toolroll 0.9.94 → 0.9.95

package/dist/server/render-tasks.js

@@ -3,7 +3,8 @@ import { archivedWords } from "../tidy.js";
 import { btn } from "./kit.js";
 import { whenUtc } from "../when-html.js";
 import { networkWords } from "../egress.js";
-import { releaseAsksAgainWords, releaseTermsSentence } from "../scope.js";
+import { chainTermsLines, liveChainFromJson, releaseAsksAgainWords, releaseTermsSentence } from "../scope.js";
+import { SUBSCRIPTION_CAPABLE } from "../keys.js";
 import { RELEASE_CI_RUNNING_WORDS } from "../release-ci-hold.js";
 import { writesWords } from "../writes-mode.js";
 import { checkAccessWords } from "../check-access.js";
@@ -28,7 +29,7 @@ import { taskRoad } from "../first-run.js";
 import { starterForWork } from "../flow-starters.js";
 import {} from "../gaps.js";
 import { readAuthModeStrict } from "../keys.js";
-import { failedAttemptSentence, retryNoteOf, START_BUILDER_COMMAND, startBuilderHref } from "../needs-you.js";
+import { failedAttemptSentence, retryNoteOf, START_BUILDER_COMMAND, startBuilderHref, STORAGE_HOLD_PREFIX } from "../needs-you.js";
 import { planVersionWords } from "../plain-words.js";
 import { chosenWords, makesNoPlan, PHASES as ROUTE_PHASES, TASK_SIZES } from "../phase-routing.js";
 import { parseExecutionPlanDocument } from "../plan.js";
@@ -315,6 +316,14 @@ export function approvalSheetParts(input) {
     if (allowed !== null)
         allowing.push(allowed);
     allowing.push(scope.budgetMicrousd === null ? "no attempt limit" : `up to ${money(scope.budgetMicrousd)} per attempt`);
+    // Fallback agents are terms: who takes over when an agent runs out, with any that spend money said before the yes.
+    const chain = chainTermsLines(scope);
+    const fallbacks = liveChainFromJson(scope.proposedChainJson ?? null)?.slice(1) ?? [];
+    if (fallbacks.length > 0) {
+        const paid = fallbacks.filter(one => one.authMode === "api-key" || SUBSCRIPTION_CAPABLE[one.profile.provider] !== true);
+        // Each agent named once, the paid one said where it stands in the order.
+        allowing.push(`if it runs out of its plan, the work moves to ${fallbacks.map(one => `${agentNameWords(one.profile.provider, one.profile.model)}${paid.includes(one) ? " on an API key, which spends money" : ""}`).join(", then ")}`);
+    }
     const earlier = earlierVersionsWords(input.earlier.active, input.earlier.running);
     if (earlier !== null)
         allowing.push(earlier);
@@ -441,6 +450,7 @@ export function approvalSheetParts(input) {
         row("Changes", changes),
         row("Won’t touch", html `<p>${scope.outOfScope === null ? "Nothing is ruled out." : scope.outOfScope}</p>`),
         row("Done when", doneWhen),
+        chain.length === 0 ? "" : row("If it runs out", html `<p>${chain[0]}</p><ol class="approval-steps" data-approval-fallback>${chain.slice(1).map(one => html `<li>${one.replace(/^\d+\. /, "")}</li>`)}</ol>`),
         html `</dl>`,
         amendment,
         // The size, said once and plainly beside who builds: "Small change: fast model, no plan".
@@ -1044,6 +1054,7 @@ export function statusActionHref(status, taskId, runId, prUrl, repo) {
         case "open-review": return repo === undefined ? reviewHref(taskId) : reviewHref(taskId, runId);
         case "open-run": return runId === null ? taskHref(taskId) : `/r/${runId}`;
         case "open-pr": return safePrUrl(prUrl) ?? (repo === undefined ? reviewHref(taskId) : reviewHref(taskId, runId));
+        case "open-findings": return `${taskHref(taskId)}#findings`;
         case "open-task":
         default: return taskHref(taskId);
     }
@@ -1364,7 +1375,7 @@ export function taskBodyParts(data) {
                     case "select-agent": return html ` <a href="#scope">Choose an available provider and model</a>.`;
                     case "approve-scope": return html ` <a href="#approve">Review the plan and approve it</a>.`;
                     case "answer-decision": return html ` <a href="#decisions">Answer the waiting question</a>.`;
-                    case "unhold": return html ` Use <strong>Remove hold</strong> when it can continue.`;
+                    case "unhold": return diagnosis.code === "storage-blocked" ? html ` Use <strong>Try again</strong> once it's allowed.` : html ` Use <strong>Remove hold</strong> when it can continue.`;
                     // The reason is the detail itself; Retry is the status card's own act, said once.
                     case "retry-task": return "";
                     case "repair-capability": return html ` <a href="/caps">Repair the requirement</a>.`;
@@ -1536,7 +1547,9 @@ export function taskBodyParts(data) {
         ? ""
         : joinHtml([
             html `<h2>Holds</h2>`,
-            joinHtml(data.holds.map(hold => html `<p class="row">${holdOwnerWords(hold.ownerKind)} — ${hold.reason}${hold.until === null ? "" : html ` <span class="meta">until ${whenTime(hold.until)}</span>`}</p>`), "\n"),
+            joinHtml(data.holds.map(
+            // The storage check's hold (dispose.ts holdForStorage) says what it waits for, in the check's own words.
+            hold => html `<p class="row">${hold.ownerKind === "backoff" && hold.reason.startsWith(STORAGE_HOLD_PREFIX) ? `waiting for macOS permission — ${hold.reason.slice(STORAGE_HOLD_PREFIX.length)}` : `${holdOwnerWords(hold.ownerKind)} — ${hold.reason}`}${hold.until === null ? "" : html ` <span class="meta">until ${whenTime(hold.until)}</span>`}</p>`), "\n"),
             html `<p class="meta">Only your hold can be lifted here. Waits for a question, repeated failures or a retry clear on their own.</p>`,
         ]);
     const approval = approvalOf(scope);
@@ -2012,7 +2025,9 @@ export function taskBodyParts(data) {
         // to "plan first" adds a second, unnecessary decision at the exact
         // moment the page should have one obvious action.
         stopControlsActive || canPlan || !canHold ? "" : holdAct,
-        data.holds.some(hold => hold.ownerKind === "operator") ? act("unhold", "Remove hold") : "",
+        data.holds.some(hold => hold.ownerKind === "operator") ? act("unhold", "Remove hold")
+            // The storage check couldn't finish (dispose.ts holdForStorage): one tap tries again now.
+            : data.holds.some(hold => hold.ownerKind === "backoff" && hold.ownerId === `storage:${hold.taskRef}`) ? act("unhold", "Try again") : "",
         html `</div>`,
         primaryAct === null ? "" : html `<p class="meta acts-why acts-why-${primaryAct.whyClass}">${primaryAct.why}</p>`,
         data.claimed && !stopControlsActive
@@ -2159,6 +2174,10 @@ export function taskBodyParts(data) {
         data.assignment == null ? section("attempts", runs, true, data.runs.length) : section("Build activity", data.runs.length === 0 ? "" : runRows, false, data.runs.length, "attempts"),
         section("usage", spendCard, false),
         section("steering", steeringCard, (data.steering ?? []).length > 0, (data.steering ?? []).length),
+        data.followThrough == null ? "" : section("findings", data.followThrough.findings, data.followThrough.openFindings > 0, data.followThrough.findingCount),
+        data.followThrough == null ? "" : section("failed checks", data.followThrough.repairs, true),
+        data.followThrough == null ? "" : section("before and after", data.followThrough.evidence, false),
+        data.followThrough == null ? "" : section("handover note", data.followThrough.handover, false),
         section("plan", 
         // The recipe road rides with the scope it reuses (UI polish
         // 2026-09-13), off the title-to-action path.

package/dist/server/route-table.js

@@ -461,6 +461,7 @@ post("settings", "spend.budget", "/spend/budget", { scope: "step-up", ...operato
 post("settings", "settings.project-concurrency", "/settings/project/concurrency");
 post("settings", "settings.project-live-view", "/settings/project/live-view", { scope: "step-up", callers: ["cookie"] });
 post("settings", "settings.project-network", "/settings/project/network", { scope: "step-up", callers: ["cookie"] });
+post("settings", "settings.project-fallback", "/settings/project/fallback", { scope: "step-up", callers: ["cookie"] });
 post("settings", "settings.project-writes", "/settings/project/writes", { scope: "step-up", callers: ["cookie"] });
 post("settings", "settings.project-check-access", "/settings/project/check-access", { scope: "step-up", callers: ["cookie"] });
 post("settings", "settings.project-sandbox", "/settings/project/sandbox", { scope: "step-up", callers: ["cookie"] });
@@ -572,6 +573,8 @@ post("tasks", "decision.answer", `^\\/d\\/${ID}\\/answer$`, { project: "decision
 // A held automatic release goes on: a person, with their password typed now (release-auto.ts allowAutoPublish).
 post("tasks", "task.release.go-on", `^\\/t\\/${TASK}\\/release\\/go-on$`, { project: "task", limited: "resource", scope: "step-up", sample: "/t/one/release/go-on", ...approver("An approver lets a release go on.", "/tasks") });
 post("tasks", "task.act.keep-grown", `^\\/t\\/${TASK}\\/keep-grown$`, { project: "task", limited: "resource", sample: "/t/one/keep-grown", callers: ["cookie"], ...approver("An approver keeps a change.", "/tasks") });
+// Findings, a failed check's repair, before-and-after evidence: a person's acts from a browser, none of them an approval.
+post("tasks", "task.act.follow-through", `^\\/t\\/${TASK}\\/follow-through$`, { project: "task", limited: "resource", sample: "/t/one/follow-through", callers: ["cookie"], ...approver("An approver acts on a finding.", "/tasks") });
 post("tasks", "task.act.hold", `^\\/t\\/${TASK}\\/hold$`, { project: "task", limited: "resource", sample: "/t/one/hold" });
 post("tasks", "task.act.unhold", `^\\/t\\/${TASK}\\/unhold$`, { project: "task", limited: "resource", sample: "/t/one/unhold" });
 post("tasks", "task.act.requeue", `^\\/t\\/${TASK}\\/requeue$`, { project: "task", limited: "resource", sample: "/t/one/requeue" });

package/dist/server/settings.js

@@ -2,6 +2,7 @@ import { PASSWORDLESS_TRADE, passwordlessSetting, setPasswordless } from "../pas
 import { ACP_AGENTS, isKeyedProvider } from "../acp-agents.js";
 import { LIVE_VIEW_CONSENT, liveViewConsentDigest, setLiveCommands } from "../live-detail.js";
 import { CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
+import { clearFallbackChain, parseEntry, setFallbackChain, setPaidGrant } from "../fallback.js";
 import { galleryTemplateOf } from "../flow-gallery.js";
 import { finishGoogleConsent, GOOGLE_CALLBACK } from "../google-mail.js";
 import { kitInstalled, kitOf } from "../kits.js";
@@ -84,7 +85,7 @@ import { acceptSuggestion, dismissSuggestion, grantWords, keepRule, modelName, r
 import { ALL_SLOTS, applyModelChoices, browserWords, checkScope, DEFAULT_PRESET, defaultAgentOf, fillDefaultRouting, isPresetName, newerModels, PRESETS, presetChange, presetInUse, previewModelChange, recentRuns, rowAt, slotKey, SLOTS, slotWords, stateDigest, switchChange } from "../model-choices.js";
 import { HEADROOM_FIVE_HOUR_LIMIT, HEADROOM_WEEKLY_LIMIT, exactModelId } from "../phase-routing.js";
 import { RISKY_MEANS, SIZE_MEANS, SIZING_CLAUDE_MODEL } from "../task-sizing.js";
-import { CHAT_APPROVE_ALL, MODE_MAX_DAYS, modeDigestOf, modeTermsJson, modeWords, presetTerms } from "../modes.js";
+import { CHAT_APPROVE_ALL, CHECK_REPAIR_LIMIT, MODE_MAX_DAYS, modeDigestOf, modeTermsJson, modeWords, presetTerms } from "../modes.js";
 import { monitoringChange, readMonitoring, saveMonitoring } from "../monitoring-settings.js";
 import { monitoringHtml, signingSecretHtml } from "../monitoring-ui.js";
 import { openRouterPickerScript } from "../openrouter-models.js";
@@ -2461,19 +2462,17 @@ ${postForm("/settings/chat-approval/save", html `\
             planAuto: body.get("plan-auto") === "1",
             reviewAuto: false,
             reviewRetryAuto: false,
-            // The repair-auto grant is the SAME rule (v40): unchecked stays
-            // false on every preset — only the explicit box grants it, and the
-            // attempt cap it carries is meaningless without it.
-            repairAuto: false,
-            repairMaxAttempts: 0,
+            // Repairing failed checks: only the explicit choice grants it, with the limit it signs (check-repair.ts).
+            repairAuto: body.get("repair-auto") === "1",
+            repairMaxAttempts: body.get("repair-auto") === "1" ? CHECK_REPAIR_LIMIT : 0,
             // Approving from the paired chat: only the explicit choice grants it, naming every chat app it covers (a grant
             // signed before it named them stays Telegram only).
             chatApprove: body.get("chat-approve") === "1",
             ...(body.get("chat-approve") === "1" ? { chatApproveChats: CHAT_APPROVE_ALL } : {}),
             publication: body.get("publication") === "automerge" ? "automerge" : "notify",
         };
-        if (["review-auto", "review-retry-auto", "repair-auto"].some(field => body.get(field) === "1")) {
-            return refuse(response, who, 400, "Review scheduling and automatic revisions are no longer available. Reload the mode form.", "/mode");
+        if (["review-auto", "review-retry-auto"].some(field => body.get(field) === "1")) {
+            return refuse(response, who, 400, "Review scheduling is no longer available. Reload the mode form.", "/mode");
         }
         if (terms.planAuto && !terms.autoApproveFiling) {
             return refuse(response, who, 400, "Automatic planner approval requires automatic filing approval.", "/mode");
@@ -2486,9 +2485,9 @@ ${postForm("/settings/chat-approval/save", html `\
             // THE CEREMONY (M1): every resolved term in words, and the password
             // signs exactly this digest — a drifted form refuses at /mode/sign.
             const nonce = mintApprovalNonce(who.name, "mode-sign", `${project}:${digest}`);
-            const signed = Object.fromEntries(["name", "days", "publication", "auto-approve", "plan-auto", "chat-approve"]
+            const signed = Object.fromEntries(["name", "days", "publication", "auto-approve", "plan-auto", "chat-approve", "repair-auto"]
                 .map(field => [field, body.get(field) ?? ""]));
-            const bodyHtml = modeCeremonyHtml({ name, project: projectName(project), words: modeWords(terms), chatApprove: signed["chat-approve"] === "1", hidden: { nonce, digest, ...signed, expiry } });
+            const bodyHtml = modeCeremonyHtml({ name, project: projectName(project), words: modeWords(terms), chatApprove: signed["chat-approve"] === "1", repairAuto: signed["repair-auto"] === "1", hidden: { nonce, digest, ...signed, expiry } });
             return sendScreen(response, 200, screen("Sign the mode", bodyHtml, { chrome: chromeFor(project, "mode") }));
         }
         // /mode/sign: the fixed expiry rides the form; the digest is
@@ -2504,8 +2503,8 @@ ${postForm("/settings/chat-approval/save", html `\
             return refuse(response, who, 409, "the terms moved while you were reading — read them again", "/mode");
         }
         const token = body.get("token") ?? "";
-        // A mode that lets a chat app approve opens a way to act: a credential act. Any other mode is an ordinary one.
-        if (!(body.get("chat-approve") === "1" ? authenticateCredential(who, token) : authenticateApprover(who, token)).ok) {
+        // A mode that lets a chat app approve, or repairs start by themselves, opens a way to act: a credential act. Any other mode is an ordinary one.
+        if (!(body.get("chat-approve") === "1" || body.get("repair-auto") === "1" ? authenticateCredential(who, token) : authenticateApprover(who, token)).ok) {
             return refuse(response, who, 403, "signing a mode takes your password, typed again", "/mode");
         }
         store.signMode({
@@ -2814,6 +2813,7 @@ ${postForm("/settings/chat-approval/save", html `\
         "settings.project-concurrency": projectConcurrency,
         "settings.project-live-view": projectLiveView,
         "settings.project-network": projectNetwork,
+        "settings.project-fallback": projectFallback,
         "settings.project-writes": projectWrites,
         "settings.project-check-access": projectCheckAccess,
         "settings.project-sandbox": projectSandbox,
@@ -3198,5 +3198,30 @@ ${postForm("/settings/chat-approval/save", html `\
                                     : kind === "suggest-on" ? "Suggestions are on for this project." : "Suggestions are off for this project.");
         };
     }
+    // Settings → Project → Fallback agents (fallback.ts): who takes over when an agent runs out of its plan. An approver for
+    // the project, with their password typed now; the ledger keeps every change. New tasks seal it; approved ones keep theirs.
+    async function projectFallback(ctx) {
+        const { who, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.projectFallback);
+        const repo = body.get("repo") ?? "";
+        if (!consoleProjects().includes(repo) || !visible(repo))
+            return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
+        if (who.via !== "cookie" || who.role !== "approver" || store.isDemo() || !store.accountCanAccess(who.name, repo))
+            return refuse(response, who, 403, "An approver for this project changes its fallback agents.", "/settings/project");
+        const back = sayTo(response, `/settings/project?repo=${encodeURIComponent(repo)}`, "#fallback");
+        const parsed = (body.get("agents") ?? "").split(/[\n,]+/).map(one => one.trim()).filter(Boolean).map(parseEntry);
+        const bad = parsed.find((one) => typeof one === "string");
+        if (bad !== undefined)
+            return back("problem", `Nothing changed: ${bad}.`);
+        if (!authenticateCredential(who, body.get("password") ?? "").ok)
+            return back("problem", "Enter your Toolroll password to change fallback agents.");
+        const done = store.transact(() => {
+            const set = parsed.length === 0 ? clearFallbackChain(store, repo, who.name, now) : setFallbackChain(store, repo, parsed, who.name, now);
+            if (!set.ok || parsed.length === 0)
+                return set;
+            return setPaidGrant(store, repo, body.get("paid") === "on", who.name, now);
+        });
+        return done.ok ? back("said", "Saved. Tasks scoped from now on use it; tasks already approved keep the chain they were approved with.") : back("problem", `Nothing changed: ${done.problem}`);
+    }
     return { registrations, modelsView };
 }

package/dist/server/task-views.js

@@ -1,3 +1,5 @@
+import { heldFindingCount } from "../findings.js";
+import { familyInWebReach } from "../findings.js";
 import { existsSync } from "node:fs";
 import { resultRecordWordsOf } from "../route-results.js";
 import { selectionEvidenceWords } from "../route-rules.js";
@@ -28,6 +30,7 @@ import { readSkillsSnapshot, skillTestResult } from "../project-skills.js";
 import { newestPullRequestOf, publishingOf, pullRequestBlocker } from '../pull-request-flow.js';
 import { structuredHandoffView, terminalDiffView } from "../result-evidence-readers.js";
 import { resultCheckLevel } from '../result-follow-ups.js';
+import { followThroughView } from "./render-follow-through.js";
 import { skillsSnapshotHtml, skillTestFeedbackHtml } from "../skills-ui.js";
 import { archiveOf } from "../store.js";
 import { runActivityOf } from "../task-activity.js";
@@ -143,6 +146,7 @@ export function createTaskViews(runtime) {
         const live = runs.find(one => runIsLive(one)) ?? null;
         const facts = {
             id: task.id,
+            heldFindings: heldFindingCount(runtime.store, task.id),
             title: task.title,
             repo: task.repo,
             state: task.state,
@@ -541,6 +545,7 @@ export function createTaskViews(runtime) {
                         : field.field === "local-refused" ? { eligible: false, message: field.message, href: field.href, action: field.action } : null };
             })(),
             routeChange: ref === null ? null : routeChangeOf(runtime.store, ref.externalId),
+            followThrough: who === undefined || familyInWebReach(runtime.store, who, taskId, runtime.visible) === null ? null : followThroughView(runtime.store, runtime.evidenceRoot, taskId, taskHref(taskId), who.role === "approver" && who.via === "cookie" && !runtime.store.isDemo(), runtime.clock()),
             fastGrown: (() => {
                 if (ref === null || runtime.store.getTask(ref.externalId)?.state !== "done" || !fastStarted(runtime.store, ref.externalId))
                     return null;

package/dist/server/tasks.js

@@ -36,6 +36,10 @@ import { firstTaskSuggestions, withBuilderStep } from "../first-run.js";
 import { fastStartPage, fastTermsRows, importPage, newTaskPage } from "./render-new-task.js";
 import { fileGithubItem, readGithubItem } from "../github-import.js";
 import { allowAutoPublish, autoPublishHeld } from "../release-auto.js";
+import { startCheckRepair } from "../check-repair.js";
+import { askFailingFirst, dropFailingFirst, rerunEvidence, saveEvidencePair } from "../evidence-pair.js";
+import { closeFinding, familyInWebReach, familyRootOf, getFinding, NOT_ON_TASK, resendFinding, runOnTask, sendFinding, sendReviewFinding } from "../findings.js";
+import { labelProviderCapture, providerCapture } from "../provider-capture.js";
 import { fastStartBuild, keepGrownChange, prepareFastStart } from "../fast-start.js";
 import { evidencePack } from "../evidence-pack.js";
 import { decisionPage, evidenceRecordPage, runPage } from "./render-history.js";
@@ -2962,6 +2966,7 @@ export function createTasksHandlers(runtime) {
         "tasks.add": addTask,
         "tasks.fast": buildNow,
         "task.act.keep-grown": keepGrown,
+        "task.act.follow-through": followThroughAct,
         "queue.move": queueMove,
         "queue.note": queueNote,
         "decision.answer": answerDecision,
@@ -3062,6 +3067,77 @@ export function createTasksHandlers(runtime) {
             return taskScreen(response, who, act.taskId, kept.message, 409);
         return redirect(response, taskHref(act.taskId));
     }
+    /** Findings, a failed check's repair and evidence (render-follow-through.ts). Nothing here is an approval: a repair is a
+     * draft, and its task page asks for the plan's approval as any other. */
+    async function followThroughAct(ctx) {
+        const { url, who, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.followThrough);
+        const act = matchTaskPath(url.pathname, "/follow-through$");
+        if (act === null)
+            return noPage(who, response);
+        const { taskId } = act;
+        // Chat's gate, here too (findings.ts familyInReach): every project in this task's family, not only this page's.
+        if (familyInWebReach(store, who, taskId, visible) === null)
+            return refuse(response, who, 403, "That task is outside your access.", "/tasks");
+        const number = (name) => Number(body.get(name) ?? "");
+        const back = () => redirect(response, `${taskHref(taskId)}#findings`);
+        const refused = (message) => taskScreen(response, who, taskId, message, 409);
+        /** A finding or a run named by a form must belong to this task's family: this page's project was the one admitted. */
+        const ownFinding = () => { const found = getFinding(store, number("finding")); return found !== null && found.familyRoot === familyRootOf(store, taskId) ? found : null; };
+        const ownRun = () => runOnTask(store, number("run"), taskId);
+        switch (body.get("act")) {
+            case "send": {
+                const line = body.get("line") ?? "";
+                const pointer = body.get("pointer") ?? "";
+                const sent = pointer !== "" ? sendReviewFinding(store, taskId, pointer, who.name, now)
+                    : sendFinding(store, { taskId, source: "person", by: who.name, summary: body.get("note") ?? "", file: body.get("file") || null, line: line === "" ? null : Number(line) }, now);
+                return sent.ok ? back() : refused(sent.message);
+            }
+            case "resend": {
+                if (ownFinding() === null)
+                    return refused("That finding isn't on this task.");
+                const sent = resendFinding(store, number("finding"), now);
+                return sent.ok ? back() : refused(sent.message);
+            }
+            case "close": {
+                if (ownFinding() === null)
+                    return refused("That finding isn't on this task.");
+                const closed = closeFinding(store, number("finding"), who.name, body.get("note") ?? "", now);
+                return closed.ok ? back() : refused(closed.message);
+            }
+            case "repair": {
+                if (!ownRun())
+                    return refused(NOT_ON_TASK);
+                const started = startCheckRepair(store, evidenceRoot, number("run"), now);
+                return started.ok ? redirect(response, taskHref(started.draft)) : refused(started.message);
+            }
+            case "save-evidence": {
+                if (!ownRun())
+                    return refused(NOT_ON_TASK);
+                const saved = saveEvidencePair(store, evidenceRoot, { taskId, runId: number("run"), by: who.name }, now);
+                return saved.ok ? back() : refused(saved.message);
+            }
+            case "rerun-evidence": {
+                const asked = rerunEvidence(store, taskId, who.name, now);
+                return asked.ok ? back() : refused(asked.message);
+            }
+            case "failing-first-on":
+                askFailingFirst(store, taskId, who.name, now);
+                return back();
+            case "failing-first-off":
+                dropFailingFirst(store, taskId);
+                return back();
+            case "mark": {
+                const capture = providerCapture(store, number("capture"));
+                const label = body.get("label");
+                if (capture === null || !runOnTask(store, capture.run, taskId) || (label !== "exhausted" && label !== "not-exhausted"))
+                    return refused("That capture isn't on this task.");
+                labelProviderCapture(store, capture.id, label, who.name);
+                return back();
+            }
+            default: return refused("Reload the page and try again.");
+        }
+    }
     return { registrations, runListPane, peekFragment, taskMutation, queueRegionFor, ciFailingFor, completedRowFor, attemptRowFor, resultRowOf, reviewCockpitViewOf, decisionEvidence, runEvidence, sendArtifact, peekGuards, liveRunIds };
 }
 /** Put away and Restore one task, and Put away old tasks (docs/plans/task-tidy.md): the preview reads only (GET-quiet);

package/dist/settings-groups-ui.d.ts

@@ -213,6 +213,7 @@ export declare function modeCeremonyHtml(view: {
     project: string;
     words: string[];
     chatApprove: boolean;
+    repairAuto: boolean;
     hidden: Readonly<Record<string, string>>;
 }): Html;
 export type PersonView = {

package/dist/settings-groups-ui.js

@@ -527,6 +527,8 @@ export function modePageHtml(view) {
                 items: [["0", "Wait for a person"], ["1", "Approve plans that keep what I filed"]] })),
             formRow("Approving from a chat app", "Plans that widen permissions, go past the attempt limit or touch protected paths still open Toolroll.", select({ name: "chat-approve", label: "Approving from a chat app", current: "",
                 items: [["", "Here, with my password"], ["1", "In my paired chat app, two taps"]] })),
+            formRow("Failed checks", "A repair stays inside the plan you approved. When it can't, or the tries run out, it comes to you.", select({ name: "repair-auto", label: "Failed checks", current: "",
+                items: [["", "Wait for me to start a repair"], ["1", "Repair them, up to 2 tries"]] })),
             html `<div class="k-acts">${btn("Review the terms", { variant: "primary", type: "submit" })}</div>`,
         ]))
     });
@@ -538,7 +540,7 @@ export function modeCeremonyHtml(view) {
     return settingsSubPage("approval", `Sign the ${view.name} mode`, joinHtml([
         settingsSection({ id: "mode-terms", title: `What you sign for ${view.project}`,
             body: html `<ul class="k-ssec-lead">${view.words.map(words => html `<li>${words}</li>`)}</ul>` }),
-        kitSectionForm({ proof: view.chatApprove ? "mode-sign-chat-approve" : "mode-sign", action: "/mode/sign", id: "mode-sign-form", native: true, hidden: view.hidden,
+        kitSectionForm({ proof: view.repairAuto ? "mode-sign-repair" : view.chatApprove ? "mode-sign-chat-approve" : "mode-sign", action: "/mode/sign", id: "mode-sign-form", native: true, hidden: view.hidden,
             save: { label: "Sign it" }, confirm: `Sign the ${view.name} mode for ${view.project}`, body: html `` }),
         note(html `<a class="k-link" href="/mode">Back, and sign nothing</a>`),
     ]));

package/dist/settings-kit.js

@@ -151,11 +151,12 @@ function rowForForm(proof, action, hidden) {
     for (const name of Object.keys(hidden))
         if (row.field === name || row.secrets.includes(name))
             throw new Error(`${row.id}: ${name} is never a hidden value`);
-    // The exact variant: its own selector must be in the hidden terms, and no other variant's may be.
+    // The exact variant: its own selector must be in the hidden terms, and no other variant's may be, unless both are
+    // credential acts: two of those on one form ask the strongest proof there is, so nothing gets weaker.
     if (row.select !== undefined && String(hidden[row.select.field] ?? "") !== row.select.value)
         throw new Error(`${row.id} posts ${row.select.field}=${row.select.value}`);
     for (const other of variantsOf(row))
-        if (other.select !== undefined && String(hidden[other.select.field] ?? "") === other.select.value)
+        if (other.select !== undefined && !(other.proof === "credential" && row.proof === "credential") && String(hidden[other.select.field] ?? "") === other.select.value)
             throw new Error(`${action} with ${other.select.field}=${other.select.value} is ${other.id}, not ${row.id}`);
     return row;
 }

package/dist/settings-proofs.js

@@ -20,7 +20,7 @@ const CREDENTIAL = { passwordless: "refused", sso: "accepted" };
 const TYPED = { passwordless: "refused", sso: "refused" };
 const NONE = { passwordless: "n/a", sso: "n/a" };
 /** /mode/sign re-derives the digest from the posted terms, so every one rides back. */
-const MODE_TERMS = ["nonce", "digest", "expiry", "name", "days", "publication", "auto-approve", "plan-auto", "chat-approve"];
+const MODE_TERMS = ["nonce", "digest", "expiry", "name", "days", "publication", "auto-approve", "plan-auto", "chat-approve", "repair-auto"];
 const CHAT_APPS = [["slack", "Slack", "slack", ["app-token", "bot-token"]], ["teams", "Teams", "teams", ["secret"]], ["discord", "Discord", "discord", ["bot-token"]]];
 export const PROOF_INVENTORY = [
     // CSRF only.
@@ -72,11 +72,13 @@ export const PROOF_INVENTORY = [
     { id: "local-mode-off", action: "Turn off local mode", routes: ["/settings/local-mode/off"], form: "localModeOff", field: "password", proof: "step-up", ...ACCEPT, role: "operator", handlerRole: "a full session (never the local owner)", secrets: [], terms: [] },
     { id: "mode-sign", action: "Sign an operating mode", routes: ["/mode/sign"], form: "mode", field: "token", proof: "step-up", ...ACCEPT, role: "any", handlerRole: "an approver of the project", secrets: [], terms: MODE_TERMS },
     { id: "mode-sign-chat-approve", action: "Sign an operating mode that lets your chat app approve", routes: ["/mode/sign"], select: { field: "chat-approve", value: "1" }, form: "mode", field: "token", proof: "credential", ...CREDENTIAL, role: "any", handlerRole: "an approver of the project", secrets: [], terms: MODE_TERMS },
+    { id: "mode-sign-repair", action: "Sign an operating mode that repairs failed checks by itself", routes: ["/mode/sign"], select: { field: "repair-auto", value: "1" }, form: "mode", field: "token", proof: "credential", ...CREDENTIAL, role: "any", handlerRole: "an approver of the project", secrets: [], terms: MODE_TERMS },
     // Credential acts: a password typed now or a one-use re-check; never Passwordless.
     { id: "passwordless-on", action: "Turn Passwordless on", routes: ["/settings/passwordless"], form: "passwordless", field: "password", proof: "credential", when: "only to turn it on (off needs nothing)", ...CREDENTIAL, role: "operator", secrets: [], terms: [] },
     { id: "sign-in", action: "Change sign-in (SSO)", routes: ["/settings/sign-in"], form: "signIn", field: "password", proof: "credential", when: "every action except Test", ...CREDENTIAL, role: "operator", secrets: ["client-secret"], terms: [] },
     { id: "release-approval", action: "Approve releases automatically", routes: ["/settings/release-approval"], form: "releaseApproval", field: "password", proof: "credential", when: "only to approve automatically (Ask me needs nothing)", ...CREDENTIAL, role: "approver", handlerRole: "an approver of the project", secrets: [], terms: ["repo"] },
     { id: "project-network", action: "Change what builds may reach", routes: ["/settings/project/network"], form: "projectNetwork", field: "password", proof: "credential", ...CREDENTIAL, role: "any", handlerRole: "an approver of the project", secrets: [], terms: ["repo"] },
+    { id: "project-fallback", action: "Change a project's fallback agents", routes: ["/settings/project/fallback"], form: "projectFallback", field: "password", proof: "credential", ...CREDENTIAL, role: "any", handlerRole: "an approver of the project", secrets: [], terms: [] },
     { id: "project-writes", action: "Change where builds may write", routes: ["/settings/project/writes"], form: "projectWrites", field: "password", proof: "credential", ...CREDENTIAL, role: "any", handlerRole: "an approver of the project", secrets: [], terms: ["repo"] },
     { id: "project-sandbox", action: "Change a project's sandbox", routes: ["/settings/project/sandbox"], form: "projectSandbox", field: "password", proof: "credential", ...CREDENTIAL, role: "any", handlerRole: "an approver of the project", secrets: [], terms: ["repo"] },
     { id: "project-check-access", action: "Narrow how far checks reach", routes: ["/settings/project/check-access"], form: "projectCheckAccess", field: "password", proof: "credential", ...CREDENTIAL, role: "any", handlerRole: "an approver of the project", secrets: [], terms: ["repo"], note: "for a form that can only narrow; one that offers a wider level uses project-check-access-widen" },

package/dist/setup-guide.d.ts

@@ -18,9 +18,9 @@ export declare function previewProjectInstructions(repo: string): {
     ok: false;
     message: string;
     plan?: never;
+    content?: never;
     fingerprint?: never;
     installed?: never;
-    content?: never;
 } | {
     message?: never;
     ok: true;
@@ -33,7 +33,7 @@ export declare function addProjectInstructions(repo: string, fingerprint: string
     ok: false;
     message: string;
     plan?: never;
+    content?: never;
     fingerprint?: never;
     installed?: never;
-    content?: never;
 } | import("./skills.js").InstallResult;

package/dist/slack-chat.js

@@ -1,3 +1,6 @@
+import { slackCardBlocks } from "./card-render.js";
+import { withoutCard } from "./chat-card-part.js";
+import { cardWithin } from "./chat-card.js";
 import { chatFlowButtons } from "./chat-flow.js";
 import { refuseResultShots, resultShotsPruned, shotWaitsUntil } from "./result-shots.js";
 import { chatQuestionButtons } from "./subagent-question.js";
@@ -14,6 +17,7 @@ import { readSlackBlockActions, readSlackButton, SLACK_LINK_ACTION } from "./con
 import { object, slackId, slackTs, slackMember, SlackError, uploadSlackBytes, } from "./slack-api.js";
 import { resultImageFileName, safeResultImageCaption, verifyResultImage, } from "./chat-evidence.js";
 import {} from "./store.js";
+const SLACK_REFUSED_BLOCKS = new Set(["invalid_blocks", "invalid_blocks_format", "invalid_arguments", "msg_too_long", "msg_blocks_too_long"]);
 const nowOf = (options) => options.clock?.() ?? new Date();
 const split = (text, size = 2800) => {
     const parts = [];
@@ -214,6 +218,10 @@ export async function deliverSlackPart(options) {
         if (content.task &&
             !repos.includes(store.lookupRef(content.task)?.repo ?? ""))
             throw new SlackError("Connected projects changed");
+        if (content.rich && !cardWithin(content.rich, repos)) {
+            state.dropPart(row.id, "Connected projects changed");
+            return true;
+        }
         // A screenshot sent with a result goes in that result's thread once its message is placed, and waits until then.
         const result = content.shot?.follows == null ? null : state.part(content.shot.follows);
         if (result !== null && !slackTs(result.message) && result.state === "pending") {
@@ -385,7 +393,7 @@ export async function deliverSlackPart(options) {
                 .replaceAll("&", "&")
                 .replaceAll("<", "&lt;")
                 .replaceAll(">", "&gt;"),
-            blocks: voiced === null ? slackBlocks(text, buttons) : slackVoiceBlocks(voiced, buttons),
+            blocks: content.rich ? slackCardBlocks(content.rich, buttons) : voiced === null ? slackBlocks(text, buttons) : slackVoiceBlocks(voiced, buttons),
             mrkdwn: voiced !== null,
             parse: "none",
             unfurl_links: false,
@@ -415,6 +423,11 @@ export async function deliverSlackPart(options) {
         }
         // No permission to upload files here: one plain line instead of the result's screenshots.
         const saved = readChatPart(row.payload), content = saved.ok ? saved.value : null;
+        // Slack refused the card's blocks: the part's own plain text goes instead, so the message is never lost.
+        if (content?.rich && error instanceof SlackError && SLACK_REFUSED_BLOCKS.has(error.code)) {
+            state.repaint(row.id, withoutCard(content));
+            return true;
+        }
         if (content !== null && content.image && content.shot && error instanceof SlackError && ["missing_scope", "no_permission"].includes(error.code)) {
             refuseResultShots(state, store, row, content, "Slack", nowOf(options));
             return true;

package/dist/steer-mailbox.d.ts

@@ -1,5 +1,10 @@
 import type { Store } from "./store.js";
 export declare const STEER_HANDLED = "handled";
+/** Findings have their own folder: a finding is not operator steering, and must never read as it (findings.ts). */
+export declare const STEER_FINDINGS = "findings";
+/** What the agent writes back: one file per finding it answers. */
+export declare const STEER_ANSWERS = "answers";
+export declare const findingNoteName: (id: number) => string;
 export type SteerMailbox = {
     runId: number;
     taskRef: number;
@@ -14,11 +19,13 @@ export type SteerMailbox = {
     last: number;
     /** Mailed and not yet moved to handled/: number → note id. */
     waiting: Map<number, number>;
+    /** Findings mailed to this run and not yet moved to handled/. */
+    findingsWaiting: Set<number>;
 };
 export declare const steerNoteName: (number: number) => string;
 /** Make the folder and its handled/ inside the worktree; null when it cannot be made. */
 export declare function openSteerMailbox(worktree: string, folder: string, runId: number, taskRef: number, key: string): SteerMailbox | null;
-/** One beat: record what the agent read, then mail what is new while the agent runs. */
+/** One beat: record what the agent read and answered, then mail what is new while the agent runs. */
 export declare function pulseSteerMailbox(store: Store, box: SteerMailbox, now: Date, agentRunning: boolean): void;
 /** The attempt is over: one last read, then the folder goes. Unread notes stay pending for the next attempt. */
 export declare function closeSteerMailbox(store: Store, box: SteerMailbox, now: Date): void;