toolroll 0.9.62 → 0.9.65

package/dist/server/route-table.js

@@ -44,6 +44,7 @@ function row(stage, domain, id, method, pattern, options = {}) {
         roleBrowser: options.roleBrowser ?? false,
         ...(options.roleRefusal === undefined ? {} : { roleRefusal: options.roleRefusal }),
         ...(options.bodyCap === undefined ? {} : { bodyCap: options.bodyCap }),
+        freshness: options.freshness ?? "never",
     });
 }
 const edge = (domain, id, method, path, options = {}) => row("edge", domain, id, method, path.startsWith("^") ? path : exact(path), options);
@@ -65,6 +66,9 @@ const LARGE_FORM = 1024 * 1024;
 // ---- edge: answered before the console's sign-in ---------------------------------------------------------------
 // Ordered exactly as the server checks them: health and webhooks before the Host check, the rest after it.
 edge("pages", "edge.healthz", "GET,HEAD", "/healthz", { host: "before" });
+// Cockpit B1: the running console proves itself to this installation's CLI (a fresh challenge, answered with the
+// instance secret and the address this connection was received on). It reveals nothing and changes nothing.
+edge("pages", "edge.instance", "GET", "/__instance");
 edge("remote", "edge.telegram-hook", "POST", "/hooks/telegram", { callers: ["service"], host: "before", proof: "adapter" });
 edge("remote", "edge.flow-form", "GET,HEAD", "^\\/hooks\\/form\\/[^/]+$", { project: "flow", sample: "/hooks/form/abc", host: "before", proof: "adapter" });
 edge("remote", "edge.flow-form-send", "POST", "^\\/hooks\\/form\\/[^/]+$", { project: "flow", sample: "/hooks/form/abc", host: "before", proof: "adapter" });
@@ -83,9 +87,9 @@ edge("remote", "edge.team-read", "GET", "/api/team", { callers: ["cookie", "bear
 edge("remote", "edge.team-send", "POST", "/api/team", { callers: ["cookie", "bearer"], scope: "read", project: "adapter", proof: "adapter" });
 edge("remote", "edge.cli", "POST", "/api/cli", { callers: ["bearer"], scope: "read", project: "adapter", proof: "adapter" });
 edge("remote", "edge.teams", "POST", "/teams/messages", { callers: ["service"], proof: "adapter" });
-edge("pages", "edge.browser-asset", "GET,HEAD", "^\\/assets\\/(workspace\\.js|workspace\\.css|THIRD_PARTY_NOTICES\\.txt)$", { sample: "/assets/workspace.js" });
+edge("pages", "edge.browser-asset", "GET,HEAD", "^\\/assets\\/(workspace\\.js|workspace\\.css|terminal\\.js|terminal\\.css|THIRD_PARTY_NOTICES\\.txt)$", { sample: "/assets/workspace.js" });
 edge("pages", "edge.workspace-style", "GET,HEAD", "^\\/assets\\/workspace-[0-9a-f]{64}\\.css$", { sample: `/assets/workspace-${"0".repeat(64)}.css` });
-edge("pages", "edge.install-asset", "GET", "^\\/(manifest\\.webmanifest|favicon\\.ico|icon\\.svg|icon-192\\.png|icon-512\\.png|apple-touch-icon\\.png|sw\\.js)$", { sample: "/sw.js" });
+edge("pages", "edge.install-asset", "GET", "^\\/(manifest\\.webmanifest|favicon\\.ico|icon\\.svg|icon-attention\\.svg|icon-192\\.png|icon-512\\.png|apple-touch-icon\\.png|sw\\.js)$", { sample: "/sw.js" });
 edge("pages", "edge.font", "GET", "^\\/fonts\\/geist-(sans|mono)-(400|500|600)\\.woff2$", { sample: "/fonts/geist-sans-400.woff2" });
 edge("pages", "edge.desktop-health", "GET", "/desktop/health");
 edge("people", "edge.login-page", "GET", "/login");
@@ -108,6 +112,14 @@ for (const one of ["state", "changes", "ship"])
     get("tasks", `code.${one}`, `^\\/code\\/${SESSION}\\/${one}$`, { ...CODING, sample: `/code/${"a".repeat(32)}/${one}` });
 // Any other coding address answers "not found" after the same access check.
 get("tasks", "code.other", "^\\/code\\/.*$", { ...CODING, sample: "/code/unknown" });
+// Live terminals (docs/plans/live-terminal.md): an installation-wide operator's own, from a browser. The handlers prove
+// the operator's generation, the terminal's owner and its project; the socket's upgrade is checked in terminals.ts.
+const TERM = { ...free, callers: ["cookie"], project: "none", limited: "deny", ...operator("Terminals are for installation-wide operators.", "/") };
+const TERMINAL = "[a-f0-9]{32}";
+get("tasks", "term.page", "/term", TERM);
+get("tasks", "term.state", "/term/state", TERM);
+get("tasks", "term.session", `^\\/term\\/${TERMINAL}$`, { ...TERM, sample: `/term/${"a".repeat(32)}` });
+get("tasks", "term.socket", `^\\/term\\/${TERMINAL}\\/socket$`, { ...TERM, sample: `/term/${"a".repeat(32)}/socket` });
 get("pages", "projects.browse", "/projects/browse", free);
 get("pages", "projects.github", "/projects/github", { ...free, callers: ["cookie"], callerRefusal: { status: 403, type: "text/plain; charset=utf-8", body: "listing repositories feeds a browser session's act" },
     ...anyApprover("your login can watch — adding projects is an approver's act") });
@@ -211,8 +223,14 @@ for (const one of ["approve", "change", "revise", "complete"])
 post("settings", "provider.resume", "^\\/providers\\/[a-z]+\\/resume$", { sample: "/providers/codex/resume" });
 post("settings", "settings.updates-dismiss", "/settings/updates/dismiss");
 post("settings", "settings.updates-checks", "/settings/updates/checks");
+// Cockpit B2: Forget ends this session's remembered password now.
+// Forget is about the caller's own session only: anyone signed in with a browser may use it (a viewer, a project-limited person).
+post("settings", "session.forget-password", "/session/forget-password", { ...free, limited: "self", viewer: true, callers: ["cookie"] });
 const CODING_ACT = { scope: "step-up", project: "coding", limited: "self" };
 post("tasks", "code.start", "/code/start", CODING_ACT);
+post("tasks", "term.start", "/term/start", { ...TERM, scope: "step-up" });
+for (const one of ["close", "remove"])
+    post("tasks", `term.${one}`, `^\\/term\\/${TERMINAL}\\/${one}$`, { ...TERM, sample: `/term/${"a".repeat(32)}/${one}` });
 for (const one of ["send", "stop", "resume", "recover", "continue", "ship", "answer"])
     post("tasks", `code.${one}-send`, `^\\/code\\/${SESSION}\\/${one}$`, { ...CODING_ACT, sample: `/code/${"a".repeat(32)}/${one}` });
 // Any other coding action answers "not found" after the same access check.
@@ -238,6 +256,9 @@ for (const one of ["save", "cards", "archive", "scripts"])
     post("flows", `flow.${one}`, `^\\/flows\\/${FLOW}\\/${one}$`, { project: "flow", limited: "resource", sample: `/flows/1/${one}`, ...EDIT_FLOWS });
 for (const one of ["linear-key", "hooks-address", "secrets"])
     post("flows", `flow.${one}`, `^\\/flows\\/${FLOW}\\/${one}$`, { scope: "step-up", project: "flow", sample: `/flows/1/${one}`, ...EDIT_FLOWS });
+// "Runs on its own": signing raises authority (the owner's password, a step-up); revoking is one click for any approver.
+post("flows", "flow.unattended", `^\\/flows\\/${FLOW}\\/unattended$`, { scope: "step-up", project: "flow", sample: "/flows/1/unattended", ...EDIT_FLOWS });
+post("flows", "flow.unattended-off", `^\\/flows\\/${FLOW}\\/unattended-off$`, { project: "flow", sample: "/flows/1/unattended-off", ...EDIT_FLOWS });
 post("flows", "flow.triggers", `^\\/flows\\/${FLOW}\\/triggers$`, { project: "flow", limited: "resource", sample: "/flows/1/triggers", ...EDIT_FLOWS });
 for (const one of ["move", "decide", "cancel", "comment", "assign", "watch"])
     post("flows", `flow.card.${one}`, `^\\/flows\\/${FLOW}\\/cards\\/${FLOW}\\/${one}$`, { project: "flow", limited: "resource", sample: `/flows/1/cards/2/${one}`, ...EDIT_FLOWS });
@@ -249,11 +270,28 @@ post("flows", "flow.trigger.check", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/
 post("flows", "flow.trigger.press", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/press$`, { project: "flow", limited: "resource", sample: "/flows/1/triggers/2/press", ...EDIT_FLOWS });
 post("flows", "flow.trigger.renew", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/renew$`, { project: "flow", limited: "resource", sample: "/flows/1/triggers/2/renew", ...EDIT_FLOWS });
 post("flows", "flow.trigger.secret", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/secret$`, { scope: "step-up", project: "flow", limited: "resource", sample: "/flows/1/triggers/2/secret", ...EDIT_FLOWS });
+// v126: a signed webhook's set-up (a new address, and a secret made here shown once) and who signs it: behind the password.
+post("flows", "flow.trigger.setup", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/setup$`, { scope: "step-up", project: "flow", limited: "resource", sample: "/flows/1/triggers/2/setup", ...EDIT_FLOWS });
+// v126: clear a webhook's turned-away count once it has been seen.
+post("flows", "flow.trigger.dropped", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/dropped$`, { project: "flow", limited: "resource", sample: "/flows/1/triggers/2/dropped", ...EDIT_FLOWS });
+// v126: which project a Sentry or Vercel webhook takes deliveries from: behind the password, as its secret is.
+post("flows", "flow.trigger.scope", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/scope$`, { scope: "step-up", project: "flow", limited: "resource", sample: "/flows/1/triggers/2/scope", ...EDIT_FLOWS });
+post("flows", "flow.trigger.sender", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/sender$`, { scope: "step-up", project: "flow", limited: "resource", sample: "/flows/1/triggers/2/sender", ...EDIT_FLOWS });
 post("flows", "flow.trigger.share", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/share$`, { project: "flow", limited: "resource", sample: "/flows/1/triggers/2/share", ...EDIT_FLOWS });
 post("flows", "flow.trigger.unshare", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/unshare$`, { project: "flow", limited: "resource", sample: "/flows/1/triggers/2/unshare", ...EDIT_FLOWS });
 post("settings", "spend.budget", "/spend/budget", { scope: "step-up", ...operator("An instance operator sets budgets.", "/spend") });
 post("settings", "settings.project-concurrency", "/settings/project/concurrency");
+post("settings", "settings.project-live-view", "/settings/project/live-view", { scope: "step-up", callers: ["cookie"] });
+post("settings", "settings.project-network", "/settings/project/network", { scope: "step-up", callers: ["cookie"] });
 post("settings", "settings.project-delete", "/settings/project/delete", { scope: "step-up", ...operator("An instance operator deletes projects.", "/settings/project") });
+// Lead sweeps (docs/plans/lead-fan-out.md): the table, and cancelling what isn't ready. The handler shows a sweep only in
+// a project the reader can see, and acts only for an approver.
+get("tasks", "sweep.page", "^\\/sweeps\\/[1-9][0-9]{0,9}$", { ...free, limited: "unscoped", sample: "/sweeps/1" });
+post("tasks", "sweep.cancel-rest", "^\\/sweeps\\/[1-9][0-9]{0,9}\\/cancel-rest$", { limited: "unscoped", sample: "/sweeps/1/cancel-rest", ...approver("An approver cancels a sweep's work.", "/chat") });
+// Passwordless (docs/plans/passwordless.md): an operator's installation setting. Turning it on takes a typed password
+// (the handler proves it as a credential act); turning it off is one click, so the row itself is not a step-up.
+get("settings", "settings.passwordless", "/settings/passwordless", { ...free, ...operator("An instance operator sets Passwordless.", "/settings") });
+post("settings", "settings.passwordless-send", "/settings/passwordless", { callers: ["cookie"], ...operator("An instance operator sets Passwordless.", "/settings") });
 post("pages", "ledger.checkpoint", "/ledger/checkpoint", operator("An instance operator makes ledger checkpoints.", "/ledger"));
 const SETTINGS_ACT_ROLES = {
     policy: operator("An instance operator sets the policy.", "/settings/policy"),
@@ -325,7 +363,7 @@ post("tasks", "task.act.unhold", `^\\/t\\/${TASK}\\/unhold$`, { project: "task",
 post("tasks", "task.act.requeue", `^\\/t\\/${TASK}\\/requeue$`, { project: "task", limited: "resource", sample: "/t/one/requeue" });
 post("tasks", "task.act.cancel", `^\\/t\\/${TASK}\\/cancel$`, { project: "task", limited: "resource", sample: "/t/one/cancel" });
 post("tasks", "task.act.scope", `^\\/t\\/${TASK}\\/scope$`, { project: "task", limited: "resource", sample: "/t/one/scope", bodyCap: LARGE_FORM });
-post("tasks", "task.act.approve", `^\\/t\\/${TASK}\\/approve$`, { scope: "step-up", project: "task", limited: "resource", sample: "/t/one/approve" });
+post("tasks", "task.act.approve", `^\\/t\\/${TASK}\\/approve$`, { scope: "step-up", project: "task", limited: "resource", sample: "/t/one/approve", freshness: "allowlist" });
 post("tasks", "task.act.plan", `^\\/t\\/${TASK}\\/plan$`, { project: "task", limited: "resource", sample: "/t/one/plan" });
 post("tasks", "task.act.plan-edit", `^\\/t\\/${TASK}\\/plan-edit$`, { project: "task", limited: "resource", sample: "/t/one/plan-edit" });
 post("tasks", "task.act.next", `^\\/t\\/${TASK}\\/next$`, { project: "task", limited: "resource", sample: "/t/one/next" });
@@ -358,11 +396,15 @@ for (const one of ["identity", "about", "promise/cancel", "on"])
 post("chat", "chat.config", "/chat/config", { scope: "step-up" });
 for (const one of ["mint", "follow", "end", "stop"])
     post("chat", `chat.mate-${one}`, `/chat/mate/${one}`, { callers: ["cookie"], ...(one === "mint" ? { scope: "step-up" } : {}) });
+// Remove a message still waiting in the person's lead queue (docs/plans/lead-message-queue.md): their own, while it waits.
+post("chat", "chat.queued-remove", "^\\/chat\\/queued\\/[1-9][0-9]{0,14}\\/remove$", { callers: ["cookie"], sample: "/chat/queued/1/remove" });
+// Confirming a proposal may approve a scope (scope_approve): that one act takes the same standard-approval freshness as
+// /t/:id/approve (chat-actions.ts scopes it); every other operation it confirms still needs a password typed now.
 for (const one of ["confirm", "dismiss"])
-    post("chat", `chat.proposal.${one}`, `^\\/chat\\/proposal\\/${ID}\\/${one}$`, { project: "proposal", limited: "proposal", sample: `/chat/proposal/1/${one}` });
+    post("chat", `chat.proposal.${one}`, `^\\/chat\\/proposal\\/${ID}\\/${one}$`, { project: "proposal", limited: "proposal", sample: `/chat/proposal/1/${one}`, ...(one === "confirm" ? { freshness: "allowlist" } : {}) });
 for (const one of ["confirm", "dismiss"])
     post("chat", `coordinator.proposal.${one}`, `^\\/proposals\\/${ID}\\/${one}$`, { sample: `/proposals/1/${one}` });
-post("chat", "chat.send", "/chat", { scope: "step-up", project: "conversation" });
+post("chat", "chat.send", "/chat", { scope: "step-up", project: "conversation", freshness: "allowlist" });
 post("chat", "chat.file", "^\\/chat\\/file\\/[0-9a-f]{32}$", { scope: "step-up", sample: `/chat/file/${"a".repeat(32)}` });
 post("chat", "chat.ack-send", `^\\/chat\\/ack\\/${ID}$`, { scope: "step-up", sample: "/chat/ack/1" });
 for (const one of ["prepare", "preview", "import", "save"])
@@ -370,6 +412,8 @@ for (const one of ["prepare", "preview", "import", "save"])
 post("flows", "recipes.launch-send", "/recipes/launch", { limited: "collection" });
 for (const one of ["note", "comment", "revise", "draft-repair", "checks", "add-tests"])
     post("tasks", `run.act.${one}`, `^\\/r\\/${ID}\\/${one}$`, { project: "run", limited: "resource", sample: `/r/1/${one}` });
+// Cockpit E: reveal a running attempt's proved checkout in Finder (nothing is launched in it).
+post("tasks", "run.act.reveal", `^\\/r\\/${ID}\\/reveal$`, { project: "run", limited: "resource", callers: ["cookie"], sample: "/r/1/reveal", ...approver("Only an approver can show an agent's files.") });
 post("tasks", "session.editor-links", "/session/editor-links", { viewer: true });
 post("tasks", "incident.resolve", `^\\/i\\/${ID}\\/resolve$`, { project: "incident", sample: "/i/1/resolve" });
 /** The sole route table, in match order. */

package/dist/server/runtime.d.ts

@@ -1,3 +1,5 @@
+import type { FreshFacts } from '../scope.js';
+import type { createPersonalQueueRuntime } from '../lead-queue-runtime.js';
 import type { FlowRooms } from '../flow-live.js';
 import type { IntegrationMonitor } from '../integrations.js';
 import type { OidcSettings } from '../oidc.js';
@@ -7,7 +9,8 @@ import type { TaskRooms } from '../task-live.js';
 /** Captured server state and shared guards. Getters preserve live state across requests. */
 import { type IncomingMessage, type ServerResponse } from "node:http";
 import { type AssignmentSnapshot } from '../assignment.js';
-import { type BrowserPhoneCard, type BrowserUpdates } from '../browser-workspace.js';
+import { type BrowserPhoneCard, type BrowserResultView, type BrowserTaskTab, type BrowserUpdates } from '../browser-workspace.js';
+import type { Html } from '../html.js';
 import { CodingWorkspace } from '../coding-workspace.js';
 import { type FormFieldOf, type FormView } from "../contracts/console-api.js";
 import type { DemoLead } from "../demo.js";
@@ -93,7 +96,7 @@ export interface ServerRuntime {
         repos: string[];
         roots: readonly string[];
     };
-    taskScreen: (response: ServerResponse, who: Who, taskId: string, problem: string | null, status: number, scopeDraft?: URLSearchParams, cancelDraft?: string, editPlan?: boolean) => void;
+    taskScreen: (response: ServerResponse, who: Who, taskId: string, problem: string | null, status: number, scopeDraft?: URLSearchParams, cancelDraft?: string, editPlan?: boolean, page?: TaskPageExtras) => void;
     runVisible: (run: Run) => boolean;
     runIsLive: (run: Pick<Run, "outcome" | "leaseId" | "taskRef">) => boolean;
     options: ServeOptions;
@@ -107,7 +110,7 @@ export interface ServerRuntime {
     consoleProjects: () => string[];
     flowRooms: FlowRooms;
     providerHome: string;
-    toolHome: string;
+    toolHome: string | undefined;
     leadPrincipal: (who: Who & {
         via: "cookie";
     }) => VerifiedApprover | null;
@@ -134,6 +137,8 @@ export interface ServerRuntime {
         generation: number;
     }, csrf: string) => TeamResponse;
     team: ReturnType<typeof createTeamRuntime>;
+    /** The personal lead queue (lead-queue-runtime.ts): a message sent while the person's lead is busy waits here. */
+    personalQueue: ReturnType<typeof createPersonalQueueRuntime>;
     teamChatProvider: TeamChatProviderResolver;
     pullRequestTargetOf: (runId: number) => string | null;
     chatEnablement: () => ChatEnablement;
@@ -176,6 +181,8 @@ export interface ServerRuntime {
     settingsUpdates: (actor: string, csrf: string) => BrowserUpdates | null;
     phoneSetup: (who: Who) => BrowserPhoneCard | undefined;
     authenticateApprover: (who: Who, token: string, repo?: string | null) => ReturnType<typeof checkApproverPassword>;
+    /** A credential act (passwordless.md's closed list): a password typed now, never a session or a remembered one. */
+    authenticateCredential: (who: Who, token: string, repo?: string | null) => ReturnType<typeof checkApproverPassword>;
     projectOf: (who: Who, request: IncomingMessage) => string | null | undefined;
     bustBadge: () => void;
     revisionDestination: (child: string, back: string) => string;
@@ -223,6 +230,8 @@ export interface ServerRuntime {
     }>;
     linkKey: (code: string) => string;
     fromThisComputer: (request: IncomingMessage) => boolean;
+    /** Cockpit B2: the request's live password-freshness facts (null off a browser session). */
+    freshFactsOf: (request: IncomingMessage, who: Who | null) => FreshFacts | null;
     passwordAllowed: (name: string) => boolean;
     arrival: (request: IncomingMessage) => {
         agent: string | null;
@@ -236,6 +245,11 @@ export interface ServerRuntime {
         intent: SsoIntent;
         returnTo: string;
         expires: number;
+        startedAt: number;
+        session: {
+            hash: string;
+            generation: number;
+        } | null;
     }>;
     ssoHandoffs: Map<string, {
         claims: OidcClaims;
@@ -243,6 +257,11 @@ export interface ServerRuntime {
         intent: SsoIntent;
         returnTo: string;
         expires: number;
+        checkedAt: number | null;
+        session: {
+            hash: string;
+            generation: number;
+        } | null;
     }>;
     joinSourceOf: (request: IncomingMessage) => string;
     signInBudget: SourceBudget;
@@ -286,3 +305,15 @@ export interface ServerRuntime {
         reading: boolean;
     }>;
 }
+/** What the task page's GET adds (docs/plans/one-page-task-and-agent.md): the tab its address names, and the Result tab's
+ * selected result (its no-script HTML and its view), whether it is the task's current one. Refusals re-render without. */
+export type TaskPageExtras = {
+    tab?: BrowserTaskTab;
+    result?: {
+        html: Html;
+        selected: NonNullable<BrowserResultView["selected"]>;
+        current: boolean;
+    } | null;
+    /** The result runs the attempt picker may offer (the Result tab would show each); absent: every finished result run. */
+    admissible?: ReadonlySet<number>;
+};

package/dist/server/session.d.ts

@@ -14,6 +14,11 @@ export declare const SIGN_IN_LINK_MS: number;
 /** A cookie idles out after half a day and dies outright after a week. */
 export declare const SESSION_IDLE_MS: number;
 export declare const SESSION_ABSOLUTE_MS: number;
+/** A session's lifetime, the one reading: within its idle and absolute limits (sign-in lookup and every act use it). */
+export declare const sessionWithinLifetime: (session: {
+    lastSeen: number;
+    createdAt: number;
+}, now: number) => boolean;
 /** An approval nonce is a rendered form, not a standing right — it ages out fast. */
 export declare const NONCE_TTL_MS: number;
 export declare const NONCE_CAP = 500;
@@ -37,6 +42,15 @@ export type Session = {
     sso?: {
         at: number;
     };
+    /** Cockpit B2: when a password was last verified on this session (in memory only: a restart forgets it). */
+    passwordAt?: number;
+    /** Cockpit B2: when the identity provider last re-checked this person on request (a step-up's re-authentication).
+     * Only this, or a password, starts a freshness window; an ordinary sign-in never does. In memory only. */
+    ssoReauthAt?: number;
+    /** Cockpit B2: an explicit provider re-check not yet spent: stands in for ONE step-up (consumed by it). In memory only. */
+    ssoNowAt?: number;
+    /** Forget: nothing verified before this counts as fresh. */
+    freshFloor?: number;
     /** v101: the browser and address it signed in from, for the person to recognise it. */
     agent?: string | null;
     address?: string | null;
@@ -121,12 +135,22 @@ export declare class PersistentSessions extends Map<string, Session> {
     static hash(id: string): string;
     set(id: string, session: Session): this;
     delete(id: string): boolean;
-    /** Keep a changed session (its project, its provider check); `seen` only once a minute. */
+    /**
+     * Keep a changed session (its project, its provider check); `seen` only once a minute. Only ever an update: a session
+     * ended elsewhere (another process, Sessions) is dropped here, never written back by its cached copy (live terminals
+     * review, rounds 2–3, finding 1).
+     */
     persist(session: Session, seen?: boolean): void;
+    /** Whether this exact session is still saved in the database (ended from another process, it isn't): read at the act. */
+    savedNow(session: Session): boolean;
+    /** Whether this cookie's session is still saved (one ended in another process is not). */
+    stillSaved(id: string): boolean;
     /** A cookie from before a restart, if its session is still kept. */
     load(id: string): Session | null;
     /** End one session by its kept hash (from the Sessions page). */
     endByHash(idHash: string): void;
+    /** Whether this exact session is still signed in here (not signed out, ended from Sessions, expired or replaced). */
+    holds(session: Session): boolean;
     hashOf(session: Session): string | null;
 }
 /** The console's server, and the one-time sign-in link `up` opens: a path on this server, or null for no such approver.

package/dist/server/session.js

@@ -26,6 +26,8 @@ export const SIGN_IN_LINK_MS = 10 * 60_000;
 /** A cookie idles out after half a day and dies outright after a week. */
 export const SESSION_IDLE_MS = 12 * 60 * 60_000;
 export const SESSION_ABSOLUTE_MS = 7 * 24 * 60 * 60_000;
+/** A session's lifetime, the one reading: within its idle and absolute limits (sign-in lookup and every act use it). */
+export const sessionWithinLifetime = (session, now) => now - session.lastSeen <= SESSION_IDLE_MS && now - session.createdAt <= SESSION_ABSOLUTE_MS;
 /** An approval nonce is a rendered form, not a standing right — it ages out fast. */
 export const NONCE_TTL_MS = 15 * 60_000;
 export const NONCE_CAP = 500;
@@ -55,22 +57,32 @@ export class PersistentSessions extends Map {
     set(id, session) {
         super.set(id, session);
         this.ids.set(session, id);
-        this.persist(session);
+        this.savedAt.set(session, Date.now());
+        this.db.saveWebSession({ idHash: PersistentSessions.hash(id), account: session.name, csrf: session.csrf, role: session.role, generation: session.generation, createdAt: session.createdAt,
+            lastSeen: session.lastSeen, project: session.project, projectRevision: session.projectRevision, ssoAt: session.sso?.at ?? null, agent: session.agent ?? null, address: session.address ?? null });
         return this;
     }
     delete(id) {
         this.db.dropWebSession(PersistentSessions.hash(id));
         return super.delete(id);
     }
-    /** Keep a changed session (its project, its provider check); `seen` only once a minute. */
+    /**
+     * Keep a changed session (its project, its provider check); `seen` only once a minute. Only ever an update: a session
+     * ended elsewhere (another process, Sessions) is dropped here, never written back by its cached copy (live terminals
+     * review, rounds 2–3, finding 1).
+     */
     persist(session, seen = false) {
         const id = this.ids.get(session);
         if (id === undefined || (seen && Date.now() - (this.savedAt.get(session) ?? 0) < 60_000))
             return;
         this.savedAt.set(session, Date.now());
-        this.db.saveWebSession({ idHash: PersistentSessions.hash(id), account: session.name, csrf: session.csrf, role: session.role, generation: session.generation, createdAt: session.createdAt,
-            lastSeen: session.lastSeen, project: session.project, projectRevision: session.projectRevision, ssoAt: session.sso?.at ?? null, agent: session.agent ?? null, address: session.address ?? null });
+        if (!this.db.updateWebSession({ idHash: PersistentSessions.hash(id), lastSeen: session.lastSeen, project: session.project, projectRevision: session.projectRevision, ssoAt: session.sso?.at ?? null }))
+            super.delete(id);
     }
+    /** Whether this exact session is still saved in the database (ended from another process, it isn't): read at the act. */
+    savedNow(session) { const hash = this.hashOf(session); return hash !== null && this.db.webSession(hash) !== null; }
+    /** Whether this cookie's session is still saved (one ended in another process is not). */
+    stillSaved(id) { return this.db.webSession(PersistentSessions.hash(id)) !== null; }
     /** A cookie from before a restart, if its session is still kept. */
     load(id) {
         const row = this.db.webSession(PersistentSessions.hash(id));
@@ -90,5 +102,7 @@ export class PersistentSessions extends Map {
                 super.delete(id);
         this.db.dropWebSession(idHash);
     }
+    /** Whether this exact session is still signed in here (not signed out, ended from Sessions, expired or replaced). */
+    holds(session) { const id = this.ids.get(session); return id !== undefined && super.get(id) === session; }
     hashOf(session) { const id = this.ids.get(session); return id === undefined ? null : PersistentSessions.hash(id); }
 }