toolroll 0.9.57 → 0.9.58

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.9.58 — 2026-10-09
+
+- **One token kind.** Personal, lead and coordinator tokens now live in one
+  table with one check. Existing tokens keep working.
+- **Sessions join the CLI API.** The sessions API is now part of the CLI API.
+- **Passwords as tokens warn.** Sending your password as a token still works
+  this release but warns. Create a token with `toolroll tokens create`.
+
 ## 0.9.57 — 2026-10-09
 
 - **Truthful status.** Finished tasks read Complete everywhere. With checks

package/dist/action-ledger.js

@@ -63,10 +63,6 @@ CREATE TRIGGER IF NOT EXISTS ledger_task_placed AFTER UPDATE OF repo ON task_ref
 WHEN OLD.repo IS NOT NEW.repo BEGIN
   ${event("strftime('%Y-%m-%dT%H:%M:%fZ','now')", "'system'", "NEW.repo", "NEW.external_id", "NULL", "task placed", "'recorded'")}
 END;
-CREATE TRIGGER IF NOT EXISTS ledger_coordinator_minted AFTER INSERT ON coordinator_credential BEGIN
-  INSERT INTO action_ledger(at,actor,repo,task_id,run_id,action,outcome,source,detail) VALUES (NEW.created_at, NEW.created_by, NULL, NULL, NULL,
-    'coordinator minted: ' || NEW.name, 'minted', 'access', 'projects: ' || NEW.repos);
-END;
 CREATE TRIGGER IF NOT EXISTS ledger_task_registered AFTER INSERT ON task_ref BEGIN
   ${event("strftime('%Y-%m-%dT%H:%M:%fZ','now')", "'system'", "NEW.repo", "NEW.external_id", "NULL", "task registered", "'recorded'")}
 END;

package/dist/actor.d.ts

@@ -9,13 +9,3 @@ export declare function currentActor(): Actor | null;
 export declare function claimActor(account: string): void;
 /** How the ledger names an actor. */
 export declare function actorLabel(actor: Actor): string;
-export declare function mintLeadToken(): {
-    id: string;
-    token: string;
-    hash: string;
-};
-export declare function parseLeadToken(presented: string): {
-    id: string;
-    secret: string;
-} | null;
-export declare function leadSecretMatches(secret: string, keptHash: string): boolean;

package/dist/actor.js

@@ -2,7 +2,7 @@
  * Who is acting right now, for pings that follow responsibility.
  *
  * A lead is an agent acting for one person under a lead token (`toolroll lead
- * token`): it signs in as that person, and its acts are recorded as "lead for
+ * token`, a `credential` row of kind 'lead', api-tokens.ts): it signs in as that person, and its acts are recorded as "lead for
  * <owner>". A person acting for themselves is recorded by name. Work whose
  * actor is the lead pings nobody, and nobody is pinged about their own act.
  *
@@ -10,7 +10,6 @@
  * long-running service: a worker's facts are nobody's act.
  */
 import { AsyncLocalStorage } from "node:async_hooks";
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 /** The slot is mutable so a command can name its person after it has verified their password. */
 const slot = new AsyncLocalStorage();
 /** Run `fn` with this actor (or an empty slot a verified sign-in may fill). */
@@ -30,19 +29,3 @@ export function claimActor(account) {
 export function actorLabel(actor) {
     return actor.lead ? `lead for ${actor.account}` : actor.account;
 }
-// ---- the lead token ---------------------------------------------------------
-/** `lt_<id>_<secret>`: shown once, only its hash kept. */
-const SHAPE = /^lt_([a-f0-9]{12})_([A-Za-z0-9_-]{43})$/;
-export function mintLeadToken() {
-    const id = randomBytes(6).toString("hex"), secret = randomBytes(32).toString("base64url");
-    return { id, token: `lt_${id}_${secret}`, hash: hashLeadSecret(secret) };
-}
-const hashLeadSecret = (secret) => createHash("sha256").update(secret, "utf8").digest("hex");
-export function parseLeadToken(presented) {
-    const match = SHAPE.exec(presented.trim());
-    return match === null ? null : { id: match[1], secret: match[2] };
-}
-export function leadSecretMatches(secret, keptHash) {
-    const a = Buffer.from(hashLeadSecret(secret), "hex"), b = Buffer.from(keptHash, "hex");
-    return a.length === b.length && timingSafeEqual(a, b);
-}

package/dist/api-tokens.d.ts

@@ -1,5 +1,7 @@
 export type TokenAccess = "read" | "act";
 export type TokenPurpose = "api" | "mcp";
+/** Who a credential stands for: a person (their API token), a person's lead, or a coordinator. */
+export type CredentialKind = "person" | "lead" | "coordinator";
 export declare const MCP_ROTATION_REFUSAL = "Reconnect the MCP client to renew this token. You can still revoke it here.";
 /** Missing purpose is an old ordinary token; an unrecognised stored purpose is never treated as ordinary. */
 export declare const tokenPurpose: (value: unknown) => TokenPurpose;
@@ -7,18 +9,47 @@ export declare const tokenRotationProblem: (token: {
     purpose: TokenPurpose;
 }) => string | null;
 export declare const TOKEN_DAYS: readonly [30, 90, 365];
-export declare function mintApiToken(): {
+/** What a presented secret says it is, before any check. A coordinator's secret has no prefix and is hashed whole. */
+export type PresentedCredential = {
+    kind: "person" | "lead";
+    id: string;
+    secret: string;
+} | {
+    kind: "coordinator";
+    secret: string;
+};
+/** A new credential of `kind`: its id, the secret shown once, and the only thing kept, its hash. */
+export declare function mintCredential(kind: CredentialKind): {
     id: string;
     secret: string;
     token: string;
     hash: string;
 };
 export declare const hashSecret: (secret: string) => string;
-/** The id and secret of something shaped like a token, or null. */
+/** Read a presented credential's kind and parts; null for nothing at all. A lead token may carry surrounding space. */
+export declare function parseCredential(presented: string): PresentedCredential | null;
+export declare const mintApiToken: () => {
+    id: string;
+    secret: string;
+    token: string;
+    hash: string;
+};
+export declare const mintLeadToken: () => {
+    id: string;
+    secret: string;
+    token: string;
+    hash: string;
+};
+/** The id and secret of something shaped like an API token, or null. */
 export declare function parseApiToken(presented: string): {
     id: string;
     secret: string;
 } | null;
+/** The id and secret of something shaped like a lead token, or null. */
+export declare function parseLeadToken(presented: string): {
+    id: string;
+    secret: string;
+} | null;
 /** Whether the secret is the one whose hash was kept, in constant time. */
 export declare function secretMatches(secret: string, keptHash: string): boolean;
 /** v111: how long a rotated token keeps working beside its replacement, by default and at most. */

package/dist/api-tokens.js

@@ -1,8 +1,9 @@
 /**
- * API tokens (v101): what scripts and CI use instead of a password on each
- * request. A token belongs to one person, reads or acts (never more than the
- * person may), always expires (a year at most), is shown once, and only its
- * hash is kept. `Authorization: Bearer so_<id>_<secret>`.
+ * Machine credentials (D7, v118): one codec and one table (`credential`) for every kind. A person's API token is
+ * what scripts and CI use instead of a password on each request: it belongs to one person, reads or acts (never
+ * more than the person may), always expires (a year at most), is shown once, and only its hash is kept.
+ * `Authorization: Bearer so_<id>_<secret>`. A lead token (`lt_<id>_<secret>`) is an agent acting for its owner; a
+ * coordinator's secret (no prefix, hashed whole) files proposals over MCP. Each kind keeps its own policy.
  *
  * A token never passes a step-up: approvals and other password ceremonies
  * stay a person's act in the console.
@@ -13,16 +14,43 @@ export const MCP_ROTATION_REFUSAL = "Reconnect the MCP client to renew this toke
 export const tokenPurpose = (value) => value === undefined || value === "api" ? "api" : "mcp";
 export const tokenRotationProblem = (token) => token.purpose === "api" ? null : MCP_ROTATION_REFUSAL;
 export const TOKEN_DAYS = [30, 90, 365];
-const SHAPE = /^so_([a-f0-9]{12})_([A-Za-z0-9_-]{43})$/;
-export function mintApiToken() {
-    const id = randomBytes(6).toString("hex"), secret = randomBytes(32).toString("base64url");
-    return { id, secret, token: `so_${id}_${secret}`, hash: hashSecret(secret) };
+/** The prefixed shapes: so_ (a person's API token) and lt_ (a lead token), each `<prefix>_<12 hex>_<43 base64url>`. */
+const PRESENTED = /^(so|lt)_([a-f0-9]{12})_([A-Za-z0-9_-]{43})$/;
+const PREFIX = { person: "so", lead: "lt" };
+const CID_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
+/** A new credential of `kind`: its id, the secret shown once, and the only thing kept, its hash. */
+export function mintCredential(kind) {
+    const secret = randomBytes(32).toString("base64url");
+    if (kind === "coordinator") {
+        let id = "";
+        for (const byte of randomBytes(12))
+            id += CID_ALPHABET[byte % CID_ALPHABET.length];
+        return { id, secret, token: secret, hash: hashSecret(secret) };
+    }
+    const id = randomBytes(6).toString("hex");
+    return { id, secret, token: `${PREFIX[kind]}_${id}_${secret}`, hash: hashSecret(secret) };
 }
 export const hashSecret = (secret) => createHash("sha256").update(secret, "utf8").digest("hex");
-/** The id and secret of something shaped like a token, or null. */
+/** Read a presented credential's kind and parts; null for nothing at all. A lead token may carry surrounding space. */
+export function parseCredential(presented) {
+    if (presented === "")
+        return null;
+    const match = PRESENTED.exec(presented) ?? (/^lt_/.test(presented.trim()) ? PRESENTED.exec(presented.trim()) : null);
+    if (match !== null)
+        return { kind: match[1] === "so" ? "person" : "lead", id: match[2], secret: match[3] };
+    return { kind: "coordinator", secret: presented };
+}
+export const mintApiToken = () => mintCredential("person");
+export const mintLeadToken = () => mintCredential("lead");
+/** The id and secret of something shaped like an API token, or null. */
 export function parseApiToken(presented) {
-    const match = SHAPE.exec(presented);
-    return match === null ? null : { id: match[1], secret: match[2] };
+    const parsed = parseCredential(presented);
+    return parsed?.kind === "person" && PRESENTED.test(presented) ? { id: parsed.id, secret: parsed.secret } : null;
+}
+/** The id and secret of something shaped like a lead token, or null. */
+export function parseLeadToken(presented) {
+    const parsed = parseCredential(presented);
+    return parsed?.kind === "lead" ? { id: parsed.id, secret: parsed.secret } : null;
 }
 /** Whether the secret is the one whose hash was kept, in constant time. */
 export function secretMatches(secret, keptHash) {

package/dist/assignment-delivery.js

@@ -14,7 +14,7 @@ const ownerSql = `COALESCE((SELECT 'lead:'||o.lead FROM team_task_owner o WHERE
 function admittedRepos(store, owner) {
     if (owner.kind !== "coordinator" || typeof owner.id !== "string" || owner.id.length === 0)
         return null;
-    const row = store.handle.prepare("SELECT repos,revoked_at FROM coordinator_credential WHERE cid = ?").get(owner.id);
+    const row = store.handle.prepare("SELECT projects_json AS repos,revoked_at FROM credential WHERE id = ? AND kind = 'coordinator'").get(owner.id);
     if (!row || row["revoked_at"] !== null)
         return null;
     try {

package/dist/assignment-status.js

@@ -92,7 +92,7 @@ export function noteAssignmentStatus(store, snapshot, now) {
             const claimed = store.handle.prepare("SELECT actor FROM action_ledger WHERE task_id=? AND action='assignment claimed' AND source='work' ORDER BY id DESC LIMIT 1").get(snapshot.rootId);
             if ((claimed === undefined ? ref.coordinatorCid : String(claimed["actor"]).replace(/^coordinator:/, "")) !== owner.id)
                 return null;
-            const credential = store.handle.prepare("SELECT repos FROM coordinator_credential WHERE cid=? AND revoked_at IS NULL").get(owner.id);
+            const credential = store.handle.prepare("SELECT projects_json AS repos FROM credential WHERE id=? AND kind='coordinator' AND revoked_at IS NULL").get(owner.id);
             let repos;
             try {
                 repos = JSON.parse(String(credential?.["repos"] ?? "null"));

package/dist/assignment.js

@@ -73,7 +73,8 @@ function ownerOf(store, rootId, repo) {
     const id = claim === undefined ? origin : String(claim["actor"]).replace(/^coordinator:/, "");
     if (!id)
         return null;
-    const credential = store.handle.prepare("SELECT name,repos,revoked_at FROM coordinator_credential WHERE cid = ?").get(id);
+    // A ledger actor names a coordinator by the id it had when it acted (v118 keeps that as public_id).
+    const credential = store.handle.prepare("SELECT name,projects_json AS repos,revoked_at FROM credential WHERE kind = 'coordinator' AND (id = ? OR public_id = ?) ORDER BY id = ? DESC LIMIT 1").get(id, id, id);
     let repos = [];
     try {
         repos = JSON.parse(String(credential?.["repos"] ?? "[]"));
@@ -379,7 +380,7 @@ function readinessOf(store, receipt, repo, review) {
 function admittedOwner(store, taskId, owner, now, root) {
     if (owner.kind !== "coordinator")
         return null; // A stable lead is identity, not a bearer credential.
-    const row = store.handle.prepare("SELECT repos, revoked_at FROM coordinator_credential WHERE cid = ?").get(owner.id);
+    const row = store.handle.prepare("SELECT projects_json AS repos, revoked_at FROM credential WHERE id = ? AND kind = 'coordinator'").get(owner.id);
     if (row === undefined || row["revoked_at"] !== null)
         return null;
     let repos;

package/dist/cli-http.d.ts

@@ -3,6 +3,7 @@ import type { Store } from './store.js';
 import type { Principal } from './operate.js';
 import { type RemoteCommandLookup } from './remote-command.js';
 import { type Admission, type BudgetLimit } from './request-budget.js';
+import type { SessionRunner } from './session-remote.js';
 /**
  * `POST /api/cli` (remote CLI, Phase 1): a teammate's laptop sends the argv it would have run locally, and the central
  * server runs that same command as that person. There is no per-resource API here and no second policy: the transport
@@ -11,6 +12,10 @@ import { type Admission, type BudgetLimit } from './request-budget.js';
  *
  * Only `Authorization: Bearer so_…` is accepted — never a password, cookie or the owner's saved login — and a request
  * carrying a browser Origin is refused, so a page can never drive it.
+ *
+ * `session …` (D7) is the one command the server answers through its own owner rather than runOperateAs: native
+ * session operations need the server's live coding workspace (session-remote.ts). They are admitted, budgeted and
+ * refused here exactly like every other command.
  */
 /** Who a remote command runs as, and the runner: operate.ts's own types, so a change there breaks this build instead of
  * drifting. Type-only: the value is loaded lazily through `run` (operate.ts imports the server that imports this). */
@@ -45,6 +50,8 @@ export type CliHttpOptions = {
     modeOf?: RemoteCommandLookup | undefined;
     /** The token's request budget (request-budget.ts), charged once per request before its body is read. */
     admit?: ((principal: Principal) => Admission) | undefined;
+    /** Native session operations (`session …`), run by the server's session owner; absent where none is ready. */
+    session?: SessionRunner | undefined;
     store: Store;
 };
 /** Decode the request's shape and byte limits. The endpoint checks file references against its command policy. */

package/dist/cli-http.js

@@ -1,6 +1,7 @@
 import { adapterPolicy } from "./server/route-policy.js";
 import { contractRow, fileArguments, STEP_UP_MESSAGE } from './remote-command.js';
 import { limitWords } from './request-budget.js';
+import { TOKEN_REPLACEMENT } from './password-bearer.js';
 /** Inlined file contents, summed as UTF-8 bytes. */
 export const CLI_FILES_BYTES = 256 * 1024;
 /** The whole JSON body: the files plus argv and JSON escaping headroom. */
@@ -8,11 +9,15 @@ export const CLI_REQUEST_BYTES = 2 * CLI_FILES_BYTES;
 const ARGV_MAX = 256;
 const ARG_BYTES = 16 * 1024;
 const FILES_MAX = 16;
+/** What a missing or unusable token hears: how to get one, and how to save it. */
+const SIGN_IN = `Sign in with an API token: ${TOKEN_REPLACEMENT.charAt(0).toLowerCase()}${TOKEN_REPLACEMENT.slice(1)}, then toolroll connect <origin> --token-stdin.`;
 function send(response, status, value, headers = {}) {
     if (response.destroyed || response.writableEnded)
         return;
-    response.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff', ...headers });
-    response.end(JSON.stringify(value));
+    // A declared length: the client can tell a complete answer from a cut-off one.
+    const text = JSON.stringify(value);
+    response.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'content-length': String(Buffer.byteLength(text)), 'cache-control': 'no-store', 'x-content-type-options': 'nosniff', ...headers });
+    response.end(text);
 }
 async function body(request) {
     const chunks = [];
@@ -83,7 +88,7 @@ export async function handleCliHttp(request, response, options) {
     if (names.includes('cookie'))
         return reject(400, 'cookie-refused', 'Remote commands sign in with an API token only.');
     if (!/^Bearer so_\S+$/.test(request.headers.authorization ?? ''))
-        return reject(401, 'unauthenticated', 'Sign in with your API token: toolroll connect <origin> --token-stdin.');
+        return reject(401, 'unauthenticated', SIGN_IN);
     if (request.headers['content-type']?.split(';')[0]?.trim() !== 'application/json')
         return reject(415, 'invalid-content-type', 'Send application/json.');
     if (Number(request.headers['content-length'] ?? 0) > CLI_REQUEST_BYTES)
@@ -96,7 +101,7 @@ export async function handleCliHttp(request, response, options) {
         return reject(503, 'authentication-unavailable', 'Sign-in could not be checked.');
     }
     if (!principal)
-        return reject(401, 'unauthenticated', 'This API token is not valid (expired, revoked or its person removed).');
+        return reject(401, 'unauthenticated', `This API token is not valid (expired, revoked or its person removed). ${TOKEN_REPLACEMENT}.`);
     // Counted once here, however long the command then holds the request (a task wait is one request).
     const admitted = options.admit === undefined ? { ok: true } : options.admit(principal);
     if (!admitted.ok && admitted.status === 503)
@@ -118,6 +123,8 @@ export async function handleCliHttp(request, response, options) {
     const parsed = cliRequest(value);
     if ('problem' in parsed)
         return reject(parsed.tooLarge ? 413 : 400, 'invalid-request', parsed.problem);
+    if (parsed.argv[0] === 'session')
+        return runSession(response, options, principal, parsed);
     const row = (options.modeOf ?? contractRow)(parsed.argv);
     if (row?.mode === 'step-up')
         return reject(403, 'step-up', STEP_UP_MESSAGE);
@@ -154,3 +161,22 @@ export async function handleCliHttp(request, response, options) {
     send(response, 200, { exitCode, stdout: out.join(''), stderr: '' });
     return true;
 }
+/** `session …`: the prompt is the request's one file; the session owner answers one session envelope on stdout. */
+async function runSession(response, options, principal, parsed) {
+    const refuse = (status, code, message) => { send(response, status, { ok: false, code, message }); return true; };
+    if (options.session === undefined)
+        return refuse(501, 'remote-unavailable', 'This server cannot run session commands. Update it, or use the console.');
+    const at = parsed.argv.indexOf('--file'), file = at < 0 ? undefined : parsed.argv[at + 1];
+    if (Object.keys(parsed.files).some(path => path !== file))
+        return refuse(400, 'invalid-request', 'Each file must name a declared input file argument.');
+    const out = [];
+    let exitCode;
+    try {
+        exitCode = await options.session(principal, parsed.argv, parsed.files, line => { out.push(`${line}\n`); });
+    }
+    catch {
+        return refuse(500, 'command-failed', 'The command stopped unexpectedly on the server. Check its state before running it again.');
+    }
+    send(response, 200, { exitCode, stdout: out.join(''), stderr: '' });
+    return true;
+}

package/dist/cli.js

@@ -424,7 +424,8 @@ async function dispatch(argv, write, mainOptions) {
     if (first === "session") {
         // D5: native coding sessions are deprecated. They still run this release; each use says so once, on stderr.
         (mainOptions.session?.stderr ?? (line => process.stderr.write(`${line}\n`)))(deprecationWarning(`session ${rest.find(arg => !arg.startsWith("-")) ?? ""}`.trim(), "session"));
-        return runSessionCommand(rest, write, mainOptions.session);
+        // D7: it runs on the saved connection over /api/cli, signed in with that profile's API token.
+        return runSessionCommand(rest, write, { ...(mainOptions.remote ?? mainOptions.team), ...mainOptions.session });
     }
     if (first === "demo")
         return runDemoCommand(rest, write);

package/dist/coordinator.d.ts

@@ -2,7 +2,8 @@
  * The coordinator principal (MCP gateway spec v6; DESIGN.md §9b).
  *
  * A coordinator is the ONE credential the MCP surface accepts: minted by
- * an operator password ceremony, hashed at rest, repo-scoped at the mint,
+ * an operator password ceremony, hashed at rest (a `credential` row of kind
+ * 'coordinator', v118: the shared codec and table), repo-scoped at the mint,
  * rate-limited, revocable — and able to do exactly one thing: file a
  * proposal through the canonical door. What it files is an ordinary
  * UNAPPROVED task; admission is the operator's existing scope ceremony,

package/dist/coordinator.js

@@ -2,7 +2,8 @@
  * The coordinator principal (MCP gateway spec v6; DESIGN.md §9b).
  *
  * A coordinator is the ONE credential the MCP surface accepts: minted by
- * an operator password ceremony, hashed at rest, repo-scoped at the mint,
+ * an operator password ceremony, hashed at rest (a `credential` row of kind
+ * 'coordinator', v118: the shared codec and table), repo-scoped at the mint,
  * rate-limited, revocable — and able to do exactly one thing: file a
  * proposal through the canonical door. What it files is an ordinary
  * UNAPPROVED task; admission is the operator's existing scope ceremony,
@@ -14,7 +15,8 @@
  * the exported-cast mistake is named in the spec and not repeated here.
  * Steering and every operator-speech surface cannot accept this type.
  */
-import { createHash, randomBytes } from "node:crypto";
+import { createHash } from "node:crypto";
+import { hashSecret, mintCredential } from "./api-tokens.js";
 import { canonicalRepos } from "./runner.js";
 import { fileTaskProposal } from "./proposal.js";
 import { describeScope } from "./scope.js";
@@ -27,18 +29,7 @@ function verified(row) {
     return row;
 }
 const NAME = /^[a-z0-9-]{1,32}$/;
-const CID_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
 const KEY = /^[\x21-\x7e]{8,64}$/;
-function hashSecret(token) {
-    return createHash("sha256").update(token, "utf8").digest("hex");
-}
-function mintCid() {
-    const bytes = randomBytes(12);
-    let cid = "";
-    for (const b of bytes)
-        cid += CID_ALPHABET[b % CID_ALPHABET.length];
-    return cid;
-}
 export function mintCoordinator(store, input) {
     const days = input.days ?? 90;
     if (!Number.isInteger(days) || days < 1 || days > 365)
@@ -53,15 +44,16 @@ export function mintCoordinator(store, input) {
     if (input.repos.length === 0)
         return { ok: false, reason: "no-repos" };
     const repos = canonicalRepos(input.repos);
-    const token = (input.newToken ?? (() => randomBytes(32).toString("base64url")))();
+    const token = (input.newToken ?? (() => mintCredential("coordinator").token))();
     return store.transact(() => {
         for (let attempt = 0; attempt < 5; attempt += 1) {
-            const cid = (input.newCid ?? mintCid)();
+            const cid = (input.newCid ?? (() => mintCredential("coordinator").id))();
             try {
+                // Its generation: which coordinator of this name it is (revoke-and-remint keeps the earlier one's history apart).
                 store.handle
-                    .prepare(`INSERT INTO coordinator_credential (cid, name, credential_hash, repos, per_hour, created_by, created_at, expires_at)
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
-                    .run(cid, name, hashSecret(token), JSON.stringify(repos), perHour, input.by, input.now.toISOString(), expiresAt);
+                    .prepare(`INSERT INTO credential (id, kind, public_id, account, name, secret_hash, access, projects_json, per_hour, created_by, created_at, expires_at, generation)
+             VALUES (?, 'coordinator', ?, ?, ?, ?, 'act', ?, ?, ?, ?, ?, 1 + (SELECT count(*) FROM credential WHERE kind = 'coordinator' AND name = ?))`)
+                    .run(cid, cid, input.by, name, hashSecret(token), JSON.stringify(repos), perHour, input.by, input.now.toISOString(), expiresAt, name);
                 return { ok: true, cid, token, repos };
             }
             catch (error) {
@@ -81,9 +73,8 @@ export function mintCoordinator(store, input) {
  * the stored hash; the caller re-runs this INSIDE any mutating
  * transaction (the startup check is a courtesy; the txn check is law). */
 export function authenticateCoordinator(store, token) {
-    const row = store.handle
-        .prepare("SELECT * FROM coordinator_credential WHERE credential_hash = ?")
-        .get(hashSecret(token));
+    const found = store.presentedCredential(token);
+    const row = found?.kind === "coordinator" ? store.handle.prepare("SELECT * FROM credential WHERE id = ? AND kind = 'coordinator'").get(found.id) : undefined;
     if (row === undefined)
         return { ok: false, reason: "unknown" };
     if (row["revoked_at"] !== null)
@@ -94,23 +85,23 @@ export function authenticateCoordinator(store, token) {
     return {
         ok: true,
         who: verified({
-            cid: String(row["cid"]),
+            cid: String(row["id"]),
             name: String(row["name"]),
-            repos: JSON.parse(String(row["repos"])),
+            repos: JSON.parse(String(row["projects_json"])),
             perHour: Number(row["per_hour"]),
         }),
     };
 }
 export function revokeCoordinator(store, cid, by, now) {
     return store.transact(() => {
-        const row = store.handle.prepare("SELECT revoked_at FROM coordinator_credential WHERE cid = ?").get(cid);
+        const row = store.handle.prepare("SELECT revoked_at FROM credential WHERE id = ? AND kind = 'coordinator'").get(cid);
         if (row === undefined)
             return { ok: false, reason: "unknown" };
         if (row["revoked_at"] !== null)
             return { ok: false, reason: "already-revoked" };
         store.handle
-            .prepare("UPDATE coordinator_credential SET revoked_at = ? WHERE cid = ?")
-            .run(now.toISOString(), cid);
+            .prepare("UPDATE credential SET revoked_at = ?, revoked_by = ? WHERE id = ? AND kind = 'coordinator'")
+            .run(now.toISOString(), by, cid);
         // The revocation event rides the SAME transaction as the state change,
         // and the credential's pending proposals expire with it (mate arc v3).
         store.handle
@@ -122,13 +113,13 @@ export function revokeCoordinator(store, cid, by, now) {
 }
 export function listCoordinators(store) {
     return store.handle
-        .prepare(`SELECT c.*, (SELECT MAX(e.created_at) FROM coordinator_event e WHERE e.cid = c.cid AND e.kind = 'filed') AS last_filed
-         FROM coordinator_credential c ORDER BY c.created_at, c.cid`)
+        .prepare(`SELECT c.*, (SELECT MAX(e.created_at) FROM coordinator_event e WHERE e.cid = c.id AND e.kind = 'filed') AS last_filed
+         FROM credential c WHERE c.kind = 'coordinator' ORDER BY c.created_at, c.id`)
         .all()
         .map(row => ({
-        cid: String(row["cid"]),
+        cid: String(row["id"]),
         name: String(row["name"]),
-        repos: JSON.parse(String(row["repos"])),
+        repos: JSON.parse(String(row["projects_json"])),
         perHour: Number(row["per_hour"]),
         createdBy: String(row["created_by"]),
         createdAt: String(row["created_at"]),
@@ -253,7 +244,7 @@ export function fileCoordinatorProposal(store, token, input, now) {
                     ],
                 }),
             ...(input.deliverable === undefined ? {} : { deliverable: input.deliverable }),
-            filedVia: `mcp:${who.name}`, filedBy: { name: store.handle.prepare("SELECT created_by FROM coordinator_credential WHERE cid = ?").get(who.cid)?.["created_by"] ?? null, kind: "coordinator" },
+            filedVia: `mcp:${who.name}`, filedBy: { name: store.handle.prepare("SELECT created_by FROM credential WHERE id = ? AND kind = 'coordinator'").get(who.cid)?.["created_by"] ?? null, kind: "coordinator" },
             admittedRepos: who.repos,
         }, now);
         if (!made.ok)

package/dist/desktop-update.d.ts

@@ -94,6 +94,7 @@ export declare function prepareDesktopUpdate(stateDir: string, installed: string
 export declare function sqliteLock(file: string, busyTimeoutMs?: number): DatabaseSync | null;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
+    version?: never;
     active: boolean;
     phase: string;
     detail: string;
@@ -107,7 +108,6 @@ export declare function desktopUpdateStatus(stateDir: string): {
     wasRunning?: never;
     backupPath?: never;
     updateId?: never;
-    version?: never;
     buildId?: never;
     workDir?: never;
 } | {

package/dist/export.js

@@ -33,7 +33,7 @@ const SECRET_TABLES = new Set(["web_session", "ceremony_nonce", "chat_pair", "oa
 const DERIVED_TABLE = /^(sqlite_|memory_search)/;
 /** Columns that hold a secret (or what stands in for one): never exported. */
 const SECRET_COLUMNS = new Set([
-    "api_token.secret_hash", "lead_credential.secret_hash", "approver.credential_hash", "coordinator_credential.credential_hash", "runner.credential_hash", "invite.token_hash",
+    "credential.secret_hash", "approver.credential_hash", "runner.credential_hash", "invite.token_hash",
     "flow_trigger.hook_hash", "push_subscription.endpoint", "push_subscription.p256dh", "push_subscription.auth",
     "chat_turn.credential_key", "lead_session.credential_key", "mate_turn.credential_key", "chat_runtime.push_url", "workflow_preview.token",
     "quota.credential_fp", "oauth_grant.renew_hash", "oauth_client.source_hash",
@@ -56,7 +56,7 @@ export function categoryOf(table) {
         [/^subagent/, "subagents"],
         [/^(flow|workflow_)/, "flows"],
         [/^(chat_|lead_|team_|notification|push_)/, "chats"],
-        [/^(approver|api_token|lead_credential|invite|sso_identity|coordinator_|oauth_)/, "people"],
+        [/^(approver|credential$|invite|sso_identity|coordinator_|oauth_)/, "people"],
         [/^(run|artifact|claim|worktree$|execution_slot|criterion_review|diff_comment|proof_|review_request|repair_chain|incident|publication$|merge_|side_spend|knowledge_snapshot|learning_snapshot|skill_snapshot)/, "runs"],
         [/^(task|hold$|plan_|scope_|tool_seal|decision|external_|skill_test)/, "tasks"],
         [/^(project|approval_policy|capability|verify_command|worktree_setup|backend_grant|intake_grant|publication_grant|operating_mode|knowledge_|learning_|memory_|skill_)/, "projects"],

package/dist/mcp-http.js

@@ -1,6 +1,6 @@
 import { adapterPolicy } from "./server/route-policy.js";
 import { PACKAGE_VERSION } from "./version.js";
-import { parseApiToken, secretMatches, tokenLive, tokenProjects } from "./api-tokens.js";
+import { tokenLive, tokenProjects } from "./api-tokens.js";
 import { oauthProjects, oauthTokenAllowed, RESOURCE_PATH } from "./mcp-oauth.js";
 import { authenticateCoordinator } from "./coordinator.js";
 import { LEGACY, MAX_REQUEST, META_CAPABILITIES, META_SERVER, META_VERSION, MODERN, TOOLS, UNSUPPORTED_VERSION, callCoordinatorTool, capabilitiesShape, readMessage, shapeResult, toolsPayload, } from "./mcp-core.js";
@@ -26,10 +26,10 @@ export function createMcpHttp(options) {
         if (presented.startsWith("so_")) {
             if (!options.signedIn(request))
                 return null;
-            const parsed = parseApiToken(presented);
-            const kept = parsed === null ? null : store.apiTokenSecret(parsed.id);
-            // The secret is checked here too, so this door never rests on how signedIn reads the request.
-            if (parsed === null || kept === null || !secretMatches(parsed.secret, kept.secretHash))
+            // The secret is checked here too (the one credential check), so this door never rests on how signedIn reads the request.
+            const found = store.presentedCredential(presented);
+            const kept = found?.kind === "person" ? store.apiTokenSecret(found.id) : null;
+            if (kept === null)
                 return null;
             if (!tokenLive(kept.row, options.clock().getTime()))
                 return null;

package/dist/operate.js

@@ -96,7 +96,8 @@ import { deleteProject, holdingsWords, projectHoldings, projectRunning } from ".
 import { pushPass } from "./push.js";
 import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, openSync, readFileSync, readSync, realpathSync, renameSync, unlinkSync, writeSync, writeFileSync } from "node:fs";
 import { BRANCH_PREFIX, envTwins, envValue, existingOrFirst, taskBranches } from "./names.js";
-import { claimActor, currentActor, parseLeadToken, withActor } from "./actor.js";
+import { claimActor, currentActor, withActor } from "./actor.js";
+import { parseLeadToken } from "./api-tokens.js";
 import { CLI_PASSWORD_SOURCE, withPasswordSource } from "./sign-in-guard.js";
 import { admissionRecorded, admitProject, commandLineActor } from "./project-admission.js";
 import { leadClaim, leadSay, noteLeadWork } from "./lead-voice.js";

package/dist/password-bearer.d.ts

@@ -0,0 +1,27 @@
+/**
+ * D7: a password on each request (`Authorization: Bearer <name>:<password>`) is deprecated. This release still
+ * accepts it everywhere it was accepted, with the same per-address tries, locks and budgets, but every answer carries
+ * a deprecation warning, and every refusal of such a request names the replacement: an API token. From
+ * PASSWORD_BEARER_REFUSED_FROM on, the server refuses it before checking the password.
+ */
+import type { ServerResponse } from "node:http";
+/** The one replacement every machine-credential refusal names. */
+export declare const TOKEN_REPLACEMENT = "Create an API token with `toolroll tokens create`";
+/** The first release that refuses a password on a request: one release after this one (0.9.58) deprecated it. */
+export declare const PASSWORD_BEARER_REFUSED_FROM = "0.9.59";
+export declare const PASSWORD_BEARER_WARNING = "Signing in with a password on each request is deprecated and stops working in Toolroll 0.9.59. Create an API token with `toolroll tokens create` and send it as the bearer instead.";
+/** What the CLI says on stderr when a saved connection signs in with a password instead of an API token. */
+export declare const PASSWORD_PROFILE_WARNING = "Warning: this connection signs in with your password on each request, which is deprecated and stops working in Toolroll 0.9.59. Create an API token with `toolroll tokens create`, then connect again with --token-stdin.";
+export declare const PASSWORD_BEARER_REFUSED = "Toolroll no longer accepts a password on a request. Create an API token with `toolroll tokens create` and send it as the bearer instead.";
+/** Whether an Authorization header is a password bearer: a name and a secret, never an API token. */
+export declare function isPasswordBearer(authorization: string | undefined): boolean;
+/** Whether this build still accepts a password bearer: only a release before PASSWORD_BEARER_REFUSED_FROM does. */
+export declare function passwordBearerAccepted(version?: string): boolean;
+/** A refusal's words for this request: unchanged, or with the replacement when it came with a password bearer. */
+export declare function withReplacement(authorization: string | undefined, message: string): string;
+/**
+ * The refusal boundary for one password-bearer request, whichever adapter answers it: the deprecation is announced in
+ * headers (RFC 9745 Deprecation, and a Warning naming the replacement), and any refusal's words, plain text or a JSON
+ * `message`, gain the replacement. Successful answers are left byte for byte.
+ */
+export declare function announcePasswordBearer(response: ServerResponse): void;