toolroll 0.9.57 → 0.9.58

package/dist/password-bearer.js

@@ -0,0 +1,59 @@
+import { PACKAGE_VERSION } from "./version.js";
+/** The one replacement every machine-credential refusal names. */
+export const TOKEN_REPLACEMENT = "Create an API token with `toolroll tokens create`";
+/** The first release that refuses a password on a request: one release after this one (0.9.58) deprecated it. */
+export const PASSWORD_BEARER_REFUSED_FROM = "0.9.59";
+export const PASSWORD_BEARER_WARNING = `Signing in with a password on each request is deprecated and stops working in Toolroll ${PASSWORD_BEARER_REFUSED_FROM}. ${TOKEN_REPLACEMENT} and send it as the bearer instead.`;
+/** What the CLI says on stderr when a saved connection signs in with a password instead of an API token. */
+export const PASSWORD_PROFILE_WARNING = `Warning: this connection signs in with your password on each request, which is deprecated and stops working in Toolroll ${PASSWORD_BEARER_REFUSED_FROM}. ${TOKEN_REPLACEMENT}, then connect again with --token-stdin.`;
+export const PASSWORD_BEARER_REFUSED = `Toolroll no longer accepts a password on a request. ${TOKEN_REPLACEMENT} and send it as the bearer instead.`;
+/** Whether an Authorization header is a password bearer: a name and a secret, never an API token. */
+export function isPasswordBearer(authorization) {
+    return authorization !== undefined && /^Bearer (.+):(.+)$/.test(authorization) && !/^Bearer so_/.test(authorization);
+}
+const parts = (version) => (/^(\d+)\.(\d+)\.(\d+)/.exec(version) ?? [0, 0, 0, 0]).slice(1).map(Number);
+/** Whether this build still accepts a password bearer: only a release before PASSWORD_BEARER_REFUSED_FROM does. */
+export function passwordBearerAccepted(version = PACKAGE_VERSION) {
+    const have = parts(version), limit = parts(PASSWORD_BEARER_REFUSED_FROM);
+    for (let index = 0; index < 3; index++)
+        if (have[index] !== limit[index])
+            return have[index] < limit[index];
+    return false;
+}
+/** A refusal's words for this request: unchanged, or with the replacement when it came with a password bearer. */
+export function withReplacement(authorization, message) {
+    return !isPasswordBearer(authorization) || message.includes("toolroll tokens create") ? message : `${message} ${PASSWORD_BEARER_WARNING}`;
+}
+/**
+ * The refusal boundary for one password-bearer request, whichever adapter answers it: the deprecation is announced in
+ * headers (RFC 9745 Deprecation, and a Warning naming the replacement), and any refusal's words, plain text or a JSON
+ * `message`, gain the replacement. Successful answers are left byte for byte.
+ */
+export function announcePasswordBearer(response) {
+    response.setHeader("Deprecation", "true");
+    response.setHeader("Warning", `299 toolroll "${PASSWORD_BEARER_WARNING.replace(/"/g, "'")}"`);
+    const end = response.end.bind(response);
+    response.end = ((...args) => {
+        const [chunk] = args;
+        if (response.statusCode >= 400 && typeof chunk === "string" && !chunk.includes("toolroll tokens create"))
+            args[0] = annotated(chunk);
+        return end(...args);
+    });
+}
+function annotated(body) {
+    if (/^\s*\{/.test(body)) {
+        try {
+            const value = JSON.parse(body);
+            if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+                const row = value;
+                if (typeof row["message"] === "string")
+                    return JSON.stringify({ ...row, message: `${row["message"]} ${PASSWORD_BEARER_WARNING}` });
+                if (typeof row["error_description"] === "string")
+                    return JSON.stringify({ ...row, error_description: `${row["error_description"]} ${PASSWORD_BEARER_WARNING}` });
+            }
+        }
+        catch { /* not JSON after all: plain text below */ }
+        return body;
+    }
+    return body.trimStart().startsWith("<") ? body : `${body.replace(/\s+$/, "")}\n${PASSWORD_BEARER_WARNING}`;
+}

package/dist/remote-command.js

@@ -34,8 +34,6 @@ export const REMOTE_PATH_ARGUMENTS = [
     ...['link', 'unlink'].map(invocation => ({ invocation, argument: { flag: '--to' }, policy: 'refuse' })),
     ...['repos add', 'repos remove', 'pulls', 'graph', ''].map(invocation => ({ invocation, argument: { position: 0, name: 'path', rest: true }, policy: 'refuse' })),
     { invocation: 'project use', argument: { position: 0, name: 'checkout path' }, policy: 'refuse' },
-    // These local HTTP clients read prompts themselves; they do not consume runOperateAs's files map.
-    ...['session start', 'session send'].map(invocation => ({ invocation, argument: { flag: '--file' }, policy: 'refuse' })),
 ];
 /**
  * Parse once using declared arity, so a flag's value cannot be mistaken for another flag or a

package/dist/remote-exec.d.ts

@@ -1,4 +1,5 @@
 import { type TeamCliOptions } from './team-cli.js';
+import { type CliRequest } from './cli-http.js';
 import { type RemoteCommandLookup } from './remote-command.js';
 export { contractRow, STEP_UP_MESSAGE, type RemoteMode } from './remote-command.js';
 export type RemoteExecOptions = TeamCliOptions & {
@@ -9,6 +10,24 @@ export type RemoteExecOptions = TeamCliOptions & {
     /** Injected by tests: the contract row lookup (default: COMMAND_GUIDE's `remote` field). */
     modeOf?: RemoteCommandLookup;
 };
+type Answer = {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+};
+export type Outcome = {
+    kind: 'answer';
+    answer: Answer;
+} | {
+    kind: 'refused';
+    status: number;
+    code: string;
+    message: string;
+} | {
+    kind: 'unconfirmed';
+};
+/** One request, never retried. */
+export declare function postCli(origin: string, token: string, request: CliRequest, options: RemoteExecOptions): Promise<Outcome>;
 /**
  * null: run locally with argv unchanged. `{ local }`: run locally with this argv (`--local` removed).
  * A number: the command ran remotely (or was refused before sending) and this is its exit code.

package/dist/remote-exec.js

@@ -14,11 +14,12 @@ import { envelopeJson } from './envelope.js';
 import { COMMAND_GUIDE } from './surface.js';
 import { centralProfile, UsageError } from './team-cli.js';
 import { CLI_FILES_BYTES, CLI_WAIT_SECONDS } from './cli-http.js';
+import { TOKEN_REPLACEMENT } from './password-bearer.js';
 import { contractRow, fileArguments, STEP_UP_MESSAGE } from './remote-command.js';
 export { contractRow, STEP_UP_MESSAGE } from './remote-command.js';
 const EXIT = { ok: 0, failed: 1, usage: 2, refused: 3 };
-/** Team commands own their own central path (team-cli.ts). */
-const TEAM_COMMANDS = new Set(['connect', 'lead', 'conversation', 'chat', 'brief']);
+/** Team commands own their own central path (team-cli.ts); `session` sends its own checked request (session-cli.ts). */
+const TEAM_COMMANDS = new Set(['connect', 'lead', 'conversation', 'chat', 'brief', 'session']);
 const RESPONSE_BYTES = 16 * 1024 * 1024;
 const REQUEST_TIMEOUT_MS = (CLI_WAIT_SECONDS + 35) * 1_000;
 async function bounded(response) {
@@ -45,7 +46,7 @@ async function bounded(response) {
     return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
 }
 /** One request, never retried. */
-async function post(origin, token, request, options) {
+export async function postCli(origin, token, request, options) {
     try {
         const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
         const response = await (options.fetch ?? fetch)(`${origin}/api/cli`, {
@@ -152,7 +153,7 @@ export async function maybeRunRemoteCommand(argv, options = {}) {
     if (profile === null || !profile.apiToken) {
         if (!explicit)
             return null;
-        return refuse('usage', 'This profile has no API token. Connect again with your so_ token (toolroll connect <origin> --token-stdin).', EXIT.usage);
+        return refuse('usage', `This profile has no API token. ${TOKEN_REPLACEMENT}, then connect again with it (toolroll connect <origin> --token-stdin).`, EXIT.usage);
     }
     if (row === null || mode === 'no') {
         return refuse('usage', `${command} runs only on this computer. Drop --profile to run it here.`, EXIT.usage);
@@ -192,7 +193,7 @@ export async function maybeRunRemoteCommand(argv, options = {}) {
     };
     if (row?.invocation === 'task wait')
         return waitRemotely(sent, files, profile, options, deliver);
-    return deliver(await post(profile.origin, profile.token, { argv: sent, files }, options));
+    return deliver(await postCli(profile.origin, profile.token, { argv: sent, files }, options));
 }
 /**
  * `task wait` holds the server for at most CLI_WAIT_SECONDS per request; the client keeps asking within the caller's
@@ -203,7 +204,7 @@ async function waitRemotely(argv, files, profile, options, deliver) {
     const given = at < 0 ? null : Number(argv[at + 1]);
     const base = at < 0 ? argv : argv.filter((_one, index) => index !== at && index !== at + 1);
     if (given !== null && (!Number.isFinite(given) || given < 0))
-        return deliver(await post(profile.origin, profile.token, { argv, files }, options));
+        return deliver(await postCli(profile.origin, profile.token, { argv, files }, options));
     const json = base.includes('--json');
     const probe = json ? base : [...base, '--json'];
     const started = Date.now();
@@ -212,7 +213,7 @@ async function waitRemotely(argv, files, profile, options, deliver) {
     while (true) {
         const remaining = given === null ? CLI_WAIT_SECONDS : Math.max(0, given - (Date.now() - started) / 1_000);
         const slice = Math.min(CLI_WAIT_SECONDS, Math.floor(remaining * 1_000) / 1_000);
-        const outcome = await post(profile.origin, profile.token, { argv: [...probe, '--timeout', String(slice)], files }, options);
+        const outcome = await postCli(profile.origin, profile.token, { argv: [...probe, '--timeout', String(slice)], files }, options);
         if (outcome.kind !== 'answer')
             return deliver(outcome);
         let reason;
@@ -227,7 +228,7 @@ async function waitRemotely(argv, files, profile, options, deliver) {
             if (json)
                 return deliver(outcome);
             // Settled (or out of time): the server renders the final answer in the person's own format.
-            return deliver(await post(profile.origin, profile.token, { argv: [...base, '--timeout', '0'], files }, options));
+            return deliver(await postCli(profile.origin, profile.token, { argv: [...base, '--timeout', '0'], files }, options));
         }
         if (signal.aborted)
             return deliver(outcome);

package/dist/request-budget.d.ts

@@ -1,6 +1,6 @@
 /**
  * Request budgets for person API tokens (v112): how many requests one `so_` token may make across all accepting routes.
- * One budget per token, keyed by its api_token row id (never the secret, its name or an address), shared by those
+ * One budget per token, keyed by its credential row id (a person's API token, v118) (never the secret, its name or an address), shared by those
  * routes. A read token gets 120 requests in any sliding minute, an act token 30, and either 10,000 in a rolling day;
  * an instance operator may override any of these for the installation or for one token in the console (step-up).
  *

package/dist/scope.js

@@ -5,7 +5,8 @@ import { validateScopeText } from "./task-text.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { projectAuthority } from "./project-access.js";
 import { activeRemote } from "./remote-run.js";
-import { claimActor, currentActor, parseLeadToken } from "./actor.js";
+import { claimActor, currentActor } from "./actor.js";
+import { parseLeadToken } from "./api-tokens.js";
 /**
  * What a task is allowed to become, agreed before anything builds it.
  *

package/dist/serve.js

@@ -16,6 +16,7 @@ import { MOBILE_VIEWPORT_SCRIPT } from "./mobile-viewport.js";
 import { projectAuthority } from "./project-access.js";
 import { discoverTools, projectToolsOf, secretsSetFor, TOOL_CATALOG } from "./project-tools.js";
 import { isEdgeAddress, refuseEdge } from "./server/edge-refusal.js";
+import { announcePasswordBearer, isPasswordBearer, PASSWORD_BEARER_REFUSED, passwordBearerAccepted } from "./password-bearer.js";
 import { createSharedGuards } from "./server/guards.js";
 import { createHandlerRegistry } from "./server/handler-registry.js";
 import {} from "./server/remote-hooks.js";
@@ -606,6 +607,17 @@ export function createDecisionServer(options) {
         const matchedRoute = matchRoute(method, hook.pathname);
         const edgeRoute = matchedRoute?.stage === 'edge' ? matchedRoute : null;
         const wrongMethodEdge = edgeRoute === null ? ROUTES.find(row => row.stage === 'edge' && new RegExp(row.pattern).test(hook.pathname)) ?? null : null;
+        // D7: a password on a request still signs in this release, announced on every answer and named in every refusal;
+        // from the release that removes it, it is refused here before anything checks it.
+        if (isPasswordBearer(request.headers.authorization)) {
+            if (!(options.passwordBearerAccepted ?? passwordBearerAccepted())) {
+                request.resume();
+                return hook.pathname.startsWith('/api/')
+                    ? respond(response, 401, 'application/json; charset=utf-8', JSON.stringify({ ...(hook.pathname.startsWith('/api/team') ? { version: 1 } : {}), ok: false, code: 'password-bearer-refused', message: PASSWORD_BEARER_REFUSED }))
+                    : respond(response, 401, 'text/plain; charset=utf-8', PASSWORD_BEARER_REFUSED);
+            }
+            announcePasswordBearer(response);
+        }
         if (edgeRoute?.host === 'before')
             return dispatchEdge(edgeRoute, { url: hook, who: null, request, response, method });
         if (wrongMethodEdge?.host === 'before')
@@ -667,6 +679,9 @@ export function createDecisionServer(options) {
         if (edgeRoute?.domain === 'people')
             return provenPasswordAccount.run(passwordProof, () => dispatchEdge(edgeRoute, { url, who, request, response, method }));
         if (who === null) {
+            // A password on a request that did not sign in is a machine's refusal, never a login page.
+            if (isPasswordBearer(request.headers.authorization))
+                return respond(response, 401, "text/plain; charset=utf-8", "authenticate first");
             // A GET to an exact task or result (a phone's deep link) signs in and
             // comes back to it — the destination is a same-site path only.
             return method === "GET"

package/dist/server/edge-refusal.d.ts

@@ -1,5 +1,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { type RouteDeclaration } from './route-table.js';
+/** What a request to the retired /api/sessions transport hears (D7). */
+export declare const SESSIONS_MOVED: string;
 export declare function isEdgeAddress(path: string): boolean;
 /** Preserve each transport's refusal envelope without invoking an undeclared adapter. */
 export declare function refuseEdge(request: IncomingMessage, response: ServerResponse, path: string, declared: RouteDeclaration | null): void;

package/dist/server/edge-refusal.js

@@ -1,5 +1,7 @@
-import { sessionDescriptor } from '../session-contract.js';
+import { TOKEN_REPLACEMENT } from '../password-bearer.js';
 import { ROUTES } from './route-table.js';
+/** What a request to the retired /api/sessions transport hears (D7). */
+export const SESSIONS_MOVED = `Session operations moved to /api/cli. Update toolroll, ${TOKEN_REPLACEMENT.charAt(0).toLowerCase()}${TOKEN_REPLACEMENT.slice(1)}, connect with it, and run toolroll session <operation>.`;
 export function isEdgeAddress(path) {
     return ROUTES.some(row => row.stage === 'edge' && new RegExp(row.pattern).test(path))
         || /^\/(?:oauth|hooks|api\/(?:sessions|team|cli))(?:\/|$)/.test(path)
@@ -15,13 +17,13 @@ export function refuseEdge(request, response, path, declared) {
         type = 'application/json';
         body = JSON.stringify({ jsonrpc: '2.0', id: null, error: { code: -32000, message: 'the MCP gateway takes POST only — one JSON-RPC message per request' } });
     }
-    else if (path.startsWith('/api/sessions/')) {
-        const spec = sessionDescriptor(path.split('/')[3] ?? '');
+    else if (path === '/api/sessions' || path.startsWith('/api/sessions/')) {
+        // D7: session operations moved to /api/cli. An older client hears that nothing was sent, and what to use instead.
+        response.statusCode = 404;
         type = 'application/json';
         response.setHeader('X-Toolroll-Delivery', 'not-sent');
-        if (spec)
-            response.setHeader('allow', 'POST');
-        body = JSON.stringify({ version: 1, ...(spec ? { operation: spec.operation } : {}), ok: false, status: 'rejected', delivery: 'not-sent', retry: spec?.mutation === false ? 'safe-read' : 'never', reason: spec ? 'method-not-allowed' : 'unsupported-operation', message: spec ? 'Session operations require POST.' : 'This session operation is not supported.', nextActions: [] });
+        response.setHeader('X-Standing-Orders-Session-Delivery', 'not-sent');
+        body = JSON.stringify({ version: 1, ok: false, status: 'rejected', delivery: 'not-sent', retry: 'never', reason: 'moved', message: SESSIONS_MOVED, nextActions: [] });
     }
     else if (path === '/api/cli' || path.startsWith('/api/team')) {
         type = 'application/json';

package/dist/server/guards.js

@@ -2,7 +2,7 @@ import { OWNER_ACTIONS, sharedActionPayload } from '../chat-actions.js';
 import { CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
 import { timingSafeEqual } from "node:crypto";
 import {} from "node:http";
-import { parseApiToken, secretMatches, tokenLive, tokenProjects } from "../api-tokens.js";
+import { tokenLive, tokenProjects } from "../api-tokens.js";
 import { oauthProjects, oauthTokenAllowed } from "../mcp-oauth.js";
 import { REMOTE_MESSAGES, reproveRemote } from "../operate-remote.js";
 import { canonicalProject, rowVisible } from "../project.js";
@@ -264,9 +264,10 @@ export function createSharedGuards(runtime) {
             const source = runtime.joinSourceOf(request), at = Date.now();
             if (runtime.signInBudget.waitFor(source, at) > 0)
                 return null;
-            const parsed = parseApiToken(presented);
-            const kept = parsed === null ? null : runtime.store.apiTokenSecret(parsed.id);
-            if (parsed === null || kept === null || !secretMatches(parsed.secret, kept.secretHash)) {
+            // The one credential check (api-tokens.ts): only a person's API token signs in here.
+            const found = runtime.store.presentedCredential(presented);
+            const kept = found?.kind === "person" ? runtime.store.apiTokenSecret(found.id) : null;
+            if (kept === null) {
                 runtime.signInBudget.failed(source, at);
                 return null;
             }

package/dist/server/http.d.ts

@@ -43,6 +43,8 @@ export type ServeOptions = {
     cliRunner?: RunOperateAs;
     /** Tests: remote command metadata until the shared contract declares it. */
     cliModeOf?: CliHttpOptions['modeOf'];
+    /** Tests: whether a password on a request is still accepted (default: this release's version, password-bearer.ts). */
+    passwordBearerAccepted?: boolean;
     /** Tests: the clock request budgets for API tokens count by (request-budget.ts). */
     requestBudgetClock?: () => number;
     /** Where repos.json lives — every enrollment locks exactly this file. */

package/dist/server/remote.js

@@ -9,7 +9,7 @@ import { reproveRemote } from "../operate-remote.js";
 import { rowVisible } from "../project.js";
 import { RequestBudget, SourceAdmission } from "../request-budget.js";
 import { authenticateAccount } from "../scope.js";
-import { createSessionEndpoint } from '../session-server.js';
+import { createSessionRunner } from '../session-remote.js';
 import {} from "../store.js";
 import { handleTeamHttp, TEAM_PASSWORD_REVERIFY_MS } from '../team-http.js';
 import { handleTeamsHttp } from "../teams.js";
@@ -97,16 +97,17 @@ export function createRemoteHandlers(runtime) {
             return who?.via === 'cookie' ? teamBrowserReply(reply, actor, who.session.csrf) : reply;
         },
     });
+    // D7: native session operations are remote commands too (`session …` over /api/cli), run by the session owner.
+    const sessionRunner = createSessionRunner({ store, workspace: coding, projects: codingProjects, projectAllowed: repo => rowVisible(liveCeiling(), repo), clock });
     // Remote CLI: one live API token names the person; the shared command boundary decides everything else.
     const cliEndpoint = (request, response) => handleCliHttp(request, response, {
         admit: principal => requestBudget.admit(principal.tokenId, "api"),
         authenticate: tokenPrincipalOf,
         run: async () => options.cliRunner ?? (await import("../operate.js")).runOperateAs ?? null,
         modeOf: options.cliModeOf,
+        session: sessionRunner,
         store,
     });
-    const sessionEndpoint = createSessionEndpoint({ store, workspace: coding, projects: codingProjects, projectAllowed: repo => rowVisible(liveCeiling(), repo),
-        admit: admitPasswordSource, admitAuthenticated: admitBearer });
     const mcpHttp = createMcpHttp({ store, clock, evidenceRoot, ...(options.requestBudgetClock === undefined ? {} : { requestBudgetClock: options.requestBudgetClock }), signedIn: request => identify(request, true, true) !== null, admit: person => requestBudget.admit(person.principal.tokenId, "mcp"),
         resourceMetadata: request => { const origin = consoleOrigin(request.headers.host); return origin === null ? null : resourceMetadataUrl(origin); },
         enrolled: () => [...new Set([...managedRepos(), ...store.listProjects().map(project => project.path)])], ...(options.runOperateAs === undefined ? {} : { runAs: options.runOperateAs }) });
@@ -138,8 +139,8 @@ export function createRemoteHandlers(runtime) {
             return;
         return respond(response, 404, 'text/plain; charset=utf-8', 'No such address.');
     };
-    // D5: native coding sessions and the central team service are deprecated (still served this release); each
-    // answer says so in a Deprecation header (RFC 9745).
+    // D5: the central team service is deprecated (still served this release); each answer says so in a Deprecation
+    // header (RFC 9745).
     // Each protocol adapter keeps its own operation boundary; every row still names its own entry.
     const registrations = handlersOf("remote", {}, {
         "edge.telegram-hook": async ({ request, response }) => { await telegramHook(hookContext, request, response); },
@@ -152,14 +153,6 @@ export function createRemoteHandlers(runtime) {
         "edge.oauth-token": async ({ request, response, url }) => { await oauthHttp(request, response, url); },
         "edge.oauth-authorize": async ({ request, response, url }) => { await oauthHttp(request, response, url); },
         "edge.oauth-consent": async ({ request, response, url }) => { await oauthHttp(request, response, url); },
-        "edge.sessions-list": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await sessionEndpoint(request, response); },
-        "edge.sessions-show": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await sessionEndpoint(request, response); },
-        "edge.sessions-changes": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await sessionEndpoint(request, response); },
-        "edge.sessions-start": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await sessionEndpoint(request, response); },
-        "edge.sessions-send": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await sessionEndpoint(request, response); },
-        "edge.sessions-stop": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await sessionEndpoint(request, response); },
-        "edge.sessions-resume": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await sessionEndpoint(request, response); },
-        "edge.sessions-recover": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await sessionEndpoint(request, response); },
         "edge.team-read": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await teamEndpoint(request, response); },
         "edge.team-send": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await teamEndpoint(request, response); },
         "edge.cli": async ({ request, response }) => { await cliEndpoint(request, response); },

package/dist/server/route-table.js

@@ -79,9 +79,6 @@ edge("remote", "edge.oauth-authorize", "GET,HEAD", "/oauth/authorize");
 edge("remote", "edge.oauth-consent", "POST", "/oauth/authorize", { callers: ["cookie"], scope: "step-up", viewer: true, proof: "adapter" });
 edge("settings", "edge.google-callback", "GET", "/settings/google/callback", { callers: ["service"], proof: "adapter" });
 edge("settings", "edge.connect-callback", "GET", "/settings/tools/connected", { callers: ["service"], proof: "adapter" });
-for (const operation of ["list", "show", "changes", "start", "send", "stop", "resume", "recover"]) {
-    edge("remote", `edge.sessions-${operation}`, "POST", `/api/sessions/${operation}`, { callers: ["bearer"], scope: ["list", "show", "changes"].includes(operation) ? "read" : "act", project: "adapter", proof: "adapter" });
-}
 edge("remote", "edge.team-read", "GET", "/api/team", { callers: ["cookie", "bearer"], scope: "read", project: "adapter", proof: "adapter" });
 edge("remote", "edge.team-send", "POST", "/api/team", { callers: ["cookie", "bearer"], scope: "read", project: "adapter", proof: "adapter" });
 edge("remote", "edge.cli", "POST", "/api/cli", { callers: ["bearer"], scope: "read", project: "adapter", proof: "adapter" });

package/dist/session-cli.d.ts

@@ -1,13 +1,42 @@
-import { type SessionDescriptor, type SessionOperation } from './session-contract.js';
-export type SessionCliOptions = {
-    fetch?: typeof fetch;
-    env?: NodeJS.ProcessEnv;
+import { type SessionDescriptor, type SessionRequest, type SessionResponse } from './session-contract.js';
+import { type TeamCliOptions } from './team-cli.js';
+/**
+ * `toolroll session …` (D7): native session operations run on the central server over `POST /api/cli`, signed in with
+ * the API token `toolroll connect` saved, like every other remote command. The client checks and sends the exact
+ * request; the server (session-remote.ts) runs it through the existing session owner and answers one session envelope.
+ */
+export type SessionCliOptions = TeamCliOptions & {
     readStdin?: () => Promise<string>;
     stderr?: (line: string) => void;
 };
-export declare const SESSION_CLI_ACTIONS: readonly ["capabilities", ...SessionOperation[]];
-export declare function sessionCliFlags(spec: SessionDescriptor): Record<string, 'value' | 'flag'>;
-/** Credentials are never sent to a URL with embedded authority, an API path,
- * query, fragment or an insecure remote host. Fetch cannot follow redirects. */
-export declare function sessionServiceOrigin(raw: string): string;
+/** The files key the prompt travels under: the server reads no paths, only what the request carries. */
+export declare const SESSION_PROMPT_FILE = "prompt";
+export declare const SESSION_CLI_ACTIONS: readonly ["capabilities", ...import("./session-contract.js").SessionOperation[]];
+export declare const SESSION_TOKEN_REQUIRED = "Session commands use your saved API token. Create an API token with `toolroll tokens create`, then save it with `toolroll connect <origin> --as <account> --token-stdin`.";
+/** The flags an operation takes: on this computer (where the prompt may come from a file or stdin, and a saved
+ * profile is chosen), or on the server (where the prompt is only ever the request's own file). */
+export declare function sessionCliFlags(spec: SessionDescriptor, side?: 'client' | 'server'): Record<string, 'value' | 'flag'>;
+export type SessionArguments = {
+    spec: SessionDescriptor;
+    flags: Record<string, string | true>;
+    positionals: string[];
+};
+/** One parser for both sides of /api/cli: `<operation> [<session-id>] --flag value …`. */
+export declare function parseSessionArguments(argv: readonly string[], side: 'client' | 'server'): SessionArguments | {
+    problem: string;
+};
+/** The validated request the parsed arguments and prompt spell. */
+export declare function sessionRequestOf({ spec, flags, positionals }: SessionArguments, prompt: string | undefined): {
+    ok: true;
+    request: SessionRequest;
+} | {
+    ok: false;
+    message: string;
+};
+/** The exact argv the server runs for a validated request: always --json, the prompt as the request's one file. */
+export declare function sessionArgv(spec: SessionDescriptor, request: SessionRequest): string[];
+/** The plain-text answer, the same on either side of the transport. */
+export declare function renderSessionResponse(response: SessionResponse): string;
+/** 0 delivered · 1 unknown (inspect first) · 3 refused. */
+export declare const sessionExitCode: (response: SessionResponse) => number;
 export declare function runSessionCommand(argv: readonly string[], write: (line: string) => void, options?: SessionCliOptions): Promise<number>;