toolroll 0.9.56 → 0.9.58

package/dist/cli.js

@@ -424,7 +424,8 @@ async function dispatch(argv, write, mainOptions) {
     if (first === "session") {
         // D5: native coding sessions are deprecated. They still run this release; each use says so once, on stderr.
         (mainOptions.session?.stderr ?? (line => process.stderr.write(`${line}\n`)))(deprecationWarning(`session ${rest.find(arg => !arg.startsWith("-")) ?? ""}`.trim(), "session"));
-        return runSessionCommand(rest, write, mainOptions.session);
+        // D7: it runs on the saved connection over /api/cli, signed in with that profile's API token.
+        return runSessionCommand(rest, write, { ...(mainOptions.remote ?? mainOptions.team), ...mainOptions.session });
     }
     if (first === "demo")
         return runDemoCommand(rest, write);

package/dist/coordinator.d.ts

@@ -2,7 +2,8 @@
  * The coordinator principal (MCP gateway spec v6; DESIGN.md §9b).
  *
  * A coordinator is the ONE credential the MCP surface accepts: minted by
- * an operator password ceremony, hashed at rest, repo-scoped at the mint,
+ * an operator password ceremony, hashed at rest (a `credential` row of kind
+ * 'coordinator', v118: the shared codec and table), repo-scoped at the mint,
  * rate-limited, revocable — and able to do exactly one thing: file a
  * proposal through the canonical door. What it files is an ordinary
  * UNAPPROVED task; admission is the operator's existing scope ceremony,

package/dist/coordinator.js

@@ -2,7 +2,8 @@
  * The coordinator principal (MCP gateway spec v6; DESIGN.md §9b).
  *
  * A coordinator is the ONE credential the MCP surface accepts: minted by
- * an operator password ceremony, hashed at rest, repo-scoped at the mint,
+ * an operator password ceremony, hashed at rest (a `credential` row of kind
+ * 'coordinator', v118: the shared codec and table), repo-scoped at the mint,
  * rate-limited, revocable — and able to do exactly one thing: file a
  * proposal through the canonical door. What it files is an ordinary
  * UNAPPROVED task; admission is the operator's existing scope ceremony,
@@ -14,7 +15,8 @@
  * the exported-cast mistake is named in the spec and not repeated here.
  * Steering and every operator-speech surface cannot accept this type.
  */
-import { createHash, randomBytes } from "node:crypto";
+import { createHash } from "node:crypto";
+import { hashSecret, mintCredential } from "./api-tokens.js";
 import { canonicalRepos } from "./runner.js";
 import { fileTaskProposal } from "./proposal.js";
 import { describeScope } from "./scope.js";
@@ -27,18 +29,7 @@ function verified(row) {
     return row;
 }
 const NAME = /^[a-z0-9-]{1,32}$/;
-const CID_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
 const KEY = /^[\x21-\x7e]{8,64}$/;
-function hashSecret(token) {
-    return createHash("sha256").update(token, "utf8").digest("hex");
-}
-function mintCid() {
-    const bytes = randomBytes(12);
-    let cid = "";
-    for (const b of bytes)
-        cid += CID_ALPHABET[b % CID_ALPHABET.length];
-    return cid;
-}
 export function mintCoordinator(store, input) {
     const days = input.days ?? 90;
     if (!Number.isInteger(days) || days < 1 || days > 365)
@@ -53,15 +44,16 @@ export function mintCoordinator(store, input) {
     if (input.repos.length === 0)
         return { ok: false, reason: "no-repos" };
     const repos = canonicalRepos(input.repos);
-    const token = (input.newToken ?? (() => randomBytes(32).toString("base64url")))();
+    const token = (input.newToken ?? (() => mintCredential("coordinator").token))();
     return store.transact(() => {
         for (let attempt = 0; attempt < 5; attempt += 1) {
-            const cid = (input.newCid ?? mintCid)();
+            const cid = (input.newCid ?? (() => mintCredential("coordinator").id))();
             try {
+                // Its generation: which coordinator of this name it is (revoke-and-remint keeps the earlier one's history apart).
                 store.handle
-                    .prepare(`INSERT INTO coordinator_credential (cid, name, credential_hash, repos, per_hour, created_by, created_at, expires_at)
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
-                    .run(cid, name, hashSecret(token), JSON.stringify(repos), perHour, input.by, input.now.toISOString(), expiresAt);
+                    .prepare(`INSERT INTO credential (id, kind, public_id, account, name, secret_hash, access, projects_json, per_hour, created_by, created_at, expires_at, generation)
+             VALUES (?, 'coordinator', ?, ?, ?, ?, 'act', ?, ?, ?, ?, ?, 1 + (SELECT count(*) FROM credential WHERE kind = 'coordinator' AND name = ?))`)
+                    .run(cid, cid, input.by, name, hashSecret(token), JSON.stringify(repos), perHour, input.by, input.now.toISOString(), expiresAt, name);
                 return { ok: true, cid, token, repos };
             }
             catch (error) {
@@ -81,9 +73,8 @@ export function mintCoordinator(store, input) {
  * the stored hash; the caller re-runs this INSIDE any mutating
  * transaction (the startup check is a courtesy; the txn check is law). */
 export function authenticateCoordinator(store, token) {
-    const row = store.handle
-        .prepare("SELECT * FROM coordinator_credential WHERE credential_hash = ?")
-        .get(hashSecret(token));
+    const found = store.presentedCredential(token);
+    const row = found?.kind === "coordinator" ? store.handle.prepare("SELECT * FROM credential WHERE id = ? AND kind = 'coordinator'").get(found.id) : undefined;
     if (row === undefined)
         return { ok: false, reason: "unknown" };
     if (row["revoked_at"] !== null)
@@ -94,23 +85,23 @@ export function authenticateCoordinator(store, token) {
     return {
         ok: true,
         who: verified({
-            cid: String(row["cid"]),
+            cid: String(row["id"]),
             name: String(row["name"]),
-            repos: JSON.parse(String(row["repos"])),
+            repos: JSON.parse(String(row["projects_json"])),
             perHour: Number(row["per_hour"]),
         }),
     };
 }
 export function revokeCoordinator(store, cid, by, now) {
     return store.transact(() => {
-        const row = store.handle.prepare("SELECT revoked_at FROM coordinator_credential WHERE cid = ?").get(cid);
+        const row = store.handle.prepare("SELECT revoked_at FROM credential WHERE id = ? AND kind = 'coordinator'").get(cid);
         if (row === undefined)
             return { ok: false, reason: "unknown" };
         if (row["revoked_at"] !== null)
             return { ok: false, reason: "already-revoked" };
         store.handle
-            .prepare("UPDATE coordinator_credential SET revoked_at = ? WHERE cid = ?")
-            .run(now.toISOString(), cid);
+            .prepare("UPDATE credential SET revoked_at = ?, revoked_by = ? WHERE id = ? AND kind = 'coordinator'")
+            .run(now.toISOString(), by, cid);
         // The revocation event rides the SAME transaction as the state change,
         // and the credential's pending proposals expire with it (mate arc v3).
         store.handle
@@ -122,13 +113,13 @@ export function revokeCoordinator(store, cid, by, now) {
 }
 export function listCoordinators(store) {
     return store.handle
-        .prepare(`SELECT c.*, (SELECT MAX(e.created_at) FROM coordinator_event e WHERE e.cid = c.cid AND e.kind = 'filed') AS last_filed
-         FROM coordinator_credential c ORDER BY c.created_at, c.cid`)
+        .prepare(`SELECT c.*, (SELECT MAX(e.created_at) FROM coordinator_event e WHERE e.cid = c.id AND e.kind = 'filed') AS last_filed
+         FROM credential c WHERE c.kind = 'coordinator' ORDER BY c.created_at, c.id`)
         .all()
         .map(row => ({
-        cid: String(row["cid"]),
+        cid: String(row["id"]),
         name: String(row["name"]),
-        repos: JSON.parse(String(row["repos"])),
+        repos: JSON.parse(String(row["projects_json"])),
         perHour: Number(row["per_hour"]),
         createdBy: String(row["created_by"]),
         createdAt: String(row["created_at"]),
@@ -253,7 +244,7 @@ export function fileCoordinatorProposal(store, token, input, now) {
                     ],
                 }),
             ...(input.deliverable === undefined ? {} : { deliverable: input.deliverable }),
-            filedVia: `mcp:${who.name}`, filedBy: { name: store.handle.prepare("SELECT created_by FROM coordinator_credential WHERE cid = ?").get(who.cid)?.["created_by"] ?? null, kind: "coordinator" },
+            filedVia: `mcp:${who.name}`, filedBy: { name: store.handle.prepare("SELECT created_by FROM credential WHERE id = ? AND kind = 'coordinator'").get(who.cid)?.["created_by"] ?? null, kind: "coordinator" },
             admittedRepos: who.repos,
         }, now);
         if (!made.ok)

package/dist/desktop-update.d.ts

@@ -94,6 +94,7 @@ export declare function prepareDesktopUpdate(stateDir: string, installed: string
 export declare function sqliteLock(file: string, busyTimeoutMs?: number): DatabaseSync | null;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
+    version?: never;
     active: boolean;
     phase: string;
     detail: string;
@@ -107,7 +108,6 @@ export declare function desktopUpdateStatus(stateDir: string): {
     wasRunning?: never;
     backupPath?: never;
     updateId?: never;
-    version?: never;
     buildId?: never;
     workDir?: never;
 } | {

package/dist/dispose.js

@@ -707,10 +707,6 @@ export function maybeTriggerRepair(store, repo, evidenceRoot, sourceRunId, verdi
     };
     const briefBytes = Buffer.from(JSON.stringify(draftBrief, null, 2), "utf8");
     const key = writeEvidenceFile(evidenceRoot, sourceRunId, `repair-brief-${sourceRunId}-${attempt}.json`, briefBytes);
-    // Suffixes survive truncation (the CI-repair rule, verbatim): the prefix
-    // gives way, the identity-bearing tail never does.
-    const suffix = observation ? `-evidence-${attempt}` : `-fix-${attempt}`;
-    const draftId = `${rootTask.slice(0, 64 - suffix.length)}${suffix}`;
     // The draft files through the ONE revision boundary: the source's goal,
     // exclusions, touches, rubric, risk, quality, posture, budget, overrides
     // and pins are read from the SOURCE ROWS inside the seal — the scope
@@ -719,7 +715,6 @@ export function maybeTriggerRepair(store, repo, evidenceRoot, sourceRunId, verdi
         source: { task: ref.externalId, run: sourceRunId, scopeDigest: scope.digest },
         brief: { evidenceRoot, key, sha256: createHash("sha256").update(briefBytes).digest("hex"), bytes: briefBytes.length, capture: "machine-authored repair brief (exit 0)" },
         child: {
-            id: draftId,
             title: observation ? `Collect missing evidence for ${ref.externalId}` : verification === undefined ? `repair ${ref.externalId}: ${unresolved.length} criteri${unresolved.length === 1 ? "on" : "a"} unmet` : `Fix failed checks for ${ref.externalId}`,
             repair: observation ? `Collect only the missing observations for ${unresolved.join(", ")}. Keep the saved candidate unchanged. The machine runs supported focused test observations and reuses its intact passing gate; a fresh review assesses the added evidence.` : verification === undefined ? `repair exactly the unmet criteria named below; a comment cannot widen the scope. Unmet: ${unresolved.join(", ")}.` : "Diagnose the saved failed project check and repair within the original scope. Preserve the acceptance criteria and verification command; the revision brief binds the exact failure evidence.",
         },

package/dist/export.js

@@ -33,7 +33,7 @@ const SECRET_TABLES = new Set(["web_session", "ceremony_nonce", "chat_pair", "oa
 const DERIVED_TABLE = /^(sqlite_|memory_search)/;
 /** Columns that hold a secret (or what stands in for one): never exported. */
 const SECRET_COLUMNS = new Set([
-    "api_token.secret_hash", "lead_credential.secret_hash", "approver.credential_hash", "coordinator_credential.credential_hash", "runner.credential_hash", "invite.token_hash",
+    "credential.secret_hash", "approver.credential_hash", "runner.credential_hash", "invite.token_hash",
     "flow_trigger.hook_hash", "push_subscription.endpoint", "push_subscription.p256dh", "push_subscription.auth",
     "chat_turn.credential_key", "lead_session.credential_key", "mate_turn.credential_key", "chat_runtime.push_url", "workflow_preview.token",
     "quota.credential_fp", "oauth_grant.renew_hash", "oauth_client.source_hash",
@@ -56,7 +56,7 @@ export function categoryOf(table) {
         [/^subagent/, "subagents"],
         [/^(flow|workflow_)/, "flows"],
         [/^(chat_|lead_|team_|notification|push_)/, "chats"],
-        [/^(approver|api_token|lead_credential|invite|sso_identity|coordinator_|oauth_)/, "people"],
+        [/^(approver|credential$|invite|sso_identity|coordinator_|oauth_)/, "people"],
         [/^(run|artifact|claim|worktree$|execution_slot|criterion_review|diff_comment|proof_|review_request|repair_chain|incident|publication$|merge_|side_spend|knowledge_snapshot|learning_snapshot|skill_snapshot)/, "runs"],
         [/^(task|hold$|plan_|scope_|tool_seal|decision|external_|skill_test)/, "tasks"],
         [/^(project|approval_policy|capability|verify_command|worktree_setup|backend_grant|intake_grant|publication_grant|operating_mode|knowledge_|learning_|memory_|skill_)/, "projects"],

package/dist/lead-status.d.ts

@@ -105,7 +105,7 @@ export declare function repairStaleStatuses(store: Store, now: Date): {
  * `repos`: the only projects to report (a remote person limited to some projects); null is the whole installation.
  * A limited report counts only those projects' tasks and leaves out what belongs to the installation as a whole:
  * the release check, plan windows and the lead line are empty, never another project's. */
-export declare function installationStatus(store: Store, now: Date, viewer?: string | null, repos?: readonly string[] | null): InstallationStatus;
+export declare function installationStatus(store: Store, now: Date, viewer?: string | null, repos?: readonly string[] | null, root?: string): InstallationStatus;
 /** `limited`: a report over some projects (installationStatus's `repos`), which has no release check or plan windows to state. */
 export declare function renderInstallationStatus(status: InstallationStatus, limited?: boolean): string[];
 export declare function renderTaskWait(snapshot: TaskWaitSnapshot, outcome?: string): string;

package/dist/lead-status.js

@@ -183,7 +183,7 @@ export function repairStaleStatuses(store, now) {
  * `repos`: the only projects to report (a remote person limited to some projects); null is the whole installation.
  * A limited report counts only those projects' tasks and leaves out what belongs to the installation as a whole:
  * the release check, plan windows and the lead line are empty, never another project's. */
-export function installationStatus(store, now, viewer = currentActor()?.account ?? null, repos = null) {
+export function installationStatus(store, now, viewer = currentActor()?.account ?? null, repos = null, root) {
     const admitted = (row) => repos === null || typeof row["repo"] === "string" && repos.includes(row["repo"]);
     const access = { principal: "operator", repos, includeUnplaced: repos === null };
     const runningRows = store.handle.prepare(`SELECT run.id, run.role, run.phase, ref.id AS task_ref, ref.external_id AS task, ref.repo
@@ -262,7 +262,7 @@ export function installationStatus(store, now, viewer = currentActor()?.account
             observedAt: String(row["observed_at"]),
         })),
         signIn: pauses.map(one => ({ provider: one.provider, reason: signInReason(one), command: signInCommand(one), since: one.openedAt })),
-        tasks: workIndexPage(store, now, { ...access, viewer }, { limit: 8 }).items
+        tasks: workIndexPage(store, now, { ...access, viewer }, { limit: 8, ...(root === undefined ? {} : { root }) }).items
             .map(one => ({ task: one.rootId, title: one.title, headline: one.status.label, sentence: one.status.detail })),
         lead: repos !== null ? null : (() => {
             // Only the asker's own lead: another person's lead is never "Your lead".

package/dist/mcp-http.js

@@ -1,6 +1,6 @@
 import { adapterPolicy } from "./server/route-policy.js";
 import { PACKAGE_VERSION } from "./version.js";
-import { parseApiToken, secretMatches, tokenLive, tokenProjects } from "./api-tokens.js";
+import { tokenLive, tokenProjects } from "./api-tokens.js";
 import { oauthProjects, oauthTokenAllowed, RESOURCE_PATH } from "./mcp-oauth.js";
 import { authenticateCoordinator } from "./coordinator.js";
 import { LEGACY, MAX_REQUEST, META_CAPABILITIES, META_SERVER, META_VERSION, MODERN, TOOLS, UNSUPPORTED_VERSION, callCoordinatorTool, capabilitiesShape, readMessage, shapeResult, toolsPayload, } from "./mcp-core.js";
@@ -26,10 +26,10 @@ export function createMcpHttp(options) {
         if (presented.startsWith("so_")) {
             if (!options.signedIn(request))
                 return null;
-            const parsed = parseApiToken(presented);
-            const kept = parsed === null ? null : store.apiTokenSecret(parsed.id);
-            // The secret is checked here too, so this door never rests on how signedIn reads the request.
-            if (parsed === null || kept === null || !secretMatches(parsed.secret, kept.secretHash))
+            // The secret is checked here too (the one credential check), so this door never rests on how signedIn reads the request.
+            const found = store.presentedCredential(presented);
+            const kept = found?.kind === "person" ? store.apiTokenSecret(found.id) : null;
+            if (kept === null)
                 return null;
             if (!tokenLive(kept.row, options.clock().getTime()))
                 return null;

package/dist/operate.js

@@ -96,7 +96,8 @@ import { deleteProject, holdingsWords, projectHoldings, projectRunning } from ".
 import { pushPass } from "./push.js";
 import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, openSync, readFileSync, readSync, realpathSync, renameSync, unlinkSync, writeSync, writeFileSync } from "node:fs";
 import { BRANCH_PREFIX, envTwins, envValue, existingOrFirst, taskBranches } from "./names.js";
-import { claimActor, currentActor, parseLeadToken, withActor } from "./actor.js";
+import { claimActor, currentActor, withActor } from "./actor.js";
+import { parseLeadToken } from "./api-tokens.js";
 import { CLI_PASSWORD_SOURCE, withPasswordSource } from "./sign-in-guard.js";
 import { admissionRecorded, admitProject, commandLineActor } from "./project-admission.js";
 import { leadClaim, leadSay, noteLeadWork } from "./lead-voice.js";
@@ -179,7 +180,7 @@ import { CHAT_APPROVE_ALL, presetTerms, modeTermsJson, modeDigestOf, modeTermsFr
 import { WorktreePool } from "./worktree.js";
 import { requestTaskStop, resumeTaskStop, taskControlOf } from "./task-control.js";
 import { worktreeAdoptionNotice } from "./worktree-notices.js";
-import { workIndexPage, WorkIndexCursorError } from "./work-index.js";
+import { workIndexPage, workIndexTask, WorkIndexCursorError } from "./work-index.js";
 import { readExecutorOf } from "./read-executor.js";
 import { parseWorkView } from "./workspace-ui.js";
 import { taskWorkSummaryOf } from "./work-summary.js";
@@ -8307,10 +8308,10 @@ async function statusCommand(positional, flags, context) {
     // that belongs to the installation or other projects (updates, integrations, builds by project, unsent replies).
     const lens = context.principal?.lens ?? null;
     if (lens !== null) {
-        const status = installationStatus(context.store, context.clock(), viewer, lens);
+        const status = installationStatus(context.store, context.clock(), viewer, lens, context.evidenceRoot);
         return succeed(context.write, context.json, command, { ...status, projects: [] }, () => renderInstallationStatus(status, true));
     }
-    const status = installationStatus(context.store, context.clock(), viewer);
+    const status = installationStatus(context.store, context.clock(), viewer, null, context.evidenceRoot);
     // One line, only when a newer Toolroll exists; offline or switched off says nothing.
     const current = PACKAGE_VERSION;
     const method = installMethod(context.installBin);
@@ -8927,6 +8928,7 @@ function listTasks(flags, context) {
         view: parseWorkView(rawView ?? null), limit, cursor: text(flags, 'cursor') ?? null,
         ...(wanted === undefined ? {} : { state: wanted }),
         ...(text(flags, 'repo') === undefined ? {} : { project: text(flags, 'repo') }),
+        root: context.evidenceRoot,
     };
     const refused = (error) => {
         if (!(error instanceof WorkIndexCursorError))
@@ -8990,10 +8992,18 @@ function showTask(positional, context) {
         const repo = store.lookupRef(blocker)?.repo;
         return repo != null && lens.includes(repo);
     });
+    const work = taskWorkSummaryOf(store, id, now, access);
+    const current = assignmentOf(store, id, now, access, context.evidenceRoot);
+    // Read the same saved facts and statusOf path as task list. File health remains
+    // in the assignment diagnostics and action-time guards; it cannot rewrite history.
+    const listed = workIndexTask(store, id, now, access, context.evidenceRoot);
+    const shared = listed === null ? null : { headline: listed.status.label, sentence: listed.status.detail };
+    const primaryAction = listed === null ? work?.primaryAction ?? null : listed.primaryAction;
     const detail = {
         task,
-        work: taskWorkSummaryOf(store, id, now, access),
-        assignment: assignmentBrief(assignmentOf(store, id, now, access, context.evidenceRoot)),
+        work: work === null || listed === null ? work : { ...work, status: { ...work.status, label: listed.status.label, detail: listed.status.detail, tone: listed.status.tone }, primaryAction },
+        status: shared === null ? null : { headline: shared.headline, sentence: shared.sentence },
+        assignment: assignmentBrief(current),
         ref: ref.id,
         // One phrase for every inaccessible blocker, so even their number stays private.
         blockedBy: visibleBlockers.length === blockers.length ? visibleBlockers : [...visibleBlockers, "a task in another project"],
@@ -9033,8 +9043,8 @@ function showTask(positional, context) {
         `${task.id}  ${task.state}${ref.deliverable === "report" ? "  (scout — delivers a report)" : ""}`,
         `  ${task.title}`,
         ...(detail.work === null ? [] : [
-            `  status: ${detail.work.status.label}`,
-            ...(detail.work.primaryAction === null ? [] : [`  next: ${detail.work.primaryAction.label}${detail.work.primaryAction.target.decisionId === null ? "" : ` — decision #${detail.work.primaryAction.target.decisionId}`}`]),
+            `  status: ${shared?.headline ?? detail.work.status.label}${shared === null ? "" : ` — ${shared.sentence}`}`,
+            ...(primaryAction === null ? [] : [`  next: ${primaryAction.label}${primaryAction.target.decisionId === null ? "" : ` — decision #${primaryAction.target.decisionId}`}`]),
         ]),
         // The closed machine-authored verdict (Priority 2), computed once at
         // completion — never re-derived here. Same words `verdictWords`
@@ -9042,7 +9052,7 @@ function showTask(positional, context) {
         ...(task.state !== "done" || detail.proofVerdict === null
             ? []
             : [
-                `  proof: ${proofVerdictWords(detail.proofVerdict, detail.proofReasons).word}${detail.proofAccepted ? " (accepted)" : ""}`,
+                `  proof: ${proofVerdictWords(current?.receipt?.runId === latestFinished?.id ? current?.readiness?.verdict ?? detail.proofVerdict : detail.proofVerdict, detail.proofReasons).word}${detail.proofAccepted ? " (accepted)" : ""}`,
                 ...(detail.proofReasons.length > 0 ? [`    ${detail.proofReasons.join("; ")}`] : []),
                 ...matrixWords(detail.proofMatrix),
                 ...(detail.semanticCoverage === null ? [] : coverageWords(detail.semanticCoverage).map(line => `  ${line}`)),

package/dist/password-bearer.d.ts

@@ -0,0 +1,27 @@
+/**
+ * D7: a password on each request (`Authorization: Bearer <name>:<password>`) is deprecated. This release still
+ * accepts it everywhere it was accepted, with the same per-address tries, locks and budgets, but every answer carries
+ * a deprecation warning, and every refusal of such a request names the replacement: an API token. From
+ * PASSWORD_BEARER_REFUSED_FROM on, the server refuses it before checking the password.
+ */
+import type { ServerResponse } from "node:http";
+/** The one replacement every machine-credential refusal names. */
+export declare const TOKEN_REPLACEMENT = "Create an API token with `toolroll tokens create`";
+/** The first release that refuses a password on a request: one release after this one (0.9.58) deprecated it. */
+export declare const PASSWORD_BEARER_REFUSED_FROM = "0.9.59";
+export declare const PASSWORD_BEARER_WARNING = "Signing in with a password on each request is deprecated and stops working in Toolroll 0.9.59. Create an API token with `toolroll tokens create` and send it as the bearer instead.";
+/** What the CLI says on stderr when a saved connection signs in with a password instead of an API token. */
+export declare const PASSWORD_PROFILE_WARNING = "Warning: this connection signs in with your password on each request, which is deprecated and stops working in Toolroll 0.9.59. Create an API token with `toolroll tokens create`, then connect again with --token-stdin.";
+export declare const PASSWORD_BEARER_REFUSED = "Toolroll no longer accepts a password on a request. Create an API token with `toolroll tokens create` and send it as the bearer instead.";
+/** Whether an Authorization header is a password bearer: a name and a secret, never an API token. */
+export declare function isPasswordBearer(authorization: string | undefined): boolean;
+/** Whether this build still accepts a password bearer: only a release before PASSWORD_BEARER_REFUSED_FROM does. */
+export declare function passwordBearerAccepted(version?: string): boolean;
+/** A refusal's words for this request: unchanged, or with the replacement when it came with a password bearer. */
+export declare function withReplacement(authorization: string | undefined, message: string): string;
+/**
+ * The refusal boundary for one password-bearer request, whichever adapter answers it: the deprecation is announced in
+ * headers (RFC 9745 Deprecation, and a Warning naming the replacement), and any refusal's words, plain text or a JSON
+ * `message`, gain the replacement. Successful answers are left byte for byte.
+ */
+export declare function announcePasswordBearer(response: ServerResponse): void;

package/dist/password-bearer.js

@@ -0,0 +1,59 @@
+import { PACKAGE_VERSION } from "./version.js";
+/** The one replacement every machine-credential refusal names. */
+export const TOKEN_REPLACEMENT = "Create an API token with `toolroll tokens create`";
+/** The first release that refuses a password on a request: one release after this one (0.9.58) deprecated it. */
+export const PASSWORD_BEARER_REFUSED_FROM = "0.9.59";
+export const PASSWORD_BEARER_WARNING = `Signing in with a password on each request is deprecated and stops working in Toolroll ${PASSWORD_BEARER_REFUSED_FROM}. ${TOKEN_REPLACEMENT} and send it as the bearer instead.`;
+/** What the CLI says on stderr when a saved connection signs in with a password instead of an API token. */
+export const PASSWORD_PROFILE_WARNING = `Warning: this connection signs in with your password on each request, which is deprecated and stops working in Toolroll ${PASSWORD_BEARER_REFUSED_FROM}. ${TOKEN_REPLACEMENT}, then connect again with --token-stdin.`;
+export const PASSWORD_BEARER_REFUSED = `Toolroll no longer accepts a password on a request. ${TOKEN_REPLACEMENT} and send it as the bearer instead.`;
+/** Whether an Authorization header is a password bearer: a name and a secret, never an API token. */
+export function isPasswordBearer(authorization) {
+    return authorization !== undefined && /^Bearer (.+):(.+)$/.test(authorization) && !/^Bearer so_/.test(authorization);
+}
+const parts = (version) => (/^(\d+)\.(\d+)\.(\d+)/.exec(version) ?? [0, 0, 0, 0]).slice(1).map(Number);
+/** Whether this build still accepts a password bearer: only a release before PASSWORD_BEARER_REFUSED_FROM does. */
+export function passwordBearerAccepted(version = PACKAGE_VERSION) {
+    const have = parts(version), limit = parts(PASSWORD_BEARER_REFUSED_FROM);
+    for (let index = 0; index < 3; index++)
+        if (have[index] !== limit[index])
+            return have[index] < limit[index];
+    return false;
+}
+/** A refusal's words for this request: unchanged, or with the replacement when it came with a password bearer. */
+export function withReplacement(authorization, message) {
+    return !isPasswordBearer(authorization) || message.includes("toolroll tokens create") ? message : `${message} ${PASSWORD_BEARER_WARNING}`;
+}
+/**
+ * The refusal boundary for one password-bearer request, whichever adapter answers it: the deprecation is announced in
+ * headers (RFC 9745 Deprecation, and a Warning naming the replacement), and any refusal's words, plain text or a JSON
+ * `message`, gain the replacement. Successful answers are left byte for byte.
+ */
+export function announcePasswordBearer(response) {
+    response.setHeader("Deprecation", "true");
+    response.setHeader("Warning", `299 toolroll "${PASSWORD_BEARER_WARNING.replace(/"/g, "'")}"`);
+    const end = response.end.bind(response);
+    response.end = ((...args) => {
+        const [chunk] = args;
+        if (response.statusCode >= 400 && typeof chunk === "string" && !chunk.includes("toolroll tokens create"))
+            args[0] = annotated(chunk);
+        return end(...args);
+    });
+}
+function annotated(body) {
+    if (/^\s*\{/.test(body)) {
+        try {
+            const value = JSON.parse(body);
+            if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+                const row = value;
+                if (typeof row["message"] === "string")
+                    return JSON.stringify({ ...row, message: `${row["message"]} ${PASSWORD_BEARER_WARNING}` });
+                if (typeof row["error_description"] === "string")
+                    return JSON.stringify({ ...row, error_description: `${row["error_description"]} ${PASSWORD_BEARER_WARNING}` });
+            }
+        }
+        catch { /* not JSON after all: plain text below */ }
+        return body;
+    }
+    return body.trimStart().startsWith("<") ? body : `${body.replace(/\s+$/, "")}\n${PASSWORD_BEARER_WARNING}`;
+}

package/dist/proof.d.ts

@@ -437,6 +437,15 @@ export declare function matrixWords(matrix: readonly CriterionMatrixRow[]): stri
 /** One criterion's context standing in words — shared by the CLI matrix
  * and the console badge title so the two never drift. */
 export declare function coverageStateWords(coverage: CriterionCoverage): string;
+/** The verdict a result shows today, read from the stored one and the facts recorded since, never written back: a
+ * failed check or an unresolved HIGH review finding refutes; a pending review, or any acceptance criterion that has
+ * not passed, keeps it short. It only ever lowers the stored verdict. */
+export declare function shownVerdictOf(stored: ProofVerdict | null, facts: {
+    checkFailed: boolean;
+    highFindings: number;
+    reviewPending: boolean;
+    criteriaPassed: boolean;
+}): ProofVerdict | null;
 /** Plain words for a verdict, shared by every surface (the `summary.ts`
  * pattern) so the task page, run page, board, CLI, and chat cannot say
  * three different things about the same run. */

package/dist/proof.js

@@ -976,6 +976,18 @@ export function coverageStateWords(coverage) {
             return `GAP — inherited context is missing: ${coverage.gaps.join("; ")}${coverage.items.length > 0 ? ` (partial: ${coverage.items.join(", ")})` : ""}${prior}`;
     }
 }
+/** The verdict a result shows today, read from the stored one and the facts recorded since, never written back: a
+ * failed check or an unresolved HIGH review finding refutes; a pending review, or any acceptance criterion that has
+ * not passed, keeps it short. It only ever lowers the stored verdict. */
+export function shownVerdictOf(stored, facts) {
+    if (facts.checkFailed || facts.highFindings > 0 || stored === "refuted")
+        return "refuted";
+    if (stored === null)
+        return null;
+    if (facts.reviewPending || !facts.criteriaPassed)
+        return "short";
+    return stored;
+}
 /** Plain words for a verdict, shared by every surface (the `summary.ts`
  * pattern) so the task page, run page, board, CLI, and chat cannot say
  * three different things about the same run. */

package/dist/release-coverage.d.ts

@@ -0,0 +1,16 @@
+import type { Store } from "./store.js";
+export type ReleaseCoverage = {
+    run: number;
+    head: string;
+};
+/** How many of the newest passing release checks one read considers. */
+export declare const RELEASE_SCAN_LIMIT = 20;
+export type IsAncestor = (repo: string, ancestor: string, descendant: string) => boolean | null;
+/** `git merge-base --is-ancestor`: true, false, or null when Git couldn't say. */
+export declare const gitIsAncestor: IsAncestor;
+export type ReleaseMemo = Map<string, ReleaseCoverage[]>;
+/** The release check covering `head` in `repo`, or null. `memo` keeps one read's receipts. */
+export declare function releaseCoverageOf(store: Store, root: string | undefined, repo: string | null, head: string | null, options?: {
+    memo?: ReleaseMemo;
+    isAncestor?: IsAncestor;
+}): ReleaseCoverage | null;

package/dist/release-coverage.js

@@ -0,0 +1,92 @@
+/** Whether a release check already covers a result whose checks were Off: a
+ * passing FULL release check (run_check.release) on the same project whose
+ * checked commit contains the result's commit. Read at read time from the
+ * existing records and Git; nothing is written back, so no proof, receipt,
+ * scope digest or schema changes. Fails closed: a receipt that can't be read,
+ * a missing commit or any Git error leaves the result uncovered. */
+import { execFileSync } from "node:child_process";
+import { verificationEvidence } from "./verification-evidence.js";
+import { runCheckLevel } from "./check-levels.js";
+/** How many of the newest passing release checks one read considers. */
+export const RELEASE_SCAN_LIMIT = 20;
+const SHA = /^[a-f0-9]{40}$/;
+/** Ancestry between two fixed commits never changes, so a settled answer is kept; errors are not. */
+const ancestry = new Map();
+const ANCESTRY_LIMIT = 4096;
+/** `git merge-base --is-ancestor`: true, false, or null when Git couldn't say. */
+export const gitIsAncestor = (repo, ancestor, descendant) => {
+    if (!SHA.test(ancestor) || !SHA.test(descendant))
+        return null;
+    if (ancestor === descendant)
+        return true;
+    const key = `${repo}\0${ancestor}\0${descendant}`;
+    const known = ancestry.get(key);
+    if (known !== undefined)
+        return known;
+    let answer;
+    try {
+        execFileSync("git", ["-C", repo, "merge-base", "--is-ancestor", ancestor, descendant], { stdio: "ignore", timeout: 5_000 });
+        answer = true;
+    }
+    catch (error) {
+        // Exit 1 is Git's "no"; anything else (a missing object, no repository, a timeout) is no answer.
+        answer = error.status === 1 ? false : null;
+    }
+    if (answer !== null) {
+        if (ancestry.size >= ANCESTRY_LIMIT)
+            ancestry.clear();
+        ancestry.set(key, answer);
+    }
+    return answer;
+};
+/** The newest passing full release checks of one project, each with its sealed, verified commit. Read once per
+ * caller-held memo, so a list of results reads the receipts once. */
+function passingReleases(store, root, repo) {
+    let rows;
+    try {
+        rows = store.handle.prepare(`SELECT rc.run FROM run_check AS rc INDEXED BY run_check_release
+      JOIN run ON run.id = rc.run JOIN task_ref AS ref ON ref.id = run.task_ref
+      WHERE rc.release = 1 AND rc.status = 'passed' AND rc.exit_code = 0 AND ref.repo = ?
+      ORDER BY rc.run DESC LIMIT ${RELEASE_SCAN_LIMIT}`).all(repo);
+    }
+    catch {
+        return [];
+    }
+    return rows.flatMap(row => {
+        const run = Number(row["run"]);
+        try {
+            // Full only: a quick or Off release check covers nothing.
+            const level = runCheckLevel(store, run);
+            if (level !== null && level !== "full")
+                return [];
+            const gate = verificationEvidence(store, root, run);
+            if (!gate.ok || gate.bytes === null)
+                return [];
+            const receipt = JSON.parse(gate.bytes);
+            const head = store.getRun(run)?.headRevision ?? null;
+            if (receipt.run !== run || receipt.result?.ran !== true || receipt.result.exitCode !== 0)
+                return [];
+            if (typeof receipt.command?.repo === "string" && receipt.command.repo.startsWith("quick:"))
+                return [];
+            if (typeof receipt.head !== "string" || !SHA.test(receipt.head) || receipt.head !== head)
+                return [];
+            return [{ run, head: receipt.head }];
+        }
+        catch {
+            return [];
+        }
+    });
+}
+/** The release check covering `head` in `repo`, or null. `memo` keeps one read's receipts. */
+export function releaseCoverageOf(store, root, repo, head, options = {}) {
+    if (root === undefined || repo === null || head === null || !SHA.test(head))
+        return null;
+    const memo = options.memo ?? new Map();
+    let releases = memo.get(repo);
+    if (releases === undefined) {
+        releases = passingReleases(store, root, repo);
+        memo.set(repo, releases);
+    }
+    const isAncestor = options.isAncestor ?? gitIsAncestor;
+    return releases.find(one => isAncestor(repo, head, one.head) === true) ?? null;
+}

package/dist/remote-command.js

@@ -34,8 +34,6 @@ export const REMOTE_PATH_ARGUMENTS = [
     ...['link', 'unlink'].map(invocation => ({ invocation, argument: { flag: '--to' }, policy: 'refuse' })),
     ...['repos add', 'repos remove', 'pulls', 'graph', ''].map(invocation => ({ invocation, argument: { position: 0, name: 'path', rest: true }, policy: 'refuse' })),
     { invocation: 'project use', argument: { position: 0, name: 'checkout path' }, policy: 'refuse' },
-    // These local HTTP clients read prompts themselves; they do not consume runOperateAs's files map.
-    ...['session start', 'session send'].map(invocation => ({ invocation, argument: { flag: '--file' }, policy: 'refuse' })),
 ];
 /**
  * Parse once using declared arity, so a flag's value cannot be mistaken for another flag or a

package/dist/remote-exec.d.ts

@@ -1,4 +1,5 @@
 import { type TeamCliOptions } from './team-cli.js';
+import { type CliRequest } from './cli-http.js';
 import { type RemoteCommandLookup } from './remote-command.js';
 export { contractRow, STEP_UP_MESSAGE, type RemoteMode } from './remote-command.js';
 export type RemoteExecOptions = TeamCliOptions & {
@@ -9,6 +10,24 @@ export type RemoteExecOptions = TeamCliOptions & {
     /** Injected by tests: the contract row lookup (default: COMMAND_GUIDE's `remote` field). */
     modeOf?: RemoteCommandLookup;
 };
+type Answer = {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+};
+export type Outcome = {
+    kind: 'answer';
+    answer: Answer;
+} | {
+    kind: 'refused';
+    status: number;
+    code: string;
+    message: string;
+} | {
+    kind: 'unconfirmed';
+};
+/** One request, never retried. */
+export declare function postCli(origin: string, token: string, request: CliRequest, options: RemoteExecOptions): Promise<Outcome>;
 /**
  * null: run locally with argv unchanged. `{ local }`: run locally with this argv (`--local` removed).
  * A number: the command ran remotely (or was refused before sending) and this is its exit code.