@ref0/cli 0.13.0 → 0.14.0

package/dist/main.mjs

@@ -1038,7 +1038,7 @@ const TokenDelegated = eventKind("token.delegated", Schema.Struct({
 	/** The credential this one was made under, when there is one. */
 	parent: Schema.optionalKey(CredentialRef),
 	expiresAt: Schema.optionalKey(Schema.DateTimeUtcFromMillis),
-	/** The key it's bound to, by its thumbprint, for a host grant made with one. */
+	/** The key it's bound to, by its thumbprint, for a host grant or a session's token made with one. */
 	cnf: Schema.optionalKey(KeyBinding)
 }));
 const TokenRevoked = eventKind("token.revoked", Schema.Struct({
@@ -5543,6 +5543,11 @@ Schema.Struct({
 	/** For a child session: when its parent's token expires, which the child's never outlives. */
 	notAfter: Schema.optionalKey(Schema.DateTimeUtcFromMillis),
 	/**
+	* The key the start request's proof was signed by, which the session's token is bound to: as
+	* the Worker checked the proof, never a field of the request. None for a start with no proof.
+	*/
+	cnf: Schema.optionalKey(KeyBinding),
+	/**
 	* The generations the session token pins, from the host grant that started it, or its parent;
 	* and in an organization's project, for a person's own agent, its attachment's authorization's
 	* and the agent's target generation there.
@@ -5743,6 +5748,11 @@ Schema.Struct({
 	session: SessionId,
 	pins: SessionPins,
 	expiresAt: Schema.DateTimeUtcFromMillis,
+	/**
+	* The key the session's start was signed by, which its token is bound to. A parent bound to a
+	* key is bound to this one, or the token isn't registered.
+	*/
+	cnf: Schema.optionalKey(KeyBinding),
 	cause: Schema.Struct({
 		log: ProjectId,
 		event: EventId
@@ -14750,7 +14760,10 @@ const HistoryPack = Schema.Struct({
 		first: MergeSequence,
 		last: MergeSequence
 	})),
-	/** A baseline or deepen pack: the baseline it belongs to. After a rebuild, a retired baseline's sessions still deepen from its own chain. */
+	/**
+	* A baseline, deepen or rolled-up pack: the baseline it belongs to. After a rebuild, a retired
+	* baseline's sessions still deepen from its own chain, and its rollups hold nothing of the new one's.
+	*/
 	baseline: Schema.optionalKey(GitRepositoryId),
 	/** A deepen pack: how deep its baseline reaches with it and every pack before it. */
 	depth: Schema.optionalKey(Depth),
@@ -15379,6 +15392,7 @@ Schema.Union([Schema.Struct({ found: Schema.Literal(false) }), Schema.Struct({
 	generation: AttachedSoFar
 })]);
 Context.Service()("ref0/contracts/Caller");
+Context.Service()("ref0/contracts/ProvedKey");
 /** A browser session's cookie, as `/v1` reads it. */
 const browserSession = HttpApiSecurity.apiKey({
 	in: "cookie",
@@ -15387,8 +15401,10 @@ const browserSession = HttpApiSecurity.apiKey({
 /**
 * Every endpoint's credential, checked before its handler runs: a bearer token, a token bound to
 * a key with a proof that key signed (`Authorization: DPoP` and one `DPoP` header), or a browser
-* session's cookie. A request with a cookie and a token is refused before it gets here. A client
-* that signs proofs may fail before it sends anything, when its key store doesn't sign.
+* session's cookie. A request with a cookie and a token is refused before it gets here. Its
+* handler learns who's acting, and the key its proof was signed by, if it came with one, which a
+* session's start binds the session to. A client that signs proofs may fail before it sends
+* anything, when its key store doesn't sign.
 */
 var Authorization = class extends HttpApiMiddleware.Service()("ref0/contracts/Authorization", {
 	requiredForClient: true,
@@ -15430,7 +15446,6 @@ var ApprovalSecret = class extends HttpApiMiddleware.Service()("ref0/contracts/A
 * what to change. Any other part that fails its contract is answered with Effect's empty 400.
 */
 var MachineNameRefusal = class extends HttpApiMiddleware.Service()("ref0/contracts/MachineNameRefusal", { error: CommandRefused }) {};
-Context.Service()("ref0/contracts/ProvedKey");
 /**
 * A request with no credential, signed by a key it names, such as a machine's ask to connect: one
 * `DPoP` header, a proof with no `ath`, since there's no token, checked before the request is
@@ -19303,6 +19318,21 @@ const dpopCredential = (credential) => Layer.mergeAll(HttpApiMiddleware.layerCli
 */
 const boundClient = (credential) => ref0Client(credential.origin).pipe(Effect.provide(dpopCredential(credential)));
 /**
+* A bound credential's requests made by hand, each with a path under its origin, such as a
+* command built from its endpoint's route: sent there with its token and a proof its key store
+* signs afresh for each attempt, as `boundClient` sends its own, and never anywhere else. It needs
+* the process's `ProofClock`, and its errors hold their requests, as `boundClient`'s do.
+*/
+const boundSend = (credential) => Effect.gen(function* () {
+	const http = yield* HttpClient.HttpClient;
+	const clock = yield* ProofClock;
+	const attempts = signedAttempts(credential, clock.offset);
+	return (request) => attempts({
+		request,
+		next: (signed) => http.execute(HttpClientRequest.prependUrl(signed, credential.origin))
+	});
+});
+/**
 * A request with no credential, signed by the key it names, such as a machine's ask to connect:
 * a proof its key store signs for each attempt, with no `ath`, since there's no token. Any other
 * request is sent with nothing added.
@@ -19316,7 +19346,7 @@ const keyProof = (signer) => Layer.mergeAll(HttpApiMiddleware.layerClient(KeyPro
 const provingClient = (signer) => ref0Client(signer.origin).pipe(Effect.provide(keyProof(signer)));
 //#endregion
 //#region ../sdk/src/client/request-id.ts
-const decodeRequestId$1 = Schema.decodeUnknownEffect(RequestId);
+const decodeRequestId = Schema.decodeUnknownEffect(RequestId);
 /**
 * A new delivery ID, for a request that changes something's `Idempotency-Key`: a UUIDv7 from the
 * clock and ten random bytes, so a retry sends the same one and gets the first answer.
@@ -19325,7 +19355,7 @@ const newRequestId = Effect.gen(function* () {
 	const millis = yield* Clock.currentTimeMillis;
 	const random = /* @__PURE__ */ new Uint8Array(10);
 	for (let index = 0; index < random.length; index += 1) random[index] = yield* Random.nextIntBetween(0, 255);
-	return yield* Effect.orDie(decodeRequestId$1(`request_${encodeSuffix(uuidV7(millis, random))}`));
+	return yield* Effect.orDie(decodeRequestId(`request_${encodeSuffix(uuidV7(millis, random))}`));
 });
 //#endregion
 //#region src/sha256.ts
@@ -19396,6 +19426,317 @@ var Ref0Config = class Ref0Config extends Context.Service()("ref0/cli/Ref0Config
 	})).pipe(Layer.provide(NodeServices.layer));
 };
 //#endregion
+//#region src/keychain.ts
+/**
+* The machine's keychain, where the CLI keeps what lets it act: the host grant `ref0 connect`
+* makes, and a session's token. Never a file. On macOS through `security`, on Linux through
+* `secret-tool`, under an origin-specific `ref0/<origin>` service, by account. A secret goes in through stdin, never as
+* an argument, since any process on the machine can read another's arguments.
+*/
+var KeychainError = class extends Schema.TaggedError()("KeychainError", {
+	nextStep: Schema.String,
+	/** The keychain answered, with an item ref0 can't read, rather than not answering. */
+	unreadable: Schema.optionalKey(Schema.Literal(true))
+}) {};
+/**
+* The keychain under one service. Each API origin has its own, `ref0/<origin>`; 0.5.0 kept its
+* grants under `ref0`, which only `ref0 connect` reads, to replace and delete them.
+*/
+const keychainIn = Effect.fnUntraced(function* (service) {
+	const crypto = yield* Crypto.Crypto;
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const macOS = (yield* spawner.string(ChildProcess.make("uname", ["-s"])).pipe(Effect.orElseSucceed(() => ""))).trim() === "Darwin";
+	const unavailable = new KeychainError({ nextStep: macOS ? "The keychain didn’t answer. Unlock it, and try again." : "The keychain didn’t answer. Unlock the keychain or start a secret service, and try again." });
+	const missing = new KeychainError({ nextStep: "The keychain didn’t answer: ref0 needs `secret-tool`, from libsecret. Install `secret-tool` with `sudo apt install libsecret-tools` on Debian or Ubuntu, `sudo dnf install libsecret` on Fedora or `sudo pacman -S libsecret` on Arch." });
+	const run = (command, args, stdin) => Effect.scoped(Effect.gen(function* () {
+		const handle = yield* spawner.spawn(ChildProcess.make(command, args, { stdin: Stream.make(new TextEncoder().encode(stdin)) })).pipe(Effect.mapError((error) => !macOS && Predicate.isTagged(error.reason, "NotFound") ? missing : unavailable));
+		const [output, complaint] = yield* Effect.all([handle.stdout.pipe(Stream.decodeText(), Stream.mkString), handle.stderr.pipe(Stream.decodeText(), Stream.mkString)], { concurrency: "unbounded" });
+		const code = yield* handle.exitCode;
+		return {
+			output: output.trim(),
+			complaint: complaint.trim(),
+			code,
+			succeeded: code === ChildProcessSpawner.ExitCode(0)
+		};
+	})).pipe(Effect.catchTag("PlatformError", () => Effect.fail(unavailable)));
+	const get = Effect.fn("Keychain.get")(function* (account) {
+		const found = macOS ? yield* run("security", [
+			"find-generic-password",
+			"-s",
+			service,
+			"-a",
+			account,
+			"-w"
+		], "") : yield* run("secret-tool", [
+			"lookup",
+			"service",
+			service,
+			"account",
+			account
+		], "");
+		if (found.succeeded) return found.output.length > 0 ? Option.some(Redacted.make(found.output)) : Option.none();
+		if (macOS) {
+			if (found.code === ChildProcessSpawner.ExitCode(44)) return Option.none();
+			return yield* unavailable;
+		}
+		if (found.code !== ChildProcessSpawner.ExitCode(1) || found.complaint.length > 0) return yield* unavailable;
+		const listed = yield* run("secret-tool", [
+			"search",
+			"--all",
+			"service",
+			service,
+			"account",
+			account
+		], "");
+		if (listed.output.length > 0 || listed.complaint.length > 0) return yield* unavailable;
+		return Option.none();
+	});
+	const set = Effect.fn("Keychain.set")(function* (account, secret) {
+		const quote = (text) => `"${text.replace(/[\\"]/g, "\\$&")}"`;
+		const value = Redacted.value(secret);
+		if (macOS && /[\r\n\0]/.test(account + value)) return yield* unavailable;
+		const input = macOS ? `add-generic-password -U -s ${quote(service)} -a ${quote(account)} -w ${quote(value)}\n` : value;
+		if (macOS && new TextEncoder().encode(input).length >= 4096) return yield* unavailable;
+		if (!(macOS ? yield* run("security", ["-i"], input) : yield* run("secret-tool", [
+			"store",
+			"--label",
+			`ref0 ${account}`,
+			"service",
+			service,
+			"account",
+			account
+		], Redacted.value(secret))).succeeded) return yield* unavailable;
+	});
+	const remove = Effect.fn("Keychain.remove")(function* (account) {
+		if (!(yield* macOS ? run("security", [
+			"delete-generic-password",
+			"-s",
+			service,
+			"-a",
+			account
+		], "") : run("secret-tool", [
+			"clear",
+			"service",
+			service,
+			"account",
+			account
+		], "")).succeeded) return yield* unavailable;
+	});
+	const random = crypto.randomUUIDv4.pipe(Effect.mapError(() => unavailable));
+	return {
+		probe: Effect.gen(function* () {
+			const account = `connect-probe/${yield* random}`;
+			const value = Redacted.make(yield* random);
+			yield* Effect.gen(function* () {
+				yield* set(account, value);
+				const kept = yield* get(account);
+				if (Option.isNone(kept) || Redacted.value(kept.value) !== Redacted.value(value)) return yield* unavailable;
+				yield* remove(account);
+			}).pipe(Effect.catch((error) => remove(account).pipe(Effect.ignore, Effect.andThen(Effect.fail(error)))));
+		}).pipe(Effect.timeoutOrElse({
+			duration: Duration.minutes(1),
+			orElse: () => Effect.fail(unavailable)
+		})),
+		get,
+		set,
+		remove
+	};
+});
+var Keychain = class Keychain extends Context.Service()("ref0/cli/Keychain") {
+	static layer = Layer.effect(Keychain, Effect.flatMap(Ref0Config, (config) => Effect.map(keychainIn(`ref0/${originKey(config.api)}`), Keychain.of)));
+};
+//#endregion
+//#region src/machine-key.ts
+/**
+* This machine's key, which signs a proof for its ask to connect and for each request a host
+* grant makes: one ES256 key for each OS account and origin, in the origin's keychain service
+* under account `machine-key`, as `{ store: 'software', jwk }`. `ref0 connect` makes it, under its
+* lock, only when the keychain says it holds none, and nothing else makes one. A process reads it
+* once and keeps it, since each read is a `security` or `secret-tool` process. Its private half
+* goes to the keychain on stdin and into a Web Crypto key that can't be exported, and nowhere
+* else: no argument, environment, config, error or log.
+*/
+/** The keychain account the key is kept under. */
+const account = "machine-key";
+/** How long reading and importing the key may take for a request, and signing with it. */
+const deadline = Duration.seconds(3);
+/**
+* How long `ref0 connect` may wait on the keychain to read, make and keep the key, as its probe
+* may: a prompt to unlock the keychain can take that long.
+*/
+const connectDeadline = Duration.minutes(1);
+/** A P-256 coordinate or private scalar: 32 bytes, in base64url. */
+const Scalar = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/));
+/** A P-256 private key as a JWK: its public point, and its private scalar `d`. */
+const PrivateJwk = Schema.Struct({
+	kty: Schema.Literal("EC"),
+	crv: Schema.Literal("P-256"),
+	x: Scalar,
+	y: Scalar,
+	d: Scalar
+});
+/** The keychain's record: which store keeps the key, and the key. A hardware store keeps its own. */
+const KeptKey = Schema.Struct({
+	store: Schema.Literal("software"),
+	jwk: PrivateJwk
+});
+const decodeKept$3 = Schema.decodeUnknownOption(Schema.fromJsonString(KeptKey));
+const encodeKept$3 = Schema.encodeSync(Schema.fromJsonString(KeptKey));
+const decodePrivateJwk = Schema.decodeUnknownEffect(PrivateJwk);
+const decodePublicJwk = Schema.decodeSync(PublicJwk);
+const ecdsa = {
+	name: "ECDSA",
+	namedCurve: "P-256"
+};
+const es256 = {
+	name: "ECDSA",
+	hash: "SHA-256"
+};
+/** What a key signs to prove it signs for its public half. */
+const proved = new TextEncoder().encode("ref0 machine key");
+const timedOut = new KeychainError({ nextStep: "The keychain didn’t answer in time. Check that it’s unlocked, and try again." });
+const unreadable$1 = new KeychainError({ nextStep: "ref0 can’t read this machine’s key in the keychain, so it signs nothing and makes no other. Update ref0, which may have kept it in a newer form, or repair the keychain, and try again." });
+const notKept = new KeychainError({ nextStep: "The keychain didn’t keep this machine’s key. Check that it’s unlocked, then run ref0 connect again." });
+const windows = new KeychainError({ nextStep: "ref0 connect doesn’t run on Windows yet: it keeps this machine’s key in the macOS keychain or a Linux secret service. Run it in WSL instead." });
+const didNotSign = new KeyStoreUnavailable({ nextStep: "This machine’s key didn’t sign in time. Try again." });
+/** A fresh key's private JWK, with only the members the record keeps. */
+const freshKey = Effect.promise(async () => {
+	const pair = await crypto.subtle.generateKey(ecdsa, true, ["sign", "verify"]);
+	return await crypto.subtle.exportKey("jwk", pair.privateKey);
+}).pipe(Effect.flatMap(({ kty, crv, x, y, d }) => decodePrivateJwk({
+	kty,
+	crv,
+	x,
+	y,
+	d
+})), Effect.orDie);
+/**
+* A key store over a private JWK: imported once, as a key that can't be exported, and proved to
+* sign for its public half, or it's no key to bind anything to.
+*/
+const softwareStore = Effect.fnUntraced(function* (jwk) {
+	const publicKey = decodePublicJwk({
+		kty: jwk.kty,
+		crv: jwk.crv,
+		x: jwk.x,
+		y: jwk.y
+	});
+	const signs = yield* Effect.tryPromise({
+		try: async () => {
+			const [signing, verifying] = await Promise.all([crypto.subtle.importKey("jwk", jwk, ecdsa, false, ["sign"]), crypto.subtle.importKey("jwk", publicKey, ecdsa, false, ["verify"])]);
+			const signature = await crypto.subtle.sign(es256, signing, proved);
+			return await crypto.subtle.verify(es256, verifying, signature, proved) ? signing : void 0;
+		},
+		catch: () => unreadable$1
+	});
+	if (signs === void 0) return yield* unreadable$1;
+	const sign = (bytes) => Effect.tryPromise({
+		try: async () => new Uint8Array(await crypto.subtle.sign(es256, signs, new Uint8Array(bytes))),
+		catch: () => didNotSign
+	}).pipe(Effect.timeoutOrElse({
+		duration: deadline,
+		orElse: () => Effect.fail(didNotSign)
+	}));
+	return {
+		store: {
+			publicKey,
+			sign
+		},
+		binding: { jkt: yield* keyThumbprint(publicKey) }
+	};
+});
+/**
+* This machine's key, read once for the process. `supported` refuses a platform with no keychain
+* that keeps it, such as Windows, before `ref0 connect` asks the keychain anything. `ensure` is
+* `ref0 connect`'s: the key the keychain holds, or one made and kept now if it says it holds none,
+* under the connect lock, once the keychain is probed. `boundTo` is for a kept
+* credential bound to a key: the key it names, read again once if the one held is another, such
+* as one replaced since, or `InvalidDpopProof`, without sending anything, when the keychain has
+* none or another. Neither makes a key from an item it can't read.
+*/
+var MachineKey = class MachineKey extends Context.Service()("ref0/cli/MachineKey") {
+	/** On the platform Node names, such as `win32`, where no keychain keeps the key yet. */
+	static layerOn = (platform) => Layer.effect(MachineKey, Effect.gen(function* () {
+		const keychain = yield* Keychain;
+		const held = yield* Ref.make(Option.none());
+		const reading = yield* Semaphore.make(1);
+		const read = Effect.gen(function* () {
+			const kept = yield* keychain.get(account);
+			if (Option.isNone(kept)) return Option.none();
+			const record = decodeKept$3(Redacted.value(kept.value));
+			if (Option.isNone(record)) return yield* unreadable$1;
+			const key = yield* softwareStore(record.value.jwk);
+			yield* Ref.set(held, Option.some(key));
+			return Option.some(key);
+		});
+		const made = Effect.gen(function* () {
+			const jwk = yield* freshKey;
+			yield* keychain.set(account, Redacted.make(encodeKept$3({
+				store: "software",
+				jwk
+			})));
+			const back = yield* read;
+			const same = Option.exists(back, (key) => key.store.publicKey.x === jwk.x && key.store.publicKey.y === jwk.y);
+			if (Option.isNone(back) || !same) return yield* notKept;
+			return back.value;
+		});
+		const supported = platform === "win32" ? Effect.fail(windows) : Effect.void;
+		const ensure = Effect.gen(function* () {
+			const kept = yield* read;
+			return Option.isSome(kept) ? kept.value : yield* made;
+		}).pipe(Effect.timeoutOrElse({
+			duration: connectDeadline,
+			orElse: () => Effect.fail(timedOut)
+		}), reading.withPermits(1));
+		const boundTo = (binding) => Effect.gen(function* () {
+			const now = yield* Ref.get(held);
+			if (Option.isSome(now) && now.value.binding.jkt === binding.jkt) return now.value.store;
+			const kept = yield* read.pipe(Effect.timeoutOrElse({
+				duration: deadline,
+				orElse: () => Effect.fail(timedOut)
+			}));
+			if (Option.isSome(kept) && kept.value.binding.jkt === binding.jkt) return kept.value.store;
+			return yield* invalidDpopProof;
+		}).pipe(reading.withPermits(1));
+		return MachineKey.of({
+			supported,
+			ensure,
+			boundTo
+		});
+	}));
+	static layer = MachineKey.layerOn(process.platform);
+};
+//#endregion
+//#region src/kept-client.ts
+const decodeProofOrigin$1 = Schema.decodeUnknownEffect(ProofOrigin);
+/** A bound credential: its token, at ref0's origin, with the key it's bound to, read once. */
+const boundTo = Effect.fnUntraced(function* (kept, cnf) {
+	const config = yield* Ref0Config;
+	const store = yield* (yield* MachineKey).boundTo(cnf);
+	return {
+		origin: yield* Effect.orDie(decodeProofOrigin$1(config.api)),
+		store,
+		token: kept.token
+	};
+});
+/** ref0's `/v1` as a typed client acting with a kept credential. */
+const keptClient = Effect.fnUntraced(function* (kept) {
+	if (kept.cnf === void 0) {
+		const config = yield* Ref0Config;
+		return yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(kept.token)));
+	}
+	return yield* boundClient(yield* boundTo(kept, kept.cnf));
+});
+/** Requests made by hand, each with a path under ref0's origin, sent with a kept credential. */
+const keptSend = Effect.fnUntraced(function* (kept) {
+	if (kept.cnf === void 0) {
+		const config = yield* Ref0Config;
+		const http = yield* HttpClient.HttpClient;
+		return (request) => http.execute(HttpClientRequest.prependUrl(HttpClientRequest.bearerToken(request, kept.token), config.api));
+	}
+	return yield* boundSend(yield* boundTo(kept, kept.cnf));
+});
+//#endregion
 //#region src/secret.ts
 const hashed = (secret) => Effect.gen(function* () {
 	const digest = yield* Effect.promise(async () => await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret)));
@@ -19598,15 +19939,36 @@ const sayFailed = (words) => printBlocks(Predicate.isString(words) ? [[words]] :
 //#endregion
 //#region src/session.ts
 /**
+* A session's credential as this machine keeps it, in one keychain write: its token, its
+* session, the key it's bound to, if it is, and the host grant its chain started from, by its
+* ID, so a grant kept since tells whether it's the one that started it.
+*/
+const KeptSession = Schema.Struct({
+	token: Schema.RedactedFromValue(Schema.String),
+	session: SessionId,
+	/** This machine's key, by its thumbprint, when ref0 bound the session to it. */
+	cnf: Schema.optional(KeyBinding),
+	hostGrant: CredentialRef
+});
+const decodeKeptSession = Schema.decodeUnknownOption(Schema.fromJsonString(KeptSession));
+const encodeKeptSession = Schema.encodeSync(Schema.fromJsonString(KeptSession));
+/**
+* A kept session's record, from the keychain's value: none for one this ref0 can't read, such as
+* the bare token an earlier ref0 kept, which the next prompt replaces with a session of its own.
+*/
+const readKeptSession = (value) => Option.flatMap(value, (kept) => decodeKeptSession(Redacted.value(kept)));
+/** A kept session's record, as the keychain keeps it. */
+const keptSessionValue = (kept) => Redacted.make(encodeKeptSession(kept));
+/**
 * An agent's command in a harness session that has no ref0 session, though an agent is connected
 * for its config folder: why, as far as ref0 can tell, and what to do. It never runs as its
 * person instead.
 */
 var NoSession = class extends Schema.TaggedError()("NoSession", { nextStep: Schema.String }) {};
 /**
-* The token of the session this command runs in, if it runs in one: an agent's, which its
-* harness bound when the session started. Where it's found is the harness's to say. Outside a
-* session, there's none, and every command is the person's, asked by approval.
+* The session this command runs in, as its credential is kept, if it runs in one: an agent's,
+* which its harness bound when the session started. Where it's found is the harness's to say.
+* Outside a session, there's none, and every command is the person's, asked by approval.
 */
 var SessionToken = class SessionToken extends Context.Service()("ref0/cli/SessionToken") {
 	/** No session: until a harness binds one, the person asks, by approval. */
@@ -19623,9 +19985,11 @@ var SessionThread = class SessionThread extends Context.Service()("ref0/cli/Sess
 //#endregion
 //#region src/call.ts
 /**
-* Every command's one way to ref0: an endpoint's request, sent with the session's token when
-* the command runs in a session, or else asked of the person, by approval, from this terminal.
-* Either way the answer is the endpoint's own, as JSON.
+* Every command's one way to ref0: an endpoint's request, sent as the session when the command
+* runs in one, signed with this machine's key when the session's bound to it, or else asked of
+* the person, by approval, from this terminal. Either way the answer is the endpoint's own, as
+* JSON. A session's request its key can't sign fails here, as the session's: never asked of the
+* person instead.
 */
 /** What ref0 said no to, or what went wrong on the way: its status, its kind, and what to do. */
 var CallFailed = class extends Schema.TaggedError()("CallFailed", {
@@ -19682,7 +20046,7 @@ const refusedBy = (status, refusal, change) => new CallFailed({
 * An answer none of its endpoint's schemas reads: another endpoint's, or one a bug in ref0 or
 * the CLI made. A change it answered may have run.
 */
-const unreadable$1 = (endpoint, change) => new CallFailed({
+const unreadable = (endpoint, change) => new CallFailed({
 	status: 0,
 	kind: "Unexpected",
 	nextStep: change ? `ref0’s answer to ${endpoint} isn’t one that endpoint gives, so it may have run. Check before you run it again.` : `ref0’s answer to ${endpoint} isn’t one that endpoint gives. Try again.`
@@ -19731,7 +20095,7 @@ const waitForAnswer = Effect.fnUntraced(function* (collect, expiresAt, change, e
 		const state = answered.value;
 		heardAt = now;
 		if (state.state === "ran") return yield* Option.match(ranOf(endpoint, state), {
-			onNone: () => Effect.fail(unreadable$1(endpoint, change)),
+			onNone: () => Effect.fail(unreadable(endpoint, change)),
 			onSome: Result.match({
 				onSuccess: () => Effect.succeed(state.result),
 				onFailure: (refusal) => Effect.fail(refusedBy(state.status, refusal, change))
@@ -19761,42 +20125,52 @@ var Ref0 = class Ref0 extends Context.Service()("ref0/cli/Ref0") {
 		const config = yield* Ref0Config;
 		const session = yield* SessionToken;
 		const http = yield* HttpClient.HttpClient;
-		const asSession = Effect.fnUntraced(function* (token, request, endpoint) {
+		const signing = yield* Effect.context();
+		const asSession = Effect.fnUntraced(function* (kept, request, endpoint) {
 			const timeout = timeoutOf(request.command.endpoint);
-			const base = HttpClientRequest.make(request.method)(`${config.api}${request.url}`).pipe(HttpClientRequest.bearerToken(token), HttpClientRequest.setHeader("idempotency-key", yield* newRequestId));
+			const send = yield* keptSend(kept).pipe(Effect.provide(signing), Effect.provideService(Ref0Config, config), Effect.provideService(HttpClient.HttpClient, http), Effect.mapError((error) => new CallFailed({
+				status: 0,
+				kind: error._tag,
+				nextStep: error.nextStep
+			})));
+			const base = HttpClientRequest.make(request.method)(request.url).pipe(HttpClientRequest.setHeader("idempotency-key", yield* newRequestId));
 			const sent = request.body === void 0 ? base : HttpClientRequest.bodyText(base, request.body, "application/json");
 			const change = request.method !== "GET";
 			const lost = change ? unanswered$1 : unreachable;
-			const { response, text } = yield* http.execute(sent).pipe(Effect.flatMap((response) => Effect.map(response.text, (text) => ({
+			const { response, text } = yield* send(sent).pipe(Effect.flatMap((response) => Effect.map(response.text, (text) => ({
 				response,
 				text
+			}))), Effect.catchTag("KeyStoreUnavailable", (unsigned) => Effect.fail(new CallFailed({
+				status: 0,
+				kind: unsigned._tag,
+				nextStep: unsigned.nextStep
 			}))), Effect.timeoutOrElse({
 				duration: timeout,
 				orElse: () => Effect.fail(lost)
-			}), Effect.mapError(() => lost));
+			}), Effect.mapError((error) => error instanceof CallFailed ? error : lost));
 			const body = text.length === 0 ? null : yield* Effect.orElseSucceed(decodeJson$1(text), () => null);
 			if (response.status === 202) {
 				const needed = decodeNeeded(body);
 				if (Option.isNone(needed)) return yield* failedWith$16(202, body, change);
 				yield* printBlocks([[`Waiting for your person to approve it under Waiting on you, at ${config.api}${webPages.home}: ${needed.value.says}.`]]);
-				return yield* waitForAnswer(yield* collectAsSession(token, needed.value.approval, change), needed.value.expiresAt, change, endpoint);
+				return yield* waitForAnswer(yield* collectAsSession(kept, needed.value.approval, change), needed.value.expiresAt, change, endpoint);
 			}
 			return response.status < 300 ? body : yield* failedWith$16(response.status, body, change);
 		});
-		const collectAsSession = Effect.fnUntraced(function* (token, approval, change) {
-			const client = yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(token)), Effect.provideService(HttpClient.HttpClient, http));
+		const collectAsSession = Effect.fnUntraced(function* (kept, approval, change) {
 			const refused = (status) => (error) => Effect.fail(new CallFailed({
 				status,
 				kind: error._tag,
 				nextStep: error.nextStep
 			}));
-			return client.approvals.get({ params: { approval } }).pipe(Effect.map(Option.some), Effect.timeoutOrElse({
+			return (yield* keptClient(kept).pipe(Effect.provide(signing), Effect.provideService(Ref0Config, config), Effect.provideService(HttpClient.HttpClient, http), Effect.catch(refused(0)))).approvals.get({ params: { approval } }).pipe(Effect.map(Option.some), Effect.timeoutOrElse({
 				duration: requestTimeout$1,
 				orElse: () => Effect.succeedNone
 			}), Effect.catchTags({
 				ApprovalNotFound: (missing) => Effect.fail(gone(change, missing.nextStep)),
 				Unauthenticated: refused(401),
-				SessionHasEnded: refused(410)
+				SessionHasEnded: refused(410),
+				InvalidDpopProof: refused(401)
 			}), Effect.catch((error) => error instanceof CallFailed ? Effect.fail(error) : Effect.succeedNone));
 		});
 		const asPerson = Effect.fnUntraced(function* (command, change, endpoint) {
@@ -19833,22 +20207,22 @@ var Ref0 = class Ref0 extends Context.Service()("ref0/cli/Ref0") {
 			return yield* waitForAnswer(collect, started.expiresAt, change, endpoint);
 		});
 		const call = Effect.fn("Ref0.call")(function* (command) {
-			const token = yield* session.current.pipe(Effect.mapError((error) => new CallFailed({
+			const kept = yield* session.current.pipe(Effect.mapError((error) => new CallFailed({
 				status: 0,
 				kind: error._tag,
 				nextStep: error.nextStep
 			})));
-			const request = yield* (Option.isSome(token) ? commandRequest(command) : approvalRequest(command)).pipe(Effect.mapError((refused) => new CallFailed({
+			const request = yield* (Option.isSome(kept) ? commandRequest(command) : approvalRequest(command)).pipe(Effect.mapError((refused) => new CallFailed({
 				status: 400,
 				kind: refused._tag,
 				nextStep: refused.nextStep
 			})));
 			const change = request.method !== "GET";
-			const answer = yield* Option.match(token, {
+			const answer = yield* Option.match(kept, {
 				onNone: () => asPerson(request.command, change, command.endpoint),
-				onSome: (bearer) => asSession(bearer, request, command.endpoint)
+				onSome: (one) => asSession(one, request, command.endpoint)
 			});
-			if (!isSuccessOf(request.command.endpoint, answer)) return yield* unreadable$1(request.command.endpoint, change);
+			if (!isSuccessOf(request.command.endpoint, answer)) return yield* unreadable(request.command.endpoint, change);
 			return answer;
 		});
 		return Ref0.of({ call });
@@ -19863,7 +20237,7 @@ const callEndpoint = (command) => Effect.gen(function* () {
 	return {
 		json,
 		value: yield* Option.match(successOf(command.endpoint, json), {
-			onNone: () => Effect.fail(unreadable$1(command.endpoint, false)),
+			onNone: () => Effect.fail(unreadable(command.endpoint, false)),
 			onSome: Effect.succeed
 		})
 	};
@@ -21528,287 +21902,6 @@ const connectLineFor = Effect.fnUntraced(function* (harness, configFolder) {
 	return `${configFolders[harness].variable}=${shellWord(configFolder)} ref0 connect`;
 });
 //#endregion
-//#region src/keychain.ts
-/**
-* The machine's keychain, where the CLI keeps what lets it act: the host grant `ref0 connect`
-* makes, and a session's token. Never a file. On macOS through `security`, on Linux through
-* `secret-tool`, under an origin-specific `ref0/<origin>` service, by account. A secret goes in through stdin, never as
-* an argument, since any process on the machine can read another's arguments.
-*/
-var KeychainError = class extends Schema.TaggedError()("KeychainError", {
-	nextStep: Schema.String,
-	/** The keychain answered, with an item ref0 can't read, rather than not answering. */
-	unreadable: Schema.optionalKey(Schema.Literal(true))
-}) {};
-/**
-* The keychain under one service. Each API origin has its own, `ref0/<origin>`; 0.5.0 kept its
-* grants under `ref0`, which only `ref0 connect` reads, to replace and delete them.
-*/
-const keychainIn = Effect.fnUntraced(function* (service) {
-	const crypto = yield* Crypto.Crypto;
-	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-	const macOS = (yield* spawner.string(ChildProcess.make("uname", ["-s"])).pipe(Effect.orElseSucceed(() => ""))).trim() === "Darwin";
-	const unavailable = new KeychainError({ nextStep: macOS ? "The keychain didn’t answer. Unlock it, and try again." : "The keychain didn’t answer. Unlock the keychain or start a secret service, and try again." });
-	const missing = new KeychainError({ nextStep: "The keychain didn’t answer: ref0 needs `secret-tool`, from libsecret. Install `secret-tool` with `sudo apt install libsecret-tools` on Debian or Ubuntu, `sudo dnf install libsecret` on Fedora or `sudo pacman -S libsecret` on Arch." });
-	const run = (command, args, stdin) => Effect.scoped(Effect.gen(function* () {
-		const handle = yield* spawner.spawn(ChildProcess.make(command, args, { stdin: Stream.make(new TextEncoder().encode(stdin)) })).pipe(Effect.mapError((error) => !macOS && Predicate.isTagged(error.reason, "NotFound") ? missing : unavailable));
-		const [output, complaint] = yield* Effect.all([handle.stdout.pipe(Stream.decodeText(), Stream.mkString), handle.stderr.pipe(Stream.decodeText(), Stream.mkString)], { concurrency: "unbounded" });
-		const code = yield* handle.exitCode;
-		return {
-			output: output.trim(),
-			complaint: complaint.trim(),
-			code,
-			succeeded: code === ChildProcessSpawner.ExitCode(0)
-		};
-	})).pipe(Effect.catchTag("PlatformError", () => Effect.fail(unavailable)));
-	const get = Effect.fn("Keychain.get")(function* (account) {
-		const found = macOS ? yield* run("security", [
-			"find-generic-password",
-			"-s",
-			service,
-			"-a",
-			account,
-			"-w"
-		], "") : yield* run("secret-tool", [
-			"lookup",
-			"service",
-			service,
-			"account",
-			account
-		], "");
-		if (found.succeeded) return found.output.length > 0 ? Option.some(Redacted.make(found.output)) : Option.none();
-		if (macOS) {
-			if (found.code === ChildProcessSpawner.ExitCode(44)) return Option.none();
-			return yield* unavailable;
-		}
-		if (found.code !== ChildProcessSpawner.ExitCode(1) || found.complaint.length > 0) return yield* unavailable;
-		const listed = yield* run("secret-tool", [
-			"search",
-			"--all",
-			"service",
-			service,
-			"account",
-			account
-		], "");
-		if (listed.output.length > 0 || listed.complaint.length > 0) return yield* unavailable;
-		return Option.none();
-	});
-	const set = Effect.fn("Keychain.set")(function* (account, secret) {
-		const quote = (text) => `"${text.replace(/[\\"]/g, "\\$&")}"`;
-		const value = Redacted.value(secret);
-		if (macOS && /[\r\n\0]/.test(account + value)) return yield* unavailable;
-		const input = macOS ? `add-generic-password -U -s ${quote(service)} -a ${quote(account)} -w ${quote(value)}\n` : value;
-		if (macOS && new TextEncoder().encode(input).length >= 4096) return yield* unavailable;
-		if (!(macOS ? yield* run("security", ["-i"], input) : yield* run("secret-tool", [
-			"store",
-			"--label",
-			`ref0 ${account}`,
-			"service",
-			service,
-			"account",
-			account
-		], Redacted.value(secret))).succeeded) return yield* unavailable;
-	});
-	const remove = Effect.fn("Keychain.remove")(function* (account) {
-		if (!(yield* macOS ? run("security", [
-			"delete-generic-password",
-			"-s",
-			service,
-			"-a",
-			account
-		], "") : run("secret-tool", [
-			"clear",
-			"service",
-			service,
-			"account",
-			account
-		], "")).succeeded) return yield* unavailable;
-	});
-	const random = crypto.randomUUIDv4.pipe(Effect.mapError(() => unavailable));
-	return {
-		probe: Effect.gen(function* () {
-			const account = `connect-probe/${yield* random}`;
-			const value = Redacted.make(yield* random);
-			yield* Effect.gen(function* () {
-				yield* set(account, value);
-				const kept = yield* get(account);
-				if (Option.isNone(kept) || Redacted.value(kept.value) !== Redacted.value(value)) return yield* unavailable;
-				yield* remove(account);
-			}).pipe(Effect.catch((error) => remove(account).pipe(Effect.ignore, Effect.andThen(Effect.fail(error)))));
-		}).pipe(Effect.timeoutOrElse({
-			duration: Duration.minutes(1),
-			orElse: () => Effect.fail(unavailable)
-		})),
-		get,
-		set,
-		remove
-	};
-});
-var Keychain = class Keychain extends Context.Service()("ref0/cli/Keychain") {
-	static layer = Layer.effect(Keychain, Effect.flatMap(Ref0Config, (config) => Effect.map(keychainIn(`ref0/${originKey(config.api)}`), Keychain.of)));
-};
-//#endregion
-//#region src/machine-key.ts
-/**
-* This machine's key, which signs a proof for its ask to connect and for each request a host
-* grant makes: one ES256 key for each OS account and origin, in the origin's keychain service
-* under account `machine-key`, as `{ store: 'software', jwk }`. `ref0 connect` makes it, under its
-* lock, only when the keychain says it holds none, and nothing else makes one. A process reads it
-* once and keeps it, since each read is a `security` or `secret-tool` process. Its private half
-* goes to the keychain on stdin and into a Web Crypto key that can't be exported, and nowhere
-* else: no argument, environment, config, error or log.
-*/
-/** The keychain account the key is kept under. */
-const account = "machine-key";
-/** How long reading and importing the key may take for a request, and signing with it. */
-const deadline = Duration.seconds(3);
-/**
-* How long `ref0 connect` may wait on the keychain to read, make and keep the key, as its probe
-* may: a prompt to unlock the keychain can take that long.
-*/
-const connectDeadline = Duration.minutes(1);
-/** A P-256 coordinate or private scalar: 32 bytes, in base64url. */
-const Scalar = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/));
-/** A P-256 private key as a JWK: its public point, and its private scalar `d`. */
-const PrivateJwk = Schema.Struct({
-	kty: Schema.Literal("EC"),
-	crv: Schema.Literal("P-256"),
-	x: Scalar,
-	y: Scalar,
-	d: Scalar
-});
-/** The keychain's record: which store keeps the key, and the key. A hardware store keeps its own. */
-const KeptKey = Schema.Struct({
-	store: Schema.Literal("software"),
-	jwk: PrivateJwk
-});
-const decodeKept$3 = Schema.decodeUnknownOption(Schema.fromJsonString(KeptKey));
-const encodeKept$3 = Schema.encodeSync(Schema.fromJsonString(KeptKey));
-const decodePrivateJwk = Schema.decodeUnknownEffect(PrivateJwk);
-const decodePublicJwk = Schema.decodeSync(PublicJwk);
-const ecdsa = {
-	name: "ECDSA",
-	namedCurve: "P-256"
-};
-const es256 = {
-	name: "ECDSA",
-	hash: "SHA-256"
-};
-/** What a key signs to prove it signs for its public half. */
-const proved = new TextEncoder().encode("ref0 machine key");
-const timedOut = new KeychainError({ nextStep: "The keychain didn’t answer in time. Check that it’s unlocked, and try again." });
-const unreadable = new KeychainError({ nextStep: "ref0 can’t read this machine’s key in the keychain, so it signs nothing and makes no other. Update ref0, which may have kept it in a newer form, or repair the keychain, and try again." });
-const notKept = new KeychainError({ nextStep: "The keychain didn’t keep this machine’s key. Check that it’s unlocked, then run ref0 connect again." });
-const windows = new KeychainError({ nextStep: "ref0 connect doesn’t run on Windows yet: it keeps this machine’s key in the macOS keychain or a Linux secret service. Run it in WSL instead." });
-const didNotSign = new KeyStoreUnavailable({ nextStep: "This machine’s key didn’t sign in time. Try again." });
-/** A fresh key's private JWK, with only the members the record keeps. */
-const freshKey = Effect.promise(async () => {
-	const pair = await crypto.subtle.generateKey(ecdsa, true, ["sign", "verify"]);
-	return await crypto.subtle.exportKey("jwk", pair.privateKey);
-}).pipe(Effect.flatMap(({ kty, crv, x, y, d }) => decodePrivateJwk({
-	kty,
-	crv,
-	x,
-	y,
-	d
-})), Effect.orDie);
-/**
-* A key store over a private JWK: imported once, as a key that can't be exported, and proved to
-* sign for its public half, or it's no key to bind anything to.
-*/
-const softwareStore = Effect.fnUntraced(function* (jwk) {
-	const publicKey = decodePublicJwk({
-		kty: jwk.kty,
-		crv: jwk.crv,
-		x: jwk.x,
-		y: jwk.y
-	});
-	const signs = yield* Effect.tryPromise({
-		try: async () => {
-			const [signing, verifying] = await Promise.all([crypto.subtle.importKey("jwk", jwk, ecdsa, false, ["sign"]), crypto.subtle.importKey("jwk", publicKey, ecdsa, false, ["verify"])]);
-			const signature = await crypto.subtle.sign(es256, signing, proved);
-			return await crypto.subtle.verify(es256, verifying, signature, proved) ? signing : void 0;
-		},
-		catch: () => unreadable
-	});
-	if (signs === void 0) return yield* unreadable;
-	const sign = (bytes) => Effect.tryPromise({
-		try: async () => new Uint8Array(await crypto.subtle.sign(es256, signs, new Uint8Array(bytes))),
-		catch: () => didNotSign
-	}).pipe(Effect.timeoutOrElse({
-		duration: deadline,
-		orElse: () => Effect.fail(didNotSign)
-	}));
-	return {
-		store: {
-			publicKey,
-			sign
-		},
-		binding: { jkt: yield* keyThumbprint(publicKey) }
-	};
-});
-/**
-* This machine's key, read once for the process. `supported` refuses a platform with no keychain
-* that keeps it, such as Windows, before `ref0 connect` asks the keychain anything. `ensure` is
-* `ref0 connect`'s: the key the keychain holds, or one made and kept now if it says it holds none,
-* under the connect lock, once the keychain is probed. `boundTo` is for a kept
-* credential bound to a key: the key it names, read again once if the one held is another, such
-* as one replaced since, or `InvalidDpopProof`, without sending anything, when the keychain has
-* none or another. Neither makes a key from an item it can't read.
-*/
-var MachineKey = class MachineKey extends Context.Service()("ref0/cli/MachineKey") {
-	/** On the platform Node names, such as `win32`, where no keychain keeps the key yet. */
-	static layerOn = (platform) => Layer.effect(MachineKey, Effect.gen(function* () {
-		const keychain = yield* Keychain;
-		const held = yield* Ref.make(Option.none());
-		const reading = yield* Semaphore.make(1);
-		const read = Effect.gen(function* () {
-			const kept = yield* keychain.get(account);
-			if (Option.isNone(kept)) return Option.none();
-			const record = decodeKept$3(Redacted.value(kept.value));
-			if (Option.isNone(record)) return yield* unreadable;
-			const key = yield* softwareStore(record.value.jwk);
-			yield* Ref.set(held, Option.some(key));
-			return Option.some(key);
-		});
-		const made = Effect.gen(function* () {
-			const jwk = yield* freshKey;
-			yield* keychain.set(account, Redacted.make(encodeKept$3({
-				store: "software",
-				jwk
-			})));
-			const back = yield* read;
-			const same = Option.exists(back, (key) => key.store.publicKey.x === jwk.x && key.store.publicKey.y === jwk.y);
-			if (Option.isNone(back) || !same) return yield* notKept;
-			return back.value;
-		});
-		const supported = platform === "win32" ? Effect.fail(windows) : Effect.void;
-		const ensure = Effect.gen(function* () {
-			const kept = yield* read;
-			return Option.isSome(kept) ? kept.value : yield* made;
-		}).pipe(Effect.timeoutOrElse({
-			duration: connectDeadline,
-			orElse: () => Effect.fail(timedOut)
-		}), reading.withPermits(1));
-		const boundTo = (binding) => Effect.gen(function* () {
-			const now = yield* Ref.get(held);
-			if (Option.isSome(now) && now.value.binding.jkt === binding.jkt) return now.value.store;
-			const kept = yield* read.pipe(Effect.timeoutOrElse({
-				duration: deadline,
-				orElse: () => Effect.fail(timedOut)
-			}));
-			if (Option.isSome(kept) && kept.value.binding.jkt === binding.jkt) return kept.value.store;
-			return yield* invalidDpopProof;
-		}).pipe(reading.withPermits(1));
-		return MachineKey.of({
-			supported,
-			ensure,
-			boundTo
-		});
-	}));
-	static layer = MachineKey.layerOn(process.platform);
-};
-//#endregion
 //#region src/host-grant.ts
 /**
 * All lasting authority for one config folder, stored as one keychain value: the agent the folder
@@ -21832,6 +21925,15 @@ const encodeGrant = Schema.encodeSync(Schema.fromJsonString(KeptHostGrant));
 * read as a grant, such as one an earlier ref0 kept, still names the grant it held.
 */
 const decodeHeldToken = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Struct({ token: KeptHostGrant.fields.token })));
+const decodeCredentialRef = Schema.decodeUnknownOption(CredentialRef);
+/**
+* A kept grant by its locator, whose it is and which row, as its token names them: what a
+* session it started, and a start it authorized, are kept beside. None for a token that isn't one.
+*/
+const grantRef = (grant) => Option.flatMap(parseToken(Redacted.value(grant.token)), (parts) => decodeCredentialRef({
+	person: parts.person,
+	id: parts.token
+}));
 /** Grants in the origin’s keychain service, account host-grant/<resolved config folder>. */
 var HostGrant = class HostGrant extends Context.Service()("ref0/cli/HostGrant") {
 	static layer = Layer.effect(HostGrant, Effect.gen(function* () {
@@ -21867,24 +21969,6 @@ const grantForAgent = Effect.fnUntraced(function* (owner, agent) {
 	}
 	return Option.none();
 });
-const decodeProofOrigin$1 = Schema.decodeUnknownEffect(ProofOrigin);
-/**
-* ref0's `/v1` as a typed client acting with a kept host grant: with a proof this machine's key
-* signs for each request when the grant is bound to it, or as a bearer token when it's a grant
-* from before binding. A grant bound to a key the keychain no longer holds is refused here, with
-* `InvalidDpopProof`, and nothing is sent.
-*/
-const grantClient = Effect.fnUntraced(function* (grant) {
-	const config = yield* Ref0Config;
-	if (grant.cnf === void 0) return yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(grant.token)));
-	const store = yield* (yield* MachineKey).boundTo(grant.cnf);
-	const origin = yield* Effect.orDie(decodeProofOrigin$1(config.api));
-	return yield* boundClient({
-		origin,
-		store,
-		token: grant.token
-	});
-});
 //#endregion
 //#region src/version.ts
 /**
@@ -21893,7 +21977,7 @@ const grantClient = Effect.fnUntraced(function* (grant) {
 * an update installs anew. Node, run from source, loads JSON only with the `type` attribute,
 * and only as a default export.
 */
-const cliVersion = "0.13.0";
+const cliVersion = "0.14.0";
 //#endregion
 //#region src/harness/hook-protocol.ts
 /**
@@ -27203,10 +27287,9 @@ const gitTokenOf = Effect.fnUntraced(function* (binding) {
 	const keychain = yield* Keychain;
 	const kept = yield* keychain.get(gitTokenAccount(binding));
 	if (Option.isSome(kept)) return kept;
-	const sessionToken = yield* keychain.get(sessionAccount(binding));
-	if (Option.isNone(sessionToken)) return Option.none();
-	const config = yield* Ref0Config;
-	const client = yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(sessionToken.value)));
+	const session = readKeptSession(yield* keychain.get(sessionAccount(binding)));
+	if (Option.isNone(session)) return Option.none();
+	const client = yield* keptClient(session.value);
 	const me = yield* client.me.get();
 	if (me.session === void 0) return Option.none();
 	const { secret, hash } = yield* freshTokenSecret;
@@ -27344,12 +27427,11 @@ const trimShallow = Effect.fnUntraced(function* (gitDir) {
 * attempts the merge: the checkout's own for `ref0 sync`, or the local check's scratch one.
 */
 const loadSyncHistory = Effect.fnUntraced(function* (gitDir, repo) {
-	const config = yield* Ref0Config;
-	const token = yield* (yield* SessionToken).current.pipe(Effect.catchTag("NoSession", () => Effect.succeedNone));
-	if (Option.isNone(token)) return yield* new HistoryNotLoaded({ why: "this terminal has no session to load it as" });
+	const kept = yield* (yield* SessionToken).current.pipe(Effect.catchTag("NoSession", () => Effect.succeedNone));
+	if (Option.isNone(kept)) return yield* new HistoryNotLoaded({ why: "this terminal has no session to load it as" });
 	const fs = yield* FileSystem.FileSystem;
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-	const client = yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(token.value)));
+	const client = yield* keptClient(kept.value);
 	const params = yield* decodePlace(repoParts(repo));
 	const manifest = yield* client.repos.manifest({ params });
 	const temp = yield* fs.makeTempDirectoryScoped();
@@ -30578,7 +30660,7 @@ const watchCommands = [Command.make("watch", {
 		owner: ownerName,
 		agent: flags.agent
 	});
-	const client = yield* grantClient(grant.value);
+	const client = yield* keptClient(grant.value);
 	const watching = {
 		project: flags.project,
 		parent: Option.getOrUndefined(flags.parent),
@@ -32452,7 +32534,7 @@ var BaseChecks = class BaseChecks extends Context.Service()("ref0/cli/BaseChecks
 		], { stdin: "ignore" })).pipe(Effect.map((code) => Number(code) === 0), Effect.orElseSucceed(() => false));
 		return BaseChecks.of({
 			settingsAt,
-			check: (top, base, delivered, within, token) => checkBase(top, base, delivered, within).pipe(Effect.provide(context), Effect.provideService(SessionToken, SessionToken.of({ current: Effect.succeedSome(token) }))),
+			check: (top, base, delivered, within, session) => checkBase(top, base, delivered, within).pipe(Effect.provide(context), Effect.provideService(SessionToken, SessionToken.of({ current: Effect.succeedSome(session) }))),
 			holds
 		});
 	}));
@@ -32505,10 +32587,10 @@ const baseWatch = Effect.fnUntraced(function* (edges) {
 			return;
 		}
 		if (Option.isNone(repo)) return;
-		const read = yield* (yield* clientOf(bound.token)).sessions.base({ params: {
+		const read = yield* clientOf(bound.kept).pipe(Effect.flatMap((client) => client.sessions.base({ params: {
 			session: bound.session,
 			repo: repo.value
-		} }).pipe(Effect.option);
+		} })), Effect.option);
 		if (Option.isNone(read)) return;
 		const base = read.value;
 		const mark = {
@@ -32534,7 +32616,7 @@ const baseWatch = Effect.fnUntraced(function* (edges) {
 			commit: base.commit,
 			url,
 			ref: base.ref
-		}, delivered, clone.within, bound.token).pipe(Effect.option);
+		}, delivered, clone.within, bound.kept).pipe(Effect.option);
 		if (Option.isNone(checked)) return;
 		const notice = checked.value.kind === "compared" ? checked.value.notice : Option.none();
 		yield* Ref.update(watched, (was) => was.top !== clone.top ? was : {
@@ -34157,28 +34239,31 @@ function readHook(args) {
 * `ref0 clone` writes), or, with none, on a new thread under a plain title, such as "Claude Code
 * in shop, 9 Oct 14:02", which the agent then names in its own words (decided, 9 Oct 2026, 3).
 * The prompt's words never become the title. A session `ref0 watch` started says so, with the
-* event that started its thread, as its trigger. The session's token is kept in the keychain
-* under its binding's account, and nowhere else, and its thread beside it, so the session that
-* follows one that ended goes on the same thread.
+* event that started its thread, as its trigger. The session's credential is kept in the
+* keychain under its binding's account, and nowhere else, as one record with the key it's bound
+* to and the grant that started it, and its thread beside it, so the session that follows one
+* that ended goes on the same thread.
 */
 /** The keychain account a binding's thread is kept under, beside its session token's. */
 const threadAccount = (binding) => `${sessionAccount(binding)}/thread`;
 /** The keychain account a start not yet landed is kept under, beside its session token's. */
 const pendingAccount = (binding) => `${sessionAccount(binding)}/pending`;
 const decodeRequest = Schema.decodeUnknownEffect(StartSessionRequest);
-const decodeRequestId = Schema.decodeUnknownOption(RequestId);
 /**
-* A pending start's request ID and secret, as kept: `<request ID> <secret>`. One whose secret
-* isn't a token's, kept before tokens took only those, could never authorize, so it's dropped.
+* A start not yet landed, as kept: its request ID and secret, and the grant that authorized it
+* and the key it was signed by, so it's sent again only by that grant, with that key. One kept
+* in any other form is dropped, and the next start is a new one.
 */
-const decodePending = (kept) => {
-	const [requestId = "", secret = ""] = kept.split(" ");
-	if (!isTokenSecret(secret)) return Option.none();
-	return Option.map(decodeRequestId(requestId), (id) => ({
-		requestId: id,
-		secret
-	}));
-};
+const PendingStart = Schema.Struct({
+	requestId: RequestId,
+	secret: Schema.String.check(Schema.makeFilter((secret) => isTokenSecret(secret))),
+	hostGrant: CredentialRef,
+	cnf: Schema.optional(KeyBinding)
+});
+const decodePending = Schema.decodeUnknownOption(Schema.fromJsonString(PendingStart));
+const encodePending = Schema.encodeSync(Schema.fromJsonString(PendingStart));
+/** Whether a pending start was authorized as a start now would be: by this grant, with this key. */
+const sameAuthority = (pending, hostGrant, cnf) => pending.hostGrant.person === hostGrant.person && pending.hostGrant.id === hostGrant.id && pending.cnf?.jkt === cnf?.jkt;
 /** A secret's SHA-256, as hex: all ref0 is told of it. */
 const hashOf = (secret) => Effect.map(Effect.promise(async () => await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret))), (digest) => Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join(""));
 /** How the harness is named in a plain title. */
@@ -34203,15 +34288,23 @@ const startHarnessSession = Effect.fnUntraced(function* (input) {
 	const folder = yield* (yield* ConfigFolders).folder(harness);
 	const grant = yield* hostGrant.get(folder);
 	if (Option.isNone(grant) || grant.value.harness !== harness) return Option.none();
-	const client = yield* grantClient(grant.value);
+	const authorizing = grantRef(grant.value);
+	if (Option.isNone(authorizing)) return Option.none();
+	const cnf = grant.value.cnf;
+	const client = yield* keptClient(grant.value);
 	const pending = pendingAccount(input.binding);
-	const held = Option.flatMap(yield* keychain.get(sessionAccount(input.binding)), (kept) => parseToken(Redacted.value(kept)));
-	const resent = Option.filter(Option.flatMap(yield* keychain.get(pending), (kept) => decodePending(Redacted.value(kept))), (one) => !Option.exists(held, (parts) => parts.secret === one.secret));
+	const held = Option.flatMap(readKeptSession(yield* keychain.get(sessionAccount(input.binding))), (kept) => parseToken(Redacted.value(kept.token)));
+	const resent = Option.filter(Option.flatMap(yield* keychain.get(pending), (kept) => decodePending(Redacted.value(kept))), (one) => sameAuthority(one, authorizing.value, cnf) && !Option.exists(held, (parts) => parts.secret === one.secret));
 	const { requestId, secret } = Option.isSome(resent) ? resent.value : {
 		requestId: yield* newRequestId,
 		secret: encodeSecret(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)))
 	};
-	if (Option.isNone(resent)) yield* keychain.set(pending, Redacted.make(`${requestId} ${secret}`));
+	if (Option.isNone(resent)) yield* keychain.set(pending, Redacted.make(encodePending({
+		requestId,
+		secret,
+		hostGrant: authorizing.value,
+		cnf
+	})));
 	const hash = yield* hashOf(secret);
 	const where = input.on.kind === "thread" ? threadParts(input.on.written) : {
 		owner: grant.value.owner,
@@ -34246,11 +34339,20 @@ const startHarnessSession = Effect.fnUntraced(function* (input) {
 		kind: "project",
 		name: newThreadProject
 	}, started.threadNumber);
+	const kept = {
+		token: Redacted.make(formatToken(started.credential.person, started.credential.id, secret)),
+		session: started.session,
+		hostGrant: authorizing.value,
+		cnf
+	};
 	yield* keychain.remove(gitTokenAccount(input.binding)).pipe(Effect.ignore);
-	yield* keychain.set(sessionAccount(input.binding), Redacted.make(formatToken(started.credential.person, started.credential.id, secret)));
+	yield* keychain.set(sessionAccount(input.binding), keptSessionValue(kept));
 	yield* keychain.set(threadAccount(input.binding), Redacted.make(thread)).pipe(Effect.ignore);
 	yield* keychain.remove(pending).pipe(Effect.ignore);
-	return Option.some(started);
+	return Option.some({
+		started,
+		kept
+	});
 });
 //#endregion
 //#region src/harness/watched-start.ts
@@ -34333,14 +34435,13 @@ const sessionBinding = Effect.fnUntraced(function* (edges) {
 	const owned = yield* Ref.make(Option.none());
 	const onTheWay = yield* Ref.make(Option.none());
 	const listen = Effect.fnUntraced(function* (bound) {
-		const client = yield* clientOf(bound.token);
 		let pause = 1;
 		let opened = false;
 		for (;;) {
-			const ticket = yield* client.live.ticket({ payload: { track: {
+			const ticket = yield* clientOf(bound.kept).pipe(Effect.flatMap((client) => client.live.ticket({ payload: { track: {
 				kind: "session",
 				session: bound.session
-			} } }).pipe(Effect.option);
+			} } })), Effect.option);
 			let closed;
 			if (Option.isSome(ticket)) {
 				if (opened) yield* edges.moved;
@@ -34366,12 +34467,12 @@ const sessionBinding = Effect.fnUntraced(function* (edges) {
 		}
 	});
 	const renew = Effect.fnUntraced(function* (bound) {
-		const client = yield* clientOf(bound.token);
 		for (;;) {
-			const renewed = yield* client.sessions.renew({
+			const key = yield* newRequestId;
+			const renewed = yield* clientOf(bound.kept).pipe(Effect.flatMap((client) => client.sessions.renew({
 				params: { session: bound.session },
-				headers: { "idempotency-key": yield* newRequestId }
-			}).pipe(Effect.as("renewed"), Effect.catchTag("SessionHasEnded", () => Effect.succeed("ended")), Effect.orElseSucceed(() => "failed"));
+				headers: { "idempotency-key": key }
+			}))).pipe(Effect.as("renewed"), Effect.catchTag("SessionHasEnded", () => Effect.succeed("ended")), Effect.orElseSucceed(() => "failed"));
 			if (renewed === "ended") {
 				yield* oneAtATime.withPermits(1)(Ref.set(state, {
 					kind: "ended",
@@ -34383,9 +34484,9 @@ const sessionBinding = Effect.fnUntraced(function* (edges) {
 		}
 	});
 	const keptThread = (binding) => keychain.get(threadAccount(binding)).pipe(Effect.map(Option.flatMap((kept) => decodeWrittenThread(Redacted.value(kept)))), Effect.orElseSucceed(() => Option.none()));
-	const hasEnded = (token) => clientOf(token).pipe(Effect.flatMap((client) => client.me.get()), Effect.as(false), Effect.catchTag("SessionHasEnded", () => Effect.succeed(true)), Effect.orElseSucceed(() => false));
+	const hasEnded = (kept) => clientOf(kept).pipe(Effect.flatMap((client) => client.me.get()), Effect.as(false), Effect.catchTag("SessionHasEnded", () => Effect.succeed(true)), Effect.orElseSucceed(() => false));
 	const heldFor = Effect.fnUntraced(function* (binding, over) {
-		const kept = yield* keychain.get(sessionAccount(binding)).pipe(Effect.orElseSucceed(() => Option.none()));
+		const kept = readKeptSession(yield* keychain.get(sessionAccount(binding)).pipe(Effect.orElseSucceed(() => Option.none())));
 		if (!over || Option.isNone(kept) || !(yield* hasEnded(kept.value))) return kept;
 		return Option.none();
 	});
@@ -34424,8 +34525,7 @@ const sessionBinding = Effect.fnUntraced(function* (edges) {
 			"ProjectNotFound",
 			"NotPermitted"
 		], (refused) => Option.isSome(before) ? Effect.andThen(keychain.remove(threadAccount(binding)).pipe(Effect.ignore), startOn(start.thread)) : Effect.fail(refused)), Effect.orElseSucceed(() => Option.none()));
-		if (Option.isNone(started)) return Option.none();
-		return yield* keychain.get(sessionAccount(binding)).pipe(Effect.orElseSucceed(() => Option.none()));
+		return Option.map(started, (one) => one.kept);
 	});
 	const startedFor = Effect.fnUntraced(function* (binding, hook, starting) {
 		const sent = yield* Ref.get(onTheWay);
@@ -34451,28 +34551,19 @@ const sessionBinding = Effect.fnUntraced(function* (edges) {
 		if ((over && !starting || waiting) && !sent) return Option.none();
 		const binding = yield* bindingForServer(hook.harnessSession);
 		const held = Option.isNone(binding) ? Option.none() : yield* heldFor(binding.value, over);
-		const token = Option.isSome(held) || Option.isNone(binding) ? held : yield* startedFor(binding.value, hook, starting);
-		if (Option.isNone(binding) || Option.isNone(token)) {
+		const kept = Option.isSome(held) || Option.isNone(binding) ? held : yield* startedFor(binding.value, hook, starting);
+		if (Option.isNone(binding) || Option.isNone(kept)) {
 			if (!over) yield* Ref.set(state, {
 				kind: "unbound",
 				until: now + unboundMillis
 			});
 			return Option.none();
 		}
-		const client = yield* clientOf(token.value);
-		const me = yield* client.me.get();
-		if (me.session === void 0) {
-			yield* Ref.set(state, {
-				kind: "unbound",
-				until: now + unboundMillis
-			});
-			return Option.none();
-		}
-		const registered = yield* client.sessions.process({ params: { session: me.session.session } });
+		const registered = yield* (yield* clientOf(kept.value)).sessions.process({ params: { session: kept.value.session } });
 		const bound = {
 			binding: binding.value,
-			token: token.value,
-			session: me.session.session,
+			kept: kept.value,
+			session: kept.value.session,
 			generation: registered.generation,
 			counter: 0,
 			unreported: []
@@ -34857,7 +34948,6 @@ var HarnessSession = class HarnessSession extends Context.Service()("ref0/cli/Ha
 	*/
 	static layerFor(agent) {
 		return Layer.effect(HarnessSession, Effect.gen(function* () {
-			const config = yield* Ref0Config;
 			const context = yield* Effect.context();
 			const state = yield* Ref.make({
 				kind: "unbound",
@@ -34877,13 +34967,13 @@ var HarnessSession = class HarnessSession extends Context.Service()("ref0/cli/Ha
 				within: Effect.suspend(() => binding.within),
 				scope
 			});
-			const clientOf = (token) => ref0Client(config.api).pipe(Effect.provide(bearerCredential(token)));
+			const clientOf = (kept) => keptClient(kept).pipe(Effect.provide(context));
 			const watch = yield* baseWatch({
 				scope,
 				clientOf
 			});
 			const settle = Effect.fnUntraced(function* (bound) {
-				const client = yield* clientOf(bound.token);
+				const client = yield* clientOf(bound.kept);
 				const refused = () => Effect.succeed("refused");
 				yield* attribution.settle(ownerOf(bound), (repo, part) => client.sessions.commit({
 					params: {
@@ -34929,7 +35019,7 @@ var HarnessSession = class HarnessSession extends Context.Service()("ref0/cli/Ha
 				if (hook.event === "UserPromptSubmit") yield* Ref.set(prompted, Option.some(hook));
 				const bound = yield* binding.bind(hook);
 				if (Option.isNone(bound)) return Option.none();
-				const client = yield* clientOf(bound.value.token);
+				const client = yield* clientOf(bound.value.kept);
 				const prompt = Option.filter(yield* Ref.get(prompted), (one) => one.harnessSession === hook.harnessSession && one.harnessTurn === hook.harnessTurn);
 				if (Option.isSome(prompt)) yield* Ref.set(prompted, Option.none());
 				if (Option.isSome(prompt) && prompt.value !== hook) yield* turns.trackLate(client, bound.value, prompt.value, deadline);
@@ -35158,11 +35248,6 @@ const lastRead = Effect.fnUntraced(function* (client, session, harness, transcri
 		}
 	});
 });
-/** The typed `/v1` as a session, with its own token: not the one this process's environment names. */
-const asSession = (token) => Effect.gen(function* () {
-	const config = yield* Ref0Config;
-	return yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(token)));
-});
 /** What the hook does, from the hook's input on stdin. */
 const endHarnessSession = Effect.gen(function* () {
 	const stdio = yield* Stdio.Stdio;
@@ -35174,13 +35259,13 @@ const endHarnessSession = Effect.gen(function* () {
 	const binding = yield* bindingHere(hook.value.session_id);
 	if (Option.isNone(binding)) return;
 	const account = sessionAccount(binding.value);
-	const token = yield* keychain.get(account);
-	if (Option.isNone(token)) return;
+	const held = yield* keychain.get(account);
+	if (Option.isNone(held)) return;
 	yield* Effect.gen(function* () {
-		const client = yield* asSession(token.value);
-		const me = yield* client.me.get();
-		if (me.session === void 0) return;
-		const session = me.session.session;
+		const kept = readKeptSession(held);
+		if (Option.isNone(kept)) return;
+		const client = yield* keptClient(kept.value);
+		const session = kept.value.session;
 		const harness = binding.value.harness === "codex" ? "codex" : "claude-code";
 		yield* lastRead(client, session, harness, hook.value.transcript_path).pipe(Effect.timeout(lastReadWithin), Effect.ignore);
 		yield* client.sessions.end({
@@ -35377,23 +35462,19 @@ const setCommitEnvironment = Effect.fnUntraced(function* (session) {
 */
 const decodeHook = Schema.decodeUnknownOption(Schema.fromJsonString(SessionStartHookInput));
 /**
-* What blocks the session's thread, in the words its agent reads, read with the session's own
-* token; none if nothing does. A session already started is found by its token.
+* What blocks the session's thread, in the words its agent reads, read as the session, as it's
+* kept; none if nothing does.
 */
-const blockedBy = Effect.fnUntraced(function* (token, known) {
-	const config = yield* Ref0Config;
-	const client = yield* ref0Client(config.api).pipe(Effect.provide(bearerCredential(token)));
-	const session = Option.isSome(known) ? known.value : (yield* client.me.get()).session?.session;
-	if (session === void 0) return Option.none();
-	const read = yield* client.sessions.blockers({
-		params: { session },
+const blockedBy = Effect.fnUntraced(function* (kept) {
+	const read = yield* (yield* keptClient(kept)).sessions.blockers({
+		params: { session: kept.session },
 		query: {}
 	});
 	if (read.blockers.length === 0) return Option.none();
 	return Option.some(renderBlockedBy(read.thread, read.blockers));
 });
 /** Says what blocks the session's thread, if anything does; says nothing if ref0 can't tell. */
-const sayBlockers = (token, known) => blockedBy(token, known).pipe(Effect.flatMap(Option.match({
+const sayBlockers = (kept) => blockedBy(kept).pipe(Effect.flatMap(Option.match({
 	onNone: () => Effect.void,
 	onSome: Console.log
 })), Effect.ignore);
@@ -35434,9 +35515,8 @@ const startOnHook = (protocol) => Effect.gen(function* () {
 		const why = kept.readable ? `no agent is connected for this ${name} config folder, ${folder}` : `the host grant kept for this ${name} config folder, ${folder}, can't be read`;
 		return yield* Console.log(`ref0: ${why}, so no session starts. In your own terminal, run: ${repair}`);
 	}
-	const account = sessionAccount(binding.value);
-	const held = yield* keychain.get(account);
-	if (Option.isSome(held)) return yield* sayBlockers(held.value, Option.none());
+	const held = readKeptSession(yield* keychain.get(sessionAccount(binding.value)));
+	if (Option.isSome(held)) return yield* sayBlockers(held.value);
 	const place = startPlace(yield* checkout.threadAt(hook.value.cwd ?? "."), yield* watchedHere);
 	if (Option.isNone(place.thread)) return;
 	const thread = place.thread.value;
@@ -35454,11 +35534,10 @@ const startOnHook = (protocol) => Effect.gen(function* () {
 		version
 	}).pipe(Effect.tapError((error) => place.trigger.kind === "event" ? Console.log(refusedWords(thread, "nextStep" in error ? error.nextStep : void 0)) : Effect.void));
 	if (Option.isNone(started)) return;
-	yield* Console.log(`ref0: this session is on ${thread}, as its session ${started.value.sessionNumber}.`);
+	yield* Console.log(`ref0: this session is on ${thread}, as its session ${started.value.started.sessionNumber}.`);
 	const watched = watchedWords(place, thread);
 	if (watched !== void 0) yield* Console.log(`ref0: ${watched}`);
-	const token = yield* keychain.get(account);
-	if (Option.isSome(token)) yield* sayBlockers(token.value, Option.some(started.value.session));
+	yield* sayBlockers(started.value.kept);
 }).pipe(Effect.timeout("10 seconds"), Effect.ignore);
 const sessionStart = Command.make(harnessCommandNames.sessionStart, { protocol: protocolFlag }, (flags) => startOnHook(flags.protocol)).pipe(Command.withDescription("Starts the ref0 session of a harness session that’s opening"), Command.withShortDescription("Start a ref0 session for the harness"));
 /** The commands a harness runs: `ref0 mcp`, and its command hooks. */
@@ -35466,7 +35545,7 @@ const harnessCommands = [mcp, Command.make(harnessCommandNames.hook).pipe(Comman
 //#endregion
 //#region src/harness/command-token.ts
 /**
-* The session an agent's command acts as: its harness session's, by the token kept under its
+* The session an agent's command acts as: its harness session's, by the record kept under its
 * binding. Outside a harness there's none, and a command is its person's, asked by approval; so
 * too in a harness whose config folder has no agent connected. Where one is connected, a harness
 * session with no token has lost its start, and the command says why, as far as ref0 can tell,
@@ -35514,11 +35593,12 @@ const harnessSessionToken = Layer.effect(SessionToken, Effect.gen(function* () {
 	const current = Effect.gen(function* () {
 		const binding = yield* bindingHere().pipe(Effect.provideService(HarnessProcess, harness), Effect.orElseSucceed(() => Option.none()));
 		if (Option.isNone(binding)) return Option.none();
-		const kept = yield* keychain.get(sessionAccount(binding.value));
+		const held = yield* keychain.get(sessionAccount(binding.value));
+		const kept = readKeptSession(held);
 		if (Option.isSome(kept)) return kept;
 		const name = binding.value.harness === "codex" ? "codex" : "claude-code";
 		const grant = yield* hostGrant.get(yield* folders.folder(name)).pipe(Effect.catchIf((failed) => failed.unreadable === true, () => Effect.succeedNone));
-		if (Option.isNone(grant) || grant.value.harness !== name) return Option.none();
+		if ((Option.isNone(grant) || grant.value.harness !== name) && Option.isNone(held)) return Option.none();
 		const pending = yield* keychain.get(pendingAccount(binding.value));
 		const serverRuns = yield* servers.runsUnder(binding.value.process);
 		return yield* new NoSession({ nextStep: noSessionStep(name, `plugin:${plugin}:${plugin}`, {
@@ -35714,12 +35794,10 @@ const whoIs = (client) => client.me.get().pipe(Effect.timeout("10 seconds"), Eff
 	InvalidDpopProof: refused,
 	KeyStoreUnavailable: unsigned
 }), Effect.orElseSucceed(() => ({ kind: "unanswered" })));
-/** A session's token, as a bearer token: sessions aren't bound to a key yet. */
-const sessionClient = (token) => Effect.flatMap(Ref0Config, (config) => ref0Client(config.api).pipe(Effect.provide(bearerCredential(token))));
 const unansweredWords = (api) => `ref0 didn’t answer at ${api}.`;
 /** Check the grant kept for this folder, without borrowing another folder's authority. */
 const grantChecks = Effect.fnUntraced(function* (grant, configFolder) {
-	const asked = yield* grantClient(grant).pipe(Effect.flatMap(whoIs), Effect.catchTags({
+	const asked = yield* keptClient(grant).pipe(Effect.flatMap(whoIs), Effect.catchTags({
 		InvalidDpopProof: refused,
 		KeychainError: unsigned
 	}));
@@ -35819,8 +35897,12 @@ const sessionCheck = Effect.fnUntraced(function* (harness, configFolder) {
 	if (Option.isNone(binding)) return checkOf("session", "unknown", (yield* harnessEnvironment).CODEX_SANDBOX === void 0 ? "no current session to check" : "Codex’s sandbox hides its session", launch);
 	const token = yield* Effect.result((yield* Keychain).get(sessionAccount(binding.value)));
 	if (Result.isFailure(token)) return checkOf("session", "unknown", `The keychain didn’t say whether ref0 follows this ${configFolders[harness].name} session.`, token.failure.nextStep);
-	if (Option.isNone(token.success)) return checkOf("session", "no", "start a new session in this folder", launch);
-	const asked = yield* Effect.flatMap(sessionClient(token.success.value), whoIs);
+	const kept = readKeptSession(token.success);
+	if (Option.isNone(kept)) return checkOf("session", "no", "start a new session in this folder", launch);
+	const asked = yield* keptClient(kept.value).pipe(Effect.flatMap(whoIs), Effect.catchTags({
+		InvalidDpopProof: refused,
+		KeychainError: unsigned
+	}));
 	switch (asked.kind) {
 		case "accepted": return asked.me.session === void 0 ? checkOf("session", "no", "start a new session in this folder", launch) : checkOf("session", "yes", `ref0 follows this session as ${asked.me.session.session}`);
 		case "refused": return checkOf("session", "no", "ref0 no longer follows this session", launch);
@@ -35918,6 +36000,7 @@ const ref0 = Command.make("ref0").pipe(Command.withDescription("ref0 from the te
 ]));
 const keychain = Keychain.layer.pipe(Layer.provide([NodeServices.layer, Ref0Config.layer]));
 const harnessProcess = HarnessProcess.layer.pipe(Layer.provide(NodeServices.layer));
+const machineKey = MachineKey.layer.pipe(Layer.provide(keychain));
 const sessionToken = harnessSessionToken.pipe(Layer.provide([
 	keychain,
 	harnessProcess,
@@ -35928,8 +36011,15 @@ const sessionToken = harnessSessionToken.pipe(Layer.provide([
 const services = Layer.mergeAll(cliOutput, Ref0.layer.pipe(Layer.provide([
 	Ref0Config.layer,
 	sessionToken,
-	FetchHttpClient.layer
-])), sessionToken, harnessSessionThread.pipe(Layer.provide([keychain, harnessProcess])), FetchHttpClient.layer, keychain, MachineKey.layer.pipe(Layer.provide(keychain)), ProofClock.layer, HostGrant.layer.pipe(Layer.provide(keychain)), OldHostGrants.layer, ConnectLock.layer.pipe(Layer.provide(Processes.layer)), Machine.layer, Tty.layer, harnessProcess, Checkout.layer.pipe(Layer.provide(NodeServices.layer)), BaseChecks.layer.pipe(Layer.provide([Ref0Config.layer, FetchHttpClient.layer])), Attribution.layer.pipe(Layer.provide([Commits.layer, Checkout.layer])), HarnessTasks.layer, Transcripts.layer, Waker.layer, LiveHints.layer).pipe(Layer.provideMerge(ConfigFolders.layer), Layer.provideMerge(Ref0Config.layer), Layer.provideMerge(NodeServices.layer));
+	FetchHttpClient.layer,
+	machineKey,
+	ProofClock.layer
+])), sessionToken, harnessSessionThread.pipe(Layer.provide([keychain, harnessProcess])), FetchHttpClient.layer, keychain, machineKey, ProofClock.layer, HostGrant.layer.pipe(Layer.provide(keychain)), OldHostGrants.layer, ConnectLock.layer.pipe(Layer.provide(Processes.layer)), Machine.layer, Tty.layer, harnessProcess, Checkout.layer.pipe(Layer.provide(NodeServices.layer)), BaseChecks.layer.pipe(Layer.provide([
+	Ref0Config.layer,
+	FetchHttpClient.layer,
+	machineKey,
+	ProofClock.layer
+])), Attribution.layer.pipe(Layer.provide([Commits.layer, Checkout.layer])), HarnessTasks.layer, Transcripts.layer, Waker.layer, LiveHints.layer).pipe(Layer.provideMerge(ConfigFolders.layer), Layer.provideMerge(Ref0Config.layer), Layer.provideMerge(NodeServices.layer));
 //#endregion
 //#region src/root.ts
 /**