "Turn off" : "Turn on";
-    const change = password === null ? ""
-        : html `<details class="settings-more"><summary>${act}</summary>${postForm("/settings/checks", html `${password}<button type="submit">${act}</button>`, { attrs: { class: "check-settings" }, hidden: { repo: view.repo, act: "review", on: review.on ? "0" : "1" } })}</details>`;
-    return html `<section class="card check-settings" data-review-switch="${review.on ? "on" : "off"}"><h2>Automatic review</h2><p><strong>${state}</strong> · One read-only review after each build passes its checks. Only high findings send it back, once.</p>${change}</section>`;
 }
+/** The follow-up list's look (result-follow-ups.ts); the checks page itself is kit markup. */
 export const CHECK_SETTINGS_CSS = `
-  .check-settings { display: grid; gap: .6rem; max-width: 40rem; }
-  .check-settings p, .check-settings h2 { margin: 0; }
-  .check-settings h2 { font-size: 1rem; }
-  .check-settings fieldset { border: 0; margin: 0; padding: 0; display: grid; gap: .25rem; }
-  .check-settings legend { font-weight: 600; margin-bottom: .25rem; }
-  .check-settings label { display: grid; gap: .25rem; }
-  .check-settings .check-choice { display: flex; align-items: flex-start; gap: .6rem; min-height: 44px; padding: .35rem 0; cursor: pointer; }
-  .check-settings .check-choice > span { display: grid; gap: .1rem; }
-  .check-settings .check-choice input { margin-top: .2rem; }
-  .check-settings input[type=password], .check-settings input[type=number], .check-settings textarea { min-height: 44px; box-sizing: border-box; width: 100%; }
-  .check-settings button { min-height: 44px; justify-self: start; }
-  .check-settings .check-command { overflow-wrap: anywhere; }
-  .check-terms { margin: 0; padding-left: 1.1rem; display: grid; gap: .25rem; }
-  @media (max-width: 480px) { .check-settings button { justify-self: stretch; } }
   .follow-ups .follow-up-list { margin: .4rem 0; padding-left: 1.1rem; display: grid; gap: .25rem; }
   .follow-ups .follow-up-acts, .follow-ups .follow-up-act { display: flex; flex-wrap: wrap; gap: .5rem; margin: .5rem 0 0; }
   .follow-ups .follow-up-act { margin: 0; }

package/dist/claim.d.ts

@@ -103,6 +103,9 @@ export type AcquireResult = {
  | {
     ok: false;
     reason: "coordinator-filed";
+} | {
+    ok: false;
+    reason: "archived";
 } | {
     ok: false;
     reason: "watch-custody";

package/dist/claim.js

@@ -31,7 +31,7 @@ import { randomUUID } from "node:crypto";
 import { authenticate, drainOf } from "./runner.js";
 import { pauseForAuth } from "./provider-auth.js";
 import { DEFAULT_MAX_OPEN_DECISIONS, missingCapability, scopeApprovedForDispatch, taskReadinessBlocker, } from "./dispatch.js";
-import { BUILT_IN, } from "./store.js";
+import { BUILT_IN, refArchived, } from "./store.js";
 import { digestOf } from "./scope.js";
 import { parseExecutionPlanDocument } from "./plan.js";
 import { sealUnchangedPlanUnderMode } from "./plan-auto.js";
@@ -109,6 +109,9 @@ function acquireLocked(store, taskRef, runner, options) {
         if (placedRef !== null && placedRef.coordinatorCid !== null && !store.scopeSealed(placedRef.externalId)) {
             return { ok: false, reason: "coordinator-filed" };
         }
+        // A PUT-AWAY TASK (v145, task-tidy.md) claims for nobody, on every road: restore it first.
+        if (refArchived(store, taskRef))
+            return { ok: false, reason: "archived" };
         // The reservation gate lives HERE, in the one primitive every
         // acquisition path shares (queue-columns review, finding 1): tick's
         // acquireIfReady and the raw CLI claim both

package/dist/contracts/chat-actions.d.ts

@@ -160,6 +160,13 @@ export declare const chatActionRequestSchemas: {
     readonly flow_trigger_remove: z.ZodObject<{
         trigger: z.ZodInt;
     }, z.core.$strict>;
+    /** Browser use in the flow's script zones (flow-browser.ts): allowing it takes the person's own password in the secure screen. */
+    readonly flow_browser: z.ZodObject<{
+        flow: z.ZodInt;
+    }, z.core.$strict>;
+    readonly flow_browser_off: z.ZodObject<{
+        flow: z.ZodInt;
+    }, z.core.$strict>;
     readonly subagent_create: z.ZodObject<{
         repo: z.ZodString;
         template: z.ZodOptional<z.ZodUnknown>;
@@ -282,6 +289,8 @@ export declare const sharedActionSchema: z.ZodObject<{
     operation: z.ZodEnum<{
         decision_record: "decision_record";
         decision_retire: "decision_retire";
+        flow_browser: "flow_browser";
+        flow_browser_off: "flow_browser_off";
         flow_card_add: "flow_card_add";
         flow_card_approve: "flow_card_approve";
         flow_card_assign: "flow_card_assign";

package/dist/contracts/chat-actions.js

@@ -61,6 +61,9 @@ export const chatActionRequestSchemas = {
     flow_trigger_pause: z.strictObject({ trigger: id }),
     flow_trigger_resume: z.strictObject({ trigger: id }),
     flow_trigger_remove: z.strictObject({ trigger: id }),
+    /** Browser use in the flow's script zones (flow-browser.ts): allowing it takes the person's own password in the secure screen. */
+    flow_browser: z.strictObject({ flow: id }),
+    flow_browser_off: z.strictObject({ flow: id }),
     subagent_create: z.strictObject({ repo: words, template: z.unknown().optional(), name: z.unknown().optional(), soul: z.unknown().optional() }),
     subagent_soul: z.strictObject({ subagent: id, soul: words }),
     subagent_state: z.strictObject({ subagent: id, state: z.enum(["active", "paused", "removed"]) }),