toolroll 0.9.94 → 0.9.96

package/dist/chat-decide.js

@@ -4,10 +4,9 @@
  * and each button is one opaque token bound to the exact result, receipt, plan or commit the card showed: a card a
  * newer result, a finished task or a changed plan has overtaken says so and acts on nothing.
  *
- * Approving a plan or merging needs the password, which never goes in chat, so they act in chat only where the owner
- * turned approving from chat on (their lasting setting, chat-approval.ts, or a signed mode's chatApprove term), for
- * their own chat; otherwise, and for a plan that widens permissions, exceeds the limit or touches protected paths, the
- * card keeps its link. The change requests one youiyoux pass filed come as one card that shows every word of each
+ * A person with the authority approves a plan or merges from their own linked chat by default (owner's decision,
+ * docs/plans/toolroll-cards.md); their own off or limits (chat-approval.ts) and a signed mode's chatApprove term still
+ * hold. A tap is theirs alone, and the card binds it to the exact terms. The change requests one youiyoux pass filed come as one card that shows every word of each
  * task's terms, with Approve all and each one's own Approve (the requests card, below).
  *
  * The same in every chat app: Telegram's bridge and the shared engine Slack, Discord and Teams run on (chat-delivery.ts)
@@ -23,18 +22,19 @@ import { chatControlHref, chatResultHref } from "./chat-controls.js";
 import { applyChatTaskAction, chatTaskStamp } from "./chat-task-actions.js";
 import { chatTitle } from "./chat-voice.js";
 import { readVerifiedArtifact, scanForSecrets } from "./evidence.js";
-import { effectiveChatApproval } from "./chat-approval.js";
-import { chatApproveChatsOf, chatNames, modeTermsFromJson } from "./modes.js";
+import { chatApproveMode } from "./chat-approval.js";
 import { parseExecutionPlanDocument } from "./plan.js";
 import { verifyApproverStanding } from "./principal.js";
 import { pullRequestFollowOf } from "./pull-request-flow.js";
 import { requestResultChanges } from "./result-actions.js";
 import { revisionSourceOf } from "./result-review.js";
-import { APPROVAL_PROOF, approvalOf, approvalProofDetail, deployGateScope, quarantinedAuthor } from "./scope.js";
+import { APPROVAL_PROOF, approvalOf, approvalProofDetail, approve, deployGateScope, quarantinedAuthor } from "./scope.js";
+import { gateWords } from "./approval-policy.js";
 import { releaseCardOf } from "./release-card.js";
 import { releaseCiHoldOf, releaseCiHoldWords } from "./release-ci-hold.js";
 import { phoneText, projectLabel } from "./telegram-status.js";
-import { permissionPlainWords, scopeTermsText, shownTermsDigest } from "./chat-terms.js";
+import { cardTermsDigest, chatLimitProblem, permissionPlainWords, scopeTermsText, shownTermsDigest } from "./chat-terms.js";
+import { chainTermsLines } from "./scope.js";
 import { YOUIYOUX_CARD_KIND, YOUIYOUX_FILED_VIA, YOUIYOUX_HOME_PATH } from "./contracts/youiyoux-request.js";
 import { FILED_PER_PASS, requestKindWord, requestPassOf } from "./youiyoux-intake.js";
 import { discordPlain } from "./reply-shape.js";
@@ -67,33 +67,7 @@ const sha = (text) => createHash("sha256").update(text).digest("hex");
 const isAct = (one) => "act" in one;
 const title = (store, taskId) => phoneText(chatTitle(store, taskId), 60);
 // ---- the chatApprove term ----------------------------------------------------------
-/** What lets this person's chat on `channel` approve on this repository now: their lasting chat-approval setting
- * (chat-approval.ts), or else a live signed mode carrying the chatApprove term, signed by them, that names this chat
- * app (a mode signed before the term named its apps covers Telegram alone). `digest` names that authority for the
- * ledger; the yes itself is the person's tap and is sealed as theirs, so it doesn't lapse when the authority does. */
-export function chatApproveMode(store, repo, approver, now, channel) {
-    if (repo === null)
-        return { ok: false, why: "Approving from chat isn't turned on for this project." };
-    const setting = effectiveChatApproval(store, repo, approver);
-    if (setting.ok)
-        return { ok: true, digest: setting.setting.digest, limits: setting.limits, source: "setting" };
-    const mode = store.activeMode(repo, now);
-    const terms = mode === null ? null : modeTermsFromJson(mode.termsJson);
-    if (mode === null || terms === null || !terms.chatApprove)
-        return setting;
-    if (mode.signedBy !== approver || !store.accountCanAccess(approver, repo))
-        return { ok: false, why: "Only the person who signed this project's mode can approve from chat." };
-    const chats = chatApproveChatsOf(terms);
-    if (!chats.includes(channel))
-        return { ok: false, why: `Your mode approves from ${chatNames(chats)} only. Sign it again to approve from ${chatNames([channel])}.` };
-    return { ok: true, digest: mode.digest, limits: { fullAccess: terms.permissionDefault === "escalated", capMicrousd: terms.perAttemptBudgetMicrousd }, source: "mode" };
-}
-function fullAccess(profile) {
-    if (profile === null || profile === undefined)
-        return false;
-    return profile.provider === "claude" ? profile.permissionArgv === "bypassPermissions"
-        : profile.provider === "gemini" ? profile.approvalArgv === "yolo" : isAcpProfile(profile) ? true : profile.sandboxMode === "danger-full-access";
-}
+export { chatApproveMode };
 const money = (micro) => `$${(micro / 1_000_000).toFixed(2)}`;
 /** A plan this person's chat may approve now: the term, the plan's exact bytes, and none of the reasons it must open
  * Toolroll instead. `digest` binds the scope and the plan document the card shows. */
@@ -121,19 +95,16 @@ from) {
     const family = store.taskFamilyOf(taskId, [ref.repo], false);
     if (family === null || family.problem !== null || family.current.id !== taskId)
         return { ok: false, why: "A newer version of this task is current." };
-    // What the mode's seal refuses anyway, said first: model- or coordinator-written terms, an unreadable route.
-    if (ref.coordinatorCid !== null || quarantinedAuthor(scope.proposedVia ?? null))
-        return { ok: false, why: "This plan was written for you, so you approve it in Toolroll." };
+    // Terms a machine wrote, or checks that reach past the sandbox: a person reads every word before a yes, so the card shows them whole.
+    const whole = ref.coordinatorCid !== null || quarantinedAuthor(scope.proposedVia ?? null);
     if (scope.profileState === "unresolved" || scope.routeEra == null || (scope.termsProblem ?? null) !== null)
         return { ok: false, why: "This plan can't say exactly which agents run, so you approve it in Toolroll." };
-    const yours = mode.source === "setting" ? "your chat approval setting" : "your mode";
-    if (fullAccess(scope.profile) && !mode.limits.fullAccess)
-        return { ok: false, why: `This plan asks for more access than ${yours} allows.` };
-    const cap = mode.limits.capMicrousd;
-    if (cap !== null && (scope.budgetMicrousd === null || scope.budgetMicrousd > cap))
-        return { ok: false, why: `This plan has ${scope.budgetMicrousd === null ? "no attempt limit" : `a ${money(scope.budgetMicrousd)} attempt limit`}, more than ${yours === "your mode" ? "your mode's" : "your chat approval limit of"} ${money(cap)}.` };
-    if (store.approvalGate(taskId, approver, "mode").verdict !== "seal")
-        return { ok: false, why: "This plan touches protected work, so two people approve it in Toolroll." };
+    const limited = chatLimitProblem(scope, mode.limits, mode.source === "setting" ? "your chat approval setting" : "your mode");
+    if (limited !== null)
+        return { ok: false, why: limited };
+    const gate = store.approvalGate(taskId, approver, "person");
+    if (gate.verdict === "refuse")
+        return { ok: false, why: gateWords(gate) };
     if (store.scopePolicyRefusal(taskId) !== null)
         return { ok: false, why: "Your organisation's policy needs this plan approved in Toolroll." };
     // A revision approves only against notes that still verify, as on the console.
@@ -162,7 +133,8 @@ from) {
         if (!verified)
             return { ok: false, why: "The saved plan can't be verified here, so you approve it in Toolroll." };
     }
-    return { ok: true, modeDigest: mode.digest, source: mode.source, scope, digest: sha(`${scope.digest}:${plan?.sha256 ?? ""}`) };
+    // Terms shown whole are part of what the card is bound to, so the digest kept on its buttons covers those words.
+    return { ok: true, modeDigest: mode.digest, source: mode.source, scope, whole, digest: sha(`${scope.digest}:${plan?.sha256 ?? ""}${whole ? `:${cardTermsDigest(scopeTermsText(scope))}` : ""}`) };
 }
 /** A ready pull request this person's chat may merge now, bound to the exact commit. */
 export function mergeInChat(store, taskId, run, approver, now, channel) {
@@ -397,10 +369,13 @@ export function planCardText(store, taskId, scope, root, channel) {
     const allowing = [permissionPlainWords(scope.profile), scope.budgetMicrousd === null ? "no attempt limit" : `up to ${money(scope.budgetMicrousd)} per attempt`]
         .filter((one) => one !== null);
     const changed = routeChangeOf(store, taskId);
+    // Fallback agents are terms: in full on every card, near the top, and never cut.
+    const chain = chainTermsLines(scope);
     if (channel === "telegram") {
         return [
             `Plan ready: ${title(store, taskId)}`,
             ...(changed === null ? [] : [changed]),
+            ...chain,
             `Starting allows: ${allowing.join(" · ")}`,
             "",
             ...goal,
@@ -414,6 +389,7 @@ export function planCardText(store, taskId, scope, root, channel) {
     return [
         `Plan ready: ${title(store, taskId)}`,
         ...(changed === null ? [] : [changed]),
+        ...chain,
         "",
         ...goal,
         "",
@@ -470,7 +446,7 @@ export function decideOffer(store, target, who, now, channel, root) {
                 catch {
                     head = [title(store, target.taskId)];
                 }
-                return { text: [...head, "", needsPassword(plan.scope)].join("\n"), rows: [[{ label: "Approve in Toolroll", path: chatControlHref("approval", target.taskId) }]] };
+                return { text: [...head, "", needsFullCard(plan.scope)].join("\n"), rows: [[{ label: "Approve in Toolroll", path: chatControlHref("approval", target.taskId) }]] };
             }
             // A deploy gate is approved from chat only through its release card (chat-management.md §0a.5).
             if (release) {
@@ -576,7 +552,7 @@ export function isDecideToken(store, token) {
 /** A release card's acts carry its card digest (release-card.ts), never a plan's. */
 const RELEASE_DIGEST = "release:";
 /** Why a password-only scope (passwordOnlySeal) isn't approved from chat, for a release or a plan. */
-const needsPassword = (scope) => `This ${deployGateScope(scope) ? "release" : "plan"}'s checks run outside the sandbox, so it's approved in Toolroll with your password.`;
+const needsFullCard = (scope) => `This ${deployGateScope(scope) ? "release" : "plan"}'s checks run outside the sandbox, so this card can't approve it. Approve it in Toolroll, or ask your lead for its approval card, which shows every term.`;
 /** Whether only a person's password ceremony seals this scope (store.ts sealScopeApproval): checks that reach beyond the
  * sandbox (sign-ins, or none at all) or extra macOS services, sealed into its profile. */
 const passwordOnlySeal = (scope) => {
@@ -615,7 +591,7 @@ seat, root) {
     if (!deployGateScope(plan.scope))
         return { ok: false, why: "This plan isn't a release." };
     if (passwordOnlySeal(plan.scope))
-        return { ok: false, why: needsPassword(plan.scope) };
+        return { ok: false, why: needsFullCard(plan.scope) };
     const ref = store.lookupRef(taskId);
     if (ref === null || nightlyTaskRef(store, ref.id))
         return { ok: false, why: NIGHTLY_CHECK_ONLY };
@@ -709,7 +685,7 @@ function staleWhy(store, row, who, now, channel, root) {
             if (deployGateScope(plan.scope))
                 return "This is a release: approve it from its release card.";
             if (passwordOnlySeal(plan.scope))
-                return needsPassword(plan.scope);
+                return needsFullCard(plan.scope);
             return plan.digest === row.digest ? null : "The plan changed since this card was sent.";
         }
         case "merge": {
@@ -868,7 +844,10 @@ export function applyDecideTap(store, seat, input) {
             const spec = { act: "approve", run: null, digest: row.digest };
             const yes = mint(store, seat, input.message, spec, row.taskId, "yes", now);
             const later = mint(store, seat, input.message, { act: "not-now", run: null, digest: row.digest }, row.taskId, "offer", now);
-            return { ack: "Read the plan, then approve.", edit: { text: `${planCardText(store, row.taskId, plan.scope, input.root, seat.channel)}\n\n${QUESTIONS.approve(name)} This approves exactly this plan.`,
+            // Terms a machine wrote go on the card word for word, or the yes isn't to what they say.
+            if (plan.whole && scopeTermsText(plan.scope).length > PLATFORM_LIMITS[seat.channel] - ROOM)
+                return stale(`This plan's ${TOO_LONG}, so you approve it in Toolroll.`);
+            return { ack: "Read the plan, then approve.", edit: { text: `${plan.whole ? `${name}\n\n${scopeTermsText(plan.scope)}` : planCardText(store, row.taskId, plan.scope, input.root, seat.channel)}\n\n${QUESTIONS.approve(name)} This approves exactly this plan.`,
                     rows: [[{ label: DECIDE_LABELS.approve, token: yes }], [{ label: DECIDE_LABELS.edit, link: { label: DECIDE_LABELS.edit, path: chatControlHref("approval", row.taskId) } }, { label: DECIDE_LABELS["not-now"], token: later }]], tokens: [yes, later] } };
         }
         // The first tap asks; only the yes acts, bound to exactly what this button was.
@@ -929,9 +908,19 @@ export function applyDecideTap(store, seat, input) {
             if (deployGateScope(plan.scope))
                 return notDone("This is a release: approve it from its release card.");
             if (passwordOnlySeal(plan.scope))
-                return notDone(needsPassword(plan.scope));
-            if (!sealPlanInChat(store, who, seat, ref.repo, row.taskId, plan, now))
+                return notDone(needsFullCard(plan.scope));
+            // The one approval every road shares (scope.ts approve): the rules, two-person votes and the proof, as this person.
+            // plan.digest matched this button's kept digest above (staleWhy), so these are the words its card showed.
+            const words = scopeTermsText(plan.scope);
+            if (plan.whole && (plan.digest !== row.digest || words.length > PLATFORM_LIMITS[seat.channel] - ROOM))
+                return notDone("this plan changed. Open it in Toolroll.");
+            const approved = approve(store, row.taskId, who.name, now, plan.scope.digest, "", {}, undefined, { modeDigest: plan.modeDigest, shown: plan.whole ? { expect: cardTermsDigest(words), terms: words } : null });
+            if (!approved.ok && approved.reason === "second-approver")
+                return done(gateWords({ verdict: "vote", have: approved.have, need: 2, already: approved.already }));
+            if (!approved.ok)
                 return notDone("the plan couldn't be approved from chat. Open it in Toolroll.");
+            store.recordAction({ at: now.toISOString(), actor: who.name, repo: ref.repo, taskId: row.taskId, runId: null, action: "plan approved in chat", outcome: "approved",
+                source: "request", detail: `via ${seat.channel} · chat binding #${seat.binding} · ${plan.source} ${plan.modeDigest}` });
             return done("✓ Approved. Work starts when a worker is free.");
         }
         case "merge": {

package/dist/chat-delivery.js

@@ -10,6 +10,9 @@ import { ceilingDigestOf, verifyApproverStanding } from "./principal.js";
 import { ChatState, ChatDeliveryError, chatHash, savedChatPart, } from "./chat-delivery-state.js";
 import { readChatActionBody, readChatMessageBody, readChatPairBody, readChatPart } from "./contracts/chat-content.js";
 import { readProposalActionRow } from "./contracts/chat-callback-rows.js";
+import { cardContent, cardPart } from "./chat-card-part.js";
+import { flowDoneCard } from "./flow-result-card.js";
+import { cardsFirst, isCardProposal } from "./chat-card.js";
 import { answerChatFlowPrompt, answerChoiceMessage, applyChatFlowTap, flowDecisionParts, flowSendParts } from "./chat-flow.js";
 import { connectChannel, FLOW_WORDS, takeChannelMessage, watchedChannel } from "./chat-inbox.js";
 import { triggerConfigOf } from "./flow-triggers.js";
@@ -484,10 +487,9 @@ export async function processChatEvent(options) {
                 task: image.taskId,
                 run: image.run,
             });
-        for (const proposal of store
-            .listLeadProposals(turn.thread, ["pending"])
-            .filter((p) => p.turn === turn.id))
-            parts.push({ text: "", proposal: proposal.id });
+        // Cards first, so what a card leads to sits right under it. A card is an ordinary part: it confirms nothing.
+        for (const proposal of cardsFirst(store.listLeadProposals(turn.thread, ["pending"]).filter((p) => p.turn === turn.id)))
+            parts.push(isCardProposal(proposal) ? cardPart(proposal) : { text: "", proposal: proposal.id });
         state.plan(event.id, parts, nowOf(options));
         return true;
     }
@@ -655,6 +657,7 @@ export function applyChatAction(options, event, binding, repos) {
                 // A paired chat seat speaks for its account's full authority (pairing is a full session's act).
                 authority: "full",
                 via: options.state.provider,
+                binding: binding.id,
                 evidenceRoot: options.evidenceRoot,
                 confirm: phase === "yes",
                 deferSignal: (signal) => signals.push(signal),
@@ -1053,6 +1056,12 @@ function offerNotice(options, notification, binding, registry) {
                     ts: "", thread: "", payload: {}, created: now.toISOString() });
                 state.plan(id, flowSendParts(store, notification, state.provider), now);
             }
+            else if (personal && flowDoneCard(store, notification, now) !== null) {
+                // A card that reached Done: what it went through, as a card with its links.
+                state.enqueue({ id, installation: identity.installation, binding: binding.id, kind: "notice", channel: binding.channel, member: binding.member,
+                    ts: "", thread: "", payload: {}, created: now.toISOString() });
+                state.plan(id, [cardContent(flowDoneCard(store, notification, now))], now);
+            }
             else if (notification.kind === "flow-card" && questionParts(store, notification, binding) !== null) {
                 // A subagent's question (v93): its options and "Answer in words" on the notice, for the person it asks.
                 state.enqueue({ id, installation: identity.installation, binding: binding.id, kind: "notice", channel: binding.channel, member: binding.member,

package/dist/chat-flow.d.ts

@@ -1,30 +1,3 @@
-/**
- * Flow decisions in Slack, Discord and Teams (v88): the Approve / Edit /
- * Send back that Telegram has (telegram-flow.ts), on the notice itself.
- *
- * - The notice carries the draft (split over as many parts as it needs, so
- *   what is approved is what was read) and the buttons on its last part.
- * - Approve decides through the same door as the console (decideFlowCard),
- *   as the paired person, for exactly the visit the notice was about, then
- *   repaints the notice with what happened and no buttons.
- * - Edit and Send back open a prompt: the person's next message in their
- *   chat with Toolroll is the new draft (which comes back with fresh
- *   buttons) or the note. "cancel" leaves it, and a prompt lapses after
- *   30 minutes. Chat apps can't all name the message a reply answers, so
- *   the prompt says plainly what the next message does.
- *
- * Every button is one opaque token for one visit of one card, on the part it
- * rides: a tap on any other message, from anyone but the paired person, or
- * for a card that moved on, changes nothing.
- *
- * A "Send to me" visit (flow-send.ts) is one notice with its links; a "Person
- * chooses" visit is the same with the zone's own options as buttons. Instead
- * of a tap, a reply in the notice's thread is the note for where replies go;
- * the first other message in their chat is asked about once ("Use this as
- * your note?"), and everything else goes to the lead as usual. Choices are
- * made through chooseFlowCard, by that person alone, for exactly that visit,
- * and spend that visit's buttons in every chat app.
- */
 import type { ChatProvider } from "./contracts/chat-tables.js";
 import { type ChatBinding, type ChatContent, type ChatEvent, type ChatState } from "./chat-delivery-state.js";
 import type { Store } from "./store.js";

package/dist/chat-flow.js

@@ -1,3 +1,31 @@
+/**
+ * Flow decisions in Slack, Discord and Teams (v88): the Approve / Edit /
+ * Send back that Telegram has (telegram-flow.ts), on the notice itself.
+ *
+ * - The notice carries the draft (split over as many parts as it needs, so
+ *   what is approved is what was read) and the buttons on its last part.
+ * - Approve decides through the same door as the console (decideFlowCard),
+ *   as the paired person, for exactly the visit the notice was about, then
+ *   repaints the notice with what happened and no buttons.
+ * - Edit and Send back open a prompt: the person's next message in their
+ *   chat with Toolroll is the new draft (which comes back with fresh
+ *   buttons) or the note. "cancel" leaves it, and a prompt lapses after
+ *   30 minutes. Chat apps can't all name the message a reply answers, so
+ *   the prompt says plainly what the next message does.
+ *
+ * Every button is one opaque token for one visit of one card, on the part it
+ * rides: a tap on any other message, from anyone but the paired person, or
+ * for a card that moved on, changes nothing.
+ *
+ * A "Send to me" visit (flow-send.ts) is one notice with its links; a "Person
+ * chooses" visit is the same with the zone's own options as buttons. Instead
+ * of a tap, a reply in the notice's thread is the note for where replies go;
+ * the first other message in their chat is asked about once ("Use this as
+ * your note?"), and everything else goes to the lead as usual. Choices are
+ * made through chooseFlowCard, by that person alone, for exactly that visit,
+ * and spend that visit's buttons in every chat app.
+ */
+import { cardContent } from "./chat-card-part.js";
 import { LIMITS } from "./decision.js";
 import { keptDraft } from "./flow-draft.js";
 import { decideFlowCard, flowCardHref, flowDefinitionOf } from "./flow-engine.js";
@@ -66,11 +94,12 @@ export function flowSendParts(store, notification, app) {
     const content = kept === null ? null : readFlowSend(kept.contentJson);
     if (content === null)
         return null;
+    const card = content.card === undefined ? [] : [cardContent(content.card)];
     const voiced = itemsText(content, notification.subject, app);
     if (voiced !== null)
-        return voiced.map((text, index) => index < voiced.length - 1 ? { text, voice: true } : { text, voice: true, ...sendLinks(flowSendPaths(content)) });
+        return [...voiced.map((text, index) => index < voiced.length - 1 ? { text, voice: true } : { text, voice: true, ...sendLinks(flowSendPaths(content)) }), ...card];
     const all = pieces(chatFlowText(`${notification.subject}\n\n${notification.body}`));
-    return all.map((piece, index) => index < all.length - 1 ? { text: piece } : { text: piece, ...sendLinks(flowSendPaths(content)) });
+    return [...all.map((piece, index) => index < all.length - 1 ? { text: piece } : { text: piece, ...sendLinks(flowSendPaths(content)) }), ...card];
 }
 /**
  * A "flow-decision" notice as chat parts, or null when it isn't one (or the

package/dist/chat-quiet.js

@@ -19,7 +19,7 @@ import { YOUIYOUX_CARD_KIND } from "./contracts/youiyoux-request.js";
  * (a sign-in or plan-limit pause, an evening digest). */
 const NEEDED_KINDS = new Set([
     "acceptance-ready", "acceptance-evidence", "flow-decision", "flow-card", "plan-ready", "report-ready",
-    "stale-approval", "security-release", "secret-detected",
+    "stale-approval", "security-release", "secret-detected", "protected-storage",
 ]);
 /** What still wants a person who pairs after it landed, in every chat app: an open decision or an unresolved attention
  * notice. Routine history is never replayed to a chat that just arrived (store.ts WANTED_BEFORE_PAIRING, the same rule). */

package/dist/chat-task-actions.d.ts

@@ -7,8 +7,8 @@ export declare const CHAT_TASK_ACTIONS: {
         readonly detail: "Pauses this task once the run acknowledges the stop. Saved work remains; other tasks continue.";
     };
     readonly resume: {
-        readonly label: "Review resume";
-        readonly detail: "Opens password confirmation to lift this stop’s hold and continue from saved work. Other holds and approval requirements still apply.";
+        readonly label: "Resume task";
+        readonly detail: "Lifts this stop’s hold and continues from saved work. Other holds and approval requirements still apply.";
     };
     readonly retry: {
         readonly label: "Try again";
@@ -48,6 +48,7 @@ export declare function chatTaskRun(store: Store, task: string, operation: "stop
 export declare function applyChatTaskAction(store: Store, who: VerifiedApprover, payload: Record<string, unknown>, now: Date, web: boolean, controls?: Pick<StopRequest, "deferSignal"> & {
     via?: StopRequest["via"];
     evidenceRoot?: string;
+    person?: boolean;
 }): {
     ok: true;
     taskId: string;

package/dist/chat-task-actions.js

@@ -1,12 +1,13 @@
 import { verifiedAuthor } from "./store.js";
-import { requestTaskStop, taskControlOf } from "./task-control.js";
+import { chatApproveMode, effectiveChatApproval } from "./chat-approval.js";
+import { requestTaskStop, resumeTaskStop, taskControlOf } from "./task-control.js";
 import { authorizePlanUnderMode } from "./plan-auto.js";
 import { fileAddTestsTask, requestFollowUpChecks } from "./result-follow-ups.js";
 export const CHAT_TASK_ACTIONS = {
     // Build #1604 feedback: one short consequence that still says saved work
     // remains, other tasks continue, and the pause waits for acknowledgement.
     stop: { label: "Stop task", detail: "Pauses this task once the run acknowledges the stop. Saved work remains; other tasks continue." },
-    resume: { label: "Review resume", detail: "Opens password confirmation to lift this stop’s hold and continue from saved work. Other holds and approval requirements still apply." },
+    resume: { label: "Resume task", detail: "Lifts this stop’s hold and continues from saved work. Other holds and approval requirements still apply." },
     retry: { label: "Try again", detail: "Queues another attempt. Existing approvals and holds still apply." },
     plan: { label: "Plan first", detail: "Requests a plan. Building still requires approval." },
     wait_for: { label: "Add dependency", detail: "Waits for the selected task to finish." },
@@ -52,9 +53,22 @@ export function applyChatTaskAction(store, who, payload, now, web, controls = {}
         const run = chatTaskRun(store, task, operation, now);
         if (run === null || run !== payload["run"])
             return { ok: false, message: "This attempt changed. Review the current task before confirming." };
-        // Resume remains the existing nonce + password ceremony. A proposal only opens it.
-        if (operation === "resume")
-            return { ok: true, taskId: task, said: `Resume review requested for ${task}. Complete the password confirmation on the task to resume.` };
+        // Resuming is an approval: a person's own tap or signed-in click lifts the stop; any other road only asks for it.
+        if (operation === "resume") {
+            if (controls.person !== true)
+                return { ok: true, taskId: task, said: `Resume requested for ${task}. Finish it in your chat or on the task.` };
+            // Resuming is an approval: a person's own off holds here as on every other one.
+            const allowed = effectiveChatApproval(store, ref.repo, who.name);
+            if (!allowed.ok && controls.via !== "web") {
+                const mode = controls.via === undefined || controls.via === "cli" ? allowed : chatApproveMode(store, ref.repo, who.name, now, controls.via);
+                if (!mode.ok)
+                    return { ok: false, message: mode.why };
+            }
+            if (!allowed.ok && controls.via === "web")
+                return { ok: false, message: allowed.why };
+            const resumed = resumeTaskStop(store, { taskId: task, runId: run, by: verifiedAuthor(who.name), via: controls.via ?? "web" }, now);
+            return resumed.ok ? { ok: true, taskId: task, said: `Stop released. ${resumed.gate ? "Other requirements still prevent the next attempt." : "The next attempt may start."}` } : { ok: false, message: resumed.detail };
+        }
         const { via, evidenceRoot: _root, ...rest } = controls;
         const result = requestTaskStop(store, { taskId: task, runId: run, by: verifiedAuthor(who.name), via: via ?? (web ? "web" : "cli"), ...rest }, now);
         return result.ok ? { ok: true, taskId: task, said: `Stop requested for ${task}, run #${run}.` }

package/dist/chat-terms.d.ts

@@ -1,9 +1,21 @@
-import type { Scope } from "./scope.js";
+import { type Scope } from "./scope.js";
 /** What a plan's yes allows an agent to do, in a few plain words (the approval sheet's "You're allowing"). */
 export declare function permissionPlainWords(profile: Scope["profile"] | null | undefined): string | null;
-export type ShownScope = Pick<Scope, "goal" | "outOfScope" | "touches" | "acceptance" | "profile" | "budgetMicrousd">;
+export type ShownScope = Pick<Scope, "goal" | "outOfScope" | "touches" | "acceptance" | "profile" | "budgetMicrousd"> & Partial<Pick<Scope, "proposedChainJson">>;
 /** Every word of the terms a yes agrees to, as the card shows them: the goal, what's excluded, the files (or plainly any
  * file), each requirement with the evidence it needs, and what the agent may do and spend. Nothing is shortened. */
 export declare function scopeTermsText(scope: ShownScope): string;
 /** The digest of the terms shown, bound to the scope's own digest: a changed word, limit or route is another digest. */
 export declare function shownTermsDigest(scope: ShownScope & Pick<Scope, "digest">): string;
+/** The digest of the exact words a card showed, taken when the card was made and kept with it. */
+export declare function cardTermsDigest(terms: string): string;
+/** Whether these words show this scope as it is now: its whole terms text, word for word, and what only a person's own
+ * yes may agree to (checks past the sandbox, extra services). Part of the terms, or an earlier version's, is not. */
+export declare function cardShowsScope(scope: ShownScope, terms: string): boolean;
+/** Whether a scope lets its agent do anything, nothing asking first. */
+export declare function scopeFullAccess(profile: Scope["profile"] | null | undefined): boolean;
+/** Why a person's own limits refuse this scope, or null. */
+export declare function chatLimitProblem(scope: Pick<Scope, "profile" | "budgetMicrousd">, limits: {
+    fullAccess: boolean;
+    capMicrousd: number | null;
+}, yours: string): string | null;

package/dist/chat-terms.js

@@ -6,6 +6,9 @@
  */
 import { createHash } from "node:crypto";
 import { isAcpProfile } from "./acp-agents.js";
+import { checkAccessWords } from "./check-access.js";
+import { sandboxTermsWords } from "./project-sandbox.js";
+import { chainTermsLines } from "./scope.js";
 /** What a plan's yes allows an agent to do, in a few plain words (the approval sheet's "You're allowing"). */
 export function permissionPlainWords(profile) {
     if (profile === null || profile === undefined)
@@ -38,9 +41,41 @@ export function scopeTermsText(scope) {
         ...(scope.acceptance.length === 0 ? ["You decide when you review the result."] : scope.acceptance.map(one => `• ${one.statement} (${one.evidence.join(", ")})`)),
         "",
         `Starting allows: ${allows.join(" · ")}`,
+        ...((chain) => chain.length === 0 ? [] : ["", "Fallback agents:", ...chain])(chainTermsLines(scope)),
     ].join("\n");
 }
 /** The digest of the terms shown, bound to the scope's own digest: a changed word, limit or route is another digest. */
 export function shownTermsDigest(scope) {
     return createHash("sha256").update(JSON.stringify({ v: 1, scope: scope.digest, shown: scopeTermsText(scope) })).digest("hex");
 }
+/** The digest of the exact words a card showed, taken when the card was made and kept with it. */
+export function cardTermsDigest(terms) {
+    return createHash("sha256").update(JSON.stringify({ v: 2, shown: terms })).digest("hex");
+}
+/** Whether these words show this scope as it is now: its whole terms text, word for word, and what only a person's own
+ * yes may agree to (checks past the sandbox, extra services). Part of the terms, or an earlier version's, is not. */
+export function cardShowsScope(scope, terms) {
+    if (!terms.includes(scopeTermsText(scope)))
+        return false;
+    const profile = scope.profile;
+    if (profile === null || profile === undefined)
+        return true;
+    const access = profile.checkAccess, mach = sandboxTermsWords(profile).mach;
+    return (access === undefined || terms.includes(checkAccessWords(access))) && (mach === null || terms.includes(mach));
+}
+/** Whether a scope lets its agent do anything, nothing asking first. */
+export function scopeFullAccess(profile) {
+    if (profile === null || profile === undefined)
+        return false;
+    return profile.provider === "claude" ? profile.permissionArgv === "bypassPermissions"
+        : profile.provider === "gemini" ? profile.approvalArgv === "yolo" : isAcpProfile(profile) ? true : profile.sandboxMode === "danger-full-access";
+}
+/** Why a person's own limits refuse this scope, or null. */
+export function chatLimitProblem(scope, limits, yours) {
+    if (scopeFullAccess(scope.profile) && !limits.fullAccess)
+        return `This plan asks for more access than ${yours} allows.`;
+    const cap = limits.capMicrousd;
+    if (cap !== null && (scope.budgetMicrousd === null || scope.budgetMicrousd > cap))
+        return `This plan has ${scope.budgetMicrousd === null ? "no attempt limit" : `a ${money(scope.budgetMicrousd)} attempt limit`}, more than ${yours === "your mode" ? "your mode's" : "your chat approval limit of"} ${money(cap)}.`;
+    return null;
+}

package/dist/check-failure.d.ts

@@ -64,6 +64,8 @@ export declare function ranNoCheck(store: Store, row: {
     head: unknown;
     checkRow: unknown;
 }): boolean;
+/** The ledger entry the build writes when it refuses a prepared candidate before any process (builder.ts). */
+export declare const NOTHING_STARTED_ACTION = "attempt refused before anything ran";
 /**
  * Whether a passing check of a release task stands, given every earlier attempt on the same candidate and signed scope:
  * each earlier failure must be confirmed infrastructure the release itself reran (at most two), and nothing in the

package/dist/check-failure.js

@@ -208,11 +208,43 @@ export function setupReplayWords(first) {
  * got as far as its check keeps every rule below.
  */
 export function ranNoCheck(store, row) {
-    if (row.outcome !== "failed" || row.reason !== "interrupted" || row.head !== null || row.checkRow !== null)
+    if (row.outcome !== "failed" || (row.reason !== "interrupted" && row.reason !== "no-op") || row.head !== null || row.checkRow !== null)
         return false;
     if (checkAttemptOf(store, row.id) !== null)
         return false;
-    return !store.artifactsFor(row.id).some(artifact => artifact.kind === "check-log" || isVerificationReceipt(artifact));
+    if (store.artifactsFor(row.id).some(artifact => artifact.kind === "check-log" || isVerificationReceipt(artifact)))
+        return false;
+    return row.reason === "interrupted" || refusedBeforeAnything(store, row.id);
+}
+/** The ledger entry the build writes when it refuses a prepared candidate before any process (builder.ts). */
+export const NOTHING_STARTED_ACTION = "attempt refused before anything ran";
+/** Every table a process, an agent or a check of this run writes. */
+const RUN_TRACES = [["artifact", "run"], ["run_process", "run"], ["run_process_summary", "run"], ["run_tool", "run"], ["run_activity", "run"],
+    ["check_stamp", "run_id"], ["release_check_attempt", "run"], ["run_note", "run"], ["agent_turn", "run"], ["run_checkpoint", "run"], ["run_decision", "run"]];
+/**
+ * An attempt the build refused before anything ran (run 3332: Git couldn't read HEAD while it proved the candidate; the
+ * next attempt passed). A failed attempt with reason `no-op` proves nothing alone: an agent's empty result and a check's
+ * refusal end that way too. So the build's own ledger entry says so, written only where nothing has run, and the run's
+ * records agree: no base stamped, no provider start, session, tokens or commit, and not one row of any process, agent or
+ * check. All of them, or it stands as a failure, and a record that can't be read (an older database) never excuses one.
+ */
+function refusedBeforeAnything(store, runId) {
+    try {
+        const said = store.handle.prepare("SELECT COUNT(*) AS n FROM action_ledger WHERE run_id = ? AND action = ? AND outcome = 'refused'").get(runId, NOTHING_STARTED_ACTION)?.["n"];
+        if (Number(said) !== 1)
+            return false;
+        const run = store.handle.prepare("SELECT base_revision, head_revision, provider_started_at, session_id, tokens_in, tokens_out, cost_usd, committed FROM run WHERE id = ?").get(runId);
+        if (run === undefined || Object.values(run).some(value => value !== null))
+            return false;
+        // check_fact is a learning-loops table (eval-hooks.ts): read here in its own literal statement, never through the
+        // table list, so no SQL text that could name it is assembled outside its sole writer.
+        if (store.handle.prepare("SELECT 1 FROM check_fact WHERE run = ? LIMIT 1").get(runId) !== undefined)
+            return false;
+        return RUN_TRACES.every(([table, column]) => store.handle.prepare(`SELECT 1 FROM ${table} WHERE ${column} = ? LIMIT 1`).get(runId) === undefined);
+    }
+    catch {
+        return false;
+    }
 }
 /** The task's finished builder runs under `digest`, oldest first, each with whether its check passed or never ran. */
 function builderRuns(store, taskRef, digest) {

package/dist/check-repair.d.ts

@@ -0,0 +1,47 @@
+import type { Store } from "./store.js";
+export type CheckRepairState = "waiting" | "repairing" | "rerunning" | "with-person" | "parked" | "fixed" | "closed";
+export type CheckRepair = {
+    id: number;
+    familyRoot: string;
+    ownerTask: string;
+    repo: string;
+    revision: string;
+    sourceRun: number;
+    state: CheckRepairState;
+    why: string;
+    repairTask: string | null;
+    attempt: number | null;
+    createdAt: string;
+    updatedAt: string;
+};
+export declare function checkRepairsOfTask(store: Store, taskId: string): CheckRepair[];
+export declare function checkRepairOfRun(store: Store, runId: number): CheckRepair | null;
+/** What makes this failure this failure: the command, how it ended, and which files failed. Never the log's own bytes,
+ * which differ on every run. */
+export declare function failureKeyOf(receipt: string, log: string): string;
+/**
+ * Route one failed check. Runs at disposition. A failure already on record for this family and revision changes nothing,
+ * unless it was the one rerun of an unrelated failure, which now goes to a person through the ledger's own rerun stop.
+ */
+export declare function routeFailedCheck(store: Store, repo: string, root: string, runId: number, now: Date): CheckRepair | null;
+export type StartRepair = {
+    ok: true;
+    draft: string;
+    attempt: number;
+    approved: boolean;
+} | {
+    ok: false;
+    reason: "unknown" | "refused";
+    message: string;
+};
+/** A person asks for the repair. The draft takes the normal plan approval: this is not that approval. */
+export declare function startCheckRepair(store: Store, root: string, runId: number, now: Date): StartRepair;
+/** A passing result in the family ends its failed-check rows. Rows the person already holds end too: the code passes now. */
+export declare function settleCheckRepairs(store: Store, taskId: string, verdict: string, now: Date): void;
+/** Each sweep: a parked failure whose task is free again takes its next step, unless a newer attempt replaced it. */
+export declare function resumeParkedRepairs(store: Store, root: string, now: Date): number;
+/** A build was accepted as finished: count what it answered, then route its check if it failed. Bookkeeping that never
+ * costs the build its result: a problem here leaves the finding open and the failed check on the result. */
+export declare function followBuiltRun(store: Store, repo: string, root: string, runId: number, worktree: string, now: Date): void;
+/** How a failed check stands, for a person, in one line. */
+export declare function checkRepairWords(row: CheckRepair): string;