@agimon-ai/doompi-workflow 0.0.1-alpha.56 → 0.0.1-alpha.58

package/README.md

@@ -16,8 +16,8 @@ host-executed steps, while DoomPi provides session-scoped tools and TUI surfaces
 
 ## Install
 
-DoomPi includes Workflow in every composition; its tools remain inactive until Workflow mode is
-enabled. For standalone Pi:
+The seeded `modes.yaml` selects Workflow in `default.packages`. Keep it there or select it through
+a layer; its tools remain inactive until Workflow mode is enabled. For standalone Pi:
 
 ```bash
 pi install npm:@agimon-ai/doompi-workflow

package/dist/types/webWorkflowTerminal.cjs

@@ -1,2 +1,2 @@
-exports.WORKFLOW_API_BASE_PATH=`workflow`,exports.WORKFLOW_SCREEN_EVENT=`screen`;
+require("@agimon-ai/doompi-extension-contracts/package-api"),exports.WORKFLOW_API_BASE_PATH=`workflow`,exports.WORKFLOW_SCREEN_EVENT=`screen`;
 //# sourceMappingURL=webWorkflowTerminal.cjs.map

package/dist/types/webWorkflowTerminal.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"webWorkflowTerminal.cjs","names":[],"sources":["../../src/types/webWorkflowTerminal.ts"],"sourcesContent":["/**\n * The wire contract between this package's hub API and its cockpit client:\n * one run's terminal, and the files its run directory holds.\n *\n * Both halves of the cockpit import these names, so the route strings and the\n * event names live here rather than being spelled twice.\n */\n\n/** Segment this package's API is mounted under, below /api/plugin/. */\nexport const WORKFLOW_API_BASE_PATH = 'workflow';\n\n/** The SSE event name the screen stream writes. */\nexport const WORKFLOW_SCREEN_EVENT = 'screen';\n\n/** Where a run's routes live, below the mount every hub-scoped package API shares. */\nexport function workflowRunPath(workspace: string, runKey: string): string {\n  return `/api/plugin/${WORKFLOW_API_BASE_PATH}/runs/${encodeURIComponent(workspace)}/${encodeURIComponent(runKey)}`;\n}\n\n/** What a surface may do with one run's terminal, and why anything is missing. */\nexport interface WorkflowTerminalCapabilitiesView {\n  readable: boolean;\n  writable: boolean;\n  resizable: boolean;\n  reason?: string;\n}\n\n/** One frame of a run's terminal, as the stream pushes it. */\nexport interface WorkflowScreenEvent {\n  /** The visible screen, newest line last, carrying the colour the run printed. */\n  lines: string[];\n  capabilities: WorkflowTerminalCapabilitiesView;\n  /** True once the run has settled, after which the stream ends. */\n  ended?: boolean;\n}\n\n/** Answer to taking or releasing the keyboard for one run. */\nexport interface WorkflowControlResponse {\n  /** True when this caller now holds the keyboard. */\n  held: boolean;\n  /** The token later writes must carry; absent when control was refused or released. */\n  token?: string;\n  /** Why control was refused, worded for a reader. */\n  reason?: string;\n}\n\n/** Answer after a settled run and its directory have been permanently removed. */\nexport interface WorkflowDeleteResponse {\n  deleted: true;\n}\n\n/** How a declared run-directory entry compares with what is on disk. */\nexport type WorkflowArtifactState = 'written' | 'empty' | 'pending' | 'unreadable';\n\n/** One file or directory in a run's own folder. */\nexport interface WorkflowArtifactView {\n  /** Path relative to the run directory, which is also the read route's parameter. */\n  path: string;\n  kind: 'file' | 'directory';\n  /** What the workflow says this file is for; empty for a file it never declared. */\n  description: string;\n  /** The jobs the workflow says write it. */\n  producedBy: string[];\n  /** True when the workflow's run-directory block names this entry. */\n  declared: boolean;\n  state: WorkflowArtifactState;\n  /** Bytes on disk, absent until the file exists. */\n  size?: number;\n  /** ISO 8601 of the last write, absent until the file exists. */\n  modifiedAt?: string;\n}\n\nexport interface WorkflowArtifactsResponse {\n  /** Absolute path of the run's own directory, which the reader may want to open. */\n  runDir: string;\n  /** What the workflow says the directory is for. */\n  description: string;\n  artifacts: WorkflowArtifactView[];\n}\n\n/** One artifact's metadata and optional text, as the viewer tab reads it. */\nexport interface WorkflowArtifactContentResponse {\n  path: string;\n  size: number;\n  modifiedAt: string;\n  /** Media type inferred from the file extension by the trusted hub. Absent on older hubs. */\n  mimeType?: string;\n  /** Present for text formats; binary files are streamed from the raw route instead. */\n  text?: string;\n  /** True when textual content was longer than the reader's byte budget. */\n  truncated: boolean;\n}\n"],"mappings":""}
+{"version":3,"file":"webWorkflowTerminal.cjs","names":[],"sources":["../../src/types/webWorkflowTerminal.ts"],"sourcesContent":["/**\n * The wire contract between this package's hub API and its cockpit client:\n * one run's terminal, and the files its run directory holds.\n *\n * Both halves of the cockpit import these names, so the route strings and the\n * event names live here rather than being spelled twice.\n */\n\nimport { DOOM_HUB_API_SESSION_QUERY_PARAM } from '@agimon-ai/doompi-extension-contracts/package-api';\n\n/** Segment this package's API is mounted under, below /api/plugin/. */\nexport const WORKFLOW_API_BASE_PATH = 'workflow';\n/** Host query parameter that selects the focused session's hub API bundle. */\nexport const WORKFLOW_HUB_SESSION_QUERY_PARAM = DOOM_HUB_API_SESSION_QUERY_PARAM;\n\n/** The SSE event name the screen stream writes. */\nexport const WORKFLOW_SCREEN_EVENT = 'screen';\n\n/** Where a run's routes live, below the mount every hub-scoped package API shares. */\nexport function workflowRunPath(workspace: string, runKey: string): string {\n  return `/api/plugin/${WORKFLOW_API_BASE_PATH}/runs/${encodeURIComponent(workspace)}/${encodeURIComponent(runKey)}`;\n}\n\n/** What a surface may do with one run's terminal, and why anything is missing. */\nexport interface WorkflowTerminalCapabilitiesView {\n  readable: boolean;\n  writable: boolean;\n  resizable: boolean;\n  reason?: string;\n}\n\n/** One frame of a run's terminal, as the stream pushes it. */\nexport interface WorkflowScreenEvent {\n  /** The visible screen, newest line last, carrying the colour the run printed. */\n  lines: string[];\n  capabilities: WorkflowTerminalCapabilitiesView;\n  /** True once the run has settled, after which the stream ends. */\n  ended?: boolean;\n}\n\n/** Answer to taking or releasing the keyboard for one run. */\nexport interface WorkflowControlResponse {\n  /** True when this caller now holds the keyboard. */\n  held: boolean;\n  /** The token later writes must carry; absent when control was refused or released. */\n  token?: string;\n  /** Why control was refused, worded for a reader. */\n  reason?: string;\n}\n\n/** Answer after a settled run and its directory have been permanently removed. */\nexport interface WorkflowDeleteResponse {\n  deleted: true;\n}\n\n/** How a declared run-directory entry compares with what is on disk. */\nexport type WorkflowArtifactState = 'written' | 'empty' | 'pending' | 'unreadable';\n\n/** One file or directory in a run's own folder. */\nexport interface WorkflowArtifactView {\n  /** Path relative to the run directory, which is also the read route's parameter. */\n  path: string;\n  kind: 'file' | 'directory';\n  /** What the workflow says this file is for; empty for a file it never declared. */\n  description: string;\n  /** The jobs the workflow says write it. */\n  producedBy: string[];\n  /** True when the workflow's run-directory block names this entry. */\n  declared: boolean;\n  state: WorkflowArtifactState;\n  /** Bytes on disk, absent until the file exists. */\n  size?: number;\n  /** ISO 8601 of the last write, absent until the file exists. */\n  modifiedAt?: string;\n}\n\nexport interface WorkflowArtifactsResponse {\n  /** Absolute path of the run's own directory, which the reader may want to open. */\n  runDir: string;\n  /** What the workflow says the directory is for. */\n  description: string;\n  artifacts: WorkflowArtifactView[];\n}\n\n/** One artifact's metadata and optional text, as the viewer tab reads it. */\nexport interface WorkflowArtifactContentResponse {\n  path: string;\n  size: number;\n  modifiedAt: string;\n  /** Media type inferred from the file extension by the trusted hub. Absent on older hubs. */\n  mimeType?: string;\n  /** Present for text formats; binary files are streamed from the raw route instead. */\n  text?: string;\n  /** True when textual content was longer than the reader's byte budget. */\n  truncated: boolean;\n}\n"],"mappings":""}

package/dist/types/webWorkflowTerminal.mjs

@@ -1,2 +1,2 @@
-const e=`workflow`,t=`screen`;export{e as WORKFLOW_API_BASE_PATH,t as WORKFLOW_SCREEN_EVENT};
+import"@agimon-ai/doompi-extension-contracts/package-api";const e=`workflow`,t=`screen`;export{e as WORKFLOW_API_BASE_PATH,t as WORKFLOW_SCREEN_EVENT};
 //# sourceMappingURL=webWorkflowTerminal.mjs.map

package/dist/types/webWorkflowTerminal.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"webWorkflowTerminal.mjs","names":[],"sources":["../../src/types/webWorkflowTerminal.ts"],"sourcesContent":["/**\n * The wire contract between this package's hub API and its cockpit client:\n * one run's terminal, and the files its run directory holds.\n *\n * Both halves of the cockpit import these names, so the route strings and the\n * event names live here rather than being spelled twice.\n */\n\n/** Segment this package's API is mounted under, below /api/plugin/. */\nexport const WORKFLOW_API_BASE_PATH = 'workflow';\n\n/** The SSE event name the screen stream writes. */\nexport const WORKFLOW_SCREEN_EVENT = 'screen';\n\n/** Where a run's routes live, below the mount every hub-scoped package API shares. */\nexport function workflowRunPath(workspace: string, runKey: string): string {\n  return `/api/plugin/${WORKFLOW_API_BASE_PATH}/runs/${encodeURIComponent(workspace)}/${encodeURIComponent(runKey)}`;\n}\n\n/** What a surface may do with one run's terminal, and why anything is missing. */\nexport interface WorkflowTerminalCapabilitiesView {\n  readable: boolean;\n  writable: boolean;\n  resizable: boolean;\n  reason?: string;\n}\n\n/** One frame of a run's terminal, as the stream pushes it. */\nexport interface WorkflowScreenEvent {\n  /** The visible screen, newest line last, carrying the colour the run printed. */\n  lines: string[];\n  capabilities: WorkflowTerminalCapabilitiesView;\n  /** True once the run has settled, after which the stream ends. */\n  ended?: boolean;\n}\n\n/** Answer to taking or releasing the keyboard for one run. */\nexport interface WorkflowControlResponse {\n  /** True when this caller now holds the keyboard. */\n  held: boolean;\n  /** The token later writes must carry; absent when control was refused or released. */\n  token?: string;\n  /** Why control was refused, worded for a reader. */\n  reason?: string;\n}\n\n/** Answer after a settled run and its directory have been permanently removed. */\nexport interface WorkflowDeleteResponse {\n  deleted: true;\n}\n\n/** How a declared run-directory entry compares with what is on disk. */\nexport type WorkflowArtifactState = 'written' | 'empty' | 'pending' | 'unreadable';\n\n/** One file or directory in a run's own folder. */\nexport interface WorkflowArtifactView {\n  /** Path relative to the run directory, which is also the read route's parameter. */\n  path: string;\n  kind: 'file' | 'directory';\n  /** What the workflow says this file is for; empty for a file it never declared. */\n  description: string;\n  /** The jobs the workflow says write it. */\n  producedBy: string[];\n  /** True when the workflow's run-directory block names this entry. */\n  declared: boolean;\n  state: WorkflowArtifactState;\n  /** Bytes on disk, absent until the file exists. */\n  size?: number;\n  /** ISO 8601 of the last write, absent until the file exists. */\n  modifiedAt?: string;\n}\n\nexport interface WorkflowArtifactsResponse {\n  /** Absolute path of the run's own directory, which the reader may want to open. */\n  runDir: string;\n  /** What the workflow says the directory is for. */\n  description: string;\n  artifacts: WorkflowArtifactView[];\n}\n\n/** One artifact's metadata and optional text, as the viewer tab reads it. */\nexport interface WorkflowArtifactContentResponse {\n  path: string;\n  size: number;\n  modifiedAt: string;\n  /** Media type inferred from the file extension by the trusted hub. Absent on older hubs. */\n  mimeType?: string;\n  /** Present for text formats; binary files are streamed from the raw route instead. */\n  text?: string;\n  /** True when textual content was longer than the reader's byte budget. */\n  truncated: boolean;\n}\n"],"mappings":"AASA,MAAa,EAAyB,WAGzB,EAAwB"}
+{"version":3,"file":"webWorkflowTerminal.mjs","names":[],"sources":["../../src/types/webWorkflowTerminal.ts"],"sourcesContent":["/**\n * The wire contract between this package's hub API and its cockpit client:\n * one run's terminal, and the files its run directory holds.\n *\n * Both halves of the cockpit import these names, so the route strings and the\n * event names live here rather than being spelled twice.\n */\n\nimport { DOOM_HUB_API_SESSION_QUERY_PARAM } from '@agimon-ai/doompi-extension-contracts/package-api';\n\n/** Segment this package's API is mounted under, below /api/plugin/. */\nexport const WORKFLOW_API_BASE_PATH = 'workflow';\n/** Host query parameter that selects the focused session's hub API bundle. */\nexport const WORKFLOW_HUB_SESSION_QUERY_PARAM = DOOM_HUB_API_SESSION_QUERY_PARAM;\n\n/** The SSE event name the screen stream writes. */\nexport const WORKFLOW_SCREEN_EVENT = 'screen';\n\n/** Where a run's routes live, below the mount every hub-scoped package API shares. */\nexport function workflowRunPath(workspace: string, runKey: string): string {\n  return `/api/plugin/${WORKFLOW_API_BASE_PATH}/runs/${encodeURIComponent(workspace)}/${encodeURIComponent(runKey)}`;\n}\n\n/** What a surface may do with one run's terminal, and why anything is missing. */\nexport interface WorkflowTerminalCapabilitiesView {\n  readable: boolean;\n  writable: boolean;\n  resizable: boolean;\n  reason?: string;\n}\n\n/** One frame of a run's terminal, as the stream pushes it. */\nexport interface WorkflowScreenEvent {\n  /** The visible screen, newest line last, carrying the colour the run printed. */\n  lines: string[];\n  capabilities: WorkflowTerminalCapabilitiesView;\n  /** True once the run has settled, after which the stream ends. */\n  ended?: boolean;\n}\n\n/** Answer to taking or releasing the keyboard for one run. */\nexport interface WorkflowControlResponse {\n  /** True when this caller now holds the keyboard. */\n  held: boolean;\n  /** The token later writes must carry; absent when control was refused or released. */\n  token?: string;\n  /** Why control was refused, worded for a reader. */\n  reason?: string;\n}\n\n/** Answer after a settled run and its directory have been permanently removed. */\nexport interface WorkflowDeleteResponse {\n  deleted: true;\n}\n\n/** How a declared run-directory entry compares with what is on disk. */\nexport type WorkflowArtifactState = 'written' | 'empty' | 'pending' | 'unreadable';\n\n/** One file or directory in a run's own folder. */\nexport interface WorkflowArtifactView {\n  /** Path relative to the run directory, which is also the read route's parameter. */\n  path: string;\n  kind: 'file' | 'directory';\n  /** What the workflow says this file is for; empty for a file it never declared. */\n  description: string;\n  /** The jobs the workflow says write it. */\n  producedBy: string[];\n  /** True when the workflow's run-directory block names this entry. */\n  declared: boolean;\n  state: WorkflowArtifactState;\n  /** Bytes on disk, absent until the file exists. */\n  size?: number;\n  /** ISO 8601 of the last write, absent until the file exists. */\n  modifiedAt?: string;\n}\n\nexport interface WorkflowArtifactsResponse {\n  /** Absolute path of the run's own directory, which the reader may want to open. */\n  runDir: string;\n  /** What the workflow says the directory is for. */\n  description: string;\n  artifacts: WorkflowArtifactView[];\n}\n\n/** One artifact's metadata and optional text, as the viewer tab reads it. */\nexport interface WorkflowArtifactContentResponse {\n  path: string;\n  size: number;\n  modifiedAt: string;\n  /** Media type inferred from the file extension by the trusted hub. Absent on older hubs. */\n  mimeType?: string;\n  /** Present for text formats; binary files are streamed from the raw route instead. */\n  text?: string;\n  /** True when textual content was longer than the reader's byte budget. */\n  truncated: boolean;\n}\n"],"mappings":"0DAWA,MAAa,EAAyB,WAKzB,EAAwB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agimon-ai/doompi-workflow",
-  "version": "0.0.1-alpha.56",
+  "version": "0.0.1-alpha.58",
   "description": "GitHub Actions-style workflow graphs, artifacts, recovery, and asynchronous runs for DoomPi.",
   "keywords": [
     "ai",
@@ -68,12 +68,12 @@
     "@modelcontextprotocol/sdk": "1.30.0",
     "hono": "4.13.5",
     "zod": "4.4.3",
-    "@agimon-ai/doompi-telemetry": "0.0.1-alpha.55",
-    "@agimon-ai/doompi-extension-contracts": "0.0.1-alpha.55",
-    "@agimon-ai/doompi-web-components": "0.0.1-alpha.16",
-    "@agimon-ai/doompi-web-contracts": "0.0.1-alpha.19",
-    "@agimon-ai/doompi-ui": "0.0.1-alpha.56",
-    "@agimon-ai/doompi-web-security": "0.0.1-alpha.17"
+    "@agimon-ai/doompi-extension-contracts": "0.0.1-alpha.57",
+    "@agimon-ai/doompi-web-contracts": "0.0.1-alpha.20",
+    "@agimon-ai/doompi-web-components": "0.0.1-alpha.17",
+    "@agimon-ai/doompi-ui": "0.0.1-alpha.58",
+    "@agimon-ai/doompi-telemetry": "0.0.1-alpha.56",
+    "@agimon-ai/doompi-web-security": "0.0.1-alpha.19"
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "0.85.0",

package/src/types/webWorkflowTerminal.ts

@@ -6,8 +6,12 @@
  * event names live here rather than being spelled twice.
  */
 
+import { DOOM_HUB_API_SESSION_QUERY_PARAM } from '@agimon-ai/doompi-extension-contracts/package-api';
+
 /** Segment this package's API is mounted under, below /api/plugin/. */
 export const WORKFLOW_API_BASE_PATH = 'workflow';
+/** Host query parameter that selects the focused session's hub API bundle. */
+export const WORKFLOW_HUB_SESSION_QUERY_PARAM = DOOM_HUB_API_SESSION_QUERY_PARAM;
 
 /** The SSE event name the screen stream writes. */
 export const WORKFLOW_SCREEN_EVENT = 'screen';

package/src/web/ArtifactsPane.tsx

@@ -246,6 +246,7 @@ export function ArtifactViewerPanel({
   workspace,
   runKey,
   path,
+  sessionId,
 }: WebPluginSlotProps & { workspace: string; runKey: string; path: string }) {
   const [content, setContent] = useState<WorkflowArtifactContentResponse>();
   const [error, setError] = useState<string>();
@@ -254,7 +255,7 @@ export function ArtifactViewerPanel({
 
   useEffect(() => {
     let live = true;
-    void fetchArtifact(workspace, runKey, path).then((result) => {
+    void fetchArtifact(workspace, runKey, path, sessionId).then((result) => {
       if (!live) return;
       if ('error' in result) {
         setError(result.error);
@@ -267,10 +268,10 @@ export function ArtifactViewerPanel({
     return () => {
       live = false;
     };
-  }, [workspace, runKey, path, reloads]);
+  }, [workspace, runKey, path, reloads, sessionId]);
 
-  const rawUrl = artifactContentUrl(workspace, runKey, path);
-  const downloadUrl = artifactContentUrl(workspace, runKey, path, true);
+  const rawUrl = artifactContentUrl(workspace, runKey, path, false, sessionId);
+  const downloadUrl = artifactContentUrl(workspace, runKey, path, true, sessionId);
   const mimeType = content === undefined ? undefined : previewMimeType(content);
   const isMarkdown = mimeType === 'text/markdown';
 
@@ -344,14 +345,22 @@ export function ArtifactViewerPanel({
  * including entries no job has produced yet, because the declaration is what
  * the run is for. What the folder holds besides that follows.
  */
-export function ArtifactsPane({ run, onOpen }: { run: WorkflowRunView; onOpen: (path: string) => void }) {
+export function ArtifactsPane({
+  run,
+  sessionId,
+  onOpen,
+}: {
+  run: WorkflowRunView;
+  sessionId: string | null;
+  onOpen: (path: string) => void;
+}) {
   const [listing, setListing] = useState<WorkflowArtifactsResponse>();
   const [error, setError] = useState<string>();
 
   useEffect(() => {
     let live = true;
     const read = (): void => {
-      void fetchArtifacts(run.workspace, run.runKey).then((result) => {
+      void fetchArtifacts(run.workspace, run.runKey, sessionId).then((result) => {
         if (!live) return;
         if ('error' in result) {
           setError(result.error);
@@ -370,7 +379,7 @@ export function ArtifactsPane({ run, onOpen }: { run: WorkflowRunView; onOpen: (
       live = false;
       clearInterval(timer);
     };
-  }, [run.workspace, run.runKey, run.stage]);
+  }, [run.workspace, run.runKey, run.stage, sessionId]);
 
   const declared = listing?.artifacts.filter((entry) => entry.declared) ?? [];
   const found = listing?.artifacts.filter((entry) => !entry.declared) ?? [];

package/src/web/StepTerminalPanel.tsx

@@ -80,44 +80,49 @@ export function StepTerminalPanel({ sessionId, target }: WebPluginSlotProps & {
     // A new run's screen has not ended yet; the subscription below is the external system.
     // oxlint-disable-next-line react/set-state-in-effect
     setEnded(false);
-    return followScreen(target.workspace, target.runKey, (event) => {
-      setLines(event.lines);
-      setCapabilities(event.capabilities);
-      if (event.ended === true) setEnded(true);
-    });
-  }, [target.workspace, target.runKey]);
+    return followScreen(
+      target.workspace,
+      target.runKey,
+      (event) => {
+        setLines(event.lines);
+        setCapabilities(event.capabilities);
+        if (event.ended === true) setEnded(true);
+      },
+      sessionId,
+    );
+  }, [sessionId, target.workspace, target.runKey]);
 
   // The keyboard is a lease on the hub, so a tab that goes away must hand it
   // back rather than leaving the next reader locked out until it expires.
   useEffect(() => {
     if (token === undefined) return;
     return () => {
-      void releaseControl(target.workspace, target.runKey, token);
+      void releaseControl(target.workspace, target.runKey, token, sessionId);
     };
-  }, [token, target.workspace, target.runKey]);
+  }, [sessionId, token, target.workspace, target.runKey]);
 
   useEffect(() => {
     screenRef.current?.scrollTo({ top: screenRef.current.scrollHeight });
   }, [lines]);
 
   const arm = useCallback(async () => {
-    const result = await takeControl(target.workspace, target.runKey);
+    const result = await takeControl(target.workspace, target.runKey, undefined, sessionId);
     if (result.held && result.token !== undefined) {
       setToken(result.token);
       setNotice(undefined);
       return;
     }
     setNotice(result.reason ?? 'The keyboard is not available for this run.');
-  }, [target.workspace, target.runKey]);
+  }, [sessionId, target.workspace, target.runKey]);
 
   const disarm = useCallback(async () => {
-    if (token !== undefined) await releaseControl(target.workspace, target.runKey, token);
+    if (token !== undefined) await releaseControl(target.workspace, target.runKey, token, sessionId);
     setToken(undefined);
-  }, [token, target.workspace, target.runKey]);
+  }, [sessionId, token, target.workspace, target.runKey]);
 
   const type = async (data: string): Promise<void> => {
     if (token === undefined) return;
-    const { error } = await sendKeys(target.workspace, target.runKey, token, data);
+    const { error } = await sendKeys(target.workspace, target.runKey, token, data, sessionId);
     if (error !== undefined) {
       setNotice(error);
       setToken(undefined);

package/src/web/WorkflowsPanel.tsx

@@ -344,11 +344,13 @@ function InlineStepOutput({
   run,
   job,
   step,
+  sessionId,
   onOpenTerminal,
 }: {
   run: WorkflowRunView;
   job: WorkflowJobView;
   step: WorkflowStepView | undefined;
+  sessionId: string | null;
   onOpenTerminal: () => void;
 }) {
   const [lines, setLines] = useState<string[]>([]);
@@ -363,12 +365,17 @@ function InlineStepOutput({
     setLines([]);
     setCapabilities(undefined);
     setEnded(false);
-    return followScreen(run.workspace, run.runKey, (event) => {
-      setLines(event.lines);
-      setCapabilities(event.capabilities);
-      if (event.ended === true) setEnded(true);
-    });
-  }, [run.workspace, run.runKey]);
+    return followScreen(
+      run.workspace,
+      run.runKey,
+      (event) => {
+        setLines(event.lines);
+        setCapabilities(event.capabilities);
+        if (event.ended === true) setEnded(true);
+      },
+      sessionId,
+    );
+  }, [run.workspace, run.runKey, sessionId]);
 
   useEffect(() => {
     screenRef.current?.scrollTo({ top: screenRef.current.scrollHeight });
@@ -415,10 +422,12 @@ function InlineStepOutput({
 
 function DeleteWorkflowDialog({
   run,
+  sessionId,
   onClose,
   onDeleted,
 }: {
   run: WorkflowRunView;
+  sessionId: string;
   onClose: () => void;
   onDeleted: () => void;
 }) {
@@ -428,7 +437,7 @@ function DeleteWorkflowDialog({
   const confirm = (): void => {
     setDeleting(true);
     setError(undefined);
-    void deleteWorkflowRun(run.workspace, run.runKey).then((result) => {
+    void deleteWorkflowRun(run.workspace, run.runKey, sessionId).then((result) => {
       if ('error' in result) {
         setDeleting(false);
         setError(result.error);
@@ -681,7 +690,11 @@ export function WorkflowsPanel({ sessionId, openTransientTab, sendSessionFrame }
                   </Button>
                 </div>
                 {pane === 'artifacts' ? (
-                  <ArtifactsPane run={run} onOpen={(path) => openTransientTab(artifactTab(run, path))} />
+                  <ArtifactsPane
+                    run={run}
+                    sessionId={sessionId}
+                    onOpen={(path) => openTransientTab(artifactTab(run, path))}
+                  />
                 ) : job === undefined ? (
                   <EmptyState className="py-6" title="select a job to see its output" />
                 ) : (
@@ -689,6 +702,7 @@ export function WorkflowsPanel({ sessionId, openTransientTab, sendSessionFrame }
                     run={run}
                     job={job}
                     step={step}
+                    sessionId={sessionId}
                     onOpenTerminal={() => openTransientTab(stepTerminalTab(run, job.name, step?.name))}
                   />
                 )}
@@ -721,6 +735,7 @@ export function WorkflowsPanel({ sessionId, openTransientTab, sendSessionFrame }
       {sessionId !== null && deletingRun !== undefined ? (
         <DeleteWorkflowDialog
           run={deletingRun}
+          sessionId={sessionId}
           onClose={() => setDeletingRun(undefined)}
           onDeleted={() => {
             removeRun(sessionId, workflowRunIdentity(deletingRun));

package/src/web/terminalApi.ts

@@ -1,5 +1,6 @@
 import { sealedTransport } from '@agimon-ai/doompi-web-security/browser';
 import {
+  WORKFLOW_HUB_SESSION_QUERY_PARAM,
   WORKFLOW_SCREEN_EVENT,
   workflowRunPath,
   type WorkflowArtifactContentResponse,
@@ -18,6 +19,11 @@ import {
 const UNREACHABLE = 'The cockpit hub is unreachable.';
 const JSON_HEADERS = { 'content-type': 'application/json' };
 
+function sessionUrl(path: string, sessionId?: string | null): string {
+  if (sessionId === undefined || sessionId === null) return path;
+  const separator = path.includes('?') ? '&' : '?';
+  return `${path}${separator}${WORKFLOW_HUB_SESSION_QUERY_PARAM}=${encodeURIComponent(sessionId)}`;
+}
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -27,9 +33,13 @@ function errorOf(body: unknown, fallback: string): string {
   return isRecord(body) && typeof body.error === 'string' && body.error !== '' ? body.error : fallback;
 }
 
-async function post(path: string, body: unknown): Promise<{ status: number; body: unknown }> {
+async function post(
+  path: string,
+  body: unknown,
+  sessionId?: string | null,
+): Promise<{ status: number; body: unknown }> {
   try {
-    const response = await sealedTransport.fetch(path, {
+    const response = await sealedTransport.fetch(sessionUrl(path, sessionId), {
       method: 'POST',
       headers: JSON_HEADERS,
       body: JSON.stringify(body),
@@ -51,8 +61,9 @@ export function followScreen(
   workspace: string,
   runKey: string,
   onEvent: (event: WorkflowScreenEvent) => void,
+  sessionId?: string | null,
 ): () => void {
-  const source = new EventSource(`${workflowRunPath(workspace, runKey)}/screen/stream`);
+  const source = new EventSource(sessionUrl(`${workflowRunPath(workspace, runKey)}/screen/stream`, sessionId));
   const handler = (message: MessageEvent<string>): void => {
     let parsed: unknown;
     try {
@@ -71,15 +82,25 @@ export function followScreen(
 }
 
 /** Takes the keyboard for one run, renewing when this page already holds it. */
-export async function takeControl(workspace: string, runKey: string, token?: string): Promise<WorkflowControlResponse> {
-  const { status, body } = await post(`${workflowRunPath(workspace, runKey)}/control`, { token });
+export async function takeControl(
+  workspace: string,
+  runKey: string,
+  token?: string,
+  sessionId?: string | null,
+): Promise<WorkflowControlResponse> {
+  const { status, body } = await post(`${workflowRunPath(workspace, runKey)}/control`, { token }, sessionId);
   if (status === 0) return { held: false, reason: UNREACHABLE };
   if (isRecord(body) && typeof body.held === 'boolean') return body as unknown as WorkflowControlResponse;
   return { held: false, reason: errorOf(body, 'The run refused the keyboard.') };
 }
 
-export async function releaseControl(workspace: string, runKey: string, token: string): Promise<void> {
-  await post(`${workflowRunPath(workspace, runKey)}/control`, { token, release: true });
+export async function releaseControl(
+  workspace: string,
+  runKey: string,
+  token: string,
+  sessionId?: string | null,
+): Promise<void> {
+  await post(`${workflowRunPath(workspace, runKey)}/control`, { token, release: true }, sessionId);
 }
 
 /** Sends literal keystrokes; the reason comes back when the lease has moved on. */
@@ -88,8 +109,9 @@ export async function sendKeys(
   runKey: string,
   token: string,
   data: string,
+  sessionId?: string | null,
 ): Promise<{ error?: string }> {
-  const { status, body } = await post(`${workflowRunPath(workspace, runKey)}/keys`, { token, data });
+  const { status, body } = await post(`${workflowRunPath(workspace, runKey)}/keys`, { token, data }, sessionId);
   if (status === 0) return { error: UNREACHABLE };
   if (status === 204) return {};
   return { error: errorOf(body, 'The run would not take those keys.') };
@@ -102,16 +124,23 @@ export async function resizeRun(
   token: string,
   columns: number,
   rows: number,
+  sessionId?: string | null,
 ): Promise<void> {
-  await post(`${workflowRunPath(workspace, runKey)}/resize`, { token, columns, rows });
+  await post(`${workflowRunPath(workspace, runKey)}/resize`, { token, columns, rows }, sessionId);
 }
 
 export type DeleteWorkflowResult = { result: WorkflowDeleteResponse } | { error: string };
 
 /** Permanently removes one settled run and its run directory. */
-export async function deleteWorkflowRun(workspace: string, runKey: string): Promise<DeleteWorkflowResult> {
+export async function deleteWorkflowRun(
+  workspace: string,
+  runKey: string,
+  sessionId?: string | null,
+): Promise<DeleteWorkflowResult> {
   try {
-    const response = await sealedTransport.fetch(workflowRunPath(workspace, runKey), { method: 'DELETE' });
+    const response = await sealedTransport.fetch(sessionUrl(workflowRunPath(workspace, runKey), sessionId), {
+      method: 'DELETE',
+    });
     const body = (await response.json()) as unknown;
     if (!response.ok) return { error: errorOf(body, 'The workflow could not be deleted.') };
     if (isRecord(body) && body.deleted === true) return { result: { deleted: true } };
@@ -123,9 +152,15 @@ export async function deleteWorkflowRun(workspace: string, runKey: string): Prom
 
 export type ArtifactsResult = { artifacts: WorkflowArtifactsResponse } | { error: string };
 
-export async function fetchArtifacts(workspace: string, runKey: string): Promise<ArtifactsResult> {
+export async function fetchArtifacts(
+  workspace: string,
+  runKey: string,
+  sessionId?: string | null,
+): Promise<ArtifactsResult> {
   try {
-    const response = await sealedTransport.fetch(`${workflowRunPath(workspace, runKey)}/artifacts`);
+    const response = await sealedTransport.fetch(
+      sessionUrl(`${workflowRunPath(workspace, runKey)}/artifacts`, sessionId),
+    );
     const body = (await response.json()) as unknown;
     if (!response.ok) return { error: errorOf(body, 'This run has no directory to read.') };
     return { artifacts: body as WorkflowArtifactsResponse };
@@ -137,15 +172,32 @@ export async function fetchArtifacts(workspace: string, runKey: string): Promise
 export type ArtifactResult = { artifact: WorkflowArtifactContentResponse } | { error: string };
 
 /** Trusted same-origin URL for browser-native media previews and downloads. */
-export function artifactContentUrl(workspace: string, runKey: string, path: string, download = false): string {
+export function artifactContentUrl(
+  workspace: string,
+  runKey: string,
+  path: string,
+  download = false,
+  sessionId?: string | null,
+): string {
   const encodedPath = path.split('/').map(encodeURIComponent).join('/');
-  return `${workflowRunPath(workspace, runKey)}/artifacts/${encodedPath}?raw=1${download ? '&download=1' : ''}`;
+  return sessionUrl(
+    `${workflowRunPath(workspace, runKey)}/artifacts/${encodedPath}?raw=1${download ? '&download=1' : ''}`,
+    sessionId,
+  );
 }
 
-export async function fetchArtifact(workspace: string, runKey: string, path: string): Promise<ArtifactResult> {
+export async function fetchArtifact(
+  workspace: string,
+  runKey: string,
+  path: string,
+  sessionId?: string | null,
+): Promise<ArtifactResult> {
   try {
     const response = await sealedTransport.fetch(
-      `${workflowRunPath(workspace, runKey)}/artifacts/${path.split('/').map(encodeURIComponent).join('/')}`,
+      sessionUrl(
+        `${workflowRunPath(workspace, runKey)}/artifacts/${path.split('/').map(encodeURIComponent).join('/')}`,
+        sessionId,
+      ),
     );
     const body = (await response.json()) as unknown;
     if (!response.ok) return { error: errorOf(body, 'That file has not been written.') };