feat(ask): --open adds an Open button that shows a page to sign in to in the thread's panel

docs/browser.md

@@ -123,6 +123,17 @@ is left out, since the copy cannot carry that scope. The cookies cross the conne
 action is the owner's alone and never automatic. Signing in directly works
 too: show the agent's browser and sign in there.
 
+An agent that meets a login page asks with `boite ask --open <url> "<site and
+why>" "Signed in" Skip`. The question card gets an Open button: it opens the
+page as `boite browse` does, in a new tab of the conversation's browser and
+its default profile, and shows the panel on the Browser tab, going to the
+thread first from the Agents page or another conversation. It calls
+`questions.openPage`, which names the question rather than an address, so a
+paired phone subscribed to the conversation opens the page too, and the core
+reads and checks the address again. The address must
+be http or https and carry no user name or password. Such a question never
+goes to a delegated agent's parent: only the user can sign in.
+
 A conversation has at most 8 tabs and a machine 24. A page that opens a
 window, a sign-in popup for instance, adds a tab to the same conversation; past
 the limit the window is closed. A tab still attaching counts toward both

docs/cli.md

@@ -349,7 +349,7 @@ boite diff [file]                open the changes surface, or one file's diff
 boite browse <url>               open the url in a new tab of this conversation's browser (http, https)
 boite open trace|tasks|changes|files [dir]
 boite status                     git status: branch, upstream, one row per change
-boite ask <question> [option ...] [--multiple]
+boite ask <question> [option ...] [--multiple] [--open <url>]
 boite task list|add <text>|start <id>|done <id>|remove <id>|clear
 boite todo list|add <text>|claim <id>
 boite agents list|inbox
@@ -512,7 +512,8 @@ thread does not turn `waiting` and the card stays open after the turn ends.
 A core restart keeps it too: an open card is read back from the journal at
 startup, for as long as events are kept (30 days).
 Each extra argument is an option label; with none the question takes free
-text, and `--multiple` lets the user pick several. The answer reaches the agent
+text, and `--multiple` lets the user pick several. `--open <url>` adds an Open
+button for a page the user must sign in to (docs/browser.md). The answer reaches the agent
 as a message that quotes the question, `> question` then the answer: steered
 into the running turn when the agent takes steering (Codex, pi, Muse, Grok),
 handed to Claude at the main agent's next tool call through the PostToolUse

packages/contracts/src/access.ts

@@ -139,6 +139,7 @@ export const DEVICE_METHODS: ReadonlySet<RpcMethodName> = new Set<RpcMethodName>
   'permissions.answer',
   'questions.list',
   'questions.answer',
+  'questions.openPage', // The address a pending question of the subscribed conversation carries, rechecked by the core.
   // Paired phones can dismiss the same question cards as the owner's chat.
   'questions.skip',
   // A phone says its own language and experiments, so the agent reads the screen the user reads; nothing the core trusts.

packages/contracts/src/delegation-input.ts

@@ -1,7 +1,7 @@
 import type { DelegationInput, PermissionRequest, QuestionAnswer, QuestionRequest } from './index';
 
-/** Settings cards are the owner's to decide: they never go to a delegated agent's parent. */
-export const delegationAnswerable = (question: QuestionRequest): boolean => question.setting === undefined && question.agentSetting === undefined;
+/** Settings cards and pages to sign in to are the owner's: they never go to a delegated agent's parent. */
+export const delegationAnswerable = (question: QuestionRequest): boolean => question.setting === undefined && question.agentSetting === undefined && question.open === undefined;
 
 /** What a delegated child waits on from someone, oldest first. */
 export function delegationNeeds(questions: QuestionRequest[], permissions: PermissionRequest[]): DelegationInput[] {

packages/contracts/src/messages.ts

@@ -197,6 +197,8 @@ export type MessagePart =
       setting?: SettingAsk;
       /** An agent setting card: see `QuestionRequest.agentSetting`. */
       agentSetting?: AgentSettingAsk;
+      /** A page to open: see `QuestionRequest.open`. */
+      open?: { url: string };
     }
   /**
    * The agent compacted its context mid-turn: what it held before, what is

packages/contracts/src/questions.ts

@@ -68,6 +68,8 @@ export interface QuestionRequest {
    * `text` is its reason. Always asynchronous.
    */
   agentSetting?: AgentSettingAsk;
+  /** A page the card opens in the thread's browser (`boite ask --open`), as for a sign-in. */
+  open?: { url: string };
   createdAt: Timestamp;
 }
 
@@ -181,6 +183,15 @@ export interface QuestionsRpcMethods {
     params: { threadId: ThreadId; questionId: RequestId; optionIds: string[]; text?: string; attachments?: Attachment[] };
     result: { ok: true };
   };
+  /**
+   * Open a pending question's page (`open`) as a new tab of its conversation's
+   * browser. The core reads the address from the question, so a paired phone
+   * subscribed to the conversation opens it without `panel.open`'s surfaces.
+   */
+  'questions.openPage': {
+    params: { threadId: ThreadId; questionId: RequestId };
+    result: { ok: true };
+  };
   /** Resolve a pending question without an answer, a steer or a new user message. */
   'questions.skip': {
     params: { threadId: ThreadId; questionId: RequestId };
@@ -193,7 +204,7 @@ export interface QuestionsRpcMethods {
    * none makes a free-text question.
    */
   'questions.ask': {
-    params: { threadId: ThreadId; text: string; options?: string[]; multiple?: boolean };
+    params: { threadId: ThreadId; text: string; options?: string[]; multiple?: boolean; open?: string };
     result: { questionId: RequestId };
   };
 }

packages/core/src/agent-guide.ts

@@ -19,7 +19,7 @@ export function agentGuide(asyncQuestions: boolean, logAccess = false, skills: r
     '`boite show <file>[:line]`, `boite diff [file]`, `boite browse <url>` open the panel. `boite preview <file.html>` previews HTML and local assets. `boite attach <file>` sends files/media into chat (512 MB max).',
     'Write a file reference as inline code, `path:line`: a click opens it in the panel.',
     VIEW_GUIDE_LINE,
-    ...(asyncQuestions ? ['`boite ask "<question>" [option ...]` asks asynchronously. Keep working on independent tasks; the answer arrives as a message. Silence grants no approval.'] : []),
+    ...(asyncQuestions ? ['`boite ask [--open <url>] "<question>" [option ...]` asks asynchronously. Keep working on independent tasks; the answer arrives as a message. Silence grants no approval. Login wall: `--open <url>`, the site and why, options "Signed in" Skip; never in chat.'] : []),
     '`boite settings [agent] [request|open]` reads Boite settings or a persistent agent\'s, or puts a card in chat for the user to change one.',
     'Task tracking is optional. Use it only when steps help you and the user. `boite task add <text>` / `boite task start|done <id>` track those steps. `boite todo list|add <text>|claim <id>` manages project todos; claim marks work done for user confirmation.',
     '`boite projects` lists projects; `boite projects add <folder>` adds one. `boite thread new <project> <brief>` starts independent work in a project, not a subagent; its first answer comes back.',

packages/core/src/agent.ts

@@ -247,6 +247,17 @@ export function registerAgentMethods(core: Core): void {
     // rather than believing the user saw something.
     return { shown: core.subscribers.hasSubscribers(thread.id) };
   });
+  // The page a pending question carries, for whoever answers it: a paired phone
+  // names a question, never a surface, and only in the conversation it watches.
+  core.router.register('questions.openPage', async (params, { connection }) => {
+    const thread = core.threads.require(params.threadId);
+    if (connection.identity.principal !== 'owner' && (thread.archived || !connection.subscriptions.has(thread.id))) throw refused('subscribe to the active conversation before opening its page');
+    const url = core.threads.listQuestions(thread.id).find((question) => question.id === params.questionId)?.open?.url;
+    if (url === undefined) throw refused(`questions.openPage: ${params.questionId} is not a pending question with a page`, { questionId: params.questionId });
+    const surface = checkSurface(thread.cwd, { kind: 'browser', url });
+    if (surface.kind === 'browser') await core.browser.command({ threadId: thread.id, action: { kind: 'open', url: surface.url } });
+    return { ok: true } as const;
+  });
   core.router.register('threads.tasks.set', (params) => setTasks(core, params));
   core.router.register('threads.tasks.get', (params) => {
     core.threads.require(params.threadId);

packages/core/src/cli-args.ts

@@ -12,6 +12,8 @@ export interface Parsed {
   requestId?: string;
   worktree: boolean;
   title?: string;
+  /** `boite ask --open <url>`: the page the card opens. */
+  open?: string;
   name?: string;
   model?: string;
   effort?: string;
@@ -74,6 +76,7 @@ export function parse(argv: string[]): Parsed {
     else if (numeric !== undefined) parsed[numeric] = number(arg, next());
     else if (arg === '--request-id') parsed.requestId = next();
     else if (arg === '--title') parsed.title = next();
+    else if (arg === '--open') parsed.open = next();
     else if (arg === '--name') parsed.name = next();
     else if (arg === '--project') parsed.project = next();
     else if (arg === '--why') parsed.why = next();

packages/core/src/cli.ts

@@ -84,7 +84,9 @@ ${CONTROL_HELP}
                                  report a Boite bug on GitHub with that export;
                                  show the user the draft before submit
   ask <question> [option ...]    ask the user without stopping; the answer
-                                 arrives later as a message (--multiple)
+                                 arrives later as a message (--multiple);
+                                 --open <url> adds an Open button for a page
+                                 the user must sign in to, in your browser
   settings [key]                 Boite settings you may ask about: value, page,
                                  the name the user's app shows; first, the
                                  language the app speaks; experiments last
@@ -618,7 +620,7 @@ async function run(parsed: Parsed, io: CliIo, client: CoreClient, threadId: stri
       if (rest.length === 1 && rest[0] === 'help') { print([USAGE], { help: USAGE }); return; }
       const text = want(0, 'a question');
       const options = rest.slice(1);
-      const asked = await client.call('questions.ask', { threadId, text, ...(options.length > 0 ? { options } : {}), ...(parsed.multiple ? { multiple: true } : {}) });
+      const asked = await client.call('questions.ask', { threadId, text, ...(options.length > 0 ? { options } : {}), ...(parsed.multiple ? { multiple: true } : {}), ...(parsed.open === undefined ? {} : { open: parsed.open }) });
       print([`asked: ${asked.questionId}`, 'Keep working. The answer arrives as a message quoting the question; without one, go on with a sensible default.'], asked);
     },
     status: async () => {

packages/core/src/drivers/types.ts

@@ -71,6 +71,8 @@ export interface QuestionAsk {
   setting?: SettingAsk;
   /** An agent setting card (`agents.settings.request`), always asynchronous. */
   agentSetting?: AgentSettingAsk;
+  /** A page the card opens (`boite ask --open`). */
+  open?: { url: string };
 }
 
 /**

packages/core/src/threads/cards.ts

@@ -22,6 +22,7 @@ import {
   type ThreadSummary,
   type Turn,
 } from '@boite/contracts';
+import { checkSurface } from '../agent.ts';
 import { answerText, attachToAnswer } from '../attachments.ts';
 import type { Core } from '../core.ts';
 import type { PermissionTicket, QuestionAsk, QuestionTicket } from '../drivers/types.ts';
@@ -298,7 +299,7 @@ export class ThreadCards {
    * turn, or under the last one when the agent asks between turns (from a
    * background shell of its own, say), in a message of its own.
    */
-  askAsync(params: { threadId: ThreadId; text: string; options?: string[]; multiple?: boolean }): { questionId: RequestId } {
+  askAsync(params: { threadId: ThreadId; text: string; options?: string[]; multiple?: boolean; open?: string }): { questionId: RequestId } {
     const thread = this.threads.require(params.threadId);
     if (thread.archived) throw refused('cannot ask on an archived thread', { threadId: thread.id });
     const text = typeof params.text === 'string' ? params.text.trim() : '';
@@ -308,12 +309,17 @@ export class ThreadCards {
       throw refused('options must be at most 12 labels of 1 to 200 characters', { field: 'options' });
     }
     if (params.multiple !== undefined && typeof params.multiple !== 'boolean') throw refused('multiple must be a boolean', { field: 'multiple' });
+    // The page opens as `boite browse` would open it; a user name or password in it would sit on the card and in the journal.
+    const page = params.open === undefined ? undefined : checkSurface(thread.cwd, { kind: 'browser', url: params.open });
+    const credentials = page?.kind === 'browser' ? new URL(page.url) : null;
+    if (credentials && (credentials.username || credentials.password)) throw refused('open: an address with a user name or password in it is refused', { field: 'open' });
     return this.drawAsync(thread, {
       text,
       options: labels.map((label, index) => ({ id: String(index + 1), label: label.trim() })),
       allowText: true,
       multiple: params.multiple === true && labels.length > 1,
       async: true,
+      ...(page?.kind === 'browser' ? { open: { url: page.url } } : {}),
     });
   }
 
@@ -392,6 +398,7 @@ export class ThreadCards {
       ...(ask.async === true ? { async: true } : {}),
       ...(ask.setting === undefined ? {} : { setting: ask.setting }),
       ...(ask.agentSetting === undefined ? {} : { agentSetting: ask.agentSetting }),
+      ...(ask.open === undefined ? {} : { open: ask.open }),
       createdAt: Date.now(),
     };
     let resolve: (answer: QuestionAnswer | null) => void = () => undefined;

packages/core/test/ask-open.test.ts

@@ -0,0 +1,45 @@
+import { afterEach, expect, test } from 'bun:test';
+import { connect } from '../src/client.ts';
+import { echoThread, startTestCore, waitFor, type TestCore } from './harness.ts';
+
+let h: TestCore;
+afterEach(async () => { await h?.stop(); });
+
+test('boite ask --open keeps the page on the card, and refuses an address that is not a web page or carries a login', async () => {
+  h = await startTestCore();
+  const owner = await h.connect();
+  const { threadId } = await echoThread(h, owner);
+  await owner.call('turns.start', { threadId, prompt: 'hello' });
+  await waitFor(() => h.core.journal.lastTurn(threadId) !== null);
+
+  const ask = (open: string) => owner.call('questions.ask', { threadId, text: 'billing.example: to download the invoices', options: ['Signed in', 'Skip'], open });
+  const { questionId } = await ask('https://billing.example/login?next=%2Finvoices');
+  const card = h.core.journal.listMessages(threadId).flatMap(message => message.parts).find(part => part.type === 'question' && part.questionId === questionId);
+  expect(card).toMatchObject({ open: { url: 'https://billing.example/login?next=%2Finvoices' }, async: true });
+
+  await expect(ask('file:///etc/passwd')).rejects.toThrow('http or https');
+  await expect(ask('https://me:hunter2@billing.example/')).rejects.toThrow('user name or password');
+});
+
+test('a paired phone opens the page of a pending question in the conversation it watches, and nothing else', async () => {
+  h = await startTestCore();
+  const owner = await h.connect();
+  const { threadId } = await echoThread(h, owner);
+  await owner.call('turns.start', { threadId, prompt: 'hello' });
+  await waitFor(() => h.core.journal.lastTurn(threadId) !== null);
+  const { questionId } = await owner.call('questions.ask', { threadId, text: 'ci.example: to read the failed run', options: ['Signed in', 'Skip'], open: 'https://ci.example/login' });
+  const { questionId: plain } = await owner.call('questions.ask', { threadId, text: 'Which branch?', options: ['main', 'dev'] });
+  const opened: string[] = [];
+  h.core.browser.command = (async ({ action }: { action: { url: string } }) => { opened.push(action.url); return { value: { ok: true } }; }) as typeof h.core.browser.command;
+  const { grant } = await owner.call('pairing.grant', {});
+  const phone = await connect(h.url, '', { grant, client: { name: 'pwa', version: 'test' } });
+  try {
+    await expect(phone.call('questions.openPage', { threadId, questionId })).rejects.toThrow('subscribe to the active conversation');
+    await phone.call('threads.subscribe', { threadId });
+    await phone.call('questions.openPage', { threadId, questionId });
+    expect(opened).toEqual(['https://ci.example/login']);
+    await expect(phone.call('questions.openPage', { threadId, questionId: plain })).rejects.toThrow('not a pending question with a page');
+    await expect(phone.call('panel.open', { threadId, surface: { kind: 'browser', url: 'https://ci.example/login' } })).rejects.toThrow('for the owner only');
+    expect(opened).toHaveLength(1);
+  } finally { phone.close(); }
+});

packages/ui/src/components/AssistantMessage.svelte

@@ -11,6 +11,7 @@
   import PermissionCard from './PermissionCard.svelte';
   import PlanCard from './PlanCard.svelte';
   import QuestionCard from './QuestionCard.svelte';
+  import { openQuestionPage } from '../lib/question-page';
   import SettingRequestCard from './SettingRequestCardLoader.svelte';
   import AgentSettingCard from './AgentSettingCardLoader.svelte';
   import Prose from './Prose.svelte';
@@ -178,6 +179,8 @@
           submit={() => asked !== undefined && sendAnswer(store, asked)}
           skip={() => store.skipQuestion(message.threadId, part.questionId)}
           onwrite={() => writeAnswer(store, part.questionId)}
+          page={part.open?.url}
+          onopen={() => openQuestionPage(store, message.threadId, part.questionId)}
         />
       {:else if part.type === 'compaction'}
         <div class="compaction" data-testid="compaction-part" data-trigger={part.trigger}>

packages/ui/src/components/QuestionCard.svelte

@@ -18,7 +18,9 @@
     replying = false,
     submit,
     skip,
-    onwrite
+    onwrite,
+    page,
+    onopen
   }: {
     text: string;
     options: QuestionOption[];
@@ -43,6 +45,9 @@
     skip?: () => unknown;
     /** Hands the composer to this question, when another one or an ordinary message has it. */
     onwrite?: () => void;
+    /** The page asked with `boite ask --open`, and what its Open button does. */
+    page?: string;
+    onopen?: () => unknown;
   } = $props();
 
   let sent = $state(false);
@@ -165,6 +170,9 @@
 
     {#if pending}
       <div class="actions">
+        {#if page && onopen}
+          <button type="button" class="ghost" data-testid="question-open" title={page} onmousedown={keepFocus} onclick={onopen}><span class="ui-label">{strings.chat.questionOpenPage}</span></button>
+        {/if}
         {#if skip}
           <button type="button" class="ghost" data-testid="question-skip" disabled={sent} onmousedown={keepFocus} onclick={pass}><span class="ui-label">{strings.chat.questionSkip}</span></button>
         {/if}

packages/ui/src/components/ThreadActivity.svelte

@@ -9,6 +9,7 @@
   import { dockRoom, questionDock } from '../lib/question-dock.svelte';
   import { ignoreQuestions, releaseWaiting, replyOf, repliesOf, sendAnswer, writeAnswer } from '../lib/question-reply.svelte';
   import QuestionCard from './QuestionCard.svelte';
+  import { openQuestionPage } from '../lib/question-page';
   import SettingRequestCard from './SettingRequestCardLoader.svelte';
   import { settingHeading } from '../lib/setting-requests';
   import AgentSettingCard from './AgentSettingCardLoader.svelte';
@@ -244,6 +245,8 @@
                   submit={() => sendAnswer(store, question)}
                   skip={() => store.skipQuestion(question.threadId, question.id)}
                   onwrite={child ? undefined : () => writeAnswer(store, question.id)}
+                  page={question.open?.url}
+                  onopen={() => openQuestionPage(store, question.threadId, question.id)}
                 />
                 {/if}
               </div>