docs(roadmap): add #357 — session list requires credentials; local-only op hits API

docs(roadmap): add #346 — agents show falls back to help json

ROADMAP.md

@@ -6287,4 +6287,4 @@ Original filing (2026-04-18): the session emitted `SessionStart hook (completed)
 345. **Resume-safe `/config env|hooks|model|plugins --output-format json` accepts different section names but returns the same generic config-file summary for every section** — dogfooded 2026-04-29 for the 19:00 nudge on current `origin/main` / rebuilt `./rust/target/debug/claw` with embedded `git_sha` `a510f734`. Running `./rust/target/debug/claw --resume latest /config env --output-format json`, `/config hooks`, `/config model`, and `/config plugins` all wrote stdout JSON successfully and no stderr, but each response had the same top-level shape and values: `kind:"config"`, `cwd`, `files[]`, `loaded_files:1`, and `merged_keys:1`. None of the outputs included the requested `section`, section-specific keys, hook/model/plugin/env data, `section_missing`, `section_empty`, or truncation metadata; the `env`, `hooks`, `model`, and `plugins` arguments appear to be accepted while producing an indistinguishable generic config summary. This is distinct from #344's missing config-section discovery/help path: the pinpoint here is that the advertised section-specific entrypoints do not produce section-specific machine-readable payloads once invoked. **Required fix shape:** (a) include a `section` field in `/config <section> --output-format json` responses; (b) return section-specific structured payloads for `env`, `hooks`, `model`, and `plugins`, with explicit empty/missing states when applicable; (c) preserve the config-file provenance summary separately from the requested section content so callers can tell what was inspected; (d) add regression coverage proving the four supported sections produce distinguishable JSON contracts and do not silently collapse to the bare `/config` summary. **Why this matters:** config inspection is used to diagnose model, hook, plugin, and env lifecycle issues. If every supported section returns the same generic file list, claws cannot tell whether a section is empty, unsupported, redacted, or simply ignored, and config troubleshooting remains prose/error archaeology instead of structured state inspection. Source: gaebal-gajae dogfood follow-up for the 19:00 nudge on rebuilt `./rust/target/debug/claw` `a510f734`.
 346. **Top-level `agents show <name> --output-format json` accepts a natural agent-detail request but falls back to generic help JSON instead of returning the selected agent or a typed unsupported-detail error** — dogfooded 2026-04-29 for the 20:00 nudge on current `origin/main` / rebuilt `./rust/target/debug/claw` with embedded `git_sha` `c6c01bea`. Running `./rust/target/debug/claw agents list --output-format json` returned a valid stdout JSON inventory with `kind:"agents"`, `action:"list"`, and an `agents[]` entry named `analyst`. Immediately running `./rust/target/debug/claw agents show analyst --output-format json` returned success on stdout but did not return the `analyst` detail object; instead it returned generic help-shaped JSON: `{"action":"help","kind":"agents","unexpected":"show analyst","usage":{"direct_cli":"claw agents [list|help]","slash_command":"/agents [list|help]",...}}`. Both stderr streams were empty. The command therefore accepts a natural detail-inspection spelling, recognizes it only as `unexpected`, and hides the absence of an agent-detail surface behind a successful help fallback rather than a typed `unsupported_agents_action` / `agent_detail_unavailable` error. This is distinct from #328 and #329: those cover source/provenance mismatch and slash `/agents` inventory flattening, while this pinpoint is the missing top-level agent detail/inspection contract after inventory discovery succeeds. **Required fix shape:** (a) either implement `agents show <name> --output-format json` returning the selected agent's structured fields and provenance, or return a non-success typed JSON error with `code:"unsupported_agents_action"`, `requested_action:"show"`, and `supported_actions:["list","help"]`; (b) include `agent_name` and whether the name exists in the current inventory when rejecting detail inspection; (c) avoid `action:"help"` success envelopes for unsupported subcommands because they make failed detail inspection look like intentional help output; (d) add regression coverage proving `agents show analyst --output-format json` does not silently collapse to generic help when `analyst` exists in `agents list`. **Why this matters:** claws discover agents first, then need to inspect a chosen agent before delegation. If the natural detail command returns successful generic help instead of a selected-agent payload or typed unsupported-action error, automation cannot distinguish typo, unsupported detail view, missing agent, or successful help request without comparing unrelated inventory output. Source: gaebal-gajae dogfood follow-up for the 20:00 nudge on rebuilt `./rust/target/debug/claw` `c6c01bea`; earlier false hang hypotheses for `mcp help` and `agents list` were closed after bounded repros succeeded.
 
-356. **`session list --output-format json` reports `title: null` for every session; no `/session rename` or equivalent command exists to set a human-readable title** — dogfooded 2026-04-30 by Jobdori on `c6c01bea`. Running `./rust/target/debug/claw session list --output-format json` returns a `sessions[]` array where every entry has `title: null`. Sessions are only distinguishable by their `session_id` (epoch-based path) and `workspace` field. There is no `/session rename <id> <title>` command, no `title` field in session creation, and no way to give a session a human-readable name after the fact. For automation orchestrating multiple parallel sessions, disambiguation requires comparing workspace paths or full session IDs; a human-readable title would allow stable logical references across session lifecycle events. The fuzzy-match "Did you mean" does not suggest any rename-like command because none exists. **Required fix shape:** (a) add `title` field to session creation (optional, defaults to null); (b) implement `/session rename <session-id> <title>` or `/session set-title <session-id> <title>` that persists the title in the session store; (c) surface `title` in `session list` output when set; (d) add regression coverage confirming that a session with a title set via rename appears in `session list` with the correct non-null `title`. Source: Jobdori live dogfood, mengmotaHost, `c6c01bea`, 2026-04-30.
+357. **`session list --output-format json` requires valid Anthropic API credentials even though session list is a local filesystem-only operation; exits 1 with `kind:"missing_credentials"` without credentials** — dogfooded 2026-04-30 by Jobdori on `ee41b266`. Running `./rust/target/debug/claw --output-format json session list` with no `ANTHROPIC_API_KEY`/`ANTHROPIC_AUTH_TOKEN` set returns: `{"error":"missing Anthropic credentials; export ANTHROPIC_AUTH_TOKEN or ANTHROPIC_API_KEY...","kind":"missing_credentials","type":"error"}` on stderr with exit 1 and empty stdout. Providing `ANTHROPIC_API_KEY=dummy` causes an API call that returns 401, confirming the binary actively calls the Anthropic API during session list. Session list reads files from `~/.claw/` — it does not send messages, does not need model context, and should not require network credentials. By contrast, `--resume latest /status --output-format json` works with no credentials when no actual turn is submitted; the inconsistency means that offline/credential-rotation workflows cannot enumerate sessions. **Required fix shape:** (a) make `session list` (and `session delete`, `session fork`, `session show`) skip credential initialisation entirely — these are read/write operations on local session files and have no dependency on Anthropic endpoints; (b) return credential errors only for operations that genuinely require a live API call (turn submission, model queries); (c) add regression coverage confirming `session list --output-format json` exits 0 and returns a valid `sessions[]` array with no API key set. Source: Jobdori live dogfood, mengmotaHost, `ee41b266`, 2026-04-30.