toolroll 0.9.57 → 0.9.59

package/dist/remote-exec.js

@@ -14,11 +14,12 @@ import { envelopeJson } from './envelope.js';
 import { COMMAND_GUIDE } from './surface.js';
 import { centralProfile, UsageError } from './team-cli.js';
 import { CLI_FILES_BYTES, CLI_WAIT_SECONDS } from './cli-http.js';
+import { TOKEN_REPLACEMENT } from './password-bearer.js';
 import { contractRow, fileArguments, STEP_UP_MESSAGE } from './remote-command.js';
 export { contractRow, STEP_UP_MESSAGE } from './remote-command.js';
 const EXIT = { ok: 0, failed: 1, usage: 2, refused: 3 };
-/** Team commands own their own central path (team-cli.ts). */
-const TEAM_COMMANDS = new Set(['connect', 'lead', 'conversation', 'chat', 'brief']);
+/** Team commands own their own central path (team-cli.ts); `session` sends its own checked request (session-cli.ts). */
+const TEAM_COMMANDS = new Set(['connect', 'lead', 'conversation', 'chat', 'brief', 'session']);
 const RESPONSE_BYTES = 16 * 1024 * 1024;
 const REQUEST_TIMEOUT_MS = (CLI_WAIT_SECONDS + 35) * 1_000;
 async function bounded(response) {
@@ -45,7 +46,7 @@ async function bounded(response) {
     return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
 }
 /** One request, never retried. */
-async function post(origin, token, request, options) {
+export async function postCli(origin, token, request, options) {
     try {
         const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
         const response = await (options.fetch ?? fetch)(`${origin}/api/cli`, {
@@ -152,7 +153,7 @@ export async function maybeRunRemoteCommand(argv, options = {}) {
     if (profile === null || !profile.apiToken) {
         if (!explicit)
             return null;
-        return refuse('usage', 'This profile has no API token. Connect again with your so_ token (toolroll connect <origin> --token-stdin).', EXIT.usage);
+        return refuse('usage', `This profile has no API token. ${TOKEN_REPLACEMENT}, then connect again with it (toolroll connect <origin> --token-stdin).`, EXIT.usage);
     }
     if (row === null || mode === 'no') {
         return refuse('usage', `${command} runs only on this computer. Drop --profile to run it here.`, EXIT.usage);
@@ -192,7 +193,7 @@ export async function maybeRunRemoteCommand(argv, options = {}) {
     };
     if (row?.invocation === 'task wait')
         return waitRemotely(sent, files, profile, options, deliver);
-    return deliver(await post(profile.origin, profile.token, { argv: sent, files }, options));
+    return deliver(await postCli(profile.origin, profile.token, { argv: sent, files }, options));
 }
 /**
  * `task wait` holds the server for at most CLI_WAIT_SECONDS per request; the client keeps asking within the caller's
@@ -203,7 +204,7 @@ async function waitRemotely(argv, files, profile, options, deliver) {
     const given = at < 0 ? null : Number(argv[at + 1]);
     const base = at < 0 ? argv : argv.filter((_one, index) => index !== at && index !== at + 1);
     if (given !== null && (!Number.isFinite(given) || given < 0))
-        return deliver(await post(profile.origin, profile.token, { argv, files }, options));
+        return deliver(await postCli(profile.origin, profile.token, { argv, files }, options));
     const json = base.includes('--json');
     const probe = json ? base : [...base, '--json'];
     const started = Date.now();
@@ -212,7 +213,7 @@ async function waitRemotely(argv, files, profile, options, deliver) {
     while (true) {
         const remaining = given === null ? CLI_WAIT_SECONDS : Math.max(0, given - (Date.now() - started) / 1_000);
         const slice = Math.min(CLI_WAIT_SECONDS, Math.floor(remaining * 1_000) / 1_000);
-        const outcome = await post(profile.origin, profile.token, { argv: [...probe, '--timeout', String(slice)], files }, options);
+        const outcome = await postCli(profile.origin, profile.token, { argv: [...probe, '--timeout', String(slice)], files }, options);
         if (outcome.kind !== 'answer')
             return deliver(outcome);
         let reason;
@@ -227,7 +228,7 @@ async function waitRemotely(argv, files, profile, options, deliver) {
             if (json)
                 return deliver(outcome);
             // Settled (or out of time): the server renders the final answer in the person's own format.
-            return deliver(await post(profile.origin, profile.token, { argv: [...base, '--timeout', '0'], files }, options));
+            return deliver(await postCli(profile.origin, profile.token, { argv: [...base, '--timeout', '0'], files }, options));
         }
         if (signal.aborted)
             return deliver(outcome);

package/dist/request-budget.d.ts

@@ -1,6 +1,6 @@
 /**
  * Request budgets for person API tokens (v112): how many requests one `so_` token may make across all accepting routes.
- * One budget per token, keyed by its api_token row id (never the secret, its name or an address), shared by those
+ * One budget per token, keyed by its credential row id (a person's API token, v118) (never the secret, its name or an address), shared by those
  * routes. A read token gets 120 requests in any sliding minute, an act token 30, and either 10,000 in a rolling day;
  * an instance operator may override any of these for the installation or for one token in the console (step-up).
  *

package/dist/scope.js

@@ -2,10 +2,12 @@
 export { ACCEPTANCE_LIMITS, EVIDENCE_KINDS } from "./contracts/acceptance-terms.js";
 import { currentPasswordSource, passwordGuardOf, provenPasswordAccount } from "./sign-in-guard.js";
 import { validateScopeText } from "./task-text.js";
+import { contractChangesOf } from "./contract-changes.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { projectAuthority } from "./project-access.js";
 import { activeRemote } from "./remote-run.js";
-import { claimActor, currentActor, parseLeadToken } from "./actor.js";
+import { claimActor, currentActor } from "./actor.js";
+import { parseLeadToken } from "./api-tokens.js";
 /**
  * What a task is allowed to become, agreed before anything builds it.
  *
@@ -557,6 +559,19 @@ route) {
         .slice(0, 32);
 }
 export function propose(store, input) {
+    return store.transact(() => {
+        const previous = store.getScope(input.taskId);
+        const saved = proposeLocked(store, input);
+        // A rewritten goal, exclusions, touches or rubric on a task that is planning starts its planning again (v119), in
+        // the same transaction: the next planner plans for the new terms, never from the old plan or its answers. An
+        // identical refile changes nothing; the planner's own handoff writes its draft without coming through here.
+        const ref = store.lookupRef(input.taskId);
+        if (ref !== null && ref.plan !== null && (previous === null || contractChangesOf(previous, saved).length > 0))
+            store.restartPlanning(ref.id, input.now);
+        return saved;
+    });
+}
+function proposeLocked(store, input) {
     const { taskId, goal, outOfScope = null, touches = [], budgetMicrousd = null, acceptance = [], qualityMode = "default", now, mutation = {}, profile, permissionMode, posture, proposedVia = null } = input;
     const draft = { goal, outOfScope, touches: [...touches], budgetMicrousd, acceptance: [...acceptance], qualityMode, candidate: input.candidate ?? null };
     const previous = store.getScope(taskId);

package/dist/serve.js

@@ -16,6 +16,7 @@ import { MOBILE_VIEWPORT_SCRIPT } from "./mobile-viewport.js";
 import { projectAuthority } from "./project-access.js";
 import { discoverTools, projectToolsOf, secretsSetFor, TOOL_CATALOG } from "./project-tools.js";
 import { isEdgeAddress, refuseEdge } from "./server/edge-refusal.js";
+import { announcePasswordBearer, isPasswordBearer, PASSWORD_BEARER_REFUSED, passwordBearerAccepted } from "./password-bearer.js";
 import { createSharedGuards } from "./server/guards.js";
 import { createHandlerRegistry } from "./server/handler-registry.js";
 import {} from "./server/remote-hooks.js";
@@ -606,6 +607,17 @@ export function createDecisionServer(options) {
         const matchedRoute = matchRoute(method, hook.pathname);
         const edgeRoute = matchedRoute?.stage === 'edge' ? matchedRoute : null;
         const wrongMethodEdge = edgeRoute === null ? ROUTES.find(row => row.stage === 'edge' && new RegExp(row.pattern).test(hook.pathname)) ?? null : null;
+        // D7: a password on a request still signs in this release, announced on every answer and named in every refusal;
+        // from the release that removes it, it is refused here before anything checks it.
+        if (isPasswordBearer(request.headers.authorization)) {
+            if (!(options.passwordBearerAccepted ?? passwordBearerAccepted())) {
+                request.resume();
+                return hook.pathname.startsWith('/api/')
+                    ? respond(response, 401, 'application/json; charset=utf-8', JSON.stringify({ ...(hook.pathname.startsWith('/api/team') ? { version: 1 } : {}), ok: false, code: 'password-bearer-refused', message: PASSWORD_BEARER_REFUSED }))
+                    : respond(response, 401, 'text/plain; charset=utf-8', PASSWORD_BEARER_REFUSED);
+            }
+            announcePasswordBearer(response);
+        }
         if (edgeRoute?.host === 'before')
             return dispatchEdge(edgeRoute, { url: hook, who: null, request, response, method });
         if (wrongMethodEdge?.host === 'before')
@@ -667,6 +679,9 @@ export function createDecisionServer(options) {
         if (edgeRoute?.domain === 'people')
             return provenPasswordAccount.run(passwordProof, () => dispatchEdge(edgeRoute, { url, who, request, response, method }));
         if (who === null) {
+            // A password on a request that did not sign in is a machine's refusal, never a login page.
+            if (isPasswordBearer(request.headers.authorization))
+                return respond(response, 401, "text/plain; charset=utf-8", "authenticate first");
             // A GET to an exact task or result (a phone's deep link) signs in and
             // comes back to it — the destination is a same-site path only.
             return method === "GET"

package/dist/server/edge-refusal.d.ts

@@ -1,5 +1,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { type RouteDeclaration } from './route-table.js';
+/** What a request to the retired /api/sessions transport hears (D7). */
+export declare const SESSIONS_MOVED: string;
 export declare function isEdgeAddress(path: string): boolean;
 /** Preserve each transport's refusal envelope without invoking an undeclared adapter. */
 export declare function refuseEdge(request: IncomingMessage, response: ServerResponse, path: string, declared: RouteDeclaration | null): void;

package/dist/server/edge-refusal.js

@@ -1,5 +1,7 @@
-import { sessionDescriptor } from '../session-contract.js';
+import { TOKEN_REPLACEMENT } from '../password-bearer.js';
 import { ROUTES } from './route-table.js';
+/** What a request to the retired /api/sessions transport hears (D7). */
+export const SESSIONS_MOVED = `Session operations moved to /api/cli. Update toolroll, ${TOKEN_REPLACEMENT.charAt(0).toLowerCase()}${TOKEN_REPLACEMENT.slice(1)}, connect with it, and run toolroll session <operation>.`;
 export function isEdgeAddress(path) {
     return ROUTES.some(row => row.stage === 'edge' && new RegExp(row.pattern).test(path))
         || /^\/(?:oauth|hooks|api\/(?:sessions|team|cli))(?:\/|$)/.test(path)
@@ -15,13 +17,13 @@ export function refuseEdge(request, response, path, declared) {
         type = 'application/json';
         body = JSON.stringify({ jsonrpc: '2.0', id: null, error: { code: -32000, message: 'the MCP gateway takes POST only — one JSON-RPC message per request' } });
     }
-    else if (path.startsWith('/api/sessions/')) {
-        const spec = sessionDescriptor(path.split('/')[3] ?? '');
+    else if (path === '/api/sessions' || path.startsWith('/api/sessions/')) {
+        // D7: session operations moved to /api/cli. An older client hears that nothing was sent, and what to use instead.
+        response.statusCode = 404;
         type = 'application/json';
         response.setHeader('X-Toolroll-Delivery', 'not-sent');
-        if (spec)
-            response.setHeader('allow', 'POST');
-        body = JSON.stringify({ version: 1, ...(spec ? { operation: spec.operation } : {}), ok: false, status: 'rejected', delivery: 'not-sent', retry: spec?.mutation === false ? 'safe-read' : 'never', reason: spec ? 'method-not-allowed' : 'unsupported-operation', message: spec ? 'Session operations require POST.' : 'This session operation is not supported.', nextActions: [] });
+        response.setHeader('X-Standing-Orders-Session-Delivery', 'not-sent');
+        body = JSON.stringify({ version: 1, ok: false, status: 'rejected', delivery: 'not-sent', retry: 'never', reason: 'moved', message: SESSIONS_MOVED, nextActions: [] });
     }
     else if (path === '/api/cli' || path.startsWith('/api/team')) {
         type = 'application/json';

package/dist/server/guards.js

@@ -2,7 +2,7 @@ import { OWNER_ACTIONS, sharedActionPayload } from '../chat-actions.js';
 import { CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
 import { timingSafeEqual } from "node:crypto";
 import {} from "node:http";
-import { parseApiToken, secretMatches, tokenLive, tokenProjects } from "../api-tokens.js";
+import { tokenLive, tokenProjects } from "../api-tokens.js";
 import { oauthProjects, oauthTokenAllowed } from "../mcp-oauth.js";
 import { REMOTE_MESSAGES, reproveRemote } from "../operate-remote.js";
 import { canonicalProject, rowVisible } from "../project.js";
@@ -264,9 +264,10 @@ export function createSharedGuards(runtime) {
             const source = runtime.joinSourceOf(request), at = Date.now();
             if (runtime.signInBudget.waitFor(source, at) > 0)
                 return null;
-            const parsed = parseApiToken(presented);
-            const kept = parsed === null ? null : runtime.store.apiTokenSecret(parsed.id);
-            if (parsed === null || kept === null || !secretMatches(parsed.secret, kept.secretHash)) {
+            // The one credential check (api-tokens.ts): only a person's API token signs in here.
+            const found = runtime.store.presentedCredential(presented);
+            const kept = found?.kind === "person" ? runtime.store.apiTokenSecret(found.id) : null;
+            if (kept === null) {
                 runtime.signInBudget.failed(source, at);
                 return null;
             }

package/dist/server/http.d.ts

@@ -43,6 +43,8 @@ export type ServeOptions = {
     cliRunner?: RunOperateAs;
     /** Tests: remote command metadata until the shared contract declares it. */
     cliModeOf?: CliHttpOptions['modeOf'];
+    /** Tests: whether a password on a request is still accepted (default: this release's version, password-bearer.ts). */
+    passwordBearerAccepted?: boolean;
     /** Tests: the clock request budgets for API tokens count by (request-budget.ts). */
     requestBudgetClock?: () => number;
     /** Where repos.json lives — every enrollment locks exactly this file. */

package/dist/server/remote.js

@@ -9,7 +9,7 @@ import { reproveRemote } from "../operate-remote.js";
 import { rowVisible } from "../project.js";
 import { RequestBudget, SourceAdmission } from "../request-budget.js";
 import { authenticateAccount } from "../scope.js";
-import { createSessionEndpoint } from '../session-server.js';
+import { createSessionRunner } from '../session-remote.js';
 import {} from "../store.js";
 import { handleTeamHttp, TEAM_PASSWORD_REVERIFY_MS } from '../team-http.js';
 import { handleTeamsHttp } from "../teams.js";
@@ -97,16 +97,17 @@ export function createRemoteHandlers(runtime) {
             return who?.via === 'cookie' ? teamBrowserReply(reply, actor, who.session.csrf) : reply;
         },
     });
+    // D7: native session operations are remote commands too (`session …` over /api/cli), run by the session owner.
+    const sessionRunner = createSessionRunner({ store, workspace: coding, projects: codingProjects, projectAllowed: repo => rowVisible(liveCeiling(), repo), clock });
     // Remote CLI: one live API token names the person; the shared command boundary decides everything else.
     const cliEndpoint = (request, response) => handleCliHttp(request, response, {
         admit: principal => requestBudget.admit(principal.tokenId, "api"),
         authenticate: tokenPrincipalOf,
         run: async () => options.cliRunner ?? (await import("../operate.js")).runOperateAs ?? null,
         modeOf: options.cliModeOf,
+        session: sessionRunner,
         store,
     });
-    const sessionEndpoint = createSessionEndpoint({ store, workspace: coding, projects: codingProjects, projectAllowed: repo => rowVisible(liveCeiling(), repo),
-        admit: admitPasswordSource, admitAuthenticated: admitBearer });
     const mcpHttp = createMcpHttp({ store, clock, evidenceRoot, ...(options.requestBudgetClock === undefined ? {} : { requestBudgetClock: options.requestBudgetClock }), signedIn: request => identify(request, true, true) !== null, admit: person => requestBudget.admit(person.principal.tokenId, "mcp"),
         resourceMetadata: request => { const origin = consoleOrigin(request.headers.host); return origin === null ? null : resourceMetadataUrl(origin); },
         enrolled: () => [...new Set([...managedRepos(), ...store.listProjects().map(project => project.path)])], ...(options.runOperateAs === undefined ? {} : { runAs: options.runOperateAs }) });
@@ -138,8 +139,8 @@ export function createRemoteHandlers(runtime) {
             return;
         return respond(response, 404, 'text/plain; charset=utf-8', 'No such address.');
     };
-    // D5: native coding sessions and the central team service are deprecated (still served this release); each
-    // answer says so in a Deprecation header (RFC 9745).
+    // D5: the central team service is deprecated (still served this release); each answer says so in a Deprecation
+    // header (RFC 9745).
     // Each protocol adapter keeps its own operation boundary; every row still names its own entry.
     const registrations = handlersOf("remote", {}, {
         "edge.telegram-hook": async ({ request, response }) => { await telegramHook(hookContext, request, response); },
@@ -152,14 +153,6 @@ export function createRemoteHandlers(runtime) {
         "edge.oauth-token": async ({ request, response, url }) => { await oauthHttp(request, response, url); },
         "edge.oauth-authorize": async ({ request, response, url }) => { await oauthHttp(request, response, url); },
         "edge.oauth-consent": async ({ request, response, url }) => { await oauthHttp(request, response, url); },
-        "edge.sessions-list": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await sessionEndpoint(request, response); },
-        "edge.sessions-show": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await sessionEndpoint(request, response); },
-        "edge.sessions-changes": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await sessionEndpoint(request, response); },
-        "edge.sessions-start": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await sessionEndpoint(request, response); },
-        "edge.sessions-send": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await sessionEndpoint(request, response); },
-        "edge.sessions-stop": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await sessionEndpoint(request, response); },
-        "edge.sessions-resume": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await sessionEndpoint(request, response); },
-        "edge.sessions-recover": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await sessionEndpoint(request, response); },
         "edge.team-read": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await teamEndpoint(request, response); },
         "edge.team-send": async ({ request, response }) => { response.setHeader('Deprecation', 'true'); await teamEndpoint(request, response); },
         "edge.cli": async ({ request, response }) => { await cliEndpoint(request, response); },

package/dist/server/render-chat.js

@@ -2,6 +2,7 @@
 import { assignmentSummaryHtml } from "../assignment-ui.js";
 import {} from "../assignment.js";
 import {} from "../browser-workspace.js";
+import { closedQuestionReason } from "../decision.js";
 import { CHAT_ACTIONS, sharedActionNeedsReview, sharedActionPayload, sharedActionReviewPath } from "../chat-actions.js";
 import { CHAT_CONTINUITY_SCRIPT } from "../chat-continuity.js";
 import { CHAT_CONTROLS, chatControlHref, isChatControl } from "../chat-controls.js";
@@ -478,6 +479,15 @@ export function proposalCardParts(view, inert, decision, returnTo = null) {
     const text = (key) => (typeof payload[key] === "string" ? payload[key] : "");
     const task = text("task");
     const repoId = text("repoId");
+    if (view.kind === "answer" && decision?.supersededReason != null) {
+        // The proposal remains in history, but its question no longer needs an answer.
+        // Both the server page and browser card use the same closed view, without stale consent controls.
+        const body = html `<p><a href="/d/${decision.id}">${decision.question}</a></p><p class="meta">${closedQuestionReason(decision.supersededReason)}</p>`;
+        return {
+            html: html `<article class="card proposal proposal-answer" data-card-kind="answer"><header class="proposal-head"><strong>Question closed</strong></header><div class="proposal-body">${body}</div></article>`,
+            card: { id: view.id, kind: view.kind, label: "Question closed", state: view.state, body: htmlString(body), said: null, links: [], primary: null, dismissable: false, note: null },
+        };
+    }
     const presentations = {
         task: { label: payload["report"] === true ? "Scout investigation" : "New task", action: "file task", icon: html `<path d="M12 5v14"/><path d="M5 12h14"/>` },
         next: { label: "Queue priority", action: "move to front", icon: html `<path d="M12 19V5"/><path d="m5 12 7-7 7 7"/>` },

package/dist/server/render-tasks.js

@@ -1,5 +1,6 @@
 /** Task pages: approval, agents, plans, controls, decisions and the task body. */
 import { html, htmlString, joinHtml, postForm, replaceMarkup } from "../html.js";
+import { closedQuestionReason, closedQuestionWords } from "../decision.js";
 import {} from "../activity-line.js";
 import {} from "../agentconfig.js";
 import { gateWords } from "../approval-policy.js";
@@ -1469,9 +1470,12 @@ export function taskBodyParts(data) {
         !(data.revision != null && "problem" in data.revision) && scope.profileState !== "unresolved" && consentDoorOf(scope, data.route).open;
     const planCard = data.planDocument === null
         ? data.plan === "requested"
-            ? data.revision != null && !("problem" in data.revision)
-                ? html `<div class="card planner-status"><span class="planner-orb" aria-hidden="true"></span><p><strong>Updating the plan</strong><span class="meta">Adding your notes to the plan. You approve any change before it builds.</span></p></div>`
-                : html `<div class="card planner-status"><span class="planner-orb" aria-hidden="true"></span><p><strong>Planning requested</strong><span class="meta">${data.planAuto ? "Automatic approval is enabled for a verified plan that preserves your filed contract. Amendments and unanswered questions still pause." : "The agent is inspecting the repository and drafting the goal, acceptance criteria, and approach. It will ask only if a missing answer changes the work."}</span></p></div>`
+            // A request the planner cannot be given waits on a person; the status card above already says what to shorten.
+            ? data.dispatch?.code === "planner-source"
+                ? ""
+                : data.revision != null && !("problem" in data.revision)
+                    ? html `<div class="card planner-status"><span class="planner-orb" aria-hidden="true"></span><p><strong>Updating the plan</strong><span class="meta">Adding your notes to the plan. You approve any change before it builds.</span></p></div>`
+                    : html `<div class="card planner-status"><span class="planner-orb" aria-hidden="true"></span><p><strong>Planning requested</strong><span class="meta">${data.planAuto ? "Automatic approval is enabled for a verified plan that preserves your filed contract. Amendments and unanswered questions still pause." : "The agent is inspecting the repository and drafting the goal, acceptance criteria, and approach. It will ask only if a missing answer changes the work."}</span></p></div>`
             : ""
         : joinHtml([
             approval.approved ? html `<details class="card planner-plan planner-plan-collapsed"><summary class="execution-plan-head">` : html `<section class="card planner-plan"><div class="execution-plan-head">`,
@@ -1788,7 +1792,7 @@ export function taskBodyParts(data) {
     })();
     const decisions = data.decisions.length === 0
         ? ""
-        : html `<h2>Decisions</h2>${joinHtml(data.decisions.map(decision => html `<p class="row"><a href="/d/${decision.id}">${decision.question}</a> <span class="meta">${decision.state}${isOverdue(decision, data.now) ? " · overdue" : ""}</span></p>`), "\n")}`;
+        : html `<h2>Decisions</h2>${joinHtml(data.decisions.map(decision => html `<p class="row"><a href="/d/${decision.id}">${decision.question}</a> <span class="meta">${decision.supersededReason !== null ? closedQuestionWords(decision.supersededReason) : decision.state}${isOverdue(decision, data.now) ? " · overdue" : ""}</span></p>`), "\n")}`;
     const incidents = data.incidents.length === 0
         ? ""
         : html `<h2>Incidents</h2>${joinHtml(data.incidents.map(one => one.resolvedAt === null
@@ -2068,7 +2072,11 @@ export function taskBodyParts(data) {
             continue;
         thread.push({ key: `question-${decision.id}`, at: decision.createdAt, kind: "question", who: "agent", author: "", title: "Asked",
             text: decision.question, link: { label: "Question", href: `/d/${decision.id}` }, html: "", more: null });
-        if (decision.answeredAt !== null) {
+        if (decision.supersededReason !== null) {
+            thread.push({ key: `answer-${decision.id}`, at: decision.answeredAt ?? decision.createdAt, kind: "progress", who: "agent", author: "", title: "Closed without an answer",
+                text: closedQuestionReason(decision.supersededReason), link: null, html: "", more: null });
+        }
+        else if (decision.answeredAt !== null) {
             const chosen = decision.options.find(one => one.id === decision.choice)?.label ?? decision.choice;
             thread.push({ key: `answer-${decision.id}`, at: decision.answeredAt, kind: "reply", who: "person", author: decision.answeredBy ?? "You", title: "Answered",
                 text: [chosen, decision.note].filter((one) => one !== null && one !== "").join(" — ") || null, link: null, html: "", more: null });
@@ -2320,9 +2328,11 @@ export function decisionOptionForms(decision, returnTo) {
 }
 export function decisionPage(chrome, decision, taskId, artifacts, who, now, returnTo = null) {
     const options = decisionOptionForms(decision, returnTo);
-    const answered = decision.state === "answered"
-        ? html `<div class="answered">Answered: <strong>${decision.choice ?? ""}</strong> by ${decision.answeredBy ?? ""}${decision.note === null ? "" : ` — ${decision.note}`}</div>`
-        : "";
+    const answered = decision.supersededReason !== null
+        ? html `<p class="meta">${closedQuestionReason(decision.supersededReason)}</p>`
+        : decision.state === "answered"
+            ? html `<div class="answered">Answered: <strong>${decision.choice ?? ""}</strong> by ${decision.answeredBy ?? ""}${decision.note === null ? "" : ` — ${decision.note}`}</div>`
+            : "";
     const evidence = artifacts.length === 0
         ? ""
         : joinHtml([
@@ -2331,7 +2341,7 @@ export function decisionPage(chrome, decision, taskId, artifacts, who, now, retu
             html `</div>`,
         ]);
     return screen(`decide · ${taskId}`, joinHtml([
-        html `<h1>${taskId} <span class="badge badge-${decision.state}">${decision.state}</span>${isOverdue(decision, now) ? html ` <span class="badge badge-overdue">Overdue</span>` : ""}${decision.deadline === null ? "" : html ` <span class="meta">deadline ${decision.deadline}</span>`}</h1>`,
+        html `<h1>${taskId} <span class="badge badge-${decision.state}">${decision.supersededReason !== null ? "closed" : decision.state}</span>${isOverdue(decision, now) ? html ` <span class="badge badge-overdue">Overdue</span>` : ""}${decision.deadline === null ? "" : html ` <span class="meta">deadline ${decision.deadline}</span>`}</h1>`,
         html `<div class="recap">${decision.recap}</div>`,
         html `<div class="question">${decision.question}</div>`,
         decision.state === "answered" ? answered : options,

package/dist/server/route-table.js

@@ -79,9 +79,6 @@ edge("remote", "edge.oauth-authorize", "GET,HEAD", "/oauth/authorize");
 edge("remote", "edge.oauth-consent", "POST", "/oauth/authorize", { callers: ["cookie"], scope: "step-up", viewer: true, proof: "adapter" });
 edge("settings", "edge.google-callback", "GET", "/settings/google/callback", { callers: ["service"], proof: "adapter" });
 edge("settings", "edge.connect-callback", "GET", "/settings/tools/connected", { callers: ["service"], proof: "adapter" });
-for (const operation of ["list", "show", "changes", "start", "send", "stop", "resume", "recover"]) {
-    edge("remote", `edge.sessions-${operation}`, "POST", `/api/sessions/${operation}`, { callers: ["bearer"], scope: ["list", "show", "changes"].includes(operation) ? "read" : "act", project: "adapter", proof: "adapter" });
-}
 edge("remote", "edge.team-read", "GET", "/api/team", { callers: ["cookie", "bearer"], scope: "read", project: "adapter", proof: "adapter" });
 edge("remote", "edge.team-send", "POST", "/api/team", { callers: ["cookie", "bearer"], scope: "read", project: "adapter", proof: "adapter" });
 edge("remote", "edge.cli", "POST", "/api/cli", { callers: ["bearer"], scope: "read", project: "adapter", proof: "adapter" });

package/dist/server/tasks.js

@@ -1,4 +1,5 @@
 import { handlersOf } from './handler-registry.js';
+import { closedQuestionWords } from "../decision.js";
 import { DEPRECATED_PAGE } from "../deprecations.js";
 /** tasks handlers, moved without changing their route bodies. */
 import { html, htmlString, joinHtml, postForm, textHtml } from "../html.js";
@@ -1118,7 +1119,8 @@ export function createTasksHandlers(runtime) {
         }, now);
         if (!answered.ok) {
             const status = answered.reason === "bad-option" || answered.reason === "bad-note" ? 400 : 409;
-            const why = answered.reason === "already-answered" ? "already answered — somebody got there first" : answered.reason;
+            const closed = answered.reason === "closed" ? store.getDecision(id)?.supersededReason ?? null : null;
+            const why = closed !== null ? closedQuestionWords(closed) : answered.reason === "already-answered" ? "already answered — somebody got there first" : answered.reason;
             return refuse(response, who, status, why, requestedReturn === null ? `/d/${id}` : decisionBack);
         }
         return redirect(response, decisionBack);

package/dist/session-cli.d.ts

@@ -1,13 +1,42 @@
-import { type SessionDescriptor, type SessionOperation } from './session-contract.js';
-export type SessionCliOptions = {
-    fetch?: typeof fetch;
-    env?: NodeJS.ProcessEnv;
+import { type SessionDescriptor, type SessionRequest, type SessionResponse } from './session-contract.js';
+import { type TeamCliOptions } from './team-cli.js';
+/**
+ * `toolroll session …` (D7): native session operations run on the central server over `POST /api/cli`, signed in with
+ * the API token `toolroll connect` saved, like every other remote command. The client checks and sends the exact
+ * request; the server (session-remote.ts) runs it through the existing session owner and answers one session envelope.
+ */
+export type SessionCliOptions = TeamCliOptions & {
     readStdin?: () => Promise<string>;
     stderr?: (line: string) => void;
 };
-export declare const SESSION_CLI_ACTIONS: readonly ["capabilities", ...SessionOperation[]];
-export declare function sessionCliFlags(spec: SessionDescriptor): Record<string, 'value' | 'flag'>;
-/** Credentials are never sent to a URL with embedded authority, an API path,
- * query, fragment or an insecure remote host. Fetch cannot follow redirects. */
-export declare function sessionServiceOrigin(raw: string): string;
+/** The files key the prompt travels under: the server reads no paths, only what the request carries. */
+export declare const SESSION_PROMPT_FILE = "prompt";
+export declare const SESSION_CLI_ACTIONS: readonly ["capabilities", ...import("./session-contract.js").SessionOperation[]];
+export declare const SESSION_TOKEN_REQUIRED = "Session commands use your saved API token. Create an API token with `toolroll tokens create`, then save it with `toolroll connect <origin> --as <account> --token-stdin`.";
+/** The flags an operation takes: on this computer (where the prompt may come from a file or stdin, and a saved
+ * profile is chosen), or on the server (where the prompt is only ever the request's own file). */
+export declare function sessionCliFlags(spec: SessionDescriptor, side?: 'client' | 'server'): Record<string, 'value' | 'flag'>;
+export type SessionArguments = {
+    spec: SessionDescriptor;
+    flags: Record<string, string | true>;
+    positionals: string[];
+};
+/** One parser for both sides of /api/cli: `<operation> [<session-id>] --flag value …`. */
+export declare function parseSessionArguments(argv: readonly string[], side: 'client' | 'server'): SessionArguments | {
+    problem: string;
+};
+/** The validated request the parsed arguments and prompt spell. */
+export declare function sessionRequestOf({ spec, flags, positionals }: SessionArguments, prompt: string | undefined): {
+    ok: true;
+    request: SessionRequest;
+} | {
+    ok: false;
+    message: string;
+};
+/** The exact argv the server runs for a validated request: always --json, the prompt as the request's one file. */
+export declare function sessionArgv(spec: SessionDescriptor, request: SessionRequest): string[];
+/** The plain-text answer, the same on either side of the transport. */
+export declare function renderSessionResponse(response: SessionResponse): string;
+/** 0 delivered · 1 unknown (inspect first) · 3 refused. */
+export declare const sessionExitCode: (response: SessionResponse) => number;
 export declare function runSessionCommand(argv: readonly string[], write: (line: string) => void, options?: SessionCliOptions): Promise<number>;