toolroll 0.9.63 → 0.9.65

package/dist/server/route-table.js

@@ -44,6 +44,7 @@ function row(stage, domain, id, method, pattern, options = {}) {
         roleBrowser: options.roleBrowser ?? false,
         ...(options.roleRefusal === undefined ? {} : { roleRefusal: options.roleRefusal }),
         ...(options.bodyCap === undefined ? {} : { bodyCap: options.bodyCap }),
+        freshness: options.freshness ?? "never",
     });
 }
 const edge = (domain, id, method, path, options = {}) => row("edge", domain, id, method, path.startsWith("^") ? path : exact(path), options);
@@ -65,6 +66,9 @@ const LARGE_FORM = 1024 * 1024;
 // ---- edge: answered before the console's sign-in ---------------------------------------------------------------
 // Ordered exactly as the server checks them: health and webhooks before the Host check, the rest after it.
 edge("pages", "edge.healthz", "GET,HEAD", "/healthz", { host: "before" });
+// Cockpit B1: the running console proves itself to this installation's CLI (a fresh challenge, answered with the
+// instance secret and the address this connection was received on). It reveals nothing and changes nothing.
+edge("pages", "edge.instance", "GET", "/__instance");
 edge("remote", "edge.telegram-hook", "POST", "/hooks/telegram", { callers: ["service"], host: "before", proof: "adapter" });
 edge("remote", "edge.flow-form", "GET,HEAD", "^\\/hooks\\/form\\/[^/]+$", { project: "flow", sample: "/hooks/form/abc", host: "before", proof: "adapter" });
 edge("remote", "edge.flow-form-send", "POST", "^\\/hooks\\/form\\/[^/]+$", { project: "flow", sample: "/hooks/form/abc", host: "before", proof: "adapter" });
@@ -83,9 +87,9 @@ edge("remote", "edge.team-read", "GET", "/api/team", { callers: ["cookie", "bear
 edge("remote", "edge.team-send", "POST", "/api/team", { callers: ["cookie", "bearer"], scope: "read", project: "adapter", proof: "adapter" });
 edge("remote", "edge.cli", "POST", "/api/cli", { callers: ["bearer"], scope: "read", project: "adapter", proof: "adapter" });
 edge("remote", "edge.teams", "POST", "/teams/messages", { callers: ["service"], proof: "adapter" });
-edge("pages", "edge.browser-asset", "GET,HEAD", "^\\/assets\\/(workspace\\.js|workspace\\.css|THIRD_PARTY_NOTICES\\.txt)$", { sample: "/assets/workspace.js" });
+edge("pages", "edge.browser-asset", "GET,HEAD", "^\\/assets\\/(workspace\\.js|workspace\\.css|terminal\\.js|terminal\\.css|THIRD_PARTY_NOTICES\\.txt)$", { sample: "/assets/workspace.js" });
 edge("pages", "edge.workspace-style", "GET,HEAD", "^\\/assets\\/workspace-[0-9a-f]{64}\\.css$", { sample: `/assets/workspace-${"0".repeat(64)}.css` });
-edge("pages", "edge.install-asset", "GET", "^\\/(manifest\\.webmanifest|favicon\\.ico|icon\\.svg|icon-192\\.png|icon-512\\.png|apple-touch-icon\\.png|sw\\.js)$", { sample: "/sw.js" });
+edge("pages", "edge.install-asset", "GET", "^\\/(manifest\\.webmanifest|favicon\\.ico|icon\\.svg|icon-attention\\.svg|icon-192\\.png|icon-512\\.png|apple-touch-icon\\.png|sw\\.js)$", { sample: "/sw.js" });
 edge("pages", "edge.font", "GET", "^\\/fonts\\/geist-(sans|mono)-(400|500|600)\\.woff2$", { sample: "/fonts/geist-sans-400.woff2" });
 edge("pages", "edge.desktop-health", "GET", "/desktop/health");
 edge("people", "edge.login-page", "GET", "/login");
@@ -108,6 +112,14 @@ for (const one of ["state", "changes", "ship"])
     get("tasks", `code.${one}`, `^\\/code\\/${SESSION}\\/${one}$`, { ...CODING, sample: `/code/${"a".repeat(32)}/${one}` });
 // Any other coding address answers "not found" after the same access check.
 get("tasks", "code.other", "^\\/code\\/.*$", { ...CODING, sample: "/code/unknown" });
+// Live terminals (docs/plans/live-terminal.md): an installation-wide operator's own, from a browser. The handlers prove
+// the operator's generation, the terminal's owner and its project; the socket's upgrade is checked in terminals.ts.
+const TERM = { ...free, callers: ["cookie"], project: "none", limited: "deny", ...operator("Terminals are for installation-wide operators.", "/") };
+const TERMINAL = "[a-f0-9]{32}";
+get("tasks", "term.page", "/term", TERM);
+get("tasks", "term.state", "/term/state", TERM);
+get("tasks", "term.session", `^\\/term\\/${TERMINAL}$`, { ...TERM, sample: `/term/${"a".repeat(32)}` });
+get("tasks", "term.socket", `^\\/term\\/${TERMINAL}\\/socket$`, { ...TERM, sample: `/term/${"a".repeat(32)}/socket` });
 get("pages", "projects.browse", "/projects/browse", free);
 get("pages", "projects.github", "/projects/github", { ...free, callers: ["cookie"], callerRefusal: { status: 403, type: "text/plain; charset=utf-8", body: "listing repositories feeds a browser session's act" },
     ...anyApprover("your login can watch — adding projects is an approver's act") });
@@ -211,8 +223,14 @@ for (const one of ["approve", "change", "revise", "complete"])
 post("settings", "provider.resume", "^\\/providers\\/[a-z]+\\/resume$", { sample: "/providers/codex/resume" });
 post("settings", "settings.updates-dismiss", "/settings/updates/dismiss");
 post("settings", "settings.updates-checks", "/settings/updates/checks");
+// Cockpit B2: Forget ends this session's remembered password now.
+// Forget is about the caller's own session only: anyone signed in with a browser may use it (a viewer, a project-limited person).
+post("settings", "session.forget-password", "/session/forget-password", { ...free, limited: "self", viewer: true, callers: ["cookie"] });
 const CODING_ACT = { scope: "step-up", project: "coding", limited: "self" };
 post("tasks", "code.start", "/code/start", CODING_ACT);
+post("tasks", "term.start", "/term/start", { ...TERM, scope: "step-up" });
+for (const one of ["close", "remove"])
+    post("tasks", `term.${one}`, `^\\/term\\/${TERMINAL}\\/${one}$`, { ...TERM, sample: `/term/${"a".repeat(32)}/${one}` });
 for (const one of ["send", "stop", "resume", "recover", "continue", "ship", "answer"])
     post("tasks", `code.${one}-send`, `^\\/code\\/${SESSION}\\/${one}$`, { ...CODING_ACT, sample: `/code/${"a".repeat(32)}/${one}` });
 // Any other coding action answers "not found" after the same access check.
@@ -252,11 +270,28 @@ post("flows", "flow.trigger.check", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/
 post("flows", "flow.trigger.press", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/press$`, { project: "flow", limited: "resource", sample: "/flows/1/triggers/2/press", ...EDIT_FLOWS });
 post("flows", "flow.trigger.renew", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/renew$`, { project: "flow", limited: "resource", sample: "/flows/1/triggers/2/renew", ...EDIT_FLOWS });
 post("flows", "flow.trigger.secret", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/secret$`, { scope: "step-up", project: "flow", limited: "resource", sample: "/flows/1/triggers/2/secret", ...EDIT_FLOWS });
+// v126: a signed webhook's set-up (a new address, and a secret made here shown once) and who signs it: behind the password.
+post("flows", "flow.trigger.setup", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/setup$`, { scope: "step-up", project: "flow", limited: "resource", sample: "/flows/1/triggers/2/setup", ...EDIT_FLOWS });
+// v126: clear a webhook's turned-away count once it has been seen.
+post("flows", "flow.trigger.dropped", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/dropped$`, { project: "flow", limited: "resource", sample: "/flows/1/triggers/2/dropped", ...EDIT_FLOWS });
+// v126: which project a Sentry or Vercel webhook takes deliveries from: behind the password, as its secret is.
+post("flows", "flow.trigger.scope", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/scope$`, { scope: "step-up", project: "flow", limited: "resource", sample: "/flows/1/triggers/2/scope", ...EDIT_FLOWS });
+post("flows", "flow.trigger.sender", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/sender$`, { scope: "step-up", project: "flow", limited: "resource", sample: "/flows/1/triggers/2/sender", ...EDIT_FLOWS });
 post("flows", "flow.trigger.share", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/share$`, { project: "flow", limited: "resource", sample: "/flows/1/triggers/2/share", ...EDIT_FLOWS });
 post("flows", "flow.trigger.unshare", `^\\/flows\\/${FLOW}\\/triggers\\/${FLOW}\\/unshare$`, { project: "flow", limited: "resource", sample: "/flows/1/triggers/2/unshare", ...EDIT_FLOWS });
 post("settings", "spend.budget", "/spend/budget", { scope: "step-up", ...operator("An instance operator sets budgets.", "/spend") });
 post("settings", "settings.project-concurrency", "/settings/project/concurrency");
+post("settings", "settings.project-live-view", "/settings/project/live-view", { scope: "step-up", callers: ["cookie"] });
+post("settings", "settings.project-network", "/settings/project/network", { scope: "step-up", callers: ["cookie"] });
 post("settings", "settings.project-delete", "/settings/project/delete", { scope: "step-up", ...operator("An instance operator deletes projects.", "/settings/project") });
+// Lead sweeps (docs/plans/lead-fan-out.md): the table, and cancelling what isn't ready. The handler shows a sweep only in
+// a project the reader can see, and acts only for an approver.
+get("tasks", "sweep.page", "^\\/sweeps\\/[1-9][0-9]{0,9}$", { ...free, limited: "unscoped", sample: "/sweeps/1" });
+post("tasks", "sweep.cancel-rest", "^\\/sweeps\\/[1-9][0-9]{0,9}\\/cancel-rest$", { limited: "unscoped", sample: "/sweeps/1/cancel-rest", ...approver("An approver cancels a sweep's work.", "/chat") });
+// Passwordless (docs/plans/passwordless.md): an operator's installation setting. Turning it on takes a typed password
+// (the handler proves it as a credential act); turning it off is one click, so the row itself is not a step-up.
+get("settings", "settings.passwordless", "/settings/passwordless", { ...free, ...operator("An instance operator sets Passwordless.", "/settings") });
+post("settings", "settings.passwordless-send", "/settings/passwordless", { callers: ["cookie"], ...operator("An instance operator sets Passwordless.", "/settings") });
 post("pages", "ledger.checkpoint", "/ledger/checkpoint", operator("An instance operator makes ledger checkpoints.", "/ledger"));
 const SETTINGS_ACT_ROLES = {
     policy: operator("An instance operator sets the policy.", "/settings/policy"),
@@ -328,7 +363,7 @@ post("tasks", "task.act.unhold", `^\\/t\\/${TASK}\\/unhold$`, { project: "task",
 post("tasks", "task.act.requeue", `^\\/t\\/${TASK}\\/requeue$`, { project: "task", limited: "resource", sample: "/t/one/requeue" });
 post("tasks", "task.act.cancel", `^\\/t\\/${TASK}\\/cancel$`, { project: "task", limited: "resource", sample: "/t/one/cancel" });
 post("tasks", "task.act.scope", `^\\/t\\/${TASK}\\/scope$`, { project: "task", limited: "resource", sample: "/t/one/scope", bodyCap: LARGE_FORM });
-post("tasks", "task.act.approve", `^\\/t\\/${TASK}\\/approve$`, { scope: "step-up", project: "task", limited: "resource", sample: "/t/one/approve" });
+post("tasks", "task.act.approve", `^\\/t\\/${TASK}\\/approve$`, { scope: "step-up", project: "task", limited: "resource", sample: "/t/one/approve", freshness: "allowlist" });
 post("tasks", "task.act.plan", `^\\/t\\/${TASK}\\/plan$`, { project: "task", limited: "resource", sample: "/t/one/plan" });
 post("tasks", "task.act.plan-edit", `^\\/t\\/${TASK}\\/plan-edit$`, { project: "task", limited: "resource", sample: "/t/one/plan-edit" });
 post("tasks", "task.act.next", `^\\/t\\/${TASK}\\/next$`, { project: "task", limited: "resource", sample: "/t/one/next" });
@@ -361,11 +396,15 @@ for (const one of ["identity", "about", "promise/cancel", "on"])
 post("chat", "chat.config", "/chat/config", { scope: "step-up" });
 for (const one of ["mint", "follow", "end", "stop"])
     post("chat", `chat.mate-${one}`, `/chat/mate/${one}`, { callers: ["cookie"], ...(one === "mint" ? { scope: "step-up" } : {}) });
+// Remove a message still waiting in the person's lead queue (docs/plans/lead-message-queue.md): their own, while it waits.
+post("chat", "chat.queued-remove", "^\\/chat\\/queued\\/[1-9][0-9]{0,14}\\/remove$", { callers: ["cookie"], sample: "/chat/queued/1/remove" });
+// Confirming a proposal may approve a scope (scope_approve): that one act takes the same standard-approval freshness as
+// /t/:id/approve (chat-actions.ts scopes it); every other operation it confirms still needs a password typed now.
 for (const one of ["confirm", "dismiss"])
-    post("chat", `chat.proposal.${one}`, `^\\/chat\\/proposal\\/${ID}\\/${one}$`, { project: "proposal", limited: "proposal", sample: `/chat/proposal/1/${one}` });
+    post("chat", `chat.proposal.${one}`, `^\\/chat\\/proposal\\/${ID}\\/${one}$`, { project: "proposal", limited: "proposal", sample: `/chat/proposal/1/${one}`, ...(one === "confirm" ? { freshness: "allowlist" } : {}) });
 for (const one of ["confirm", "dismiss"])
     post("chat", `coordinator.proposal.${one}`, `^\\/proposals\\/${ID}\\/${one}$`, { sample: `/proposals/1/${one}` });
-post("chat", "chat.send", "/chat", { scope: "step-up", project: "conversation" });
+post("chat", "chat.send", "/chat", { scope: "step-up", project: "conversation", freshness: "allowlist" });
 post("chat", "chat.file", "^\\/chat\\/file\\/[0-9a-f]{32}$", { scope: "step-up", sample: `/chat/file/${"a".repeat(32)}` });
 post("chat", "chat.ack-send", `^\\/chat\\/ack\\/${ID}$`, { scope: "step-up", sample: "/chat/ack/1" });
 for (const one of ["prepare", "preview", "import", "save"])
@@ -373,6 +412,8 @@ for (const one of ["prepare", "preview", "import", "save"])
 post("flows", "recipes.launch-send", "/recipes/launch", { limited: "collection" });
 for (const one of ["note", "comment", "revise", "draft-repair", "checks", "add-tests"])
     post("tasks", `run.act.${one}`, `^\\/r\\/${ID}\\/${one}$`, { project: "run", limited: "resource", sample: `/r/1/${one}` });
+// Cockpit E: reveal a running attempt's proved checkout in Finder (nothing is launched in it).
+post("tasks", "run.act.reveal", `^\\/r\\/${ID}\\/reveal$`, { project: "run", limited: "resource", callers: ["cookie"], sample: "/r/1/reveal", ...approver("Only an approver can show an agent's files.") });
 post("tasks", "session.editor-links", "/session/editor-links", { viewer: true });
 post("tasks", "incident.resolve", `^\\/i\\/${ID}\\/resolve$`, { project: "incident", sample: "/i/1/resolve" });
 /** The sole route table, in match order. */

package/dist/server/runtime.d.ts

@@ -1,3 +1,5 @@
+import type { FreshFacts } from '../scope.js';
+import type { createPersonalQueueRuntime } from '../lead-queue-runtime.js';
 import type { FlowRooms } from '../flow-live.js';
 import type { IntegrationMonitor } from '../integrations.js';
 import type { OidcSettings } from '../oidc.js';
@@ -7,7 +9,8 @@ import type { TaskRooms } from '../task-live.js';
 /** Captured server state and shared guards. Getters preserve live state across requests. */
 import { type IncomingMessage, type ServerResponse } from "node:http";
 import { type AssignmentSnapshot } from '../assignment.js';
-import { type BrowserPhoneCard, type BrowserUpdates } from '../browser-workspace.js';
+import { type BrowserPhoneCard, type BrowserResultView, type BrowserTaskTab, type BrowserUpdates } from '../browser-workspace.js';
+import type { Html } from '../html.js';
 import { CodingWorkspace } from '../coding-workspace.js';
 import { type FormFieldOf, type FormView } from "../contracts/console-api.js";
 import type { DemoLead } from "../demo.js";
@@ -93,7 +96,7 @@ export interface ServerRuntime {
         repos: string[];
         roots: readonly string[];
     };
-    taskScreen: (response: ServerResponse, who: Who, taskId: string, problem: string | null, status: number, scopeDraft?: URLSearchParams, cancelDraft?: string, editPlan?: boolean) => void;
+    taskScreen: (response: ServerResponse, who: Who, taskId: string, problem: string | null, status: number, scopeDraft?: URLSearchParams, cancelDraft?: string, editPlan?: boolean, page?: TaskPageExtras) => void;
     runVisible: (run: Run) => boolean;
     runIsLive: (run: Pick<Run, "outcome" | "leaseId" | "taskRef">) => boolean;
     options: ServeOptions;
@@ -134,6 +137,8 @@ export interface ServerRuntime {
         generation: number;
     }, csrf: string) => TeamResponse;
     team: ReturnType<typeof createTeamRuntime>;
+    /** The personal lead queue (lead-queue-runtime.ts): a message sent while the person's lead is busy waits here. */
+    personalQueue: ReturnType<typeof createPersonalQueueRuntime>;
     teamChatProvider: TeamChatProviderResolver;
     pullRequestTargetOf: (runId: number) => string | null;
     chatEnablement: () => ChatEnablement;
@@ -176,6 +181,8 @@ export interface ServerRuntime {
     settingsUpdates: (actor: string, csrf: string) => BrowserUpdates | null;
     phoneSetup: (who: Who) => BrowserPhoneCard | undefined;
     authenticateApprover: (who: Who, token: string, repo?: string | null) => ReturnType<typeof checkApproverPassword>;
+    /** A credential act (passwordless.md's closed list): a password typed now, never a session or a remembered one. */
+    authenticateCredential: (who: Who, token: string, repo?: string | null) => ReturnType<typeof checkApproverPassword>;
     projectOf: (who: Who, request: IncomingMessage) => string | null | undefined;
     bustBadge: () => void;
     revisionDestination: (child: string, back: string) => string;
@@ -223,6 +230,8 @@ export interface ServerRuntime {
     }>;
     linkKey: (code: string) => string;
     fromThisComputer: (request: IncomingMessage) => boolean;
+    /** Cockpit B2: the request's live password-freshness facts (null off a browser session). */
+    freshFactsOf: (request: IncomingMessage, who: Who | null) => FreshFacts | null;
     passwordAllowed: (name: string) => boolean;
     arrival: (request: IncomingMessage) => {
         agent: string | null;
@@ -236,6 +245,11 @@ export interface ServerRuntime {
         intent: SsoIntent;
         returnTo: string;
         expires: number;
+        startedAt: number;
+        session: {
+            hash: string;
+            generation: number;
+        } | null;
     }>;
     ssoHandoffs: Map<string, {
         claims: OidcClaims;
@@ -243,6 +257,11 @@ export interface ServerRuntime {
         intent: SsoIntent;
         returnTo: string;
         expires: number;
+        checkedAt: number | null;
+        session: {
+            hash: string;
+            generation: number;
+        } | null;
     }>;
     joinSourceOf: (request: IncomingMessage) => string;
     signInBudget: SourceBudget;
@@ -286,3 +305,15 @@ export interface ServerRuntime {
         reading: boolean;
     }>;
 }
+/** What the task page's GET adds (docs/plans/one-page-task-and-agent.md): the tab its address names, and the Result tab's
+ * selected result (its no-script HTML and its view), whether it is the task's current one. Refusals re-render without. */
+export type TaskPageExtras = {
+    tab?: BrowserTaskTab;
+    result?: {
+        html: Html;
+        selected: NonNullable<BrowserResultView["selected"]>;
+        current: boolean;
+    } | null;
+    /** The result runs the attempt picker may offer (the Result tab would show each); absent: every finished result run. */
+    admissible?: ReadonlySet<number>;
+};

package/dist/server/session.d.ts

@@ -14,6 +14,11 @@ export declare const SIGN_IN_LINK_MS: number;
 /** A cookie idles out after half a day and dies outright after a week. */
 export declare const SESSION_IDLE_MS: number;
 export declare const SESSION_ABSOLUTE_MS: number;
+/** A session's lifetime, the one reading: within its idle and absolute limits (sign-in lookup and every act use it). */
+export declare const sessionWithinLifetime: (session: {
+    lastSeen: number;
+    createdAt: number;
+}, now: number) => boolean;
 /** An approval nonce is a rendered form, not a standing right — it ages out fast. */
 export declare const NONCE_TTL_MS: number;
 export declare const NONCE_CAP = 500;
@@ -37,6 +42,15 @@ export type Session = {
     sso?: {
         at: number;
     };
+    /** Cockpit B2: when a password was last verified on this session (in memory only: a restart forgets it). */
+    passwordAt?: number;
+    /** Cockpit B2: when the identity provider last re-checked this person on request (a step-up's re-authentication).
+     * Only this, or a password, starts a freshness window; an ordinary sign-in never does. In memory only. */
+    ssoReauthAt?: number;
+    /** Cockpit B2: an explicit provider re-check not yet spent: stands in for ONE step-up (consumed by it). In memory only. */
+    ssoNowAt?: number;
+    /** Forget: nothing verified before this counts as fresh. */
+    freshFloor?: number;
     /** v101: the browser and address it signed in from, for the person to recognise it. */
     agent?: string | null;
     address?: string | null;
@@ -121,12 +135,22 @@ export declare class PersistentSessions extends Map<string, Session> {
     static hash(id: string): string;
     set(id: string, session: Session): this;
     delete(id: string): boolean;
-    /** Keep a changed session (its project, its provider check); `seen` only once a minute. */
+    /**
+     * Keep a changed session (its project, its provider check); `seen` only once a minute. Only ever an update: a session
+     * ended elsewhere (another process, Sessions) is dropped here, never written back by its cached copy (live terminals
+     * review, rounds 2–3, finding 1).
+     */
     persist(session: Session, seen?: boolean): void;
+    /** Whether this exact session is still saved in the database (ended from another process, it isn't): read at the act. */
+    savedNow(session: Session): boolean;
+    /** Whether this cookie's session is still saved (one ended in another process is not). */
+    stillSaved(id: string): boolean;
     /** A cookie from before a restart, if its session is still kept. */
     load(id: string): Session | null;
     /** End one session by its kept hash (from the Sessions page). */
     endByHash(idHash: string): void;
+    /** Whether this exact session is still signed in here (not signed out, ended from Sessions, expired or replaced). */
+    holds(session: Session): boolean;
     hashOf(session: Session): string | null;
 }
 /** The console's server, and the one-time sign-in link `up` opens: a path on this server, or null for no such approver.

package/dist/server/session.js

@@ -26,6 +26,8 @@ export const SIGN_IN_LINK_MS = 10 * 60_000;
 /** A cookie idles out after half a day and dies outright after a week. */
 export const SESSION_IDLE_MS = 12 * 60 * 60_000;
 export const SESSION_ABSOLUTE_MS = 7 * 24 * 60 * 60_000;
+/** A session's lifetime, the one reading: within its idle and absolute limits (sign-in lookup and every act use it). */
+export const sessionWithinLifetime = (session, now) => now - session.lastSeen <= SESSION_IDLE_MS && now - session.createdAt <= SESSION_ABSOLUTE_MS;
 /** An approval nonce is a rendered form, not a standing right — it ages out fast. */
 export const NONCE_TTL_MS = 15 * 60_000;
 export const NONCE_CAP = 500;
@@ -55,22 +57,32 @@ export class PersistentSessions extends Map {
     set(id, session) {
         super.set(id, session);
         this.ids.set(session, id);
-        this.persist(session);
+        this.savedAt.set(session, Date.now());
+        this.db.saveWebSession({ idHash: PersistentSessions.hash(id), account: session.name, csrf: session.csrf, role: session.role, generation: session.generation, createdAt: session.createdAt,
+            lastSeen: session.lastSeen, project: session.project, projectRevision: session.projectRevision, ssoAt: session.sso?.at ?? null, agent: session.agent ?? null, address: session.address ?? null });
         return this;
     }
     delete(id) {
         this.db.dropWebSession(PersistentSessions.hash(id));
         return super.delete(id);
     }
-    /** Keep a changed session (its project, its provider check); `seen` only once a minute. */
+    /**
+     * Keep a changed session (its project, its provider check); `seen` only once a minute. Only ever an update: a session
+     * ended elsewhere (another process, Sessions) is dropped here, never written back by its cached copy (live terminals
+     * review, rounds 2–3, finding 1).
+     */
     persist(session, seen = false) {
         const id = this.ids.get(session);
         if (id === undefined || (seen && Date.now() - (this.savedAt.get(session) ?? 0) < 60_000))
             return;
         this.savedAt.set(session, Date.now());
-        this.db.saveWebSession({ idHash: PersistentSessions.hash(id), account: session.name, csrf: session.csrf, role: session.role, generation: session.generation, createdAt: session.createdAt,
-            lastSeen: session.lastSeen, project: session.project, projectRevision: session.projectRevision, ssoAt: session.sso?.at ?? null, agent: session.agent ?? null, address: session.address ?? null });
+        if (!this.db.updateWebSession({ idHash: PersistentSessions.hash(id), lastSeen: session.lastSeen, project: session.project, projectRevision: session.projectRevision, ssoAt: session.sso?.at ?? null }))
+            super.delete(id);
     }
+    /** Whether this exact session is still saved in the database (ended from another process, it isn't): read at the act. */
+    savedNow(session) { const hash = this.hashOf(session); return hash !== null && this.db.webSession(hash) !== null; }
+    /** Whether this cookie's session is still saved (one ended in another process is not). */
+    stillSaved(id) { return this.db.webSession(PersistentSessions.hash(id)) !== null; }
     /** A cookie from before a restart, if its session is still kept. */
     load(id) {
         const row = this.db.webSession(PersistentSessions.hash(id));
@@ -90,5 +102,7 @@ export class PersistentSessions extends Map {
                 super.delete(id);
         this.db.dropWebSession(idHash);
     }
+    /** Whether this exact session is still signed in here (not signed out, ended from Sessions, expired or replaced). */
+    holds(session) { const id = this.ids.get(session); return id !== undefined && super.get(id) === session; }
     hashOf(session) { const id = this.ids.get(session); return id === undefined ? null : PersistentSessions.hash(id); }
 }

package/dist/server/settings.js

@@ -1,3 +1,6 @@
+import { PASSWORDLESS_TRADE, passwordlessSetting, setPasswordless } from "../passwordless.js";
+import { ACP_AGENTS, isKeyedProvider } from "../acp-agents.js";
+import { LIVE_VIEW_CONSENT, liveViewConsentDigest, setLiveCommands } from "../live-detail.js";
 import { CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
 import { galleryTemplateOf } from "../flow-gallery.js";
 import { finishGoogleConsent, GOOGLE_CALLBACK } from "../google-mail.js";
@@ -30,7 +33,7 @@ import { PACKAGE_VERSION } from "../version.js";
 import { handlersOf } from './handler-registry.js';
 import { refuse, screen } from "./chrome.js";
 import { HANDOFF_STYLE, redirect, respond, safeReturn, signInSpent, startedHere } from "./http.js";
-import { html, htmlString, joinHtml, postForm } from "../html.js";
+import { html, htmlString, joinHtml, postForm, reauth } from "../html.js";
 import { browserCaller } from "./session.js";
 /** settings handlers, moved without changing their route bodies. */
 import { DEFAULT_ACCENT, normalHex } from "../accent-colors.js";
@@ -76,6 +79,7 @@ import { openRouterPickerScript } from "../openrouter-models.js";
 import { policyHtml } from "../policy-ui.js";
 import { checkPolicy, parseList, policyParts } from "../policy.js";
 import { parseProjectConcurrency, saveProjectConcurrency } from "../project-concurrency.js";
+import { MAX_NETWORK_HOSTS, normalizeHost } from "../egress.js";
 import { projectDeleteConfirmHtml, projectSettingsHtml } from "../project-delete-ui.js";
 import { deleteProject, holdingsWords } from "../project-delete.js";
 import { applySavedKnowledge, changeKnowledge, knowledgeVersion, knowledgeView } from "../project-knowledge.js";
@@ -122,7 +126,7 @@ import { personChip, ROLE_TITLES } from "./chrome.js";
 import { chatReturnWithSaid, goOutside } from "./http.js";
 import { latestReleaseFor, leadSettingsHtml, notificationProjects, SETTINGS_AUTOSAVE_SCRIPT, settingsPage, settingsWorkers, telegramDeliveryWords, telegramTrouble } from "./render-settings.js";
 export function createSettingsHandlers(runtime) {
-    const { store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, deletedRepos, recordSignIn, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, defaultProject, googleVisits } = runtime;
+    const { store, providerHome, managedRepos, consoleProjects, sendScreen, chromeFor, connectionCheck, clock, modelCatalog, modelSeams, toolsViewOf, codexServers, projectViewOf, sessions, restricted, options, integrations, consoleOrigin, evidenceRoot, storagePool, visible, ssoSettings, checkLocalAgents, chatKeyFor, chatCatalog, leadWords, agentSignInCommand, settingsUpdates, phoneSetup, authenticateApprover, authenticateCredential, deletedRepos, recordSignIn, projectOf, providerFor, admissionList, toolHome, connectVisits, mintApprovalNonce, consumeApprovalNonce, defaultProject, googleVisits } = runtime;
     // v105: what agent work cost, by month, and the monthly budgets. An instance operator's page.
     async function spendPage(ctx) {
         const { url, who, response, now } = ctx;
@@ -461,6 +465,40 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
         const body = ssoSettingsHtml({ settings, redirect: origin === null ? null : `${origin}${SSO_CALLBACK}`, projects, linked: settings !== null && store.ssoIdentitiesOf(who.name).some(one => one.issuer.replace(/\/+$/, "") === settings.issuer) }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") });
         return sendScreen(response, 200, screen("Sign-in", html `<p><a href="/settings">Settings</a></p><h1>Sign-in</h1>${body}`, { chrome: chromeFor(project, "settings") }));
     }
+    /** Passwordless (docs/plans/passwordless.md): the switch, and the trade in plain words. */
+    async function passwordlessPage(ctx) {
+        const { url, response, project } = ctx;
+        browserCaller(ctx.who);
+        const setting = passwordlessSetting(store);
+        const said = url.searchParams.get("said"), problem = url.searchParams.get("problem");
+        const note = problem ? html `<p class="problem" role="alert">${problem}</p>` : said ? html `<p role="status">${said}</p>` : "";
+        const since = setting.at === null ? "" : html ` <span class="meta">(${setting.on ? "on" : "off"} since ${new Date(setting.at).toLocaleString("en-US", { dateStyle: "medium", timeStyle: "short" })}, by ${setting.setBy ?? "someone"})</span>`;
+        const control = setting.on
+            ? postForm("/settings/passwordless", html `<button class="secondary">Turn Passwordless off</button>`, { hidden: { action: "off" } })
+            : postForm("/settings/passwordless", html `<label>Your password<input type="password" name="password" autocomplete="current-password" required></label><button>Turn Passwordless on</button>`, { attrs: { class: "card approve-form" }, hidden: { action: "on" } });
+        return sendScreen(response, 200, screen("Passwordless", html `<p><a href="/settings">Settings</a></p><h1>Passwordless</h1>${note}\
+<p>When it's on, signing in is the only password: approvals, settings, budgets, signing a mode and starting a terminal no longer ask again — in the browser, on the phone, and in this computer's <code>toolroll</code> command (through its remembered login).</p>\
+<p class="meta">${PASSWORDLESS_TRADE}</p>\
+<p><strong>Passwordless is ${setting.on ? "on" : "off"}.</strong>${since}</p>${control}`, { chrome: chromeFor(project, "settings") }));
+    }
+    async function passwordlessSave(ctx) {
+        const { response, now, posted } = ctx;
+        const who = browserCaller(ctx.who);
+        const body = readForm(posted, CONSOLE_FORMS.passwordless);
+        const back = (key, words) => redirect(response, `/settings/passwordless?${key}=${encodeURIComponent(words)}`);
+        const action = body.get("action");
+        if (action === "off") {
+            setPasswordless(store, false, who.name, now);
+            return back("said", "Passwordless is off. Step-ups ask for your password again.");
+        }
+        if (action !== "on")
+            return back("problem", "Choose on or off.");
+        // Turning it on is a credential act: a password typed now (or a one-use provider re-check), never a session.
+        if (!authenticateCredential(who, body.get("password") ?? "").ok)
+            return back("problem", "Enter your Toolroll password to turn Passwordless on.");
+        setPasswordless(store, true, who.name, now);
+        return back("said", "Passwordless is on. Signing in is the only password now.");
+    }
     async function knowledgePage(ctx) {
         const { url, who, response, project } = ctx;
         const projects = consoleProjects();
@@ -600,13 +638,14 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         };
         const providerKeys = who.role !== "approver"
             ? null
-            : await Promise.all(PROVIDER_IDS.map(async (provider) => ({
+            // ACP agents sign in their own way; Toolroll keeps no key for them, so the key card lists only the others.
+            : await Promise.all(PROVIDER_IDS.filter(isKeyedProvider).map(async (provider) => ({
                 provider,
                 envName: PROVIDER_KEY_ENV[provider],
                 ...keyStatus(provider, providerHome),
                 connection: await connectionCheck(provider, url.searchParams.get("check-connection") === provider),
                 ambient: (process.env[PROVIDER_KEY_ENV[provider]] ?? "") !== "",
-                mode: readAuthMode(provider, providerHome),
+                mode: readAuthMode(provider, providerHome) === "api-key" ? "api-key" : "subscription",
                 subscriptionCapable: SUBSCRIPTION_CAPABLE[provider],
             })));
         const telegramConfigured = loadBotToken(process.env, options.telegramTokenFile) !== null;
@@ -656,6 +695,18 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         return redirect(response, "/work");
     }
     // The update notice is dismissed per browser and per version: a newer release shows it again.
+    // Cockpit B2: Forget — nothing verified on this session before now counts as fresh (a CSRF-checked post, like every act).
+    async function forgetPassword(ctx) {
+        const { who, response, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.forgetPassword);
+        if (who.via === "cookie") {
+            who.session.freshFloor = Date.now();
+            delete who.session.passwordAt;
+            delete who.session.ssoReauthAt;
+            delete who.session.ssoNowAt;
+        }
+        return redirect(response, safeReturn(body.get("return") ?? "/"));
+    }
     async function updatesDismiss(ctx) {
         const { who, response, posted } = ctx;
         const body = readForm(posted, CONSOLE_FORMS.updatesDismiss);
@@ -808,6 +859,51 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
         store.bumpWake();
         return back("said", changed.before === changed.after ? "Nothing changed." : `Saved. Up to ${n} at once.`);
     }
+    // Settings → Project → Live view (live-detail.ts): an approver for the project shows commands with their password,
+    // or hides them in one step; the ledger keeps each change. It applies from the next run.
+    async function projectLiveView(ctx) {
+        const { who, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.projectLiveView);
+        const repo = body.get("repo") ?? "";
+        if (!consoleProjects().includes(repo) || !visible(repo))
+            return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
+        if (who.via !== "cookie" || who.role !== "approver" || store.isDemo() || !store.accountCanAccess(who.name, repo))
+            return refuse(response, who, 403, "An approver for this project changes the live view.", "/settings/project");
+        const back = (key, words) => redirect(response, `/settings/project?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}`);
+        const act = body.get("act");
+        if (act === "off")
+            return back("said", setLiveCommands(store, { repo, commands: false, by: who.name, via: "the console" }, now).said);
+        if (act !== "on")
+            return back("problem", "That change isn't available.");
+        // Single use, for this person and exactly this change: a replayed or copied form changes nothing.
+        if (!consumeApprovalNonce(body.get("nonce") ?? "", who.name, LIVE_VIEW_CONSENT, liveViewConsentDigest(repo)))
+            return back("problem", "That form was already used or is out of date. Try again from this page.");
+        if (!authenticateApprover(who, body.get("password") ?? "", repo).ok)
+            return back("problem", "Enter your Toolroll password to show commands.");
+        return back("said", setLiveCommands(store, { repo, commands: true, by: who.name, via: "the console" }, now).said);
+    }
+    // Settings → Project → Network (egress.ts): what the project's builds may reach. An approver for the project changes it
+    // with their password typed now; the ledger keeps before → after. New scopes use it; approved ones keep theirs.
+    async function projectNetwork(ctx) {
+        const { who, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.projectNetwork);
+        const repo = body.get("repo") ?? "";
+        if (!consoleProjects().includes(repo) || !visible(repo))
+            return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
+        if (who.via !== "cookie" || who.role !== "approver" || store.isDemo() || !store.accountCanAccess(who.name, repo))
+            return refuse(response, who, 403, "An approver for this project changes what its builds may reach.", "/settings/project");
+        const back = (key, words) => redirect(response, `/settings/project?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}#network`);
+        const hosts = (body.get("hosts") ?? "").split(/[\s,]+/).filter(Boolean).map(normalizeHost);
+        if (hosts.some(one => one === null))
+            return back("problem", "A host is a name like api.stripe.com or *.stripe.com: no address, port or path. Nothing changed.");
+        if (hosts.length > MAX_NETWORK_HOSTS)
+            return back("problem", `A project lists at most ${MAX_NETWORK_HOSTS} hosts. Nothing changed.`);
+        if (!authenticateCredential(who, body.get("password") ?? "").ok)
+            return back("problem", "Enter your Toolroll password to change what builds may reach.");
+        const changed = store.setProjectNetwork(repo, { mode: body.get("mode") === "open" ? "open" : "allowlist", hosts: hosts, loopback: body.get("local") === "any" ? "any" : "proxy-only" }, who.name, now);
+        const same = JSON.stringify(changed.before) === JSON.stringify(changed.after);
+        return back("said", same ? "Nothing changed." : "Saved. Tasks scoped from now on use it; tasks already approved keep the network they were approved with.");
+    }
     // Delete a project, in two steps: its name, then what goes and the password. An instance operator; the ledger keeps who and what.
     async function projectDelete(ctx) {
         const { response, now, posted } = ctx;
@@ -917,7 +1013,8 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
             const found = await providerFor(before.issuer);
             return found.ok ? back("said", `${before.label} answers: it's ready for people to sign in.`) : back("problem", found.said);
         }
-        if (!authenticateApprover(who, body.get("password") ?? "").ok)
+        // Sign-in methods and the identity provider are the login itself: a credential act, a password typed now.
+        if (!authenticateCredential(who, body.get("password") ?? "").ok)
             return back("problem", "Enter your Toolroll password to change sign-in.");
         if (action === "remove") {
             removeSsoSettings(options.configDir);
@@ -1611,7 +1708,7 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
             const nonceKey = `project-instructions:${project}`;
             if (step === "preview") {
                 const nonce = mintApprovalNonce(who.name, nonceKey, preview.fingerprint);
-                return sendScreen(response, 200, screen("Review agent instructions", html `<h1>Review agent instructions</h1><p>${preview.plan.skillPath}</p><pre class="recap">${preview.content}</pre>${postForm("/control/instructions-approve", html `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label><button>Add these instructions</button>`, { hidden: { repo: project, nonce, fingerprint: preview.fingerprint } })}`, { chrome: chromeFor(project, "settings") }));
+                return sendScreen(response, 200, screen("Review agent instructions", html `<h1>Review agent instructions</h1><p>${preview.plan.skillPath}</p><pre class="recap">${preview.content}</pre>${postForm("/control/instructions-approve", html `${reauth(html `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label>`)}<button>Add these instructions</button>`, { hidden: { repo: project, nonce, fingerprint: preview.fingerprint } })}`, { chrome: chromeFor(project, "settings") }));
             }
             if (who.via === "cookie" && !consumeApprovalNonce(body.get("nonce") ?? "", who.name, nonceKey, body.get("fingerprint") ?? ""))
                 return refuse(response, who, 409, "This instruction preview expired. Review it again.", "/control");
@@ -1655,7 +1752,8 @@ ${repositoryContextHtml(chosen, query, result, who.role === 'approver' ? csrf :
             savePrimary(dir, "slack");
             return redirect(response, "/settings/slack");
         }
-        if (!authenticateApprover(who, body.get("password") ?? "").ok)
+        // Connecting or pairing opens a way to act from Slack: a credential act. Unpairing or disconnecting only closes one.
+        if (!(action === "connect" || action === "pair" ? authenticateCredential(who, body.get("password") ?? "") : authenticateApprover(who, body.get("password") ?? "")).ok)
             return show("Enter your Toolroll password to change Slack access.", 403);
         const generation = store.accountOf(who.name).generation;
         if (action === "connect") {
@@ -1758,6 +1856,11 @@ ${postForm("/settings/chat-approval/save", html `\
             return show("Submit one value for each field.");
         if (botId === null)
             return show("Connect the Telegram bot first.", 409);
+        // Pairing a phone is a credential act (a typed password, always); unpairing only closes a way in.
+        if (op === "unpair" && authenticateApprover(who, body.get("password") ?? "").ok) {
+            store.unpairTelegram(botId, who.name, now);
+            return redirect(response, "/settings/telegram");
+        }
         const pairingIdentity = authenticateAccount(store, who.name, body.get("password") ?? "");
         if (!pairingIdentity.ok || pairingIdentity.role !== "approver" || pairingIdentity.generation !== who.session.generation)
             return show("Enter your Toolroll password to change your phone pairing.", 403);
@@ -1788,7 +1891,7 @@ ${postForm("/settings/chat-approval/save", html `\
             savePrimary(dir, "teams");
             return redirect(response, "/settings/teams");
         }
-        if (!authenticateApprover(who, body.get("password") ?? "").ok)
+        if (!(action === "connect" || action === "pair" ? authenticateCredential(who, body.get("password") ?? "") : authenticateApprover(who, body.get("password") ?? "")).ok)
             return show("Enter your Toolroll password to change Teams access.", 403);
         const generation = store.accountOf(who.name).generation;
         if (action === "connect") {
@@ -1845,7 +1948,7 @@ ${postForm("/settings/chat-approval/save", html `\
             savePrimary(dir, "discord");
             return redirect(response, "/settings/discord");
         }
-        if (!authenticateApprover(who, body.get("password") ?? "").ok)
+        if (!(action === "connect" || action === "pair" ? authenticateCredential(who, body.get("password") ?? "") : authenticateApprover(who, body.get("password") ?? "")).ok)
             return show("Enter your Toolroll password to change Discord access.", 403);
         const generation = store.accountOf(who.name).generation;
         if (action === "connect") {
@@ -1984,6 +2087,8 @@ ${postForm("/settings/chat-approval/save", html `\
         const provider = body.get("provider") ?? "";
         if (!isProviderId(provider))
             return refuse(response, who, 400, "unknown provider", "/settings");
+        if (!isKeyedProvider(provider))
+            return refuse(response, who, 400, `${ACP_AGENTS[provider].name} signs in its own way — Toolroll keeps no key for it`, "/settings");
         if (op === "clear") {
             const cleared = clearProviderKey(provider, providerHome);
             const clearedMode = readAuthMode(provider, providerHome);
@@ -2167,7 +2272,8 @@ ${modeWords(terms)
             return refuse(response, who, 409, "the terms moved while you were reading — read them again", "/mode");
         }
         const token = body.get("token") ?? "";
-        if (!authenticateApprover(who, token).ok) {
+        // A mode that lets a chat app approve opens a way to act: a credential act. Any other mode is an ordinary one.
+        if (!(body.get("chat-approve") === "1" ? authenticateCredential(who, token) : authenticateApprover(who, token)).ok) {
             return refuse(response, who, 403, "signing a mode takes your password, typed again", "/mode");
         }
         store.signMode({
@@ -2353,6 +2459,8 @@ ${modeWords(terms)
         "settings.backups": backupsPage,
         "settings.data": dataPage,
         "settings.sign-in": signInPage,
+        "settings.passwordless": passwordlessPage,
+        "settings.passwordless-send": passwordlessSave,
         "settings.lead": leadPage,
         "settings.teams": teamsPage,
         "settings.discord": discordPage,
@@ -2366,12 +2474,15 @@ ${modeWords(terms)
         "settings.page": settingsHome,
         "provider.resume": providerResume,
         "settings.updates-dismiss": updatesDismiss,
+        "session.forget-password": forgetPassword,
         "settings.updates-checks": updatesChecks,
         "settings.skills-revise": skillsRevise,
         "settings.skills-import": skillsAct("import"),
         "settings.skills-change": skillsAct("change"),
         "spend.budget": spendBudget,
         "settings.project-concurrency": projectConcurrency,
+        "settings.project-live-view": projectLiveView,
+        "settings.project-network": projectNetwork,
         "settings.project-delete": projectDelete,
         "settings.policy-send": policySave,
         "settings.approval-send": approvalSave,

package/dist/server/sweeps.d.ts

@@ -0,0 +1,4 @@
+import type { ServerRuntime } from "./runtime.js";
+export declare function createSweepHandlers(runtime: ServerRuntime): {
+    registrations: import("./handler-registry.js").Registration[];
+};