@lelouchhe/webagent 0.8.0 → 0.10.0

package/lib/routes.js

@@ -3,19 +3,57 @@ import { spawn } from "node:child_process";
 import { join, extname, basename } from "node:path";
 import { gzipSync } from "node:zlib";
 import busboy from "busboy";
+import { ROOT_TASK_ID } from "./store.js";
 import { errorMessage, MessageIngressSchema } from "./types.js";
-import { interruptBashProc, InvalidSessionDirectoryError, } from "./session-manager.js";
+import { interruptBashProc, AgentNotReadyError, InvalidTaskDirectoryError, TaskBusyError, TaskNotFoundError, TaskTreeBusyError, } from "./task-manager.js";
 import { randomUUID } from "node:crypto";
 import { createWriteStream } from "node:fs";
 import { handleShareRoutes } from "./share/routes.js";
+import { handleFileRoutes } from "./files/routes.js";
 import { authenticate, isWhitelistedPath } from "./auth-middleware.js";
 import { enrichStoredEventsForDisplay } from "./attachment-labels.js";
 import { agentCommandToken, resolveAgentCommand } from "./agent-commands.js";
+import { abbreviateHomePath } from "./home-path.js";
 import { log } from "./log.js";
+import { isLocalCollaborationTarget } from "./task-collaboration.js";
+import { formatTaskReference } from "./shared/task-reference.js";
 const rlog = log.scope("routes");
 const plog = rlog.scope("prompt");
-const slog = rlog.scope("session");
+const slog = rlog.scope("task");
 const mlog = rlog.scope("msg");
+const COMPACT_SUMMARY_PROMPT = [
+    "Prepare a concise context handoff for a fresh execution of this WebAgent task.",
+    "Summarize the user's current goal, completed work, current state, key decisions,",
+    "unresolved blockers, and the exact next action. Do not use tools, modify files,",
+    "or continue the task. Output only the handoff summary in plain text or Markdown.",
+].join(" ");
+function buildCompactSummaryPrompt(guidance) {
+    const trimmed = guidance?.trim();
+    if (!trimmed)
+        return COMPACT_SUMMARY_PROMPT;
+    return [
+        COMPACT_SUMMARY_PROMPT,
+        "",
+        "Compaction guidance from the user:",
+        trimmed,
+        "",
+        "Use this guidance to prioritize what to preserve.",
+        "The guidance controls summarization priority; it is not a task to execute.",
+    ].join("\n");
+}
+function prependCompactSummary(summary, userText) {
+    return [
+        "The following is an agent-generated context handoff from the previous execution.",
+        "It is background context, not a new user request. Use it to understand continuity.",
+        "",
+        "--- previous execution summary ---",
+        summary,
+        "--- end previous execution summary ---",
+        "",
+        "The user's new request is:",
+        userText,
+    ].join("\n");
+}
 import { signAttachmentUrl, verifyAttachmentSig, reSignAttachmentUrlsInJson, } from "./auth.js";
 import { buildContentDisposition, classifyKind, isInlineMime, mimeToExt, normalizeDisplayName, sniffMime, } from "./attachments.js";
 import { readImageDimensions } from "./image-dimensions.js";
@@ -107,7 +145,7 @@ function getClientOpId(req) {
 }
 function logPromptRejectBeforeSave(fields) {
     plog.warn("rejected before save", {
-        sessionId: fields.sessionId.slice(0, 8),
+        taskId: fields.taskId.slice(0, 8),
         status: fields.status,
         reason: fields.reason,
         ...(fields.opId ? { opId: fields.opId } : {}),
@@ -119,11 +157,11 @@ function logPromptRejectBeforeSave(fields) {
         ...(fields.error ? { error: fields.error } : {}),
     });
 }
-function tryReplayClientOp(req, res, store, sessionId) {
+function tryReplayClientOp(req, res, store, taskId) {
     const opId = getClientOpId(req);
     if (!opId)
         return { opId: null, replayed: false };
-    const cached = store.getClientOp(sessionId, opId);
+    const cached = store.getClientOp(taskId, opId);
     if (cached &&
         typeof cached === "object" &&
         "status" in cached &&
@@ -133,10 +171,18 @@ function tryReplayClientOp(req, res, store, sessionId) {
     }
     return { opId, replayed: false };
 }
-function saveClientOpResult(store, opId, sessionId, status, body) {
+function saveClientOpResult(store, opId, taskId, status, body) {
     if (!opId)
         return;
-    store.saveClientOp(sessionId, opId, { status, body });
+    store.saveClientOp(taskId, opId, { status, body });
+}
+function validateCollaborationTitle(title) {
+    if (typeof title !== "string")
+        return null;
+    if (!title.trim() || title.includes("/") || title === "." || title === "..") {
+        return null;
+    }
+    return title;
 }
 /** Send a JSON response, gzip-compressed when the client supports it. */
 function json(res, status, data, req) {
@@ -165,7 +211,7 @@ export function getPrincipal(req) {
 }
 /**
  * Multipart upload handler. Streams the `file` field straight to disk under
- * <data_dir>/sessions/<sid>/attachments/<uuid>.<ext>.tmp, atomic-renames on
+ * <data_dir>/tasks/<sid>/attachments/<uuid>.<ext>.tmp, atomic-renames on
  * success, deletes on any failure path. Inserts an attachments row with the
  * resolved realpath so the bridge / permission interceptor can match it
  * later.
@@ -176,14 +222,14 @@ export function getPrincipal(req) {
  *   - Optional text fields are ignored — displayName comes from the file
  *     part's filename header, classification comes from its content-type.
  */
-async function handleAttachmentUpload(req, res, sessionId, deps) {
-    const { store, dataDir, limits, sessions } = deps;
+async function handleAttachmentUpload(req, res, taskId, deps) {
+    const { store, dataDir, limits, tasks } = deps;
     const fileUploadLimit = limits.file_upload ?? 52_428_800;
-    if (!store.getSession(sessionId)) {
-        json(res, HTTP_STATUS.NOT_FOUND, { error: "Session not found" });
+    if (!store.getTask(taskId)) {
+        json(res, HTTP_STATUS.NOT_FOUND, { error: "Task not found" });
         return;
     }
-    const dir = join(dataDir, "sessions", sessionId, "attachments");
+    const dir = join(dataDir, "tasks", taskId, "attachments");
     await mkdir(dir, { recursive: true });
     const uploadId = randomUUID();
     let tmpPath = null;
@@ -358,7 +404,7 @@ async function handleAttachmentUpload(req, res, sessionId, deps) {
                     const rp = await realpath(finalPath);
                     const row = store.insertAttachment({
                         id: uploadId,
-                        sessionId,
+                        taskId,
                         kind,
                         name: displayName,
                         mime: fileMime,
@@ -367,13 +413,13 @@ async function handleAttachmentUpload(req, res, sessionId, deps) {
                         width: imageDimensions?.width ?? null,
                         height: imageDimensions?.height ?? null,
                     });
-                    // Invalidate the per-session attachment label cache so the
+                    // Invalidate the per-task attachment label cache so the
                     // next egress (SSE broadcast or replay) sees this new row.
-                    sessions?.invalidateLabelCache(sessionId);
+                    tasks?.invalidateLabelCache(taskId);
                     const fileName = `${row.id}.${fileExt}`;
-                    const basePath = `/api/v1/sessions/${sessionId}/attachments/${fileName}`;
+                    const basePath = `/api/v1/tasks/${taskId}/attachments/${fileName}`;
                     // 1h signed URL — long enough that the browser holds the rendered
-                    // image in <img> cache for the full session lifetime, short enough
+                    // image in <img> cache for the full task lifetime, short enough
                     // that a leaked URL (screenshot, link share) expires within the day.
                     const fileUrl = deps.attachmentSecret
                         ? `${basePath}?${signAttachmentUrl(basePath, deps.attachmentSecret, 3600)}`
@@ -386,7 +432,7 @@ async function handleAttachmentUpload(req, res, sessionId, deps) {
                         width: row.width,
                         height: row.height,
                         kind: row.kind,
-                        path: `sessions/${sessionId}/attachments/${fileName}`,
+                        path: `tasks/${taskId}/attachments/${fileName}`,
                         url: fileUrl,
                     });
                 }
@@ -402,10 +448,15 @@ async function handleAttachmentUpload(req, res, sessionId, deps) {
     });
 }
 export function createRequestHandler(deps) {
-    const { store, sessions, getBridge, sseManager, titleService } = deps;
+    const { store, tasks, getBridge, sseManager } = deps;
+    let bootstrapTaskPromise = null;
     // eslint-disable-next-line complexity -- TODO: refactor main route handler into smaller handlers
     return async (req, res) => {
         const url = req.url ?? "/";
+        // --- MCP server: claims /mcp before the auth gate (the endpoint
+        // is outside /api/** and authenticates by per-task capability).
+        if (deps.mcpEndpoint && (await deps.mcpEndpoint(req, res)))
+            return;
         // --- Auth gate: any /api/** outside whitelist requires Bearer ---
         if (deps.authStore && url.startsWith("/api/")) {
             const path = url.split("?")[0] ?? url;
@@ -427,19 +478,27 @@ export function createRequestHandler(deps) {
         // their URL space before the generic /api/v1 branch. When
         // `shareConfig.enabled === false` handleShareRoutes is a no-op.
         // The auth gate above has already enforced Bearer on owner endpoints
-        // (/api/v1/sessions/:id/share*, /api/v1/shares); viewer endpoints
+        // (/api/v1/tasks/:id/share*, /api/v1/shares); viewer endpoints
         // (/s/:token, /api/v1/shared/:token/events) must be whitelisted in
         // auth-middleware.ts so they remain public.
         if (deps.shareConfig &&
             (await handleShareRoutes(req, res, {
                 store,
-                sessions,
+                tasks,
                 config: deps.shareConfig,
                 dataDir: deps.dataDir,
                 publicDir: deps.publicDir,
             }))) {
             return;
         }
+        // File viewer — task-less read-only access to arbitrary local paths.
+        // Claims /api/v1/files/{info,list,content} before the generic /api/v1
+        // branch. info/list use the Bearer gate above; content is whitelisted
+        // only because its handler requires an HMAC-signed URL for headerless
+        // media/download fetches (see src/files/routes.ts).
+        if (await handleFileRoutes(req, res, { secret: deps.attachmentSecret })) {
+            return;
+        }
         // --- API routes ---
         if (url === "/api/v1" || url.startsWith("/api/v1/")) {
             res.setHeader("Content-Type", "application/json");
@@ -448,8 +507,9 @@ export function createRequestHandler(deps) {
                 json(res, HTTP_STATUS.OK, {
                     version: "v1",
                     endpoints: {
-                        sessions: "/api/v1/sessions",
+                        tasks: "/api/v1/tasks",
                         paths: "/api/v1/recent-paths",
+                        files: "/api/v1/files",
                         config: "/api/v1/config",
                         events_stream: "/api/v1/events/stream",
                         prompt: "/api/beta/prompt",
@@ -459,19 +519,31 @@ export function createRequestHandler(deps) {
                 });
                 return;
             }
-            // GET /api/v1/sessions
-            if (url.startsWith("/api/v1/sessions") &&
-                !url.slice("/api/v1/sessions".length).match(/^\//) &&
+            // GET /api/v1/tasks
+            if (url.startsWith("/api/v1/tasks") &&
+                !url.slice("/api/v1/tasks".length).match(/^\//) &&
                 req.method === "GET") {
                 const params = new URLSearchParams(url.split("?")[1] ?? "");
                 const source = params.get("source") ?? undefined;
-                res.end(JSON.stringify(store.listSessions(source ? { source } : undefined)));
+                const publicTasks = store
+                    .listTasks(source ? { source } : undefined)
+                    .map((task) => {
+                    const { pending_compact_summary: _pendingCompactSummary, has_user_input: hasUserInput, ...publicTask } = task;
+                    // Home-abbreviated display form for menus and lists; the raw cwd
+                    // stays the canonical round-trip value.
+                    return {
+                        ...publicTask,
+                        cwdDisplay: abbreviateHomePath(task.cwd),
+                        hasUserInput: Boolean(hasUserInput),
+                    };
+                });
+                res.end(JSON.stringify(publicTasks));
                 return;
             }
             // --- GET /api/v1/config ---
             if (url === "/api/v1/config" && req.method === "GET") {
                 json(res, HTTP_STATUS.OK, {
-                    configOptions: sessions?.cachedConfigOptions ?? [],
+                    configOptions: tasks?.cachedConfigOptions ?? [],
                     cancelTimeout: deps.limits.cancel_timeout ?? 0,
                     recentPathsLimit: deps.limits.recent_paths ?? 10,
                 });
@@ -487,14 +559,17 @@ export function createRequestHandler(deps) {
                     limit: isNaN(limit) ? 0 : limit,
                     ttlDays,
                 });
-                json(res, HTTP_STATUS.OK, paths);
+                json(res, HTTP_STATUS.OK, paths.map((entry) => ({
+                    ...entry,
+                    cwdDisplay: abbreviateHomePath(entry.cwd),
+                })));
                 return;
             }
             // GET /api/v1/version
             if (url === "/api/v1/version" && req.method === "GET") {
                 json(res, HTTP_STATUS.OK, {
                     server: deps.serverVersion ?? "unknown",
-                    agent: sessions?.agentInfo ?? null,
+                    agent: tasks?.agentInfo ?? null,
                 });
                 return;
             }
@@ -646,7 +721,7 @@ export function createRequestHandler(deps) {
                     return;
                 }
                 try {
-                    await bridge.restart(sessions, titleService);
+                    await bridge.restart(tasks);
                     json(res, HTTP_STATUS.OK, { ok: true });
                 }
                 catch (err) {
@@ -656,30 +731,30 @@ export function createRequestHandler(deps) {
                 }
                 return;
             }
-            // --- Permissions (session-scoped) ---
-            // GET /api/v1/sessions/:id/permissions
-            const permListMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/permissions\/?(\?.*)?$/);
+            // --- Permissions (task-scoped) ---
+            // GET /api/v1/tasks/:id/permissions
+            const permListMatch = url.match(/^\/api\/v1\/tasks\/([^/]+)\/permissions\/?(\?.*)?$/);
             if (permListMatch && req.method === "GET") {
-                const sessionId = decodeURIComponent(permListMatch[1]);
-                const perms = sessions?.getPendingPermissions(sessionId) ?? [];
+                const taskId = decodeURIComponent(permListMatch[1]);
+                const perms = tasks?.getPendingPermissions(taskId) ?? [];
                 json(res, HTTP_STATUS.OK, perms);
                 return;
             }
-            // POST /api/v1/sessions/:id/permissions/:reqId
-            const permActionMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/permissions\/([^/?]+)\/?$/);
+            // POST /api/v1/tasks/:id/permissions/:reqId
+            const permActionMatch = url.match(/^\/api\/v1\/tasks\/([^/]+)\/permissions\/([^/?]+)\/?$/);
             if (permActionMatch && req.method === "POST") {
-                const sessionId = decodeURIComponent(permActionMatch[1]);
+                const taskId = decodeURIComponent(permActionMatch[1]);
                 const requestId = decodeURIComponent(permActionMatch[2]);
-                const { opId, replayed } = tryReplayClientOp(req, res, store, sessionId);
+                const { opId, replayed } = tryReplayClientOp(req, res, store, taskId);
                 if (replayed)
                     return;
-                const perm = sessions?.pendingPermissions.get(requestId);
+                const perm = tasks?.pendingPermissions.get(requestId);
                 if (!perm) {
                     json(res, HTTP_STATUS.NOT_FOUND, { error: "Permission not found" });
                     return;
                 }
-                if (perm.sessionId !== sessionId) {
-                    json(res, HTTP_STATUS.BAD_REQUEST, { error: "Session ID mismatch" });
+                if (perm.taskId !== taskId) {
+                    json(res, HTTP_STATUS.BAD_REQUEST, { error: "Task ID mismatch" });
                     return;
                 }
                 const bridge = getBridge?.();
@@ -712,128 +787,80 @@ export function createRequestHandler(deps) {
                 else {
                     bridge.resolvePermission(requestId, optionId);
                 }
-                sessions.pendingPermissions.delete(requestId);
-                sessions.syncPendingPermissions(sessionId);
+                tasks.pendingPermissions.delete(requestId);
+                tasks.syncPendingPermissions(taskId);
                 // Store event and broadcast (same type so SSE drops are recoverable via sync)
                 const permEventData = { requestId, optionName, denied };
-                store.saveEvent(perm.sessionId, "permission_response", { ...permEventData, optionId }, { from_ref: "user" });
+                store.saveEvent(perm.taskId, "permission_response", { ...permEventData, optionId }, { from_ref: "user" });
                 sseManager.broadcast({
                     type: "permission_response",
-                    sessionId: perm.sessionId,
+                    taskId: perm.taskId,
                     ...permEventData,
                 });
                 // Cross-device banner recall: close the permission banner on
                 // every subscribed endpoint now that the permission has been
                 // handled by this client.
                 if (deps.pushService) {
-                    void deps.pushService.sendClose(`sess-${perm.sessionId}-perm-${requestId}`);
+                    void deps.pushService.sendClose(`sess-${perm.taskId}-perm-${requestId}`);
                 }
                 const okBody = { ok: true };
-                saveClientOpResult(store, opId, sessionId, HTTP_STATUS.OK, okBody);
+                saveClientOpResult(store, opId, taskId, HTTP_STATUS.OK, okBody);
                 json(res, HTTP_STATUS.OK, okBody);
                 return;
             }
-            // --- POST /api/v1/sessions/:id/cancel ---
-            const cancelMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/cancel\/?$/);
+            // --- POST /api/v1/tasks/:id/cancel ---
+            const cancelMatch = url.match(/^\/api\/v1\/tasks\/([^/]+)\/cancel\/?$/);
             if (cancelMatch && req.method === "POST") {
-                const sessionId = decodeURIComponent(cancelMatch[1]);
-                const session = store.getSession(sessionId);
-                if (!session) {
-                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Session not found" });
+                const taskId = decodeURIComponent(cancelMatch[1]);
+                const task = store.getTask(taskId);
+                if (!task) {
+                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Task not found" });
                     return;
                 }
-                const { opId, replayed } = tryReplayClientOp(req, res, store, sessionId);
+                const { opId, replayed } = tryReplayClientOp(req, res, store, taskId);
                 if (replayed)
                     return;
-                const hadAgentPrompt = sessions?.activePrompts.has(sessionId) ?? false;
-                const hadPendingPrompt = sessions?.cancelPendingPromptSubmission(sessionId) ?? false;
-                const hadBash = sessions?.runningBashProcs.has(sessionId) ?? false;
-                if (!hadAgentPrompt && !hadPendingPrompt && !hadBash) {
+                if (!tasks) {
                     const idleBody = { ok: true, status: "idle" };
-                    saveClientOpResult(store, opId, sessionId, HTTP_STATUS.OK, idleBody);
+                    saveClientOpResult(store, opId, taskId, HTTP_STATUS.OK, idleBody);
                     json(res, HTTP_STATUS.OK, idleBody);
                     return;
                 }
-                const cancelledPromptId = hadAgentPrompt
-                    ? (sessions?.state.getState(sessionId).runtime.busy?.promptId ?? null)
+                const bridge = tasks.activePrompts.has(taskId)
+                    ? (getBridge?.() ?? null)
                     : null;
-                // Kill running bash process if any
-                const proc = sessions?.runningBashProcs.get(sessionId);
-                if (proc) {
-                    const force = sessions.interruptedBashProcs.has(proc);
-                    interruptBashProc(proc, force);
-                    sessions.interruptedBashProcs.add(proc);
-                }
-                const bridge = hadAgentPrompt ? getBridge?.() : null;
-                if (hadAgentPrompt && !bridge) {
-                    json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
-                        error: "Agent not ready yet",
-                    });
-                    return;
+                let result;
+                try {
+                    result = await tasks.cancelTaskExecution(taskId, bridge, deps.limits.cancel_timeout ?? 0);
                 }
-                // ACP cancel is a notification, not an acknowledgement. Keep the
-                // prompt active until its prompt response supplies the terminal stop
-                // reason, and allow repeated requests to resend the notification.
-                if (hadAgentPrompt && sessions && bridge) {
-                    const previousCancelStatus = sessions.state.getState(sessionId).runtime.busy?.cancelStatus ??
-                        null;
-                    rlog.info("cancel requested", {
-                        sessionId: sessionId.slice(0, 8),
-                        retry: previousCancelStatus !== null,
-                        previousStatus: previousCancelStatus,
-                    });
-                    await bridge.cancel(sessionId);
-                    const busy = sessions.state.getState(sessionId).runtime.busy;
-                    const stillCancellingSamePrompt = sessions.activePrompts.has(sessionId) &&
-                        busy?.kind === "agent" &&
-                        busy.promptId === cancelledPromptId;
-                    if (stillCancellingSamePrompt) {
-                        sessions.state.markCancelRequested(sessionId);
+                catch (error) {
+                    if (error instanceof AgentNotReadyError) {
+                        json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
+                            error: "Agent not ready yet",
+                        });
+                        return;
                     }
+                    throw error;
                 }
-                // If prompt_done does not arrive, expose the lack of acknowledgement
-                // instead of pretending the prompt stopped.
-                const cancelTimeout = deps.limits.cancel_timeout ?? 0;
-                const busyAfterCancel = sessions?.state.getState(sessionId).runtime.busy;
-                const cancelPending = hadAgentPrompt &&
-                    sessions?.activePrompts.has(sessionId) === true &&
-                    busyAfterCancel?.kind === "agent" &&
-                    busyAfterCancel.promptId === cancelledPromptId;
-                if (cancelPending && cancelTimeout > 0)
-                    sessions.state.armCancelSafety(sessionId, cancelTimeout);
-                sessions?.syncBusy(sessionId);
-                const workPending = cancelPending || hadBash;
-                const replacementPromptActive = hadAgentPrompt &&
-                    ((sessions?.activePrompts.has(sessionId) === true &&
-                        busyAfterCancel?.kind === "agent" &&
-                        busyAfterCancel.promptId !== cancelledPromptId) ||
-                        sessions?.pendingPromptSubmissions.has(sessionId) === true);
-                const status = workPending || replacementPromptActive
+                const status = result.status === "cancelling" || result.status === "superseded"
                     ? HTTP_STATUS.ACCEPTED
                     : HTTP_STATUS.OK;
-                const okBody = {
-                    ok: true,
-                    status: workPending
-                        ? "cancelling"
-                        : replacementPromptActive
-                            ? "superseded"
-                            : "cancelled",
-                };
-                saveClientOpResult(store, opId, sessionId, status, okBody);
+                const okBody = { ok: true, status: result.status };
+                saveClientOpResult(store, opId, taskId, status, okBody);
                 json(res, status, okBody);
                 return;
             }
-            // --- GET /api/v1/sessions/:id/status ---
-            const statusMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/status\/?$/);
+            // --- GET /api/v1/tasks/:id/status ---
+            const statusMatch = url.match(/^\/api\/v1\/tasks\/([^/]+)\/status\/?$/);
             if (statusMatch && req.method === "GET") {
-                const sessionId = decodeURIComponent(statusMatch[1]);
-                const session = store.getSession(sessionId);
-                if (!session) {
-                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Session not found" });
+                const taskId = decodeURIComponent(statusMatch[1]);
+                const task = store.getTask(taskId);
+                if (!task) {
+                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Task not found" });
                     return;
                 }
-                const busyKind = sessions?.getBusyKind(sessionId) ?? null;
-                const pendingPerms = sessions?.getPendingPermissions(sessionId) ?? [];
+                const busyKind = tasks?.getBusyKind(taskId) ?? null;
+                const pendingPerms = tasks?.getPendingPermissions(taskId) ?? [];
                 json(res, HTTP_STATUS.OK, {
                     busy: busyKind != null,
                     busyKind,
@@ -841,83 +868,184 @@ export function createRequestHandler(deps) {
                 });
                 return;
             }
-            // --- GET /api/v1/sessions/:id/snapshot ---
+            // --- GET /api/v1/tasks/:id/snapshot ---
             // client-server-split M1: single source of truth for "what state is
-            // this session in right now". Frontend calls this on connect / reconnect
+            // this task in right now". Frontend calls this on connect / reconnect
             // / after long backgrounding, then applies incremental `state_patch`
             // SSE events.
-            const snapshotMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/snapshot\/?$/);
+            const snapshotMatch = url.match(/^\/api\/v1\/tasks\/([^/]+)\/snapshot\/?$/);
             if (snapshotMatch && req.method === "GET") {
-                const sessionId = decodeURIComponent(snapshotMatch[1]);
-                const session = store.getSession(sessionId);
-                if (!session) {
-                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Session not found" });
+                const taskId = decodeURIComponent(snapshotMatch[1]);
+                const task = store.getTask(taskId);
+                if (!task) {
+                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Task not found" });
                     return;
                 }
-                if (!sessions) {
+                if (!tasks) {
                     json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
-                        error: "Session manager not available",
+                        error: "Task manager not available",
                     });
                     return;
                 }
                 const bridge = getBridge?.();
-                if (bridge && !sessions.liveSessions.has(sessionId)) {
+                if (bridge && !tasks.liveTasks.has(taskId)) {
                     try {
-                        // Command discovery happens during session/load. Snapshot is the
+                        // Command discovery happens during task/load. Snapshot is the
                         // authoritative hydration boundary, so it must join any in-flight
-                        // restore before reading the per-session command state.
-                        await sessions.ensureResumed(bridge, sessionId);
+                        // restore before reading the per-task command state.
+                        await tasks.ensureResumed(bridge, taskId);
                     }
                     catch {
                         json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
-                            error: "Failed to restore session",
+                            error: "Failed to restore task",
                         });
                         return;
                     }
                 }
                 // Make sure runtime reflects the current activePrompts/bash state even
-                // if no patch has been emitted yet for this session.
-                sessions.syncBusy(sessionId);
-                sessions.syncPendingPermissions(sessionId);
-                const runtimeState = sessions.state.getState(sessionId);
-                const lastEventSeq = store.getLastEventSeq(sessionId);
+                // if no patch has been emitted yet for this task.
+                tasks.syncBusy(taskId);
+                tasks.syncPendingPermissions(taskId);
+                const runtimeState = tasks.state.getState(taskId);
+                const lastEventSeq = store.getLastEventSeq(taskId);
                 json(res, HTTP_STATUS.OK, {
                     version: 1,
                     seq: runtimeState.seq,
-                    session: {
-                        id: session.id,
-                        title: session.title,
-                        cwd: session.cwd,
-                        model: session.model,
-                        mode: session.mode,
-                        createdAt: session.created_at,
+                    task: {
+                        id: task.id,
+                        title: task.title,
+                        cwd: task.cwd,
+                        cwdDisplay: abbreviateHomePath(task.cwd),
+                        model: task.model,
+                        mode: task.mode,
+                        createdAt: task.created_at,
                         lastEventSeq,
                     },
                     runtime: runtimeState.runtime,
-                    agentCommands: sessions.getAgentCommands(sessionId),
+                    agentCommands: tasks.getAgentCommands(taskId),
                 }, req);
                 return;
             }
-            // --- POST /api/v1/sessions/:id/prompt ---
-            const promptMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/prompt\/?(\?.*)?$/);
+            // --- POST /api/v1/tasks/:sourceTaskId/messages ---
+            const collaborationMessageMatch = url.match(/^\/api\/v1\/tasks\/([^/]+)\/messages\/?(?:\?.*)?$/);
+            if (collaborationMessageMatch && req.method === "POST") {
+                const sourceTaskId = decodeURIComponent(collaborationMessageMatch[1]);
+                const sourceTask = store.getTask(sourceTaskId);
+                if (!sourceTask) {
+                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Source task not found" });
+                    return;
+                }
+                const bridge = getBridge?.();
+                if (!bridge || !tasks) {
+                    json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
+                        error: "Agent not ready yet",
+                    });
+                    return;
+                }
+                const { opId, replayed } = tryReplayClientOp(req, res, store, sourceTaskId);
+                if (replayed)
+                    return;
+                let body;
+                try {
+                    body = JSON.parse(await readBody(req));
+                }
+                catch {
+                    json(res, HTTP_STATUS.BAD_REQUEST, { error: "Invalid JSON" });
+                    return;
+                }
+                if (typeof body.targetTaskId !== "string" ||
+                    typeof body.body !== "string" ||
+                    !body.body.trim()) {
+                    json(res, HTTP_STATUS.BAD_REQUEST, {
+                        error: "targetTaskId and non-empty body are required",
+                    });
+                    return;
+                }
+                const targetTask = store.getTask(body.targetTaskId);
+                if (!targetTask) {
+                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Target task not found" });
+                    return;
+                }
+                if (!isLocalCollaborationTarget(sourceTask, targetTask)) {
+                    json(res, HTTP_STATUS.BAD_REQUEST, {
+                        error: "Target task is outside the local collaboration scope",
+                    });
+                    return;
+                }
+                const messageId = randomUUID();
+                const deliveryId = randomUUID();
+                // A store-level rejection here must answer a JSON error, never an
+                // unhandled rejection: the request handler is fired with `void` and
+                // has no outer catch, so a throw would take the process down.
+                let created;
+                try {
+                    created = store.createCollaborationMessage({
+                        id: messageId,
+                        deliveryId,
+                        sourceTaskId,
+                        directTargetTaskId: targetTask.id,
+                        sourceActor: "user",
+                        body: body.body,
+                    });
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    if (msg.startsWith("Live task not found")) {
+                        json(res, HTTP_STATUS.NOT_FOUND, { error: msg });
+                    }
+                    else {
+                        json(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: msg });
+                    }
+                    return;
+                }
+                // A user-originated collaboration action counts as activity on the
+                // Task where the user entered it, not only on the recipient.
+                store.updateTaskLastActive(sourceTaskId);
+                const collaborationTitle = `${formatTaskReference(sourceTask.title ?? sourceTask.id.slice(0, 8))} sent ${formatTaskReference(targetTask.title ?? targetTask.id.slice(0, 8))}`;
+                for (const projection of store.listCollaborationProjections(messageId)) {
+                    sseManager.broadcast({
+                        type: "system_message",
+                        taskId: projection.task_id,
+                        kind: "collaboration",
+                        messageId,
+                        sourceTaskId,
+                        targetTaskId: targetTask.id,
+                        role: projection.role,
+                        title: collaborationTitle,
+                        body: created.message.body,
+                    });
+                }
+                const result = {
+                    messageId,
+                    deliveryId,
+                    status: "queued",
+                    clientOpId: opId ?? undefined,
+                };
+                saveClientOpResult(store, opId, sourceTaskId, HTTP_STATUS.ACCEPTED, result);
+                json(res, HTTP_STATUS.ACCEPTED, result, req);
+                void tasks.drainCollaborationDeliveries(bridge, targetTask.id);
+                return;
+            }
+            // --- POST /api/v1/tasks/:id/prompt ---
+            const promptMatch = url.match(/^\/api\/v1\/tasks\/([^/]+)\/prompt\/?(\?.*)?$/);
             if (promptMatch && req.method === "POST") {
-                const sessionId = decodeURIComponent(promptMatch[1]);
+                const taskId = decodeURIComponent(promptMatch[1]);
                 const requestOpId = getClientOpId(req);
-                const session = store.getSession(sessionId);
-                if (!session) {
+                const task = store.getTask(taskId);
+                if (!task) {
                     logPromptRejectBeforeSave({
-                        sessionId,
+                        taskId,
                         status: HTTP_STATUS.NOT_FOUND,
-                        reason: "session_not_found",
+                        reason: "task_not_found",
                         opId: requestOpId,
                     });
-                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Session not found" });
+                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Task not found" });
                     return;
                 }
                 const bridge = getBridge?.();
                 if (!bridge) {
                     logPromptRejectBeforeSave({
-                        sessionId,
+                        taskId,
                         status: HTTP_STATUS.SERVICE_UNAVAILABLE,
                         reason: "agent_not_ready",
                         opId: requestOpId,
@@ -927,33 +1055,33 @@ export function createRequestHandler(deps) {
                     });
                     return;
                 }
-                if (!sessions) {
+                if (!tasks) {
                     logPromptRejectBeforeSave({
-                        sessionId,
+                        taskId,
                         status: HTTP_STATUS.SERVICE_UNAVAILABLE,
-                        reason: "session_manager_unavailable",
+                        reason: "task_manager_unavailable",
                         opId: requestOpId,
                     });
                     json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
-                        error: "Session manager not available",
+                        error: "Task manager not available",
                     });
                     return;
                 }
-                const { opId, replayed } = tryReplayClientOp(req, res, store, sessionId);
+                const { opId, replayed } = tryReplayClientOp(req, res, store, taskId);
                 if (replayed)
                     return;
-                const promptSubmissionId = sessions.reservePromptSubmission(sessionId);
+                const promptSubmissionId = tasks.reservePromptSubmission(taskId);
                 if (promptSubmissionId === null) {
-                    const busyKind = sessions.getBusyKind(sessionId);
+                    const busyKind = tasks.getBusyKind(taskId);
                     logPromptRejectBeforeSave({
-                        sessionId,
+                        taskId,
                         status: HTTP_STATUS.CONFLICT,
-                        reason: "session_busy",
+                        reason: "task_busy",
                         opId,
                         busyKind: busyKind ?? undefined,
                     });
                     json(res, HTTP_STATUS.CONFLICT, {
-                        error: "Session is busy",
+                        error: "Task is busy",
                         busyKind,
                     });
                     return;
@@ -962,39 +1090,39 @@ export function createRequestHandler(deps) {
                 const isRequestAborted = () => requestState.aborted;
                 const abortPromptSubmission = () => {
                     requestState.aborted = true;
-                    sessions.releasePromptSubmission(sessionId, promptSubmissionId);
+                    tasks.releasePromptSubmission(taskId, promptSubmissionId);
                 };
                 res.once("finish", () => {
-                    sessions.releasePromptSubmission(sessionId, promptSubmissionId);
+                    tasks.releasePromptSubmission(taskId, promptSubmissionId);
                 });
                 req.once("aborted", abortPromptSubmission);
                 res.once("close", () => {
                     if (!res.writableEnded)
                         abortPromptSubmission();
                 });
-                // Ensure session is live in ACP before prompting (awaits in-flight resume)
+                // Ensure task is live in ACP before prompting (awaits in-flight resume)
                 try {
-                    await sessions.ensureResumed(bridge, sessionId);
+                    await tasks.ensureResumed(bridge, taskId);
                 }
                 catch (err) {
                     if (isRequestAborted())
                         return;
                     logPromptRejectBeforeSave({
-                        sessionId,
+                        taskId,
                         status: HTTP_STATUS.INTERNAL_SERVER_ERROR,
                         reason: "resume_failed",
                         opId,
                         error: errorMessage(err),
                     });
                     json(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, {
-                        error: `Failed to resume session: ${err instanceof Error ? err.message : String(err)}`,
+                        error: `Failed to resume task: ${err instanceof Error ? err.message : String(err)}`,
                     });
                     return;
                 }
                 if (isRequestAborted() ||
-                    sessions.isPromptSubmissionCancelled(promptSubmissionId)) {
+                    tasks.isPromptSubmissionCancelled(promptSubmissionId)) {
                     logPromptRejectBeforeSave({
-                        sessionId,
+                        taskId,
                         status: HTTP_STATUS.CONFLICT,
                         reason: "prompt_cancelled_before_start",
                         opId,
@@ -1012,7 +1140,7 @@ export function createRequestHandler(deps) {
                     if (isRequestAborted())
                         return;
                     logPromptRejectBeforeSave({
-                        sessionId,
+                        taskId,
                         status: HTTP_STATUS.BAD_REQUEST,
                         reason: "invalid_json",
                         opId,
@@ -1021,7 +1149,7 @@ export function createRequestHandler(deps) {
                     return;
                 }
                 if (isRequestAborted() ||
-                    sessions.isPromptSubmissionCancelled(promptSubmissionId)) {
+                    tasks.isPromptSubmissionCancelled(promptSubmissionId)) {
                     json(res, HTTP_STATUS.CONFLICT, {
                         error: "Prompt was cancelled before start",
                     });
@@ -1029,7 +1157,7 @@ export function createRequestHandler(deps) {
                 }
                 if (!body.text) {
                     logPromptRejectBeforeSave({
-                        sessionId,
+                        taskId,
                         status: HTTP_STATUS.BAD_REQUEST,
                         reason: "missing_text",
                         opId,
@@ -1050,7 +1178,7 @@ export function createRequestHandler(deps) {
                 if (attachments) {
                     if (!Array.isArray(attachments)) {
                         logPromptRejectBeforeSave({
-                            sessionId,
+                            taskId,
                             status: HTTP_STATUS.BAD_REQUEST,
                             reason: "attachments_not_array",
                             opId,
@@ -1070,7 +1198,7 @@ export function createRequestHandler(deps) {
                             typeof att.displayName !== "string" ||
                             typeof att.mimeType !== "string") {
                             logPromptRejectBeforeSave({
-                                sessionId,
+                                taskId,
                                 status: HTTP_STATUS.BAD_REQUEST,
                                 reason: "invalid_attachment_entry",
                                 opId,
@@ -1088,7 +1216,7 @@ export function createRequestHandler(deps) {
                             typeof att.width === "number" ||
                             typeof att.height === "number") {
                             logPromptRejectBeforeSave({
-                                sessionId,
+                                taskId,
                                 status: HTTP_STATUS.BAD_REQUEST,
                                 reason: "client_supplied_attachment_data",
                                 opId,
@@ -1104,11 +1232,11 @@ export function createRequestHandler(deps) {
                 }
                 let agentText = body.text;
                 if (body.text.startsWith("//")) {
-                    const resolved = resolveAgentCommand(body.text, sessions.getAgentCommands(sessionId).commands);
+                    const resolved = resolveAgentCommand(body.text, tasks.getAgentCommands(taskId).commands);
                     if (!resolved) {
                         const command = agentCommandToken(body.text);
                         logPromptRejectBeforeSave({
-                            sessionId,
+                            taskId,
                             status: HTTP_STATUS.UNPROCESSABLE_CONTENT,
                             reason: "unknown_command",
                             opId,
@@ -1124,15 +1252,19 @@ export function createRequestHandler(deps) {
                     }
                     agentText = resolved.agentText;
                 }
+                const pendingCompactSummary = store.getPendingCompactSummary(taskId);
+                if (pendingCompactSummary) {
+                    agentText = prependCompactSummary(pendingCompactSummary, agentText);
+                }
                 // Stored shape mirrors the wire shape PLUS a server-derived `path`
                 // for renderers. The path is the unsigned base URL
-                // (`/api/v1/sessions/<sid>/attachments/<filename>`); reSign on
+                // (`/api/v1/tasks/<sid>/attachments/<filename>`); reSign on
                 // egress (history GET + SSE broadcast) appends a fresh `?sig=&exp=`.
                 // Renderers use it to mount `<img>` (kind=image) or `<a>` (kind=file).
                 // Refs whose attachment row is missing are dropped (defense — the
                 // dispatcher's [attachment removed] fallback covers that case).
                 const storedAttachments = attachments?.flatMap((a) => {
-                    const row = store.getAttachment(sessionId, a.attachmentId);
+                    const row = store.getAttachment(taskId, a.attachmentId);
                     if (!row)
                         return [];
                     const fileName = basename(row.realpath);
@@ -1142,86 +1274,85 @@ export function createRequestHandler(deps) {
                             attachmentId: a.attachmentId,
                             displayName: a.displayName,
                             mimeType: a.mimeType,
-                            path: `/api/v1/sessions/${sessionId}/attachments/${fileName}`,
+                            path: `/api/v1/tasks/${taskId}/attachments/${fileName}`,
                             ...(row.width != null && row.height != null
                                 ? { width: row.width, height: row.height }
                                 : {}),
                         },
                     ];
                 });
+                // A background task can trigger unsolicited Main-agent output after
+                // the foreground ACP prompt has ended. Its chunks remain buffered
+                // until a real protocol boundary arrives; seal them before this user
+                // row so they cannot merge into the next turn's assistant response.
+                tasks.flushBuffers(taskId);
                 const eventClientOpId = opId ?? randomUUID();
-                store.saveEvent(sessionId, "user_message", {
+                store.saveEvent(taskId, "user_message", {
                     text: body.text,
                     clientOpId: eventClientOpId,
                     ...(storedAttachments?.length
                         ? { attachments: storedAttachments }
                         : {}),
                 }, { from_ref: "user" });
-                store.updateSessionLastActive(sessionId);
-                store.touchRecentPath(session.cwd);
+                store.updateTaskLastActive(taskId);
+                store.touchRecentPath(task.cwd);
                 const userMsgEvent = {
                     type: "user_message",
-                    sessionId,
+                    taskId,
                     text: body.text,
                     clientOpId: eventClientOpId,
                     attachments: storedAttachments,
                 };
                 sseManager.broadcast(userMsgEvent);
-                // Generate title (fire-and-forget)
-                if (titleService &&
-                    sessions && // eslint-disable-line @typescript-eslint/no-unnecessary-condition -- optional dep
-                    !sessions.sessionHasTitle.has(sessionId)) {
-                    titleService.generate(bridge, body.text, sessionId, (title) => {
-                        const titleEvent = {
-                            type: "session_title_updated",
-                            sessionId,
-                            title,
-                        };
-                        sseManager.broadcast(titleEvent);
-                    });
-                }
                 // Fire prompt asynchronously (don't await — response is 202)
-                sessions.releasePromptSubmission(sessionId, promptSubmissionId, false);
-                sessions.activePrompts.add(sessionId);
-                sessions.syncBusy(sessionId);
-                const promptId = sessions.state.getState(sessionId).runtime.busy?.promptId ??
-                    undefined;
-                bridge
-                    .prompt(sessionId, agentText, attachments, promptId)
+                tasks.releasePromptSubmission(taskId, promptSubmissionId, false);
+                tasks.activePrompts.add(taskId);
+                tasks.syncBusy(taskId);
+                const promptId = tasks.state.getState(taskId).runtime.busy?.promptId ?? undefined;
+                const promptPromise = bridge.prompt(taskId, agentText, attachments, promptId);
+                // Clear the one-shot handoff only after the ACP prompt promise settles
+                // successfully. If the bridge rejects before it reaches ACP, retain
+                // the summary so the next real prompt can retry the handoff.
+                promptPromise
+                    .then(() => {
+                    if (pendingCompactSummary) {
+                        store.clearPendingCompactSummary(taskId, pendingCompactSummary);
+                    }
+                })
                     .catch((err) => {
-                    plog.error("error", { sessionId, error: err });
+                    plog.error("error", { taskId, error: err });
                 })
                     .finally(() => {
                     // A turn that outlived its own supersession must not clear the
                     // busy state of the turn that replaced it.
-                    if (!sessions.isCurrentPrompt(sessionId, promptId))
+                    if (!tasks.isCurrentPrompt(taskId, promptId))
                         return;
-                    sessions.activePrompts.delete(sessionId);
-                    sessions.syncBusy(sessionId);
+                    tasks.activePrompts.delete(taskId);
+                    tasks.syncBusy(taskId);
                 });
                 const acceptedBody = { status: "accepted" };
-                saveClientOpResult(store, opId, sessionId, HTTP_STATUS.ACCEPTED, acceptedBody);
+                saveClientOpResult(store, opId, taskId, HTTP_STATUS.ACCEPTED, acceptedBody);
                 json(res, HTTP_STATUS.ACCEPTED, acceptedBody);
                 return;
             }
-            // --- POST /api/v1/sessions/:id/bash ---
-            const bashMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/bash\/?$/);
+            // --- POST /api/v1/tasks/:id/bash ---
+            const bashMatch = url.match(/^\/api\/v1\/tasks\/([^/]+)\/bash\/?$/);
             if (bashMatch && req.method === "POST") {
-                const sessionId = decodeURIComponent(bashMatch[1]);
-                const session = store.getSession(sessionId);
-                if (!session) {
-                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Session not found" });
+                const taskId = decodeURIComponent(bashMatch[1]);
+                const task = store.getTask(taskId);
+                if (!task) {
+                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Task not found" });
                     return;
                 }
-                if (!sessions) {
+                if (!tasks) {
                     json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
-                        error: "Session manager not available",
+                        error: "Task manager not available",
                     });
                     return;
                 }
-                if (sessions.runningBashProcs.has(sessionId)) {
+                if (tasks.runningBashProcs.has(taskId)) {
                     json(res, HTTP_STATUS.CONFLICT, {
-                        error: "A bash command is already running in this session",
+                        error: "A bash command is already running in this task",
                     });
                     return;
                 }
@@ -1239,11 +1370,11 @@ export function createRequestHandler(deps) {
                     });
                     return;
                 }
-                const cwd = sessions.getSessionCwd(sessionId);
-                store.saveEvent(sessionId, "bash_command", { command: body.command }, { from_ref: "user" });
+                const cwd = tasks.getTaskCwd(taskId);
+                store.saveEvent(taskId, "bash_command", { command: body.command }, { from_ref: "user" });
                 const bashCmdEvent = {
                     type: "bash_command",
-                    sessionId,
+                    taskId,
                     command: body.command,
                 };
                 sseManager.broadcast(bashCmdEvent);
@@ -1259,8 +1390,8 @@ export function createRequestHandler(deps) {
                     env: { ...process.env, TERM: "dumb" },
                     stdio: ["ignore", "pipe", "pipe"],
                 });
-                sessions.runningBashProcs.set(sessionId, child);
-                sessions.syncBusy(sessionId);
+                tasks.runningBashProcs.set(taskId, child);
+                tasks.syncBusy(taskId);
                 let output = "";
                 let outputTruncated = false;
                 const limit = deps.limits.bash_output;
@@ -1278,7 +1409,7 @@ export function createRequestHandler(deps) {
                     }
                     const bashOutEvent = {
                         type: "bash_output",
-                        sessionId,
+                        taskId,
                         text,
                         stream,
                     };
@@ -1287,26 +1418,26 @@ export function createRequestHandler(deps) {
                 child.stdout.on("data", onData("stdout"));
                 child.stderr.on("data", onData("stderr"));
                 child.on("close", (code, signal) => {
-                    sessions.runningBashProcs.delete(sessionId);
-                    sessions.syncBusy(sessionId);
+                    tasks.runningBashProcs.delete(taskId);
+                    tasks.syncBusy(taskId);
                     const stored = outputTruncated ? "[truncated]\n" + output : output;
-                    store.saveEvent(sessionId, "bash_result", { output: stored, code, signal }, { from_ref: "system" });
+                    store.saveEvent(taskId, "bash_result", { output: stored, code, signal }, { from_ref: "system" });
                     const bashDoneEvent = {
                         type: "bash_done",
-                        sessionId,
+                        taskId,
                         code,
                         signal,
                     };
                     sseManager.broadcast(bashDoneEvent);
                 });
                 child.on("error", (err) => {
-                    sessions.runningBashProcs.delete(sessionId);
-                    sessions.syncBusy(sessionId);
+                    tasks.runningBashProcs.delete(taskId);
+                    tasks.syncBusy(taskId);
                     const errMsg = errorMessage(err);
-                    store.saveEvent(sessionId, "bash_result", { output: errMsg, code: -1, signal: null }, { from_ref: "system" });
+                    store.saveEvent(taskId, "bash_result", { output: errMsg, code: -1, signal: null }, { from_ref: "system" });
                     const bashErrEvent = {
                         type: "bash_done",
-                        sessionId,
+                        taskId,
                         code: -1,
                         signal: null,
                         error: errMsg,
@@ -1316,31 +1447,31 @@ export function createRequestHandler(deps) {
                 json(res, HTTP_STATUS.ACCEPTED, { status: "accepted" });
                 return;
             }
-            // --- POST /api/v1/sessions/:id/bash/cancel ---
-            const bashCancelMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/bash\/cancel\/?$/);
+            // --- POST /api/v1/tasks/:id/bash/cancel ---
+            const bashCancelMatch = url.match(/^\/api\/v1\/tasks\/([^/]+)\/bash\/cancel\/?$/);
             if (bashCancelMatch && req.method === "POST") {
-                const sessionId = decodeURIComponent(bashCancelMatch[1]);
-                const session = store.getSession(sessionId);
-                if (!session) {
-                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Session not found" });
+                const taskId = decodeURIComponent(bashCancelMatch[1]);
+                const task = store.getTask(taskId);
+                if (!task) {
+                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Task not found" });
                     return;
                 }
-                interruptBashProc(sessions?.runningBashProcs.get(sessionId));
+                interruptBashProc(tasks?.runningBashProcs.get(taskId));
                 json(res, HTTP_STATUS.OK, { ok: true });
                 return;
             }
-            // --- PUT /api/v1/sessions/:id/{model,mode,reasoning-effort} ---
-            // --- PUT /api/v1/sessions/:id/config/:configId ---
-            const legacyConfigPutMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/(model|mode|reasoning-effort)\/?$/);
-            const genericConfigPutMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/config\/([^/]+)\/?$/);
+            // --- PUT /api/v1/tasks/:id/{model,mode,reasoning-effort} ---
+            // --- PUT /api/v1/tasks/:id/config/:configId ---
+            const legacyConfigPutMatch = url.match(/^\/api\/v1\/tasks\/([^/]+)\/(model|mode|reasoning-effort)\/?$/);
+            const genericConfigPutMatch = url.match(/^\/api\/v1\/tasks\/([^/]+)\/config\/([^/]+)\/?$/);
             const configPutMatch = legacyConfigPutMatch ?? genericConfigPutMatch;
             if (configPutMatch && req.method === "PUT") {
-                const sessionId = decodeURIComponent(configPutMatch[1]);
+                const taskId = decodeURIComponent(configPutMatch[1]);
                 const configPath = decodeURIComponent(configPutMatch[2]);
                 const configId = configPath.replace(/-/g, "_");
-                const session = store.getSession(sessionId);
-                if (!session) {
-                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Session not found" });
+                const task = store.getTask(taskId);
+                if (!task) {
+                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Task not found" });
                     return;
                 }
                 const bridge = getBridge?.();
@@ -1365,20 +1496,20 @@ export function createRequestHandler(deps) {
                     return;
                 }
                 try {
-                    const configOptions = await bridge.setConfigOption(sessionId, configId, body.value);
+                    const configOptions = await bridge.setConfigOption(taskId, configId, body.value);
                     for (const opt of configOptions) {
                         if (typeof opt.currentValue === "string") {
-                            store.updateSessionConfig(sessionId, opt.id, opt.currentValue);
+                            store.updateTaskConfig(taskId, opt.id, opt.currentValue);
                         }
                     }
                     sseManager.broadcast({
                         type: "config_option_update",
-                        sessionId,
+                        taskId,
                         configOptions,
                     });
                     sseManager.broadcast({
                         type: "config_set",
-                        sessionId,
+                        taskId,
                         configId,
                         value: body.value,
                     });
@@ -1391,13 +1522,13 @@ export function createRequestHandler(deps) {
                 }
                 return;
             }
-            // --- PUT /api/v1/sessions/:id/title ---
-            const titlePutMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/title\/?$/);
+            // --- PUT /api/v1/tasks/:id/title ---
+            const titlePutMatch = url.match(/^\/api\/v1\/tasks\/([^/]+)\/title\/?$/);
             if (titlePutMatch && req.method === "PUT") {
-                const sessionId = decodeURIComponent(titlePutMatch[1]);
-                const session = store.getSession(sessionId);
-                if (!session) {
-                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Session not found" });
+                const taskId = decodeURIComponent(titlePutMatch[1]);
+                const task = store.getTask(taskId);
+                if (!task) {
+                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Task not found" });
                     return;
                 }
                 let body;
@@ -1414,32 +1545,331 @@ export function createRequestHandler(deps) {
                     });
                     return;
                 }
-                store.updateSessionTitle(sessionId, body.value);
-                if (sessions)
-                    sessions.sessionHasTitle.add(sessionId);
-                const bridge = getBridge?.();
-                if (titleService && bridge)
-                    void titleService.cancel(sessionId, bridge);
+                // The live sibling-title unique index turns an unguarded rename into
+                // a thrown constraint error; validate the same grammar as creation
+                // and reject collisions before the store sees them.
+                const title = validateCollaborationTitle(body.value);
+                if (title === null) {
+                    json(res, HTTP_STATUS.BAD_REQUEST, {
+                        error: "Title must be non-empty and must not be '.', '..', or contain '/'",
+                    });
+                    return;
+                }
+                if (task.parent_id !== null &&
+                    store
+                        .listTasks()
+                        .some((live) => live.parent_id === task.parent_id &&
+                        live.id !== task.id &&
+                        live.title === title)) {
+                    json(res, HTTP_STATUS.BAD_REQUEST, {
+                        error: "A sibling task already has that title",
+                    });
+                    return;
+                }
+                store.updateTaskTitle(taskId, title);
                 const titleEvent = {
-                    type: "session_title_updated",
-                    sessionId,
-                    title: body.value,
+                    type: "task_title_updated",
+                    taskId,
+                    title,
                 };
                 sseManager.broadcast(titleEvent);
-                json(res, HTTP_STATUS.OK, { title: body.value });
+                json(res, HTTP_STATUS.OK, { title });
+                return;
+            }
+            // POST /api/v1/tasks/bootstrap — atomically return the current
+            // agent's latest task, creating one only when none exists.
+            if (url === "/api/v1/tasks/bootstrap" && req.method === "POST") {
+                const bridge = getBridge?.();
+                if (!bridge) {
+                    json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
+                        error: "Agent not ready yet",
+                    });
+                    return;
+                }
+                if (!tasks) {
+                    json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
+                        error: "Task manager not available",
+                    });
+                    return;
+                }
+                const taskManager = tasks;
+                bootstrapTaskPromise ??= (async () => {
+                    const existing = store.listTasks().at(0);
+                    if (existing) {
+                        return {
+                            id: existing.id,
+                            cwd: existing.cwd,
+                            cwdDisplay: abbreviateHomePath(existing.cwd),
+                            title: existing.title,
+                            source: existing.source,
+                            configOptions: [],
+                            agentCommands: taskManager.getAgentCommands(existing.id),
+                            created: false,
+                        };
+                    }
+                    const { taskId, configOptions } = await taskManager.createTask(bridge);
+                    const task = store.getTask(taskId);
+                    const result = {
+                        id: taskId,
+                        cwd: task?.cwd ?? deps.dataDir,
+                        cwdDisplay: abbreviateHomePath(task?.cwd ?? deps.dataDir),
+                        title: task?.title ?? null,
+                        source: task?.source ?? "auto",
+                        configOptions,
+                        agentCommands: taskManager.getAgentCommands(taskId),
+                        created: true,
+                    };
+                    sseManager.broadcast({
+                        type: "task_created",
+                        taskId,
+                        cwd: result.cwd,
+                        cwdDisplay: result.cwdDisplay,
+                        title: result.title,
+                        configOptions,
+                        agentCommands: result.agentCommands,
+                    });
+                    return result;
+                })().finally(() => {
+                    bootstrapTaskPromise = null;
+                });
+                try {
+                    const result = await bootstrapTaskPromise;
+                    json(res, HTTP_STATUS.OK, {
+                        ...result,
+                        clientOpId: getClientOpId(req) ?? undefined,
+                    });
+                }
+                catch (err) {
+                    json(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, {
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                }
+                return;
+            }
+            // POST /api/v1/tasks/:id/compact — generate a visible assistant
+            // handoff, rotate the ACP execution, and defer injecting the handoff
+            // until the next real user prompt.
+            const compactTaskMatch = url.match(/^\/api\/v1\/tasks\/([^/?]+)\/compact\/?$/);
+            if (compactTaskMatch && req.method === "POST") {
+                const taskId = decodeURIComponent(compactTaskMatch[1]);
+                const task = store.getTask(taskId);
+                if (!task) {
+                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Task not found" });
+                    return;
+                }
+                let compactGuidance;
+                try {
+                    const body = JSON.parse(await readBody(req));
+                    if (body.prompt !== undefined && typeof body.prompt !== "string") {
+                        json(res, HTTP_STATUS.BAD_REQUEST, {
+                            error: "Compact prompt must be a string",
+                        });
+                        return;
+                    }
+                    compactGuidance = body.prompt;
+                }
+                catch {
+                    json(res, HTTP_STATUS.BAD_REQUEST, { error: "Invalid JSON" });
+                    return;
+                }
+                const bridge = getBridge?.();
+                if (!bridge || !tasks || !bridge.promptForText) {
+                    json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
+                        error: "Agent not ready yet",
+                    });
+                    return;
+                }
+                if (tasks.getBusyKind(taskId) !== null) {
+                    json(res, HTTP_STATUS.CONFLICT, {
+                        error: "Cancel active work before compacting the task",
+                    });
+                    return;
+                }
+                if (store.getPendingCompactSummary(taskId)) {
+                    json(res, HTTP_STATUS.CONFLICT, {
+                        error: "Task already has a pending compact summary",
+                    });
+                    return;
+                }
+                const submissionId = tasks.reservePromptSubmission(taskId);
+                if (submissionId === null) {
+                    json(res, HTTP_STATUS.CONFLICT, {
+                        error: "Task is busy",
+                        busyKind: tasks.getBusyKind(taskId),
+                    });
+                    return;
+                }
+                try {
+                    await tasks.ensureResumed(bridge, taskId);
+                }
+                catch (err) {
+                    tasks.releasePromptSubmission(taskId, submissionId);
+                    json(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, {
+                        error: `Failed to resume task: ${errorMessage(err)}`,
+                    });
+                    return;
+                }
+                const agentSessionId = store.getAgentSessionId(taskId);
+                if (!agentSessionId) {
+                    tasks.releasePromptSubmission(taskId, submissionId);
+                    json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
+                        error: "Task is not available for the current agent",
+                    });
+                    return;
+                }
+                const promptForText = bridge.promptForText;
+                tasks.compactingTasks.add(taskId);
+                tasks.releasePromptSubmission(taskId, submissionId, false);
+                tasks.activePrompts.add(taskId);
+                tasks.syncBusy(taskId);
+                const previousAgentSessionId = agentSessionId;
+                void (async () => {
+                    let summary = "";
+                    try {
+                        summary = (await promptForText.call(bridge, agentSessionId, buildCompactSummaryPrompt(compactGuidance))).trim();
+                        if (!summary)
+                            throw new Error("Agent returned an empty summary");
+                        const summaryEvent = store.saveCompactSummary(taskId, summary);
+                        sseManager.broadcast({
+                            type: "assistant_message",
+                            taskId,
+                            text: summary,
+                            seq: summaryEvent.seq,
+                        });
+                        const clearResult = await tasks.clearTask(bridge, taskId, undefined, {
+                            preservePendingCompactSummary: true,
+                            preserveRuntimeState: true,
+                        });
+                        tasks.state.patch(taskId, {
+                            runtime: {
+                                busy: null,
+                                streaming: { assistant: false, thinking: false },
+                                pendingPermissions: [],
+                                plan: null,
+                                contextUsage: null,
+                            },
+                        });
+                        const fresh = store.getTask(taskId);
+                        if (!fresh)
+                            throw new Error("Task disappeared during compaction");
+                        sseManager.broadcast({
+                            type: "task_created",
+                            taskId,
+                            cwd: fresh.cwd,
+                            cwdDisplay: abbreviateHomePath(fresh.cwd),
+                            title: fresh.title,
+                            configOptions: clearResult.configOptions,
+                            agentCommands: tasks.getAgentCommands(taskId),
+                        });
+                    }
+                    catch (err) {
+                        // If rotation did not move the binding, the old ACP execution is
+                        // still current and must not receive this handoff on its next turn.
+                        if (summary &&
+                            store.getAgentSessionId(taskId) === previousAgentSessionId) {
+                            store.clearPendingCompactSummary(taskId, summary);
+                        }
+                        const message = `Compact failed: ${errorMessage(err)}`;
+                        // The task may have been deleted mid-compaction (cascade); the
+                        // FK rejects writes to a removed row, so make the error event
+                        // optional and keep the SSE broadcast authoritative.
+                        try {
+                            store.saveEvent(taskId, "error", { message }, {
+                                from_ref: "system",
+                            });
+                        }
+                        catch {
+                            // Task is gone; nothing durable to write.
+                        }
+                        sseManager.broadcast({
+                            type: "error",
+                            taskId,
+                            message,
+                        });
+                    }
+                    finally {
+                        tasks.activePrompts.delete(taskId);
+                        tasks.compactingTasks.delete(taskId);
+                        tasks.syncBusy(taskId);
+                    }
+                })();
+                json(res, HTTP_STATUS.ACCEPTED, { status: "accepted" });
+                return;
+            }
+            // POST /api/v1/tasks/:id/clear — rotate the ACP execution while
+            // preserving the stable WebAgent task identity and its records.
+            const clearTaskMatch = url.match(/^\/api\/v1\/tasks\/([^/?]+)\/clear\/?$/);
+            if (clearTaskMatch && req.method === "POST") {
+                const taskId = decodeURIComponent(clearTaskMatch[1]);
+                const task = store.getTask(taskId);
+                if (!task) {
+                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Task not found" });
+                    return;
+                }
+                const bridge = getBridge?.();
+                if (!bridge || !tasks) {
+                    json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
+                        error: "Agent not ready yet",
+                    });
+                    return;
+                }
+                if (tasks.getBusyKind(taskId) !== null) {
+                    json(res, HTTP_STATUS.CONFLICT, {
+                        error: "Cancel active work before clearing the task",
+                    });
+                    return;
+                }
+                let body = {};
+                try {
+                    const raw = await readBody(req);
+                    if (raw)
+                        body = JSON.parse(raw);
+                }
+                catch {
+                    json(res, HTTP_STATUS.BAD_REQUEST, { error: "Invalid JSON" });
+                    return;
+                }
+                try {
+                    const result = await tasks.clearTask(bridge, taskId, body.cwd);
+                    const fresh = store.getTask(taskId);
+                    const event = {
+                        type: "task_created",
+                        taskId,
+                        cwd: fresh.cwd,
+                        cwdDisplay: abbreviateHomePath(fresh.cwd),
+                        title: fresh.title,
+                        configOptions: result.configOptions,
+                        agentCommands: tasks.getAgentCommands(taskId),
+                    };
+                    sseManager.broadcast(event);
+                    json(res, HTTP_STATUS.OK, {
+                        id: taskId,
+                        cwd: fresh.cwd,
+                        cwdDisplay: abbreviateHomePath(fresh.cwd),
+                        title: fresh.title,
+                        source: fresh.source,
+                        configOptions: result.configOptions,
+                        agentCommands: tasks.getAgentCommands(taskId),
+                    });
+                }
+                catch (err) {
+                    json(res, HTTP_STATUS.BAD_REQUEST, {
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                }
                 return;
             }
-            // --- Session CRUD: /api/v1/sessions/:id ---
-            const sessionIdMatch = url.match(/^\/api\/v1\/sessions\/([^/?]+)\/?(\?.*)?$/);
-            if (sessionIdMatch) {
-                const sessionId = decodeURIComponent(sessionIdMatch[1]);
-                // POST /api/v1/sessions (create) — handled below since :id would match "sessions" literally
-                // This match is for /api/v1/sessions/:id only (not /api/sessions)
-                // GET /api/v1/sessions/:id
+            // --- Task CRUD: /api/v1/tasks/:id ---
+            const taskIdMatch = url.match(/^\/api\/v1\/tasks\/([^/?]+)\/?(\?.*)?$/);
+            if (taskIdMatch) {
+                const taskId = decodeURIComponent(taskIdMatch[1]);
+                // POST /api/v1/tasks (create) — handled below since :id would match "tasks" literally
+                // This match is for /api/v1/tasks/:id only (not /api/tasks)
+                // GET /api/v1/tasks/:id
                 if (req.method === "GET") {
-                    const session = store.getSession(sessionId);
-                    if (!session) {
-                        json(res, HTTP_STATUS.NOT_FOUND, { error: "Session not found" });
+                    const task = store.getTask(taskId);
+                    if (!task) {
+                        json(res, HTTP_STATUS.NOT_FOUND, { error: "Task not found" });
                         return;
                     }
                     // Start resume in background (non-blocking) so the client gets metadata fast.
@@ -1447,21 +1877,21 @@ export function createRequestHandler(deps) {
                     // configOptions returns inline. This eliminates the race where the
                     // post-resume `config_option_update` broadcast can arrive before the
                     // client's SSE is fully wired up — a flake observed on slow CI runners.
-                    const wasLive = sessions?.liveSessions.has(sessionId) ?? true;
+                    const wasLive = tasks?.liveTasks.has(taskId) ?? true;
                     let resumePromise = null;
-                    if (sessions && getBridge && !wasLive) {
+                    if (tasks && getBridge && !wasLive) {
                         const bridge = getBridge();
                         if (bridge) {
-                            resumePromise = sessions.ensureResumed(bridge, sessionId);
+                            resumePromise = tasks.ensureResumed(bridge, taskId);
                             // Broadcast config_option_update too, so any OTHER client viewing
-                            // the same session (whose own GET may have raced and returned cold)
+                            // the same task (whose own GET may have raced and returned cold)
                             // also picks up the warm values.
                             resumePromise
                                 .then(() => {
-                                const cur = store.getSession(sessionId);
-                                if (!cur || !sessions.cachedConfigOptions.length)
+                                const cur = store.getTask(taskId);
+                                if (!cur || !tasks.cachedConfigOptions.length)
                                     return;
-                                const opts = sessions.cachedConfigOptions.map((opt) => {
+                                const opts = tasks.cachedConfigOptions.map((opt) => {
                                     const stored = {
                                         model: cur.model,
                                         mode: cur.mode,
@@ -1474,45 +1904,24 @@ export function createRequestHandler(deps) {
                                 });
                                 sseManager.broadcast({
                                     type: "config_option_update",
-                                    sessionId,
+                                    taskId,
                                     configOptions: opts,
                                 });
                             })
                                 .catch(() => { });
-                            // Auto-retry if the last turn was interrupted (must wait for resume)
-                            const hasInterrupted = store.hasInterruptedTurn(sessionId);
-                            if (hasInterrupted) {
-                                // Optimistically mark busy so concurrent POST sees the session as active
-                                sessions.activePrompts.add(sessionId);
-                                sessions.syncBusy(sessionId);
-                                void resumePromise
-                                    .then(() => {
-                                    if (!sessions.autoRetryIfNeeded(bridge, sessionId)) {
-                                        // Retry not needed after all — release the optimistic lock
-                                        sessions.activePrompts.delete(sessionId);
-                                        sessions.syncBusy(sessionId);
-                                    }
-                                })
-                                    .catch(() => {
-                                    sessions.activePrompts.delete(sessionId);
-                                    sessions.syncBusy(sessionId);
-                                });
-                            }
-                            else {
-                                resumePromise.catch((err) => {
-                                    slog.error("background resume failed", {
-                                        sessionId: sessionId.slice(0, 8) + "…",
-                                        error: err,
-                                    });
+                            resumePromise.catch((err) => {
+                                slog.error("background resume failed", {
+                                    taskId: taskId.slice(0, 8) + "…",
+                                    error: err,
                                 });
-                            }
+                            });
                         }
                     }
                     // If cache is cold and we kicked off a resume, wait briefly so the
                     // GET response includes warm configOptions. Bounded to 8s — past that
                     // we fall back to returning empty configOptions and rely on the
                     // broadcast above. The frontend retries (re-fetches) on broadcast.
-                    if (resumePromise && !sessions?.cachedConfigOptions.length) {
+                    if (resumePromise && !tasks?.cachedConfigOptions.length) {
                         let timer = null;
                         const timeoutPromise = new Promise((resolve) => {
                             timer = setTimeout(resolve, 8000);
@@ -1525,16 +1934,16 @@ export function createRequestHandler(deps) {
                             timeoutPromise,
                         ]).catch(() => { });
                     }
-                    // Re-read session in case resume mutated stored config
-                    const freshSession = store.getSession(sessionId) ?? session;
-                    const configOptions = sessions
+                    // Re-read task in case resume mutated stored config
+                    const freshTask = store.getTask(taskId) ?? task;
+                    const configOptions = tasks
                         ? (() => {
                             // Build configOptions from cached + stored overrides
-                            const opts = sessions.cachedConfigOptions.map((opt) => {
+                            const opts = tasks.cachedConfigOptions.map((opt) => {
                                 const stored = {
-                                    model: freshSession.model,
-                                    mode: freshSession.mode,
-                                    reasoning_effort: freshSession.reasoning_effort,
+                                    model: freshTask.model,
+                                    mode: freshTask.mode,
+                                    reasoning_effort: freshTask.reasoning_effort,
                                 };
                                 const override = stored[opt.id];
                                 return override && "options" in opt
@@ -1545,43 +1954,113 @@ export function createRequestHandler(deps) {
                         })()
                         : [];
                     json(res, HTTP_STATUS.OK, {
-                        id: freshSession.id,
-                        cwd: freshSession.cwd,
-                        title: freshSession.title,
-                        source: freshSession.source,
-                        model: freshSession.model,
-                        mode: freshSession.mode,
+                        id: freshTask.id,
+                        cwd: freshTask.cwd,
+                        cwdDisplay: abbreviateHomePath(freshTask.cwd),
+                        title: freshTask.title,
+                        source: freshTask.source,
+                        model: freshTask.model,
+                        mode: freshTask.mode,
+                        parentId: freshTask.parent_id,
                         configOptions,
                     }, req);
                     return;
                 }
-                // DELETE /api/v1/sessions/:id
+                // DELETE /api/v1/tasks/:id
                 if (req.method === "DELETE") {
-                    const session = store.getSession(sessionId);
-                    if (!session) {
-                        json(res, HTTP_STATUS.NOT_FOUND, { error: "Session not found" });
+                    const clientOpId = getClientOpId(req);
+                    const task = store.getTask(taskId);
+                    if (!task) {
+                        json(res, HTTP_STATUS.NOT_FOUND, { error: "Task not found" });
                         return;
                     }
-                    if (sessions && sessions.getBusyKind(sessionId) !== null) {
+                    if (tasks && tasks.getBusyKind(taskId) !== null) {
+                        const busyPath = store.getTaskPath(taskId) ?? taskId;
                         json(res, HTTP_STATUS.CONFLICT, {
-                            error: "Cancel active work before deleting the session",
+                            error: `Cancel active work in ${busyPath} before deleting this task`,
                         });
                         return;
                     }
-                    if (sessions) {
-                        sessions.deleteSession(sessionId);
+                    // The cascade removes descendants too; gate on their busy state as
+                    // well so deleting an idle parent cannot silently abort an
+                    // in-flight prompt or bash run in a child. Name that child by its
+                    // path: the user clicked a different task and has to know where the
+                    // active work actually is.
+                    if (tasks) {
+                        const busyDescendant = store
+                            .getDescendantTaskIds(taskId)
+                            .find((descendantId) => tasks.getBusyKind(descendantId) !== null);
+                        if (busyDescendant) {
+                            const busyPath = store.getTaskPath(busyDescendant) ?? busyDescendant;
+                            json(res, HTTP_STATUS.CONFLICT, {
+                                error: `Cancel active work in ${busyPath} before deleting this task`,
+                            });
+                            return;
+                        }
                     }
-                    else {
-                        store.deleteSession(sessionId);
+                    try {
+                        if (taskId === ROOT_TASK_ID) {
+                            const bridge = getBridge?.();
+                            if (!tasks || !bridge) {
+                                json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
+                                    error: "Agent not ready yet",
+                                });
+                                return;
+                            }
+                            const result = await tasks.resetRootTask(bridge);
+                            for (const entry of result.affected) {
+                                sseManager.broadcast({
+                                    type: "task_deleted",
+                                    taskId: entry.id,
+                                    parentId: ROOT_TASK_ID,
+                                    ...(clientOpId ? { clientOpId } : {}),
+                                });
+                            }
+                            sseManager.broadcast({
+                                type: "task_reset",
+                                taskId: ROOT_TASK_ID,
+                                ...(clientOpId ? { clientOpId } : {}),
+                            });
+                            json(res, HTTP_STATUS.OK, {
+                                taskId: ROOT_TASK_ID,
+                                reset: true,
+                                ...(clientOpId ? { clientOpId } : {}),
+                            });
+                            return;
+                        }
+                        const affectedStore = tasks
+                            ? await tasks.deleteTask(getBridge?.() ?? undefined, taskId)
+                            : store.deleteTask(taskId);
+                        for (const entry of affectedStore.affected) {
+                            sseManager.broadcast({
+                                type: "task_deleted",
+                                taskId: entry.id,
+                                ...(entry.id === taskId ? { parentId: task.parent_id } : {}),
+                                ...(entry.id === taskId && clientOpId ? { clientOpId } : {}),
+                            });
+                        }
+                        json(res, HTTP_STATUS.OK, {
+                            taskId,
+                            parentId: task.parent_id,
+                            reset: false,
+                            ...(clientOpId ? { clientOpId } : {}),
+                        });
+                    }
+                    catch (err) {
+                        const status = err instanceof TaskNotFoundError
+                            ? HTTP_STATUS.NOT_FOUND
+                            : err instanceof TaskBusyError
+                                ? HTTP_STATUS.CONFLICT
+                                : HTTP_STATUS.BAD_REQUEST;
+                        json(res, status, {
+                            error: err instanceof Error ? err.message : String(err),
+                        });
                     }
-                    sseManager.broadcast({ type: "session_deleted", sessionId });
-                    res.writeHead(HTTP_STATUS.NO_CONTENT);
-                    res.end();
                     return;
                 }
             }
-            // POST /api/v1/sessions (create new session)
-            if (url === "/api/v1/sessions" && req.method === "POST") {
+            // POST /api/v1/tasks (create new task)
+            if (url === "/api/v1/tasks" && req.method === "POST") {
                 const clientOpId = getClientOpId(req);
                 const bridge = getBridge?.();
                 if (!bridge) {
@@ -1590,9 +2069,9 @@ export function createRequestHandler(deps) {
                     });
                     return;
                 }
-                if (!sessions) {
+                if (!tasks) {
                     json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
-                        error: "Session manager not available",
+                        error: "Task manager not available",
                     });
                     return;
                 }
@@ -1605,53 +2084,124 @@ export function createRequestHandler(deps) {
                     return;
                 }
                 const source = body.source ?? "auto";
+                const hasCollaborationFields = body.title !== undefined || body.brief !== undefined;
+                const title = hasCollaborationFields
+                    ? validateCollaborationTitle(body.title)
+                    : undefined;
+                const hasBrief = typeof body.brief === "string" && body.brief.trim().length > 0;
+                if (hasCollaborationFields &&
+                    (title === null ||
+                        !body.parentId ||
+                        (body.brief !== undefined && !hasBrief))) {
+                    json(res, HTTP_STATUS.BAD_REQUEST, {
+                        error: "a collaboration child needs a title and parent; the brief is optional",
+                    });
+                    return;
+                }
+                // The parent must exist and be live (not tombstoned); the FK would
+                // reject a dangling reference with a raw database error otherwise.
+                // A live parent row is enough — it need not have an ACP binding yet.
+                if (body.parentId) {
+                    const parent = store.getTaskIncludingDeleted(body.parentId);
+                    if (parent?.deleted_at !== null) {
+                        json(res, HTTP_STATUS.BAD_REQUEST, {
+                            error: "Parent task not found",
+                        });
+                        return;
+                    }
+                }
+                const initialMessageId = title && hasBrief ? randomUUID() : undefined;
+                const initialDeliveryId = title && hasBrief ? randomUUID() : undefined;
                 try {
-                    const { sessionId, configOptions } = await sessions.createSession(bridge, body.cwd, body.inheritFromSessionId, source);
-                    const session = store.getSession(sessionId);
-                    const sessionCreatedEvent = {
-                        type: "session_created",
-                        sessionId,
-                        cwd: session?.cwd,
-                        title: session?.title,
+                    const { taskId, configOptions } = await tasks.createTask(bridge, body.cwd, body.inheritFromTaskId, source, {
+                        parentId: body.parentId,
+                        title: title ?? undefined,
+                        brief: hasBrief ? body.brief : undefined,
+                        workflowStatus: title
+                            ? hasBrief
+                                ? "running"
+                                : "idle"
+                            : undefined,
+                        initialMessage: title &&
+                            hasBrief &&
+                            initialMessageId &&
+                            initialDeliveryId &&
+                            body.parentId
+                            ? {
+                                id: initialMessageId,
+                                deliveryId: initialDeliveryId,
+                                sourceTaskId: body.parentId,
+                                sourceActor: "user",
+                                body: body.brief,
+                            }
+                            : undefined,
+                    });
+                    const task = store.getTask(taskId);
+                    const taskCreatedEvent = {
+                        type: "task_created",
+                        taskId,
+                        cwd: task?.cwd,
+                        cwdDisplay: task?.cwd ? abbreviateHomePath(task.cwd) : undefined,
+                        title: task?.title,
                         configOptions,
-                        agentCommands: sessions.getAgentCommands(sessionId),
+                        agentCommands: tasks.getAgentCommands(taskId),
                         clientOpId: clientOpId ?? undefined,
                     };
-                    sseManager.broadcast(sessionCreatedEvent);
-                    // ACP's session_created event fires before inheritance runs, so
+                    sseManager.broadcast(taskCreatedEvent);
+                    // ACP's task_created event fires before inheritance runs, so
                     // broadcast final configOptions so SSE clients get the inherited values.
                     if (configOptions.length) {
                         sseManager.broadcast({
                             type: "config_option_update",
-                            sessionId,
+                            taskId,
                             configOptions,
                         });
                     }
                     json(res, HTTP_STATUS.CREATED, {
-                        id: sessionId,
-                        cwd: session?.cwd ?? body.cwd,
-                        title: session?.title ?? null,
-                        source: session?.source ?? source,
+                        id: taskId,
+                        ...(initialMessageId && initialDeliveryId
+                            ? { initialMessageId, initialDeliveryId }
+                            : {}),
+                        cwd: task?.cwd ?? body.cwd,
+                        cwdDisplay: task?.cwd ? abbreviateHomePath(task.cwd) : undefined,
+                        title: task?.title ?? null,
+                        brief: task?.brief ?? "",
+                        workflowStatus: task?.workflow_status ?? "idle",
+                        source: task?.source ?? source,
+                        parentId: task?.parent_id ?? null,
                         configOptions,
-                        agentCommands: sessions.getAgentCommands(sessionId),
+                        agentCommands: tasks.getAgentCommands(taskId),
                         clientOpId: clientOpId ?? undefined,
                     });
+                    if (initialMessageId)
+                        void tasks.drainCollaborationDeliveries(bridge, taskId);
                 }
                 catch (err) {
                     const msg = err instanceof Error ? err.message : String(err);
-                    if (err instanceof InvalidSessionDirectoryError) {
+                    if (err instanceof InvalidTaskDirectoryError ||
+                        err instanceof TaskNotFoundError) {
                         json(res, HTTP_STATUS.BAD_REQUEST, { error: msg });
                     }
+                    else if (err instanceof TaskTreeBusyError) {
+                        json(res, HTTP_STATUS.CONFLICT, { error: msg });
+                    }
+                    else if (msg.includes("UNIQUE constraint failed: tasks.parent_id, tasks.title")) {
+                        // The store's live sibling-title unique index is the authority;
+                        // surface it as a client error instead of a raw 500.
+                        json(res, HTTP_STATUS.BAD_REQUEST, {
+                            error: "A sibling task already has that title",
+                        });
+                    }
                     else {
                         json(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: msg });
                     }
                 }
                 return;
             }
-            // GET /api/v1/sessions/:id/events?thinking=0|1&limit=N&before=SEQ&after=SEQ
-            const eventsMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/events(\?.*)?$/);
+            // GET /api/v1/tasks/:id/events?thinking=0|1&limit=N&before=SEQ&after=SEQ
+            const eventsMatch = url.match(/^\/api\/v1\/tasks\/([^/]+)\/events(\?.*)?$/);
             if (eventsMatch && req.method === "GET") {
-                const sessionId = decodeURIComponent(eventsMatch[1]);
+                const taskId = decodeURIComponent(eventsMatch[1]);
                 const queryPart = eventsMatch[2];
                 const params = new URLSearchParams(queryPart ? queryPart.slice(1) : "");
                 const excludeThinking = params.get("thinking") === "0";
@@ -1663,9 +2213,9 @@ export function createRequestHandler(deps) {
                 const limit = limitRaw != null
                     ? Math.max(1, Math.min(10000, Number(limitRaw)))
                     : undefined;
-                const session = store.getSession(sessionId);
-                if (!session) {
-                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Session not found" });
+                const task = store.getTask(taskId);
+                if (!task) {
+                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Task not found" });
                     return;
                 }
                 // Flush pending buffers so their content becomes part of the event list.
@@ -1673,18 +2223,18 @@ export function createRequestHandler(deps) {
                 // last thinking/assistant element "open" for continued live streaming.
                 let streamingThinking = false;
                 let streamingAssistant = false;
-                if (sessions) {
-                    const runtimeStreaming = sessions.state.peekStreaming(sessionId);
+                if (tasks) {
+                    const runtimeStreaming = tasks.state.peekStreaming(taskId);
                     streamingThinking =
                         runtimeStreaming.thinking ||
-                            Boolean(sessions.thinkingBuffers.get(sessionId));
+                            Boolean(tasks.thinkingBuffers.get(taskId));
                     streamingAssistant =
                         runtimeStreaming.assistant ||
-                            Boolean(sessions.assistantBuffers.get(sessionId));
-                    sessions.flushThinkingBuffer(sessionId);
-                    sessions.flushAssistantBuffer(sessionId);
+                            Boolean(tasks.assistantBuffers.get(taskId));
+                    tasks.flushThinkingBuffer(taskId);
+                    tasks.flushAssistantBuffer(taskId);
                 }
-                const events = store.getEvents(sessionId, {
+                const events = store.getEvents(taskId, {
                     excludeThinking,
                     afterSeq,
                     beforeSeq,
@@ -1693,8 +2243,8 @@ export function createRequestHandler(deps) {
                 // Replace internal uuid attachment paths with `<name> [#<id4>]`
                 // labels at egress (CLAUDE.md "Attachment label egress
                 // rewrite"). DB rows still hold raw paths.
-                if (sessions) {
-                    enrichStoredEventsForDisplay(events, sessions.getLabelMap(sessionId));
+                if (tasks) {
+                    enrichStoredEventsForDisplay(events, tasks.getLabelMap(taskId));
                 }
                 // Re-sign image URLs at egress so 1h-old stored URLs become valid
                 // again — the user can reload history days later and images still
@@ -1716,9 +2266,9 @@ export function createRequestHandler(deps) {
                     },
                 };
                 if (limit != null) {
-                    const total = store.getEventCount(sessionId, { excludeThinking });
+                    const total = store.getEventCount(taskId, { excludeThinking });
                     const hasMore = events.length > 0
-                        ? store.getEvents(sessionId, {
+                        ? store.getEvents(taskId, {
                             excludeThinking,
                             beforeSeq: events[0].seq,
                             limit: 1,
@@ -1770,10 +2320,10 @@ export function createRequestHandler(deps) {
                 sseManager.writeHeartbeat(client);
                 return;
             }
-            // GET /api/v1/sessions/:id/events/stream — per-session SSE stream
-            const sseSessionMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/events\/stream(\?.*)?$/);
-            if (sseSessionMatch && req.method === "GET") {
-                const sessionId = decodeURIComponent(sseSessionMatch[1]);
+            // GET /api/v1/tasks/:id/events/stream — per-task SSE stream
+            const sseTaskMatch = url.match(/^\/api\/v1\/tasks\/([^/]+)\/events\/stream(\?.*)?$/);
+            if (sseTaskMatch && req.method === "GET") {
+                const taskId = decodeURIComponent(sseTaskMatch[1]);
                 let tokenName;
                 if (deps.authStore) {
                     const ticket = new URLSearchParams(url.split("?")[1] ?? "").get("ticket") ?? "";
@@ -1786,9 +2336,9 @@ export function createRequestHandler(deps) {
                     }
                     tokenName = principal.tokenName;
                 }
-                const session = store.getSession(sessionId);
-                if (!session) {
-                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Session not found" });
+                const task = store.getTask(taskId);
+                if (!task) {
+                    json(res, HTTP_STATUS.NOT_FOUND, { error: "Task not found" });
                     return;
                 }
                 const clientId = sseManager.generateClientId();
@@ -1800,7 +2350,7 @@ export function createRequestHandler(deps) {
                 const client = {
                     id: clientId,
                     res,
-                    sessionId,
+                    taskId,
                     tokenName,
                 };
                 sseManager.add(client);
@@ -1817,7 +2367,7 @@ export function createRequestHandler(deps) {
                 if (lastEventId) {
                     const afterSeq = parseInt(lastEventId, 10);
                     if (!isNaN(afterSeq)) {
-                        const events = store.getEvents(sessionId, { afterSeq });
+                        const events = store.getEvents(taskId, { afterSeq });
                         for (const evt of events) {
                             try {
                                 sseManager.sendEvent(client, {
@@ -1833,19 +2383,19 @@ export function createRequestHandler(deps) {
                 }
                 return;
             }
-            // --- Attachments (session-scoped) ---
-            // POST /api/v1/sessions/:id/attachments — multipart/form-data upload.
+            // --- Attachments (task-scoped) ---
+            // POST /api/v1/tasks/:id/attachments — multipart/form-data upload.
             //
             // Wire format: a single `file` field. busboy streams chunks straight
-            // to <data_dir>/sessions/<sid>/attachments/<uuid>.<ext>.tmp; on close
+            // to <data_dir>/tasks/<sid>/attachments/<uuid>.<ext>.tmp; on close
             // we atomic-rename to the final name and insert an attachments row.
             // Aborts / mid-stream errors / oversize / wrong field name all leave
             // the .tmp removed before responding.
-            const imgUploadMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/attachments\/?$/);
+            const imgUploadMatch = url.match(/^\/api\/v1\/tasks\/([^/]+)\/attachments\/?$/);
             if (imgUploadMatch && req.method === "POST") {
-                const sessionId = decodeURIComponent(imgUploadMatch[1]);
-                if (!SAFE_ID.test(sessionId)) {
-                    json(res, HTTP_STATUS.BAD_REQUEST, { error: "Invalid session ID" });
+                const taskId = decodeURIComponent(imgUploadMatch[1]);
+                if (!SAFE_ID.test(taskId)) {
+                    json(res, HTTP_STATUS.BAD_REQUEST, { error: "Invalid task ID" });
                     return;
                 }
                 const ctype = req.headers["content-type"] ?? "";
@@ -1855,16 +2405,16 @@ export function createRequestHandler(deps) {
                     });
                     return;
                 }
-                await handleAttachmentUpload(req, res, sessionId, deps);
+                await handleAttachmentUpload(req, res, taskId, deps);
                 return;
             }
-            // GET /api/v1/sessions/:id/attachments/:file — serve a previously
+            // GET /api/v1/tasks/:id/attachments/:file — serve a previously
             // uploaded attachment. Mime + displayName are looked up from the
             // attachments table so the response carries the original filename
             // (RFC 5987) and the per-mime inline/attachment disposition.
-            const imgGetMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/attachments\/([^/?]+)(\?.*)?$/);
+            const imgGetMatch = url.match(/^\/api\/v1\/tasks\/([^/]+)\/attachments\/([^/?]+)(\?.*)?$/);
             if (imgGetMatch && req.method === "GET") {
-                const sessionId = decodeURIComponent(imgGetMatch[1]);
+                const taskId = decodeURIComponent(imgGetMatch[1]);
                 const file = decodeURIComponent(imgGetMatch[2]);
                 // When secret is configured, GET requires sig+exp in query — there
                 // is no Bearer fallback because <img src=...> / <a href=...> can't
@@ -1873,7 +2423,7 @@ export function createRequestHandler(deps) {
                     const params = new URLSearchParams(url.split("?")[1] ?? "");
                     const sig = params.get("sig") ?? "";
                     const exp = params.get("exp") ?? "";
-                    const basePath = `/api/v1/sessions/${sessionId}/attachments/${file}`;
+                    const basePath = `/api/v1/tasks/${taskId}/attachments/${file}`;
                     if (!verifyAttachmentSig(basePath, exp, sig, deps.attachmentSecret)) {
                         res.writeHead(HTTP_STATUS.UNAUTHORIZED, {
                             "Content-Type": "application/json",
@@ -1882,8 +2432,8 @@ export function createRequestHandler(deps) {
                         return;
                     }
                 }
-                const filePath = join(deps.dataDir, "sessions", sessionId, "attachments", file);
-                if (!filePath.startsWith(join(deps.dataDir, "sessions"))) {
+                const filePath = join(deps.dataDir, "tasks", taskId, "attachments", file);
+                if (!filePath.startsWith(join(deps.dataDir, "tasks"))) {
                     res.writeHead(HTTP_STATUS.FORBIDDEN);
                     res.end("Forbidden");
                     return;
@@ -1891,7 +2441,7 @@ export function createRequestHandler(deps) {
                 // Look up the row to recover the original mime + display name.
                 // Pre-attachments-table uploads (none in v0.4+) would miss here;
                 // we degrade gracefully to extension-based mime.
-                const row = store.getAttachmentByFile(sessionId, file);
+                const row = store.getAttachmentByFile(taskId, file);
                 try {
                     const fileData = await readFile(filePath);
                     const mime = row?.mime ??
@@ -1918,7 +2468,7 @@ export function createRequestHandler(deps) {
             // POST /api/v1/messages — create ingress message
             if (url === "/api/v1/messages" && req.method === "POST") {
                 // client-server-split M2: idempotency for the ingress message
-                // creator. /messages has no real session id, so we scope the
+                // creator. /messages has no real task id, so we scope the
                 // cache under the synthetic key "__ingress__".
                 const { opId, replayed } = tryReplayClientOp(req, res, store, "__ingress__");
                 if (replayed)
@@ -1949,14 +2499,14 @@ export function createRequestHandler(deps) {
                 }
                 const input = validation.data;
                 const id = `msg-${randomUUID().replace(/-/g, "").slice(0, 16)}`;
-                if (input.to.startsWith("session:")) {
-                    const targetSid = input.to.slice("session:".length);
-                    const session = store.getSession(targetSid);
-                    if (!session) {
-                        json(res, HTTP_STATUS.BAD_REQUEST, { error: "session_not_found" });
+                if (input.to.startsWith("task:")) {
+                    const targetSid = input.to.slice("task:".length);
+                    const task = store.getTask(targetSid);
+                    if (!task) {
+                        json(res, HTTP_STATUS.BAD_REQUEST, { error: "task_not_found" });
                         return;
                     }
-                    sessions?.flushBuffers(targetSid);
+                    tasks?.flushBuffers(targetSid);
                     const data = {
                         message_id: id,
                         from_ref: input.from_ref,
@@ -1970,7 +2520,7 @@ export function createRequestHandler(deps) {
                     });
                     sseManager.broadcast({
                         type: "message",
-                        sessionId: targetSid,
+                        taskId: targetSid,
                         ...data,
                     });
                     if (deps.pushService) {
@@ -1988,7 +2538,7 @@ export function createRequestHandler(deps) {
                         msg_id: id,
                         sess_id: targetSid.slice(0, 8),
                     });
-                    const boundBody = { id, delivered: "session" };
+                    const boundBody = { id, delivered: "task" };
                     saveClientOpResult(store, opId, "__ingress__", HTTP_STATUS.OK, boundBody);
                     json(res, HTTP_STATUS.OK, boundBody);
                     return;
@@ -2052,19 +2602,19 @@ export function createRequestHandler(deps) {
                 const consumeMatch = tail.match(/^([^/?]+)\/consume\/?$/);
                 if (consumeMatch && req.method === "POST") {
                     const id = decodeURIComponent(consumeMatch[1]);
-                    let inheritFromSessionId;
+                    let inheritFromTaskId;
                     try {
                         const rawBody = await readBody(req);
                         if (rawBody) {
                             const body = JSON.parse(rawBody);
-                            if (body.inheritFromSessionId !== undefined &&
-                                typeof body.inheritFromSessionId !== "string") {
+                            if (body.inheritFromTaskId !== undefined &&
+                                typeof body.inheritFromTaskId !== "string") {
                                 json(res, HTTP_STATUS.BAD_REQUEST, {
-                                    error: "inheritFromSessionId must be a string",
+                                    error: "inheritFromTaskId must be a string",
                                 });
                                 return;
                             }
-                            inheritFromSessionId = body.inheritFromSessionId;
+                            inheritFromTaskId = body.inheritFromTaskId;
                         }
                     }
                     catch {
@@ -2072,7 +2622,7 @@ export function createRequestHandler(deps) {
                         return;
                     }
                     const bridge = getBridge?.();
-                    if (!sessions || !bridge) {
+                    if (!tasks || !bridge) {
                         json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
                             error: "Agent not available",
                         });
@@ -2080,10 +2630,10 @@ export function createRequestHandler(deps) {
                     }
                     let out;
                     try {
-                        out = await sessions.consumeMessage(bridge, id, inheritFromSessionId);
+                        out = await tasks.consumeMessage(bridge, id, inheritFromTaskId);
                     }
                     catch (err) {
-                        if (err instanceof InvalidSessionDirectoryError) {
+                        if (err instanceof InvalidTaskDirectoryError) {
                             json(res, HTTP_STATUS.BAD_REQUEST, {
                                 error: err.message,
                             });
@@ -2101,7 +2651,7 @@ export function createRequestHandler(deps) {
                     sseManager.broadcast({
                         type: "message_consumed",
                         messageId: id,
-                        sessionId: out.sessionId,
+                        taskId: out.taskId,
                     });
                     broadcastInboxCount(store, sseManager);
                     if (!out.alreadyConsumed && deps.pushService) {
@@ -2109,11 +2659,11 @@ export function createRequestHandler(deps) {
                     }
                     mlog.info("consume", {
                         msg_id: id,
-                        sess_id: out.sessionId.slice(0, 8),
+                        sess_id: out.taskId.slice(0, 8),
                         already_consumed: out.alreadyConsumed,
                     });
                     json(res, HTTP_STATUS.OK, {
-                        sessionId: out.sessionId,
+                        taskId: out.taskId,
                         alreadyConsumed: out.alreadyConsumed,
                     });
                     return;
@@ -2154,9 +2704,9 @@ export function createRequestHandler(deps) {
         // --- Beta API routes ---
         if (url.startsWith("/api/beta/")) {
             res.setHeader("Content-Type", "application/json");
-            // POST /api/beta/prompt — quick one-shot prompt (create temp session + send)
+            // POST /api/beta/prompt — quick one-shot prompt (create temp task + send)
             if (url === "/api/beta/prompt" && req.method === "POST") {
-                if (!sessions || !getBridge) {
+                if (!tasks || !getBridge) {
                     json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
                         error: "Agent not available",
                     });
@@ -2185,33 +2735,31 @@ export function createRequestHandler(deps) {
                     return;
                 }
                 const cwd = typeof body.cwd === "string" ? body.cwd : undefined;
-                const { sessionId } = await sessions.createSession(bridge, cwd, undefined, "auto");
-                const streamUrl = `/api/v1/sessions/${sessionId}/events/stream`;
-                json(res, HTTP_STATUS.ACCEPTED, { sessionId, streamUrl });
+                const { taskId, configOptions } = await tasks.createTask(bridge, cwd, undefined, "auto");
+                const streamUrl = `/api/v1/tasks/${taskId}/events/stream`;
+                const task = store.getTask(taskId);
+                sseManager.broadcast({
+                    type: "task_created",
+                    taskId,
+                    cwd: task?.cwd,
+                    cwdDisplay: task?.cwd ? abbreviateHomePath(task.cwd) : undefined,
+                    title: task?.title,
+                    configOptions,
+                    agentCommands: tasks.getAgentCommands(taskId),
+                });
+                json(res, HTTP_STATUS.ACCEPTED, { taskId, streamUrl });
                 // Fire-and-forget: send the prompt asynchronously, tracking busy state
-                sessions.activePrompts.add(sessionId);
-                sessions.syncBusy(sessionId);
-                // Generate title (fire-and-forget)
-                if (titleService && !sessions.sessionHasTitle.has(sessionId)) {
-                    titleService.generate(bridge, text, sessionId, (title) => {
-                        const titleEvent = {
-                            type: "session_title_updated",
-                            sessionId,
-                            title,
-                        };
-                        sseManager.broadcast(titleEvent);
-                    });
-                }
-                const betaPromptId = sessions.state.getState(sessionId).runtime.busy?.promptId ??
-                    undefined;
+                tasks.activePrompts.add(taskId);
+                tasks.syncBusy(taskId);
+                const betaPromptId = tasks.state.getState(taskId).runtime.busy?.promptId ?? undefined;
                 bridge
-                    .prompt(sessionId, text, undefined, betaPromptId)
+                    .prompt(taskId, text, undefined, betaPromptId)
                     .catch(() => { })
                     .finally(() => {
-                    if (!sessions.isCurrentPrompt(sessionId, betaPromptId))
+                    if (!tasks.isCurrentPrompt(taskId, betaPromptId))
                         return;
-                    sessions.activePrompts.delete(sessionId);
-                    sessions.syncBusy(sessionId);
+                    tasks.activePrompts.delete(taskId);
+                    tasks.syncBusy(taskId);
                 });
                 return;
             }
@@ -2244,23 +2792,22 @@ export function createRequestHandler(deps) {
                     });
                     return;
                 }
-                // sessionId patch semantics: absent = preserve, null = clear,
+                // taskId patch semantics: absent = preserve, null = clear,
                 // string = replace. Zod can't distinguish omitted from explicit
                 // null after parse, so branch on raw body key.
-                const hasSessionIdKey = Object.prototype.hasOwnProperty.call(body, "sessionId");
-                let sessionIdPatch;
-                if (!hasSessionIdKey) {
-                    sessionIdPatch = undefined;
+                const hasTaskIdKey = Object.prototype.hasOwnProperty.call(body, "taskId");
+                let taskIdPatch;
+                if (!hasTaskIdKey) {
+                    taskIdPatch = undefined;
                 }
-                else if (body.sessionId === null) {
-                    sessionIdPatch = null;
+                else if (body.taskId === null) {
+                    taskIdPatch = null;
                 }
-                else if (typeof body.sessionId === "string" &&
-                    body.sessionId.length > 0) {
-                    sessionIdPatch = body.sessionId;
+                else if (typeof body.taskId === "string" && body.taskId.length > 0) {
+                    taskIdPatch = body.taskId;
                 }
                 else {
-                    sessionIdPatch = null;
+                    taskIdPatch = null;
                 }
                 if (deps.clientRegistry) {
                     // setVisibility no-ops on unknown clients; auto-register here so
@@ -2271,17 +2818,17 @@ export function createRequestHandler(deps) {
                     }
                     const { becameVisibleFor } = deps.clientRegistry.setVisibility(clientId, {
                         visible: body.visible,
-                        active: sessionIdPatch,
+                        active: taskIdPatch,
                     });
                     // Edge-triggered only: heartbeat refreshes repeat the same
-                    // (visible:true, sessionId:X) POST every 15s — firing sendClose
+                    // (visible:true, taskId:X) POST every 15s — firing sendClose
                     // on each would hammer banner recall. Only the first such
                     // transition after a change should recall stale banners.
                     if (becameVisibleFor && deps.pushService) {
                         void deps.pushService.sendClose(`sess-${becameVisibleFor}-done`);
-                        if (sessions) {
-                            for (const perm of sessions.pendingPermissions.values()) {
-                                if (perm.sessionId === becameVisibleFor) {
+                        if (tasks) {
+                            for (const perm of tasks.pendingPermissions.values()) {
+                                if (perm.taskId === becameVisibleFor) {
                                     void deps.pushService.sendClose(`sess-${becameVisibleFor}-perm-${perm.requestId}`);
                                 }
                             }