@miphamai/cli 0.85.4 → 0.85.6

package/src/core/permission-classifier.ts

@@ -57,15 +57,27 @@ import type { PermissionMode } from '../shared/index.ts'
 export const PROMPT_VERSION = 'mipham-auto-classifier/1'
 
 /**
- * Milliseconds before a ruling is abandoned. Same bound as
- * `self-critique.ts:52`, which is the only measured precedent in this repo.
+ * Milliseconds before a ruling is abandoned.
+ *
+ * This used to be declared as "same bound as `self-critique.ts`" — that pairing
+ * is gone, and deliberately not restored in either direction. The two are both
+ * secondary model calls, but they fail in *opposite* directions: `self-critique`
+ * fails **open** (a timeout ⇒ `null` ⇒ the tool runs), so its budget is bounded
+ * by "how often do we want the critique to actually happen"; this one fails
+ * **closed**, so its budget is bounded by "how long may a legitimate call be
+ * refused for". A budget derived from the fail-open side would be a budget
+ * derived from the wrong question.
  *
  * A tighter bound was considered (it is on the gated path, so every ruled call
  * costs the user the full wait) and rejected: with a fail-closed default, a
  * timeout is indistinguishable from a denial to the user, so shrinking this
- * trades "slow" for "auto mode intermittently refuses legitimate work" — and
- * nobody has measured where the real latency distribution sits. Making it
- * configurable is the right fix when someone does.
+ * trades "slow" for "auto mode intermittently refuses legitimate work" — and the
+ * classifier's own latency distribution still has not been measured. (A sibling
+ * measurement does now exist — `self-critique`'s, median 3.95s over 30 real
+ * calls — and it is a reason to *distrust* this 2s, not a reading that may be
+ * substituted for one.) Making it configurable, or re-basing it, needs that
+ * measurement first; the prompts, the target model and the output shape all
+ * differ from the sibling.
  */
 export const DEFAULT_CLASSIFIER_TIMEOUT_MS = 2000
 

package/src/core/permission-rules.ts

@@ -362,7 +362,7 @@ function extractSubstitutions(command: string): string[] {
  * REPORTTIME/REPORTMEMORY/DIRSTACKSIZE assignments immediately — and
  * `bash -c 'rm -rf /'`. Over-matching is the safe direction for a deny rule.
  */
-function flattenCommand(command: string, depth = 0): string[] {
+export function flattenCommand(command: string, depth = 0): string[] {
   const out: string[] = []
   for (const seg of splitShellSegments(command)) {
     out.push(seg)

package/src/core/permission.ts

@@ -7,6 +7,8 @@ import type {
 } from '../shared/index.ts'
 import type { PermissionRuleEntry } from '../shared/index.ts'
 import { matchBashRule, compileRule } from './permission-rules'
+import { detectDangerousRm } from '../security/dangerous-rm'
+import type { DangerousRm } from '../security/dangerous-rm'
 import {
   loadPermissionConfig,
   nextMode,
@@ -123,6 +125,7 @@ export type PermissionDenialReason =
   | 'tool-default' // tool.permission === 'ask'
   | 'system-default' // no rule, no tool permission → fallback ask
   | 'classifier-deny' // `auto` mode's classifier ruled against the call
+  | 'dangerous-rm' // recursive rm whose target is not a path in the command text
 
 /**
  * Which denial reasons `auto` mode's classifier is allowed to rule on — an
@@ -138,6 +141,11 @@ export type PermissionDenialReason =
  * `legacy-rule` is absent for the same reason as the rules: it is an explicit
  * per-tool decision from `setRule()`. `classifier-deny` is absent because it is not
  * a *static* reason at all — `explainDenial()` never returns it.
+ *
+ * `dangerous-rm` is absent because a classifier cannot be *asked* the question this
+ * reason answers. Every other reason here is "the mode was not sure, let a second
+ * opinion decide"; this one is "the command does not say what it will delete", and
+ * a second opinion reading the same command is reading the same missing text.
  */
 const CLASSIFIABLE: ReadonlySet<PermissionDenialReason> = new Set<PermissionDenialReason>([
   'mode-baseline',
@@ -463,6 +471,21 @@ export class PermissionSystem {
       return 'ask' // absent tool → safest default
     }
 
+    // ── A recursive `rm` whose target is not a path written in the command ──
+    // First, and deliberately **uncached**. Every other branch below reasons about
+    // the command's text; this is the one case where the text does not name what
+    // gets deleted, so it has to sit ahead of the allow rules and ahead of every
+    // mode baseline (`auto`, `bypassPermissions`) rather than inside them.
+    //
+    // Not cached because its answer depends on the environment opt-out, and the
+    // cache is keyed on tool+input alone. Caching here would mean an opt-out set
+    // before launch could never be observed being *un*set — the decision would
+    // outlive the input that produced it. Re-running the string check on each Bash
+    // call is cheaper than a cache that can contradict its own inputs.
+    if (this.dangerousRm(tool, input)) {
+      return 'ask'
+    }
+
     // ── Cache lookup (P2): reuse decision for same tool+mode+input ──
     const cacheKey = this.cacheKey(tool, input)
     if (this.cacheMode === this.mode) {
@@ -551,7 +574,7 @@ export class PermissionSystem {
   explainDenial(
     tool: ToolDefinition,
     input: Record<string, unknown>,
-  ): { reason: PermissionDenialReason; rulePattern?: string } {
+  ): { reason: PermissionDenialReason; rulePattern?: string; target?: string } {
     for (const rule of this.denyRules) {
       if (this.ruleMatches(rule, tool, input)) {
         return { reason: 'deny-rule', rulePattern: rule.pattern }
@@ -562,6 +585,10 @@ export class PermissionSystem {
         return { reason: 'ask-rule', rulePattern: rule.pattern }
       }
     }
+    const dangerous = this.dangerousRm(tool, input)
+    if (dangerous) {
+      return { reason: 'dangerous-rm', target: dangerous.target }
+    }
     if (this.legacyRules.has(tool.name)) {
       return { reason: 'legacy-rule' }
     }
@@ -583,6 +610,28 @@ export class PermissionSystem {
     return tool.name + '|' + JSON.stringify(input, Object.keys(input).sort())
   }
 
+  /**
+   * A recursive `rm` whose target is not a path written in the command.
+   *
+   * Only the Bash tool: the question is about a *shell command line*, and a tool
+   * that merely happens to take a `command` parameter is not making a claim about
+   * what it will delete.
+   *
+   * The escape hatch is read from the **environment**, not from tool parameters.
+   * That is the difference between an operator switch and a model switch: a
+   * parameter the call can set is a guard the call can turn off, and
+   * `dangerouslyDisableSandbox` already shows how that ends. Read at call time
+   * rather than captured at construction so that a process which sets it before
+   * its first matching call gets the documented behaviour.
+   */
+  private dangerousRm(tool: ToolDefinition, input: Record<string, unknown>): DangerousRm | null {
+    if (tool.name !== 'Bash') return null
+    if (process.env.MIPHAM_DISABLE_DANGEROUS_RM_PROMPT === '1') return null
+    const command = input.command
+    if (typeof command !== 'string') return null
+    return detectDangerousRm(command)
+  }
+
   /**
    * Resolve a call to a decision, consulting `auto` mode's classifier when — and
    * only when — the static chain answered `'ask'` for a reason a classifier is

package/src/core/rule-engine.ts

@@ -18,6 +18,23 @@ export interface ToolRule {
   enabled: boolean
 }
 
+/**
+ * 一条**能真正生效**的规则必须自带 `match`/`fix` —— 而这两个是函数，落不了盘。
+ * 判据放在这里而不是内联，是为了让「载回来的规则必须是能用的规则」只有一处定义。
+ */
+function isUsableRule(candidate: unknown): candidate is ToolRule {
+  const r = candidate as Partial<ToolRule> | null
+  return (
+    !!r &&
+    typeof r === 'object' &&
+    typeof r.id === 'string' &&
+    r.id.length > 0 &&
+    typeof r.toolName === 'string' &&
+    typeof r.match === 'function' &&
+    typeof r.fix === 'function'
+  )
+}
+
 const BUILTIN_RULES: ToolRule[] = [
   {
     id: 'rule-timeout-bash-heavy',
@@ -168,9 +185,17 @@ export class ExperienceRuleEngine {
   load(): void {
     if (!existsSync(this.storePath)) return
     try {
-      const raw = JSON.parse(readFileSync(this.storePath, 'utf-8')) as ToolRule[]
+      const parsed: unknown = JSON.parse(readFileSync(this.storePath, 'utf-8'))
+      // 形状门 —— 这一格的门比别处严，因为**这个 store 载不动一条可用的规则**：
+      // `ToolRule.match`/`fix` 是函数，`JSON.stringify` 必然丢，所以 `persist()` 写出去的
+      // 形状里不可能带回来它们。旧读法把这种条目照收，`getActiveRules()` 再把它报成
+      // active（`/rules` 面板跟着说它是活的），而 `intercept()` 里 `rule.match` 不存在
+      // → 抛 → 被那个 `try/catch` 吞成**静默惰性**。列出来是活的、实际永不触发 ——
+      // 正是本仓库反复收的那种账。收不进就是收不进：不校验形状 = 报一份假的活跃清单。
+      if (!Array.isArray(parsed)) return
       const reservedIds = new Set([...BUILTIN_RULES, ...MANAGED_RULES].map((r) => r.id))
-      for (const rule of raw) {
+      for (const rule of parsed) {
+        if (!isUsableRule(rule)) continue
         // Reject if a builtin/managed rule with the same ID exists (source rules always win)
         if (reservedIds.has(rule.id)) continue
         this.rules.push(rule)

package/src/core/self-critique.ts

@@ -3,8 +3,11 @@
  *
  * Inspired by Anthropic's RLAIF (Reinforcement Learning from AI Feedback):
  * instead of relying on human feedback loops, the AI critiques its own
- * tool calls before execution. A fast model (Flash / Qwen2.5-1.5B) performs
- * a lightweight safety & correctness check with <200ms latency.
+ * tool calls before execution. A fast model performs a lightweight safety &
+ * correctness check — but "lightweight" is about the *prompt*, not the clock:
+ * it is a full model round-trip, measured at a median ≈4s on the configured
+ * provider (see `DEFAULT_SELF_CRITIQUE_CONFIG.timeoutMs`), not the sub-200ms
+ * this comment used to claim.
  *
  * Architecture:
  *   Model generates tool call
@@ -58,7 +61,16 @@ export const DEFAULT_SELF_CRITIQUE_CONFIG: SelfCritiqueConfig = {
   enabled: false, // Opt-in by default — user enables via /crsi critique on
   threshold: 0.6,
   targetTools: ['Bash', 'Write', 'Edit', 'Agent'],
-  timeoutMs: 2000,
+  // Measured, not chosen: 30 real critiques against the configured provider
+  // (`findFastestModel` → `deepseek-v4-flash`; default model is the slower
+  // `-pro`) took min 1.85s / median 3.95s / max 17.9s, and **28 of 30 exceeded
+  // 2s** — the value this replaced. At 2s the budget would have skipped 93% of
+  // critiques, and since `critique()` fails *open* (null ⇒ the tool runs
+  // unreviewed) that failure is silent: `/crsi critique` would look enabled and
+  // do nothing. 15s keeps 90% (27/30) while still bounding a gated tool call to
+  // well under the provider's 90s stream-idle backstop. One model, one day —
+  // re-measure if the critique model changes.
+  timeoutMs: 15_000,
 }
 
 // ── Prompt Templates ──

package/src/core/session-log.ts

@@ -118,6 +118,66 @@ export function deriveMessages(events: SessionEvent[]): Message[] {
 
 const LOG_DIR = miphamHome('sessions')
 
+/** 补上的那条结果的正文：说明事情本身，并给出下一步，而不是只报一个状态。 */
+function interruptedCallNotice(): string {
+  return (
+    `This tool call was in flight when the session ended, so its outcome is unknown — ` +
+    `the result was never recorded.\n` +
+    `Do not assume it succeeded or failed: check the actual state (read the files, ` +
+    `re-run the command) and re-issue the call if it did not take effect.`
+  )
+}
+
+/**
+ * 恢复会话时收尾：给日志里**没有结果**的调用补一条「结果未知」的 `tool/result`
+ * 事件，返回补了几条。
+ *
+ * 为什么非补不可：助手消息里挂着 `tool_calls` 而没有任何结果回应，OpenAI / DeepSeek
+ * 会整条请求拒收，Anthropic 还要求 `tool_result` 紧跟在那条 `tool_use` 之后。于是
+ * 「这次的调用没收尾」在用户那里表现成「恢复之后说的第一句话就报协议错」。
+ *
+ * 这个形状**是从盘上读来的，不是引擎写出来的**：`engine.ts` 先落调用消息、紧接着
+ * 落结果（同一同步块），而这批事件只在退出时整份刷盘 —— 跑到一半被杀根本留不下那条
+ * 调用。够得着的是**读侧**：`save()` 逐行追加，`open()` 把读不动的行静默丢掉（半截
+ * JSON 过不了 `JSON.parse`），于是写盘写到一半被打断时，末尾那条结果被丢、调用留在
+ * 盘上。修在恢复这一步，是因为读侧的入口只有这一个（`ContextManager.restoreLog`）。
+ *
+ * 为什么补成**事件**而不是往投影里塞一条消息：本仓库的不变量是「模型看得见的必须已
+ * 记录」（`assertModelVisible`），凭空出现的消息正好违反它；`messageToEvents` /
+ * `deriveMessages` 的字节级互逆也不能被动过。补事件两边都成立 —— 模型**看得见那次
+ * 调用**（它本来就在历史里），也知道**结果未知**，于是它先去查证，而不是当成没发生过、
+ * 也不是猜成功或失败。
+ *
+ * 幂等：已经有结果的 id 不会再补第二条。
+ */
+export function closeInterruptedToolCalls(log: SessionLog): number {
+  const events = log.events()
+  const answered = new Set<string>()
+  for (const e of events) {
+    if (e.type === 'tool/result') answered.add(e.id)
+    else if (e.type === 'user/message' && Array.isArray(e.message.content)) {
+      // 结果也可能整条嵌在 user/message 里（多块消息不拆事件），一样算「已回答」。
+      for (const b of e.message.content) {
+        if (b.type === 'tool_result') answered.add(b.tool_use_id)
+      }
+    }
+  }
+
+  const pending: string[] = []
+  for (const e of events) {
+    if (e.type === 'tool/call' && !answered.has(e.id)) pending.push(e.id)
+  }
+
+  const at = Date.now()
+  for (const id of pending) {
+    // 失败结果在投影里被读成 `error || content`（见 `deriveMessages`），两个字段同写；
+    // 这一段与 `deleted-cwd` 那次是同一个教训。
+    const content = interruptedCallNotice()
+    log.append({ type: 'tool/result', at, id, result: { success: false, content, error: content } })
+  }
+  return pending.length
+}
+
 /** 一次性告警：日志路径不是普通文件（写不进去），每个进程只说一句。 */
 let warnedNotAppendable = false
 

package/src/daemon/index.ts

@@ -13,7 +13,6 @@ import type { Server } from 'bun'
 import { DaemonDatabase } from './database'
 import { SessionManager } from './session-manager'
 import { AgentManager } from './agent-manager'
-import { MessageBus } from './message-bus'
 import { GoalManager } from './goal-manager'
 import { ScheduleManager } from './schedule-manager'
 import { createServer } from './server'
@@ -118,7 +117,7 @@ export function getPort(): number {
  * 1. Ensures ~/.mipham exists (mode 0o700)
  * 2. Loads or creates the auth token
  * 3. Initializes the SQLite database and runs JSONL migration on first start
- * 4. Creates a SessionManager, AgentManager, and MessageBus
+ * 4. Creates a SessionManager and AgentManager
  * 5. Starts the HTTP server on an available port
  * 6. Writes PID and port files to disk
  *
@@ -152,9 +151,8 @@ export async function startDaemon(): Promise<{ port: number; token: string }> {
   const pool = new WorkerPool(db)
   activePool = pool
 
-  // Create agent manager and message bus (Phase 3)
+  // Create agent manager (Phase 3)
   const agentManager = new AgentManager(db)
-  const messageBus = new MessageBus()
 
   // Create goal manager and schedule manager (Phase 4)
   const goalManager = new GoalManager(db)
@@ -236,7 +234,6 @@ export async function startDaemon(): Promise<{ port: number; token: string }> {
     port,
     hostname,
     agentManager,
-    messageBus,
     goalManager,
     scheduleManager,
     rateLimiter,

package/src/daemon/launch.ts

@@ -12,7 +12,7 @@
  */
 
 import { spawn, type SpawnOptions } from 'node:child_process'
-import { closeSync, mkdirSync, openSync, readFileSync, statSync } from 'node:fs'
+import { closeSync, mkdirSync, openSync, readFileSync, renameSync, statSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
 import { miphamHome } from '../core/paths.ts'
 
@@ -141,6 +141,13 @@ const READY_TIMEOUT_MS = 10_000
 const POLL_INTERVAL_MS = 100
 /** How long `restart` waits for the *old* daemon to go before refusing. */
 const OLD_DAEMON_EXIT_TIMEOUT_MS = 10_000
+/**
+ * Bound on the daemon log, enforced by `rotateLogIfLarge`. Two files at this size
+ * are invisible on any disk it will sit on, while the reader only ever wants a tail
+ * (`tailLog` takes the last 800 bytes) — so what the bound has to preserve is not
+ * volume but *the previous generation* of a start that keeps failing.
+ */
+export const MAX_LOG_BYTES = 5 * 1024 * 1024
 
 async function defaultGetStatus(): Promise<DaemonStatusLike | null> {
   const { getDaemonStatus } = await import('./index')
@@ -157,6 +164,45 @@ function tailLog(logPath: string, maxBytes = 800): string {
   }
 }
 
+/**
+ * Bound the log the daemon is about to append to.
+ *
+ * Called before the child is spawned, which is the only moment nothing holds it:
+ * `startDetachedDaemon` returns early when a daemon is already up, so by here its
+ * pid file was gone. (A daemon that died without unlinking the pid file could still
+ * hold the old inode — its lines then land in the renamed file, which loses nothing
+ * and corrupts nothing.)
+ *
+ * **Rename, not truncate.** Either bounds the file, and the reader only wants a tail
+ * — but the case this exists for is a start that keeps failing, and there the
+ * previous generation *is* the evidence. Keeping exactly one bounds the sink at two
+ * files; `renameSync` overwrites the target, so that is also the oldest generation's
+ * cleanup. There is never a `.2`.
+ *
+ * Failing to bound is never fatal: a daemon that refuses to start because its log
+ * could not be rotated trades a slow hazard for an immediate one. And an unreadable
+ * size means the append below is about to fail loudly anyway, so `return` is not a
+ * silent degradation of anything that was working.
+ */
+export function rotateLogIfLarge(logPath: string, maxBytes: number = MAX_LOG_BYTES): void {
+  let size: number
+  try {
+    size = statSync(logPath).size
+  } catch {
+    return // no log yet (every first start)
+  }
+  if (size < maxBytes) return
+  try {
+    renameSync(logPath, `${logPath}.1`)
+  } catch (err) {
+    // Printed rather than thrown, but never swallowed: a bound that switched itself
+    // off in silence is the defect class this whole file is about.
+    process.stderr.write(
+      `⚠️  daemon 日志轮转失败，本次仍按无上限追加: ${err instanceof Error ? err.message : String(err)}\n`,
+    )
+  }
+}
+
 /**
  * Start the daemon detached and *wait until it is actually up*.
  *
@@ -177,6 +223,7 @@ export async function startDetachedDaemon(
 
   const plan = planDaemonSpawn()
   mkdirSync(dirname(plan.logPath), { recursive: true, mode: 0o700 })
+  rotateLogIfLarge(plan.logPath)
 
   let spawnError: Error | null = null
   let exitCode: number | null = null
@@ -217,9 +264,29 @@ export async function startDetachedDaemon(
       }
     }
   }
+  // The deadline is a prediction, not a fact. Probe once more before acting on
+  // it: a child that became ready inside the last poll interval is up, and
+  // reporting failure for it — then killing it — would be this module's own
+  // "success with no daemon behind it" defect wearing the opposite sign.
+  const late = await getStatus()
+  if (late) return { ok: true, pid: late.pid, port: late.port }
+
+  // Reclaim the child. Leaving it running makes a failed start a half-truth the
+  // caller cannot act on: `getStatus()` is a pid file plus `kill(pid, 0)`, so the
+  // next `daemon start` finds the abandoned process and reports *success* with
+  // its pid. SIGKILL, not SIGTERM: this process is by definition not ready, so
+  // there is no session to drain — and a child that has already ignored the
+  // deadline is exactly the one that may ignore a polite signal too.
+  const reclaimed = child.kill('SIGKILL')
   return {
     ok: false,
-    reason: `daemon did not become ready within ${opts.timeoutMs ?? READY_TIMEOUT_MS}ms (log: ${plan.logPath})`,
+    reason:
+      `daemon did not become ready within ${opts.timeoutMs ?? READY_TIMEOUT_MS}ms` +
+      // Claim the kill only when it happened: `kill()` also returns false for a
+      // child that exited on its own between the probe and here, and that is not
+      // something to report as "reclaimed".
+      (reclaimed ? '; the child it spawned was killed so no daemon is left running' : '') +
+      ` (log: ${plan.logPath})`,
   }
 }
 

package/src/daemon/server.ts

@@ -3,7 +3,6 @@ import type { Server, ServerWebSocket } from 'bun'
 import type { DaemonDatabase } from './database'
 import type { SessionManager } from './session-manager'
 import type { AgentManager } from './agent-manager'
-import type { MessageBus } from './message-bus'
 import type { DaemonGoal, AgentKind } from './types'
 import type { GoalManager } from './goal-manager'
 import type { ScheduleManager } from './schedule-manager'
@@ -49,7 +48,6 @@ interface ServerConfig {
   port: number
   hostname: string
   agentManager: AgentManager
-  messageBus: MessageBus
   goalManager: GoalManager
   scheduleManager: ScheduleManager
   rateLimiter: RateLimiter
@@ -156,7 +154,6 @@ export function createServer(config: ServerConfig): Server<WsData> {
     port,
     hostname,
     agentManager,
-    messageBus,
     goalManager,
     scheduleManager,
     rateLimiter,
@@ -192,15 +189,8 @@ export function createServer(config: ServerConfig): Server<WsData> {
     }
   }
 
-  // ── Agent lifecycle → WebSocket broadcast + MessageBus registration ──
+  // ── Agent lifecycle → WebSocket broadcast ──
   agentManager.onLifecycleEvent((event) => {
-    // Register / unregister in the message bus for broadcastToSession routing
-    if (event.type === 'created') {
-      messageBus.registerAgent(event.agent.sessionId, event.agent.id)
-    } else if (event.type === 'completed' || event.type === 'failed') {
-      messageBus.unregisterAgent(event.agent.id)
-    }
-
     // Broadcast lifecycle events to all WebSocket clients in the agent's session
     broadcast(event.agent.sessionId, {
       type: 'agent_lifecycle',
@@ -670,8 +660,23 @@ export function createServer(config: ServerConfig): Server<WsData> {
           return json({ ok: false, error: 'Agent not found' }, { status: 404 })
         }
 
-        messageBus.send('user', agentId, content)
-        return json({ ok: true }, { status: 202 })
+        // 从前这里 `messageBus.send(...)` 后回 **202 + `{ok:true}`** —— 一张兑现不了的收条。
+        // daemon 侧**不存在 agent 执行循环**（`AgentManager` 纯持久化，`src/daemon/*.ts` 里
+        // `SubAgent`/`spawn` 零命中），所以进程内没有任何东西会去读这条消息；而真正在用的
+        // 那条总线（`src/agent/message-bus.ts`）由子代理 / workflow 用 `bg-…` 那套 id 投递，
+        // 与这里的 `agent-<uuid8>` **不同一个 id 空间**，改投它也找不到人。
+        // 202 在这里是有害的：调用方据此认为话已送达，于是不再重试、也不再报错。
+        // 报 501 并给出替代路径 —— 只说「不支持」会让调用方反复重试同一件事。
+        return json(
+          {
+            ok: false,
+            error:
+              'Agent messaging is not implemented on the daemon: this build has no agent ' +
+              'execution loop, so nothing would receive the message. Use ' +
+              'POST /api/v1/sessions/:id/prompt to send work to a session instead.',
+          },
+          { status: 501 },
+        )
       }
 
       // ── Goals (Phase 4 — service-backed) ────────────
@@ -806,7 +811,7 @@ export function createServer(config: ServerConfig): Server<WsData> {
               {
                 method: 'POST',
                 path: '/api/v1/agents/:id/message',
-                description: 'Send message to an agent',
+                description: 'Not implemented — always 501; use POST /api/v1/sessions/:id/prompt',
               },
               { method: 'GET', path: '/api/v1/goals', description: 'List goals for a session' },
               { method: 'POST', path: '/api/v1/goals', description: 'Create a goal' },