toolroll 0.9.93 → 0.9.95

package/dist/chat-approval.d.ts

@@ -27,6 +27,19 @@ export declare function effectiveChatApproval(store: Store, repo: string, approv
     ok: false;
     why: string;
 };
+/** What this person's chat on `channel` may approve on this repository now, and under whose limits: their saved setting,
+ * else (only with nothing saved) their own live signed mode that names this chat app, else their standing as an
+ * approver. A saved setting that refuses refuses here. `digest` names that for
+ * the ledger; the yes itself is the person's tap and is sealed as theirs, so it doesn't lapse when the authority does. */
+export declare function chatApproveMode(store: Store, repo: string | null, approver: string, now: Date, channel: "telegram" | "slack" | "discord" | "teams"): {
+    ok: true;
+    digest: string;
+    limits: ChatApprovalLimits;
+    source: "setting" | "mode";
+} | {
+    ok: false;
+    why: string;
+};
 export type ChatApprovalChange = {
     approver: string;
     scope: string;

package/dist/chat-approval.js

@@ -1,15 +1,17 @@
-/** Approving from chat as a lasting owner setting. An approver turns it on for all their projects or for one, with the
- * limits they agree to (whether a plan may ask for full access, and the most one attempt may cost); a project's own
- * row outranks the all-projects one, and an explicit "off" on a project keeps it off there. Turning it off for all
- * projects also disables that owner's saved project rows. It is off until turned on.
+/** Approving from chat (owner's decision, docs/plans/toolroll-cards.md): a person with the authority approves from their
+ * own linked chat by default, with no limits of their own. This setting is how they say otherwise: off for all their
+ * projects or for one, or on with limits (whether a plan may ask for full access, and the most one attempt may cost). A
+ * project's own row outranks the all-projects one, and an explicit "off" keeps it off. Turning it off for all projects
+ * also disables that owner's saved project rows.
  *
- * It never lapses by date, but it ends with the account: a reset password, revoked access or a lost project ends it.
- * Turning it on or changing its limits takes the password; turning it off is one step. Every change is a ledger line.
+ * A saved row ends with the account: a reset password, revoked access or a lost project ends it, and it must be saved
+ * again. Saving limits takes the password; turning it off is one step. Every change is a ledger line.
  *
  * What the setting allows is only that the owner's own two taps in their paired chat count as their yes. Every other
  * rule still applies at the offer and again at the tap (chat-decide.ts planInChat): protected paths, separation of
  * duties, organisation policy, written-for-you plans, unresolved routes, and the limits here. */
 import { createHash } from "node:crypto";
+import { chatApproveChatsOf, chatNames, modeTermsFromJson } from "./modes.js";
 /** The all-projects row's scope. */
 export const ALL_PROJECTS = "*";
 const money = (micro) => `$${(micro / 1_000_000).toFixed(2)}`;
@@ -37,16 +39,44 @@ export function effectiveChatApproval(store, repo, approver) {
     const all = store.handle.prepare("SELECT * FROM chat_approval_setting WHERE approver = ? AND scope = ?").get(approver, ALL_PROJECTS);
     const row = project ?? all;
     const setting = row === undefined ? null : readRow(row);
-    if (setting === null || !setting.enabled)
-        return { ok: false, why: "Approving from chat isn't turned on for this project." };
     const account = store.accountOf(approver);
+    if (setting === null) {
+        if (account === null || account.revokedAt !== null || account.role !== "approver" || !store.accountCanAccess(approver, repo))
+            return { ok: false, why: "Only an approver for this project can approve it." };
+        const limits = { fullAccess: true, capMicrousd: null };
+        return { ok: true, limits, setting: { ...limits, approver, scope: ALL_PROJECTS, enabled: true, generation: account.generation, digest: digestOf(approver, ALL_PROJECTS, limits, account.generation), updatedBy: approver, updatedAt: "" } };
+    }
+    if (!setting.enabled)
+        return { ok: false, why: "You turned off approving from chat for this project." };
     if (account === null || account.revokedAt !== null || account.role !== "approver" || account.generation !== setting.generation || !store.accountCanAccess(approver, repo)) {
-        return { ok: false, why: "Your access changed since you turned on approving from chat. Turn it on again in Settings." };
+        return { ok: false, why: "Your access changed since you saved your chat approval setting. Save it again in Settings." };
     }
     if (setting.digest !== digestOf(setting.approver, setting.scope, setting, setting.generation))
         return { ok: false, why: "Your chat approval setting can't be read. Turn it on again in Settings." };
     return { ok: true, setting, limits: { fullAccess: setting.fullAccess, capMicrousd: setting.capMicrousd } };
 }
+/** What this person's chat on `channel` may approve on this repository now, and under whose limits: their saved setting,
+ * else (only with nothing saved) their own live signed mode that names this chat app, else their standing as an
+ * approver. A saved setting that refuses refuses here. `digest` names that for
+ * the ledger; the yes itself is the person's tap and is sealed as theirs, so it doesn't lapse when the authority does. */
+export function chatApproveMode(store, repo, approver, now, channel) {
+    if (repo === null)
+        return { ok: false, why: "Approving from chat isn't turned on for this project." };
+    const setting = effectiveChatApproval(store, repo, approver);
+    // A saved setting decides: its "off", a lapse after an access change or an unreadable row refuses before any mode is
+    // looked at, so a signed mode never reopens what the person turned off. The mode counts only when nothing is saved.
+    if (!setting.ok)
+        return setting;
+    const chosen = { ok: true, source: "setting" };
+    if (setting.setting.updatedAt !== "")
+        return { ...chosen, digest: setting.setting.digest, limits: setting.limits };
+    // Nothing saved: their own signed mode's limits, where it names this chat app; otherwise their standing as an approver.
+    const mode = store.activeMode(repo, now);
+    const terms = mode === null ? null : modeTermsFromJson(mode.termsJson);
+    if (mode !== null && terms !== null && terms.chatApprove && mode.signedBy === approver && store.accountCanAccess(approver, repo) && chatApproveChatsOf(terms).includes(channel))
+        return { ok: true, digest: mode.digest, limits: { fullAccess: terms.permissionDefault === "escalated", capMicrousd: terms.perAttemptBudgetMicrousd }, source: "mode" };
+    return { ...chosen, digest: setting.setting.digest, limits: setting.limits };
+}
 /** Save and ledger the setting; all-projects off also disables every saved project row for this owner.
  * The caller has proved who is asking, and for "on" the password. */
 export function setChatApproval(store, change, now) {

package/dist/chat-card-part.d.ts

@@ -0,0 +1,11 @@
+import type { ChatContent } from "./contracts/chat-content.js";
+import type { ChatCard } from "./contracts/chat-card.js";
+/** The buttons of a card, as a part's links. */
+export declare const cardLinks: (card: ChatCard) => Pick<ChatContent, "link" | "also">;
+export declare const cardContent: (card: ChatCard) => ChatContent;
+/** A card that can't be read goes out as the plain words kept with it. */
+export declare function cardPart(proposal: {
+    kind: string;
+    payload: Record<string, unknown>;
+}): ChatContent;
+export declare function withoutCard(content: ChatContent): ChatContent;

package/dist/chat-card-part.js

@@ -0,0 +1,18 @@
+/** A card as a chat part: its plain text and link buttons always there, the card beside them. */
+import { cardOfProposal, cardPlainOf } from "./chat-card.js";
+import { cardPlainText } from "./card-render.js";
+/** The buttons of a card, as a part's links. */
+export const cardLinks = (card) => {
+    const [first, ...rest] = card.buttons;
+    return { ...(first === undefined ? {} : { link: first }), ...(rest.length === 0 ? {} : { also: rest }) };
+};
+export const cardContent = (card) => ({ text: cardPlainText(card), rich: card, ...cardLinks(card) });
+/** A card that can't be read goes out as the plain words kept with it. */
+export function cardPart(proposal) {
+    const card = cardOfProposal(proposal);
+    return card === null ? { text: cardPlainOf(proposal) } : cardContent(card);
+}
+export function withoutCard(content) {
+    const { rich: _rich, ...plain } = content;
+    return plain;
+}

package/dist/chat-card.d.ts

@@ -0,0 +1,46 @@
+/**
+ * From a checked spec to a card (docs/plans/toolroll-cards.md): Toolroll fills every data part from its records and every
+ * button from its own tables. Nothing the model wrote reaches a card except a Text part, and every app labels that as
+ * the lead's note, never as one of Toolroll's records (card-render.ts).
+ */
+import type { CardPlan } from "./card-catalog.js";
+import { type CardReader } from "./card-sources.js";
+import { type ChatCard } from "./contracts/chat-card.js";
+/** How a Button becomes a page or a proposal: the lead's own checks, so a card can't reach what show_control can't. */
+export type CardButtons = (props: Record<string, unknown>) => {
+    ok: true;
+    button?: ChatCard["buttons"][number];
+    action?: ChatCard["actions"][number];
+} | {
+    ok: false;
+    message: string;
+};
+/** A plan as a card, read now, or why it can't be one. */
+export declare function buildChatCard(reader: CardReader, plan: CardPlan, repoOf: (id: unknown) => string | null, buttons: CardButtons): {
+    ok: true;
+    card: ChatCard;
+} | {
+    ok: false;
+    message: string;
+};
+/** A card kept on a `control` proposal, as its marker says. */
+export declare const CARD_CONTROL = "card";
+export declare function cardOfProposal(proposal: {
+    kind: string;
+    payload: Record<string, unknown>;
+}): ChatCard | null;
+export declare function isCardProposal(proposal: {
+    kind: string;
+    payload: Record<string, unknown>;
+}): boolean;
+/** The plain version kept beside a card, for when the card itself can't be read. */
+export declare const cardPlainOf: (proposal: {
+    payload: Record<string, unknown>;
+}) => string;
+/** Cards before the proposals they lead to, so each Confirm sits under its card. */
+export declare function cardsFirst<T extends {
+    kind: string;
+    payload: Record<string, unknown>;
+}>(proposals: readonly T[]): T[];
+/** A card goes only where every project behind it is still reachable. */
+export declare const cardWithin: (card: Pick<ChatCard, "repos">, repos: readonly string[]) => boolean;

package/dist/chat-card.js

@@ -0,0 +1,99 @@
+import { readCardSource } from "./card-sources.js";
+import { publicChatText } from "./chat-display.js";
+import { CARD_LIMITS, readChatCard } from "./contracts/chat-card.js";
+const queryOf = (props, repoOf) => {
+    const repo = props["repo"] === undefined ? null : repoOf(props["repo"]);
+    if (props["repo"] !== undefined && repo === null)
+        return null;
+    return { repo, ...(props["task"] === undefined ? {} : { task: String(props["task"]) }), ...(props["state"] === undefined ? {} : { state: String(props["state"]) }), ...(props["limit"] === undefined ? {} : { limit: Number(props["limit"]) }),
+        ...(props["flow"] === undefined ? {} : { flow: Number(props["flow"]) }), ...(props["days"] === undefined ? {} : { days: Number(props["days"]) }) };
+};
+function tableOf(data, wanted) {
+    const ids = Array.isArray(wanted) ? wanted.map(String) : data.columns.slice(0, CARD_LIMITS.columns).map(one => one.id);
+    const columns = ids.map(id => data.columns.find(one => one.id === id));
+    const missing = ids.filter((_, index) => columns[index] === undefined);
+    if (missing.length > 0)
+        return `No column ${missing.join(", ")}. This source has: ${data.columns.map(one => one.id).join(", ")}.`;
+    return { kind: "table", heading: data.heading, origin: data.origin ?? "records", columns: columns.map(one => ({ label: one.label, numeric: one.numeric === true })), rows: data.rows.map(row => ids.map(id => row[id] ?? "")), more: data.more };
+}
+function factsOf(data, wanted) {
+    const ids = Array.isArray(wanted) ? wanted.map(String) : data.facts.map(one => one.id);
+    const items = ids.flatMap(id => data.facts.filter(one => one.id === id));
+    if (items.length !== ids.length)
+        return `This source's facts are: ${data.facts.map(one => one.id).join(", ")}.`;
+    if (items.length === 0)
+        return "This source has no facts to show now.";
+    return { kind: "facts", heading: data.heading, items: items.slice(0, CARD_LIMITS.facts).map(({ label, value }) => ({ label, value })) };
+}
+/** A plan as a card, read now, or why it can't be one. */
+export function buildChatCard(reader, plan, repoOf, buttons) {
+    const blocks = [];
+    const repos = new Set();
+    let title = null;
+    for (const part of plan.parts) {
+        if (part.type === "Divider") {
+            blocks.push({ kind: "divider" });
+            continue;
+        }
+        if (part.type === "Text") {
+            const text = publicChatText(String(part.props["text"]), CARD_LIMITS.text);
+            if (text !== "")
+                blocks.push({ kind: "text", text });
+            continue;
+        }
+        const query = queryOf(part.props, repoOf);
+        if (query === null)
+            return { ok: false, message: "repo must be one of the ids from list_repos." };
+        const data = readCardSource(reader, part.props["source"], query);
+        if ("problem" in data)
+            return { ok: false, message: data.problem };
+        title ??= data.heading;
+        for (const repo of data.repos)
+            repos.add(repo);
+        if (part.type === "Notes") {
+            if (data.notes === undefined || data.notes.length === 0)
+                return { ok: false, message: "There are no saved words to show here. Try a Table." };
+            const items = data.notes.slice(0, CARD_LIMITS.notes);
+            blocks.push({ kind: "notes", heading: data.heading, origin: data.origin ?? "records", items, more: data.notes.length - items.length });
+            continue;
+        }
+        if (part.type === "Chart") {
+            if (data.points.length === 0)
+                return { ok: false, message: "There are no numbers to chart yet: show a Table or Fields instead." };
+            blocks.push({ kind: "chart", heading: data.heading, chart: part.props["chart"], points: [...data.points] });
+            continue;
+        }
+        const block = part.type === "Table" ? tableOf(data, part.props["columns"]) : factsOf(data, part.props["facts"]);
+        if (typeof block === "string")
+            return { ok: false, message: block };
+        blocks.push(block);
+    }
+    const links = [], actions = [];
+    for (const props of plan.buttons) {
+        const made = buttons(props);
+        if (!made.ok)
+            return made;
+        if (made.button !== undefined)
+            links.push(made.button);
+        if (made.action !== undefined)
+            actions.push(made.action);
+    }
+    const card = readChatCard({ version: 1, title: title ?? "Toolroll", asOf: reader.now.toISOString(), repos: [...repos], blocks, buttons: links.slice(0, CARD_LIMITS.buttons), actions: actions.slice(0, CARD_LIMITS.actions) });
+    return card === null ? { ok: false, message: "That card doesn't fit. Show fewer parts." } : { ok: true, card };
+}
+/** A card kept on a `control` proposal, as its marker says. */
+export const CARD_CONTROL = "card";
+export function cardOfProposal(proposal) {
+    return proposal.kind === "control" && proposal.payload["control"] === CARD_CONTROL ? readChatCard(proposal.payload["card"]) : null;
+}
+export function isCardProposal(proposal) {
+    return proposal.kind === "control" && proposal.payload["control"] === CARD_CONTROL;
+}
+/** The plain version kept beside a card, for when the card itself can't be read. */
+export const cardPlainOf = (proposal) => typeof proposal.payload["plain"] === "string" ? proposal.payload["plain"] : "This card can't be shown.";
+/** Cards before the proposals they lead to, so each Confirm sits under its card. */
+export function cardsFirst(proposals) {
+    return [...proposals.filter(isCardProposal), ...proposals.filter(one => !isCardProposal(one))];
+}
+/** A card goes only where every project behind it is still reachable. */
+export const cardWithin = (card, repos) => card.repos.every(one => repos.includes(one));

package/dist/chat-channel.d.ts

@@ -67,6 +67,8 @@ export type ChatChannelName = "telegram" | "slack" | "discord" | "teams";
 /** The card text once its challenge is armed: an irreversible answer or a
  * challenge action, in the same words on every channel. */
 export declare function armedCardText(proposal: LeadProposal, previewText: string): string;
+/** The second question on an action's card, in words true of what it does. */
+export declare function armedQuestion(proposal: LeadProposal): string;
 /** The "yes" button's label for an armed card. */
 export declare function armedYesLabel(proposal: LeadProposal): string;
 export declare function proposalLink(store: Store, proposal: LeadProposal, repos: readonly string[], channel?: ChatChannelName | null): PhoneLink | null;

package/dist/chat-channel.js

@@ -3,10 +3,11 @@ import { parseFeedbackImage } from "./result-review.js";
 import { FLOW_HREF } from "./flow-engine.js";
 import { closedQuestionWords, LIMITS } from "./decision.js";
 import { createHash } from "node:crypto";
-import { sharedActionPayload, sharedActionNeedsReview, sharedActionReviewPath, sharedActionAllowsChallenge, CHAT_ACTIONS, } from "./chat-actions.js";
+import { sharedActionPayload, sharedActionNeedsReview, sharedActionReviewPath, APPROVAL_TERM_CHARS, sharedActionAllowsChallenge, CHAT_ACTIONS, } from "./chat-actions.js";
 import { isDirectChatProvider, subscriptionCredentialKey } from "./converse.js";
 import { LEAD_MESSAGE_MAX_CHARS } from "./lead.js";
 import { LEAD_TOOL_SCHEMAS } from "./lead-tools.js";
+import { cardPlainOf, isCardProposal } from "./chat-card.js";
 import { verifyApproverStanding } from "./principal.js";
 import { canonicalProject } from "./project.js";
 import { phoneText, projectLabel } from "./telegram-status.js";
@@ -201,9 +202,14 @@ function taskLink(store, taskId, repos) {
 export function armedCardText(proposal, previewText) {
     const body = previewText.split("\n\nConfirm or Dismiss below")[0] ?? previewText;
     if (proposal.kind === "action")
-        return `${body}\n\nThis records that you handled this exact result. Confirm?`;
+        return `${body}\n\n${armedQuestion(proposal)}`;
     return `⚠ This answer is IRREVERSIBLE.\n\n${body}\n\nConfirm?`;
 }
+/** The second question on an action's card, in words true of what it does. */
+export function armedQuestion(proposal) {
+    const action = proposal.kind === "action" ? sharedActionPayload(proposal.payload) : null;
+    return action?.operation === "result_accept" ? "This records that you handled this exact result. Confirm?" : "You approve exactly what's written above. Confirm?";
+}
 /** The "yes" button's label for an armed card. */
 export function armedYesLabel(proposal) {
     if (proposal.kind === "action") {
@@ -340,7 +346,7 @@ export function proposalPreview(store, proposal, repos, channel = null) {
             if (!action)
                 return handoff("This action is unavailable.");
             if (channel !== null && sharedActionAllowsChallenge(action))
-                return card(phoneText(action.title, 200), action.terms.map((term) => phoneText(term, 1200)), "Confirm asks once more before anything is recorded.");
+                return card(phoneText(action.title, 200), action.terms.map((term) => phoneText(term, APPROVAL_TERM_CHARS)), "Confirm asks once more before anything is recorded.");
             return sharedActionNeedsReview(action)
                 ? handoff(phoneText(action.title, 200), [
                     "Review the full details and confirm this exact action.",
@@ -405,7 +411,7 @@ export function proposalPreview(store, proposal, repos, channel = null) {
             return card(`Rewrite the scope of ${taskName}:`, [
                 `Goal: ${t("goal", 600)}`,
                 ...(t("not") === "" ? [] : [`Not: ${t("not", 300)}`]),
-            ], "After confirming, the new scope still needs your password approval before work starts.");
+            ], "After confirming, the new scope still needs your approval before work starts.");
         case "answer": {
             const id = typeof payload["decision"] === "number" ? payload["decision"] : null;
             const decision = id === null ? null : store.getDecision(id);
@@ -432,9 +438,7 @@ export function proposalPreview(store, proposal, repos, channel = null) {
             const dependency = t("dependencyTitle", 120) || t("dependency", 64);
             if (action === null)
                 return handoff(`An unavailable action was proposed for ${taskName}.`);
-            return card(`${action.label}: ${taskName}${dependency === "" ? "" : ` · ${dependency}`}`, [action.detail], operation === "resume"
-                ? "Confirming only requests the resume. Work resumes after the password step on the task, not from here."
-                : null);
+            return card(`${action.label}: ${taskName}${dependency === "" ? "" : ` · ${dependency}`}`, [action.detail], null);
         }
         case "review": {
             const revise = payload["operation"] === "revise";
@@ -469,6 +473,8 @@ export function proposalPreview(store, proposal, repos, channel = null) {
                 "Cancelling is armed on the task itself, never from a card.",
             ]);
         case "control": {
+            if (isCardProposal(proposal))
+                return handoff(cardPlainOf(proposal));
             const control = payload["control"];
             const label = isChatControl(control)
                 ? CHAT_CONTROLS[control].label
@@ -529,6 +535,16 @@ export const CHAT_ACTION_PARITY = {
         how: "Reads bounded source excerpts or advisory import impact in an accessible enrolled project through the shared engine, with source-search fallback when its index is unavailable.",
         gap: "Index refresh uses the local CLI. Dedicated Telegram and Slack journeys for this tool and live channel rendering remain unverified.",
     },
+    get_code_map: {
+        support: "direct",
+        how: "Reads the project's generated code map through the shared reader, one labelled answer at most 6 KB, paging one pinned version.",
+        gap: null,
+    },
+    refresh_code_map: {
+        support: "direct",
+        how: "Queues a check of the project's main, as Check now does on the page.",
+        gap: null,
+    },
     get_action_status: {
         support: "direct",
         how: "Reads the exact saved shared action and its outcome, including completion through secure review.",
@@ -569,6 +585,7 @@ export const CHAT_ACTION_PARITY = {
         how: "Read during a turn.",
         gap: null,
     },
+    get_flaky_tests: { support: "direct", how: "Read during a turn: a project's tests with mixed outcomes, each with the task that would fix it. Fixing one is an ordinary task card.", gap: null },
     get_models: { support: "direct", how: "Read during a turn: default agents with the exact model each runs, CLI versions and new models. Changes use the labelled Settings → Models page.", gap: null },
     get_diff: { support: "direct", how: "Read during a turn: the exact result's changed files, then one file's diff, so a requested change names the right file and line.", gap: null },
     get_check_log: { support: "direct", how: "Read during a turn: the end of the exact result's check log, a page of it, or the lines matching a search.", gap: null },
@@ -619,6 +636,12 @@ export const CHAT_ACTION_PARITY = {
         how: "Pushes the plan's or flow card's own decision card to the owner's paired chat: Approve arms Yes and Cancel, and only the owner's Yes decides, through sealScopeApproval (as a chat-origin approval) or decideFlowCard. Outside the owner's chat-approval setting or a decision's rules it answers why, and the lead opens the console control.",
         gap: "A flow card's Send back, Edit and a Person chooses step act from the pushed card; a plan's Send back stays in the console. Fixture proof only, no physical-phone rendering.",
     },
+    get_findings: { support: "direct", how: "Read during a turn; a finding's words are shown as untrusted text.", gap: null },
+    show_card: {
+        support: "direct",
+        how: "A card of Toolroll's own records. Telegram shows it as one message: key facts as lines, tables and charts as monospaced text, its links as url buttons.",
+        gap: "A chart is bars of text on Telegram, with every number written out.",
+    },
     show_control: {
         support: "handoff",
         how: "The card names the control and the task, with one url button to that exact console control when a trusted https console-url is configured; the button opens the signed-in console and acts on nothing.",
@@ -627,12 +650,12 @@ export const CHAT_ACTION_PARITY = {
     propose_task: {
         support: "direct",
         how: "Card with Confirm/Dismiss through confirmLeadProposal (filed as a lead proposal, via telegram). The confirmed card links Review & start for the filed task while its scope waits; under a signed automatic mode it says the scope is approved and links the task.",
-        gap: "Under manual approval the password step happens in the console, reached from the card's button.",
+        gap: "Under manual approval the plan then needs the person's own yes, on its card.",
     },
     propose_sweep: {
         support: "direct",
         how: "A protected shared action (sweep_file): the card lists every item, the shared rules and the success test; confirming files them all and approves each scope.",
-        gap: "Starting a sweep approves work, so it opens the secure review in the console (the password, or Passwordless).",
+        gap: "Terms too long for one message open the review page, in the signed-in console.",
     },
     get_sweep: {
         support: "direct",
@@ -647,7 +670,7 @@ export const CHAT_ACTION_PARITY = {
     propose_scope: {
         support: "direct",
         how: "Confirm rewrites the scope through the shared door; the confirmed card links Review & start for the exact task.",
-        gap: "Approving the rewritten scope needs the password, in the console.",
+        gap: "Approving the rewritten scope is a separate yes, on its own card.",
     },
     propose_next: {
         support: "direct",
@@ -686,8 +709,8 @@ export const CHAT_ACTION_PARITY = {
     },
     propose_task_action: {
         support: "direct",
-        how: "stop, retry, plan, wait_for and stop_waiting confirm through the shared door (a stop is audited via telegram); resume confirms only the request, says nothing has resumed, and links the task where the password step lives.",
-        gap: "resume completes in the console (incomplete phone action).",
+        how: "stop, retry, plan, wait_for and stop_waiting confirm through the shared door (a stop is audited via telegram); resume, on a person's own tap, lifts the stop.",
+        gap: null,
     },
     propose_answer: {
         support: "direct",
@@ -744,8 +767,8 @@ export function confirmedCardText(store, outcome, proposal, note) {
         : revise && state === "approved"
             ? "Revision created under your automatic approval settings."
             : said;
-    const next = resume
-        ? "Nothing has resumed yet: the password step on the task finishes it."
+    const next = resume && said.startsWith("Resume requested")
+        ? "Nothing has resumed yet: finish it on the task."
         : approval && note !== null
             ? "Approve it in Toolroll on the computer."
             : "";

package/dist/chat-controls.d.ts

@@ -26,6 +26,10 @@ export declare const CHAT_CONTROLS: {
         readonly label: "Open result";
         readonly target: "task";
     };
+    readonly findings: {
+        readonly label: "Open findings";
+        readonly target: "task";
+    };
     readonly acceptance: {
         readonly label: "Inspect result";
         readonly target: "task";

package/dist/chat-controls.js

@@ -8,6 +8,8 @@ export const CHAT_CONTROLS = {
     recovery: { label: "Review recovery options", target: "task" },
     cancel: { label: "Cancel task", target: "task" },
     result: { label: "Open result", target: "task" },
+    // A task's findings, failed checks and evidence: closing a finding and starting a repair happen there.
+    findings: { label: "Open findings", target: "task" },
     acceptance: { label: "Inspect result", target: "task" },
     publish: { label: "Review publication", target: "task" },
     projects: { label: "Manage projects", href: "/projects" },
@@ -50,5 +52,7 @@ export function chatControlHref(control, task, run, project) {
     // Task details owns cancel, retry, publication and other dedicated ceremonies.
     if (control === "cancel" || control === "recovery" || control === "publish")
         return "/t/" + encodeURIComponent(task);
+    if (control === "findings")
+        return `/t/${encodeURIComponent(task)}#findings`;
     return base + (control === "approval" || control === "planning" ? "#task-chat-action" : "");
 }

package/dist/chat-decide.d.ts

@@ -1,5 +1,5 @@
 import { DECIDE_ACTS } from "./contracts/chat-callback-rows.js";
-import { type ChatApprovalLimits } from "./chat-approval.js";
+import { chatApproveMode } from "./chat-approval.js";
 import { type VerifiedApprover } from "./principal.js";
 import type { Scope } from "./scope.js";
 import { type ReleaseCard } from "./release-card.js";
@@ -51,13 +51,18 @@ export type DecideButton = {
 };
 /** The words, said once. */
 export declare const DECIDE_LABELS: {
-    readonly accept: "Accept and finish";
-    readonly changes: "Request changes";
+    readonly accept: "Accept";
+    readonly changes: "Send back";
     readonly retry: "Retry";
     readonly approve: "Approve & start";
     readonly "not-now": "Not now";
     readonly merge: "Merge";
     readonly look: "Look first";
+    /** A result's one link (docs/plans/plain-toolroll.md P1.5). */
+    readonly open: "Open result";
+    /** A plan card's one button: it shows the full terms, and the Approve sits under them. Never an approval itself. */
+    readonly review: "Review plan";
+    readonly details: "Details";
     readonly edit: "Edit";
     readonly yes: "Yes";
     readonly cancel: "Cancel";
@@ -81,19 +86,7 @@ export type DecideOffer = {
         text: string;
     };
 };
-/** What lets this person's chat on `channel` approve on this repository now: their lasting chat-approval setting
- * (chat-approval.ts), or else a live signed mode carrying the chatApprove term, signed by them, that names this chat
- * app (a mode signed before the term named its apps covers Telegram alone). `digest` names that authority for the
- * ledger; the yes itself is the person's tap and is sealed as theirs, so it doesn't lapse when the authority does. */
-export declare function chatApproveMode(store: Store, repo: string | null, approver: string, now: Date, channel: DecideChannel): {
-    ok: true;
-    digest: string;
-    limits: ChatApprovalLimits;
-    source: "setting" | "mode";
-} | {
-    ok: false;
-    why: string;
-};
+export { chatApproveMode };
 /** A plan this person's chat may approve now: the term, the plan's exact bytes, and none of the reasons it must open
  * Toolroll instead. `digest` binds the scope and the plan document the card shows. */
 export declare function planInChat(store: Store, taskId: string, approver: string, now: Date, channel: DecideChannel, root?: string, 
@@ -104,6 +97,7 @@ from?: "requests"): {
     source: "setting" | "mode";
     digest: string;
     scope: Scope;
+    whole: boolean;
 } | {
     ok: false;
     why: string;