toolroll 0.9.82 → 0.9.84

package/dist/server/pages.js

@@ -5,10 +5,12 @@ import { handlersOf } from './handler-registry.js';
 import { html, joinHtml, postForm, reauth } from "../html.js";
 /** pages handlers, moved without changing their route bodies. */
 import { createHmac, randomBytes } from "node:crypto";
-import { existsSync, opendirSync, readdirSync, realpathSync } from "node:fs";
+import { realpathSync } from "node:fs";
 import {} from "node:http";
 import { homedir, hostname } from "node:os";
-import { dirname, join } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
+import { buildersFor } from "../dispatch.js";
+import { listFolder, localOrigins } from "../folder-look.js";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { setImmediate as yieldEventLoop } from "node:timers/promises";
@@ -49,13 +51,13 @@ import { refuse, regionScript, screen, settingsRows, WORKSPACE_STYLE, workToolRo
 import { redirect, respond, safeReturn, SAFETY, taskHref } from "./http.js";
 import { assignmentOf } from "../assignment.js";
 import { assignmentTaskStatusOf } from "../assignment-presentation.js";
-import { browsePage, fleetBody, fleetScript, githubIdentityOf, githubReposPage, homePage, originUrlOf, portfolioOverview, projectsPage, systemPage, workbenchRail } from "./render-pages.js";
+import { browsePage, fleetBody, fleetScript, githubIdentityOf, githubReposPage, homePage, portfolioOverview, projectsPage, startBuilderHtml, systemPage, workbenchRail } from "./render-pages.js";
 import { capsPage } from "./render-settings.js";
 import { decisionAnswerScript, taskBody } from "./render-tasks.js";
 import {} from "./session.js";
 import { rereadBrowser } from "./live.js";
 export function createPagesHandlers(runtime) {
-    const { clock, lastChecks, store, visible, consoleProjects, restricted, ceiling, options, projectFamilyPeek, sendScreen, chromeFor, unscopedMode, admissionList, taskRepoOf, taskViewData, runVisible, evidenceRoot, workAccess, identify, liveCeiling, sessions, deletedRepos, authenticateApprover, authenticateCredential, projectOf, lookupSession } = runtime;
+    const { identities, clock, lastChecks, store, visible, consoleProjects, restricted, ceiling, options, projectFamilyPeek, sendScreen, chromeFor, unscopedMode, admissionList, taskRepoOf, taskViewData, runVisible, evidenceRoot, workAccess, identify, liveCeiling, sessions, deletedRepos, authenticateApprover, authenticateCredential, projectOf, lookupSession } = runtime;
     // The filesystem browser (operator request): pick a project folder by
     // looking, not typing. CONFINED to exactly what opening allows —
     // explicit --repo mode has an enumerable list and gets no browser at
@@ -67,40 +69,32 @@ export function createPagesHandlers(runtime) {
         const { url, who, response } = ctx;
         if (who.via !== "cookie")
             return refuse(response, who, 403, "browsing feeds a browser session's act");
-        const browseRoots = ceiling.roots.length > 0 ? [...ceiling.roots] : unscopedMode ? [realpathSync(homedir())] : [];
+        const browseRoots = ceiling.roots.length > 0 ? [...ceiling.roots] : unscopedMode ? [identities.hot(homedir())] : [];
         if (browseRoots.length === 0) {
             return refuse(response, who, 404, "this server was configured with an explicit repo list — the openable projects are all on the projects page", "/projects");
         }
         const asked = url.searchParams.get("at") ?? browseRoots[0];
-        const canonical = canonicalProject(asked);
-        const inside = canonical !== null &&
-            browseRoots.some(root => canonical === root || canonical.startsWith(`${root}/`));
-        if (canonical === null || !inside) {
+        const within = (path) => browseRoots.some(root => path === root || path.startsWith(`${root}/`));
+        // Spelled outside every root: refused before anything is read. Inside, the look resolves links and checks again.
+        if (!within(resolve(asked))) {
             return refuse(response, who, 403, "that path is outside what this server may browse", "/projects/browse");
         }
-        let entries = [];
-        try {
-            entries = readdirSync(canonical, { withFileTypes: true })
-                .filter(one => one.isDirectory() || one.isSymbolicLink())
-                .filter(one => !one.name.startsWith(".") && one.name !== "node_modules")
-                .slice(0, 400)
-                .map(one => {
-                const path = join(canonical, one.name);
-                // Resolve NOW so a symlink pointing outside the fence renders
-                // as nothing rather than as a door.
-                const resolved = canonicalProject(path);
-                if (resolved === null || !browseRoots.some(root => resolved === root || resolved.startsWith(`${root}/`))) {
-                    return null;
-                }
-                return { name: one.name, path: resolved, git: existsSync(join(resolved, ".git")) };
-            })
-                .filter((one) => one !== null)
-                .sort((a, b) => Number(b.git) - Number(a.git) || a.name.localeCompare(b.name))
-                .slice(0, 200);
+        // Read off the console's thread (folder-look.ts): a folder that doesn't answer never freezes the console.
+        const looked = await listFolder(asked, browseRoots, { ...(options.folderLook === undefined ? {} : { runner: options.folderLook }), ...(options.folderLookMs === undefined ? {} : { deadlineMs: options.folderLookMs }) });
+        if (!looked.ok) {
+            return looked.why === "no-answer"
+                ? refuse(response, who, 503, "This folder didn't answer. It may be on a drive that's disconnected, or waiting on macOS. Try again in a moment.", "/projects")
+                : refuse(response, who, 404, "that directory cannot be read", "/projects/browse");
         }
-        catch {
-            return refuse(response, who, 404, "that directory cannot be read", "/projects/browse");
+        const canonical = looked.value.at;
+        if (canonical === null || !within(canonical)) {
+            return refuse(response, who, 403, "that path is outside what this server may browse", "/projects/browse");
         }
+        // The look kept only folders inside a root; checked here again, as before.
+        const entries = looked.value.entries
+            .filter(one => within(one.path))
+            .sort((a, b) => Number(b.git) - Number(a.git) || a.name.localeCompare(b.name))
+            .slice(0, 200);
         const root = browseRoots.find(one => canonical === one || canonical.startsWith(`${one}/`));
         const parent = canonical === root ? null : canonical.slice(0, canonical.lastIndexOf("/")) || root;
         const csrf = who.session.csrf;
@@ -133,48 +127,28 @@ export function createPagesHandlers(runtime) {
         // (GitHub's rule); the FIRST match wins.
         const localByIdentity = new Map();
         const registered = new Set();
-        for (const project of store.listProjects()) {
-            if (!visible(project.path))
-                continue;
-            registered.add(project.path);
-            const identity = githubIdentityOf(originUrlOf(project.path) ?? "");
-            if (identity !== null && !localByIdentity.has(identity.toLowerCase())) {
-                localByIdentity.set(identity.toLowerCase(), project.path);
-            }
-        }
+        for (const project of store.listProjects())
+            if (visible(project.path))
+                registered.add(project.path);
         // Roots are walked ONLY when there are listed repos to match against
-        // (finding 1), through an iterator that stops at 400 entries — a
-        // directory with a million children costs 400 stats, not a scan.
-        if (listed !== null && listed.ok && listed.repos.length > 0) {
-            for (const root of ceiling.roots) {
-                const children = [];
-                try {
-                    const dir = opendirSync(root);
-                    try {
-                        for (let seen = 0; seen < 400; seen++) {
-                            const entry = dir.readSync();
-                            if (entry === null)
-                                break;
-                            if (entry.isDirectory())
-                                children.push(join(root, entry.name));
-                        }
-                    }
-                    finally {
-                        dir.closeSync();
-                    }
-                }
-                catch {
-                    // an unreadable root offers nothing
-                }
-                for (const child of children) {
-                    if (!existsSync(join(child, ".git")))
-                        continue;
-                    const identity = githubIdentityOf(originUrlOf(child) ?? "");
-                    if (identity !== null && !localByIdentity.has(identity.toLowerCase())) {
-                        localByIdentity.set(identity.toLowerCase(), child);
-                    }
+        // (finding 1), at most 400 folders a root. Every read runs off the
+        // console's thread (folder-look.ts): a folder that doesn't answer
+        // leaves its copies unmatched and the page says so.
+        const roots = listed !== null && listed.ok && listed.repos.length > 0 ? [...ceiling.roots] : [];
+        let localUnanswered = false;
+        if (registered.size > 0 || roots.length > 0) {
+            const looked = await localOrigins([...registered], roots, { ...(options.folderLook === undefined ? {} : { runner: options.folderLook }), ...(options.folderLookMs === undefined ? {} : { deadlineMs: options.folderLookMs }) });
+            if (looked.ok) {
+                const children = looked.value.found.filter(one => roots.some(root => one.path.startsWith(`${root}/`)));
+                for (const one of [...looked.value.registered.filter(row => registered.has(row.path)), ...children]) {
+                    const identity = githubIdentityOf(one.url ?? "");
+                    if (identity !== null && !localByIdentity.has(identity.toLowerCase()))
+                        localByIdentity.set(identity.toLowerCase(), one.path);
                 }
             }
+            else {
+                localUnanswered = looked.why === "no-answer";
+            }
         }
         return sendScreen(response, 200, githubReposPage(chromeFor(who.via === "cookie" ? who.session.project : null, "projects"), {
             listed,
@@ -183,6 +157,7 @@ export function createPagesHandlers(runtime) {
             csrf: who.via === "cookie" ? who.session.csrf : "",
             cloneReady: ceiling.roots.length > 0,
             openProject: who.via === "cookie" ? who.session.project ?? null : null,
+            localUnanswered,
         }));
     }
     // List repositories / Refresh list: ask the GitHub CLI signed in on this machine, then show the page.
@@ -354,7 +329,7 @@ export function createPagesHandlers(runtime) {
             runners: store.listRunners(),
             worktrees: store
                 .listWorktrees()
-                .filter(one => project === null || sameRepo(one.repo, project)),
+                .filter(one => project === null || one.repo === project || identities.hot(one.repo) === identities.hot(project)),
             episode: project === null ? null : store.latestWatchEpisode(project),
             now,
         }));
@@ -378,7 +353,7 @@ export function createPagesHandlers(runtime) {
             }),
             building: store.liveClaims(project, now),
             runners: store.listRunners(),
-            worktrees: store.listWorktrees().filter(one => project === null || sameRepo(one.repo, project)),
+            worktrees: store.listWorktrees().filter(one => project === null || one.repo === project || identities.hot(one.repo) === identities.hot(project)),
             episode: project === null ? null : store.latestWatchEpisode(project),
             outboxPending: store.pendingForAttention().length,
             // External work at a glance (arc 3 finding 24): every dispatch
@@ -665,10 +640,18 @@ export function createPagesHandlers(runtime) {
             return refuse(response, who, 403, "selecting a project is a browser session's act");
         }
         const askedPath = (body.get("path") ?? "").trim();
-        const canonicalPick = askedPath === "" ? null : canonicalProject(askedPath);
+        // Resolved off the console's thread (project-identity.ts): a folder that doesn't answer is said, never waited on.
+        const decidedOn = identities.generation();
+        const picked = askedPath === "" ? null : await identities.resolveNow(askedPath);
+        if (picked === "no-answer")
+            return refuse(response, who, 503, "That project's folder didn't answer. It may be on a drive that's disconnected, or waiting on macOS. Try again in a moment.");
+        const canonicalPick = picked;
         if ((askedPath !== "" && canonicalPick === null) || (canonicalPick !== null && (!visible(canonicalPick) || !(await authorizedProject(liveCeiling(), canonicalPick))))) {
             return refuse(response, who, 403, "that project is outside this console's reach");
         }
+        // An identity that changed during the awaits above undoes what they proved.
+        if (identities.generation() !== decidedOn)
+            return refuse(response, who, 409, "a project folder changed while this was being checked — try again");
         who.session.project = canonicalPick;
         who.session.projectRevision += 1;
         sessions.persist(who.session);
@@ -702,7 +685,12 @@ export function createPagesHandlers(runtime) {
             return refuse(response, who, 403, "opening a project is a browser session's act");
         }
         const asked = (body.get("path") ?? "").trim();
-        const canonical = asked === "" ? null : canonicalProject(asked);
+        const decidedOn = identities.generation();
+        const resolved = asked === "" ? null : await identities.resolveNow(asked);
+        if (resolved === "no-answer") {
+            return void projectsScreen(response, who, "that folder didn't answer — it may be on a drive that's disconnected, or waiting on macOS; try again in a moment", 503, safeReturn(body.get("return")));
+        }
+        const canonical = resolved;
         if (canonical === null) {
             return void projectsScreen(response, who, "that path does not exist on this server", 400, safeReturn(body.get("return")));
         }
@@ -720,13 +708,21 @@ export function createPagesHandlers(runtime) {
         if (!visible(canonical)) {
             return void projectsScreen(response, who, "That project is outside your access.", 403, safeReturn(body.get("return")));
         }
+        // An identity that changed during the awaits above undoes what they proved.
+        if (identities.generation() !== decidedOn)
+            return void projectsScreen(response, who, "a project folder changed while this was being checked — try again", 409, safeReturn(body.get("return")));
         // Opening an allowed repository admits it the same way `repos add` does
         // (project-admission.ts). A co-located `up` notices the durable list and
         // connects its builder; there is no separate restart or binding step.
-        const admitted = await admitProject(store, { registryFile: options.registryPath ?? null, path: canonical, actor: { label: who.name, origin: "console" }, now });
+        // The admission asks again, inside its registry lock and its transaction, about the repo it proves.
+        const stillAllowed = (repo) => identities.generation() === decidedOn && visible(repo);
+        const admitted = await admitProject(store, { registryFile: options.registryPath ?? null, path: canonical, actor: { label: who.name, origin: "console" }, now, stillAllowed });
         if (!admitted.ok) {
-            return void projectsScreen(response, who, admitted.reason === "not-git" ? "that path is not a git repository" : `that project is valid, but it could not be added — ${admitted.message}`, 400, safeReturn(body.get("return")));
+            return void projectsScreen(response, who, admitted.reason === "not-git" ? "that path is not a git repository" : `that project is valid, but it could not be added — ${admitted.message}`, admitted.reason === "moved" ? 409 : 400, safeReturn(body.get("return")));
         }
+        // And once more before the session follows it.
+        if (!stillAllowed(admitted.repo))
+            return void projectsScreen(response, who, "a project folder changed while this was being checked — try again", 409, safeReturn(body.get("return")));
         deletedRepos.delete(admitted.repo);
         who.session.project = admitted.repo;
         who.session.projectRevision++;
@@ -807,13 +803,9 @@ export function createPagesHandlers(runtime) {
         const rootRaw = Number.isInteger(rootIndex) ? ceiling.roots[rootIndex] : undefined;
         if (rootRaw === undefined)
             return projectsScreen(response, who, "pick one of the configured roots", 400);
-        let root;
-        try {
-            root = realpathSync(rootRaw);
-        }
-        catch {
+        const root = await identities.resolveNow(rootRaw);
+        if (root === null || root === "no-answer")
             return projectsScreen(response, who, "that projects root does not resolve right now", 400);
-        }
         const previewed = await (options.ghPreview ?? previewGithubRepo)(shape.owner, shape.name);
         if (!previewed.ok)
             return projectsScreen(response, who, previewed.message, 400);
@@ -880,19 +872,17 @@ export function createPagesHandlers(runtime) {
             return projectsScreen(response, who, "that preview expired or was already used — preview again", 400);
         }
         live.onboard?.delete(nonce); // consumed BEFORE the first await
+        // Identities as this confirmation found them: the admission below re-checks against them (project-identity.ts).
+        const decidedOn = identities.generation();
         if (record.large && body.get("big-ok") !== "1") {
             return projectsScreen(response, who, "that repository is large (or its size is unknown) — tick the box to clone it anyway", 400);
         }
         const rootRaw = ceiling.roots[record.rootIndex];
         if (rootRaw === undefined)
             return projectsScreen(response, who, "the configured roots changed — preview again", 400);
-        let root;
-        try {
-            root = realpathSync(rootRaw);
-        }
-        catch {
+        const root = await identities.resolveNow(rootRaw);
+        if (root === null || root === "no-answer")
             return projectsScreen(response, who, "that projects root does not resolve right now", 400);
-        }
         if (dirname(record.target) !== root)
             return projectsScreen(response, who, "the configured roots changed — preview again", 400);
         const cloned = await (options.ghClone ?? cloneGithubRepo)(record.nameWithOwner, root, async (cwd) => {
@@ -908,15 +898,18 @@ export function createPagesHandlers(runtime) {
             return projectsScreen(response, who, "the clone answered with a different path than the preview promised — refused; nothing was enrolled", 400);
         }
         // authorizedProject AFTER the repository exists (finding 20).
-        const proved = await authorizedProject(liveCeiling(), cloned.target);
-        const admitted = proved ? (canonicalProject(cloned.target) ?? cloned.target) : null;
+        const clonedAt = await identities.resolveNow(cloned.target);
+        const admitted = typeof clonedAt === "string" && clonedAt !== "no-answer" && (await authorizedProject(liveCeiling(), clonedAt)) ? clonedAt : null;
         if (admitted === null) {
             return projectsScreen(response, who, `the clone landed at ${cloned.target} but did not prove under the ceiling — it was left in place; enroll it by hand`, 400);
         }
-        const joined = await admitProject(store, { registryFile: options.registryPath ?? null, path: admitted, actor: { label: who.name, origin: "console" }, now });
+        const stillAllowed = (repo) => identities.generation() === decidedOn && visible(repo);
+        const joined = await admitProject(store, { registryFile: options.registryPath ?? null, path: admitted, actor: { label: who.name, origin: "console" }, now, stillAllowed });
         if (!joined.ok) {
-            return projectsScreen(response, who, `${cloned.target} is cloned but not added — ${joined.message}`, 400);
+            return projectsScreen(response, who, `${cloned.target} is cloned but not added — ${joined.message}`, joined.reason === "moved" ? 409 : 400);
         }
+        if (!stillAllowed(joined.repo))
+            return projectsScreen(response, who, `${cloned.target} is cloned but wasn't opened — a project folder changed while it was being checked; try again`, 409);
         deletedRepos.delete(admitted);
         who.session.project = admitted;
         who.session.projectRevision += 1;
@@ -937,7 +930,7 @@ export function createPagesHandlers(runtime) {
         const recentPaths = new Set(recent.map(one => one.path));
         const candidates = new Set();
         for (const path of consoleProjects()) {
-            const canonical = canonicalProject(path) ?? path;
+            const canonical = identities.hot(path);
             if (!recentPaths.has(canonical) && visible(canonical))
                 candidates.add(canonical);
         }
@@ -1084,6 +1077,22 @@ export function createPagesHandlers(runtime) {
             return respond(response, 404, "application/json", JSON.stringify({ error: "run" }));
         return respond(response, 200, "application/json", JSON.stringify(window.ok ? window : { error: window.reason }));
     }
+    /** Start a builder (Settings revamp S4): the command, and whether a builder that may build the open project is
+     * checking in, as dispatch decides. Read-only; a project-limited person sees only a project they may see. */
+    async function startBuilderPage(ctx) {
+        const { response, now, project, url, who } = ctx;
+        // ?task=<id>: that task's own saved project (a builder there, as dispatch decides for it), never the open one; the
+        // session's selection is left alone. Unknown, unplaced or not visible to this person: 404, the same answer.
+        const taskId = url.searchParams.get("task");
+        const ref = taskId === null ? null : store.lookupRef(taskId.slice(0, 200));
+        if (taskId !== null && (ref === null || ref.repo === null || !visible(ref.repo)))
+            return refuse(response, who, 404, "That task is not available.", "/work");
+        const shown = ref !== null ? ref.repo : project !== null && visible(project) ? project : null;
+        const connected = shown === null ? null : buildersFor(store, shown, now, ref?.assignedRunner ?? null).alive.length > 0;
+        return sendScreen(response, 200, screen("Start a builder", startBuilderHtml({
+            heading: "h1", project: shown === null ? null : basename(shown), connected, managed: !restricted(),
+        }), { chrome: chromeFor(project, "none") }));
+    }
     const registrations = handlersOf("pages", {
         "projects.browse": projectsBrowse,
         "projects.github": projectsGithub,
@@ -1095,6 +1104,7 @@ export function createPagesHandlers(runtime) {
         "ledger": ledgerPage,
         "activity": activityPage,
         "system": systemScreen,
+        "start-builder": startBuilderPage,
         "peek": peekPage,
         "agents": agentsPage,
         "agents.live": agentsLive,

package/dist/server/people-tokens.js

@@ -12,7 +12,7 @@ import { SSO_CALLBACK } from "../sso-settings.js";
 import { personChip, refuse, screen } from "./chrome.js";
 import { redirect, respond, sayTo } from "./http.js";
 /** people handlers, moved without changing their route bodies. */
-import { randomBytes, timingSafeEqual } from "node:crypto";
+import { randomBytes } from "node:crypto";
 import {} from "node:http";
 import {} from "../contracts/console-api.js";
 import { listCoordinators } from "../coordinator.js";
@@ -22,8 +22,9 @@ import { personAuditHtml, personHref } from "../people-audit-ui.js";
 import { cursorOf as auditCursorOf, remoteAudit } from "../remote-audit.js";
 import { credentialProof, hashPassword, proveAccountNow } from "../scope.js";
 import { form, HANDOFF_STYLE, loginHref, loginReturn, page, SIGN_IN_COOKIE, signInSpent, startedHere } from "./http.js";
-import { joinDeadPage, joinFormPage, loginPage, signupPage } from "./render-people.js";
+import { joinDeadPage, joinFormPage, loginPage, SIGNUP_NAME, SIGNUP_PASSWORD_MIN, signupPage } from "./render-people.js";
 import { SESSION_COOKIE, SIGN_IN_LINK_PATH } from "./session.js";
+import { setupCodeMatches, signupCookie, signupFromHere } from "./signup-gate.js";
 /** Clock skew allowed between the provider and this server when reading auth_time — forward only (a provider clock
  * running ahead). auth_time is in whole seconds, so a check made in the visit's own second is floored below startedAt:
  * the one allowance backward is that rounding, never a check made before the visit began. */
@@ -39,7 +40,7 @@ export function sameVisitCheck(authTime, startedAt, now) {
     return Math.min(Math.max(at, startedAt), now);
 }
 export function createPeopleHandlers(runtime) {
-    const { joinBySource, ssoOffer, ssoVisits, ssoSettings, options, clock, ssoHandoffs, managedRepos, store, visible, admissionList, sendScreen, chromeFor, restricted, sessions, consoleProjects, authenticateApprover, authenticateCredential, bustBadge, projectOf, signInLinks, linkKey, fromThisComputer, recordSignIn, passwordAllowed, arrival, defaultProject, cookieSecure, consoleOrigin, providerFor, providerKnown, joinSourceOf, signInBudget, signInActor, minutesWords } = runtime;
+    const { joinBySource, ssoOffer, ssoVisits, ssoSettings, options, clock, ssoHandoffs, managedRepos, store, visible, admissionList, sendScreen, chromeFor, restricted, sessions, consoleProjects, authenticateApprover, authenticateCredential, bustBadge, projectOf, signInLinks, linkKey, fromThisComputer, recordSignIn, passwordAllowed, arrival, cookieSecure, consoleOrigin, providerFor, providerKnown, joinSourceOf, signInBudget, signInActor, minutesWords } = runtime;
     // v101: Settings → Sessions & tokens: where you're signed in, and your API tokens. An instance operator can see everyone's.
     async function sessionsPage(ctx) {
         const { url, who, response, project } = ctx;
@@ -307,6 +308,11 @@ ${reauth(html `<label>Password <input type="password" name="token" autocomplete=
     async function signInPage(ctx) {
         const { url, response } = ctx;
         if (options.setupCode !== undefined && store.listApprovers().length === 0) {
+            // The form's same-site proof (signup-gate.ts): a post without it never reaches the setup code.
+            if (runtime.setupAttemptsLeft > 0)
+                response.setHeader("Set-Cookie", signupCookie(cookieSecure));
+            // Its own post then carries this console's Origin (the console's default no-referrer sends `null`).
+            response.setHeader("Referrer-Policy", "same-origin");
             return page(response, 200, signupPage(null, runtime.setupAttemptsLeft));
         }
         return page(response, 200, loginPage(null, loginReturn(url.searchParams.get("return")), ssoOffer()));
@@ -334,7 +340,7 @@ ${reauth(html `<label>Password <input type="password" name="token" autocomplete=
             return page(response, 403, loginPage(`Sign in with ${ssoSettings()?.label ?? "your identity provider"}.`, "/chat", ssoOffer()));
         const id = randomBytes(32).toString("hex");
         sessions.set(id, { ...arrival(request), name: held.account, csrf: randomBytes(32).toString("hex"), role: account.role, generation: account.generation, createdAt: Date.now(), sawBoardAt: null, lastSeen: Date.now(),
-            project: defaultProject, projectRevision: 1 });
+            project: runtime.defaultProject, projectRevision: 1 });
         recordSignIn(held.account, "signed in", "one-time link");
         response.setHeader("Set-Cookie", `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`);
         return redirect(response, "/chat");
@@ -429,44 +435,58 @@ ${reauth(html `<label>Password <input type="password" name="token" autocomplete=
         const account = store.accountOf(signedIn.account);
         const id = randomBytes(32).toString("hex");
         sessions.set(id, { ...arrival(request), name: signedIn.account, csrf: randomBytes(32).toString("hex"), role: account.role, generation: account.generation, createdAt: Date.now(), sawBoardAt: null, lastSeen: Date.now(),
-            project: defaultProject, projectRevision: 1, sso: { at: handoff.checkedAt ?? 0 } });
+            project: runtime.defaultProject, projectRevision: 1, sso: { at: handoff.checkedAt ?? 0 } });
         recordSignIn(signedIn.account, "signed in", settings.label);
         response.setHeader("Set-Cookie", [signInSpent("/login/sso/finish"), `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`]);
         return redirect(response, handoff.returnTo);
     }
     async function signupSend(ctx) {
         const { request, response } = ctx;
+        // A re-shown form posts again: its Origin must name this console too (signup-gate.ts).
+        response.setHeader("Referrer-Policy", "same-origin");
         // Only while the table is empty, only with the printed code, only
         // five tries: the bootstrap door underneath is atomic, so two first
         // visitors serialize to one owner.
         if (options.setupCode === undefined || store.listApprovers().length > 0) {
-            return page(response, 409, loginPage("an account already exists — sign in"));
+            return page(response, 409, loginPage("An account already exists. Sign in."));
         }
         if (runtime.setupAttemptsLeft <= 0) {
-            return page(response, 403, signupPage("too many wrong codes — restart the server to get a fresh code", 0));
+            return page(response, 403, signupPage(null, 0));
+        }
+        // Another site's post (or one without this page's cookie) is refused before it can spend a try.
+        if (!signupFromHere(request, runtime.allowedHost)) {
+            request.resume();
+            response.setHeader("Set-Cookie", signupCookie(cookieSecure));
+            return page(response, 403, signupPage("This form had expired, so it was reloaded. Enter the details again.", runtime.setupAttemptsLeft));
         }
         const body = readForm(await form(request), CONSOLE_FORMS.signup);
         const code = (body.get("code") ?? "").trim();
         const name = (body.get("name") ?? "").trim();
         const password = body.get("password") ?? "";
-        const given = Buffer.from(code.padEnd(64, " "), "utf8");
-        const wanted = Buffer.from(options.setupCode.padEnd(64, " "), "utf8");
-        if (code === "" || !timingSafeEqual(given, wanted)) {
+        // Re-read after the body: concurrent posts all waited above, and only the tries still left may be compared.
+        // From here to the decrement nothing awaits, so check and spend are one step.
+        if (runtime.setupAttemptsLeft <= 0) {
+            return page(response, 403, signupPage(null, 0));
+        }
+        if (!setupCodeMatches(code, options.setupCode)) {
             runtime.setupAttemptsLeft -= 1;
-            return page(response, 403, signupPage("that is not the setup code the server printed", runtime.setupAttemptsLeft));
+            // What was typed comes back except the code and the password (never echoed); the count rides the code's note.
+            return page(response, 403, signupPage(runtime.setupAttemptsLeft > 0
+                ? { field: "code", text: "That isn't the setup code Toolroll printed. Check the terminal and try again." }
+                : "That wasn't the setup code, and that was the last try. Restart Toolroll to get a new code.", runtime.setupAttemptsLeft, name));
         }
-        if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(name)) {
-            return page(response, 400, signupPage("a username is letters, digits, dots, dashes — up to 64", runtime.setupAttemptsLeft));
+        if (!SIGNUP_NAME.test(name)) {
+            return page(response, 400, signupPage({ field: "name", text: "Use only letters, digits, dots, dashes or underscores, starting with a letter or digit." }, runtime.setupAttemptsLeft, name));
         }
-        if (password.length < 8) {
-            return page(response, 400, signupPage("a password is at least 8 characters", runtime.setupAttemptsLeft));
+        if (password.length < SIGNUP_PASSWORD_MIN) {
+            return page(response, 400, signupPage({ field: "password", text: `Use at least ${SIGNUP_PASSWORD_MIN} characters.` }, runtime.setupAttemptsLeft, name));
         }
         const made = store.bootstrapApproverIfNone(name, hashPassword(password), clock());
         if (!made.ok)
-            return page(response, 409, loginPage("an account already exists — sign in"));
+            return page(response, 409, loginPage("An account already exists. Sign in."));
         const authenticated = authenticateAccount(store, name, password);
         if (authenticated === null || !authenticated.ok)
-            return page(response, 500, loginPage("the account was created but could not sign in — try again"));
+            return page(response, 500, loginPage("The account was created, but signing in failed. Sign in with it now."));
         const id = randomBytes(32).toString("hex");
         sessions.set(id, {
             ...arrival(request),
@@ -477,7 +497,7 @@ ${reauth(html `<label>Password <input type="password" name="token" autocomplete=
             createdAt: Date.now(),
             sawBoardAt: null,
             lastSeen: Date.now(),
-            project: defaultProject,
+            project: runtime.defaultProject,
             projectRevision: 1,
             // A password typed on this computer starts this session's freshness window (cockpit B2); from anywhere else, never.
             ...(fromThisComputer(request) ? { passwordAt: Date.now() } : {}),
@@ -528,7 +548,7 @@ ${reauth(html `<label>Password <input type="password" name="token" autocomplete=
             createdAt: Date.now(),
             sawBoardAt: null,
             lastSeen: Date.now(),
-            project: defaultProject,
+            project: runtime.defaultProject,
             projectRevision: 1,
             // A password typed to sign in on this computer starts this session's freshness window (cockpit B2); from anywhere
             // else (a phone, a proxy) it signs in and proves nothing more.
@@ -615,7 +635,7 @@ ${reauth(html `<label>Password <input type="password" name="token" autocomplete=
             createdAt: Date.now(),
             sawBoardAt: null,
             lastSeen: Date.now(),
-            project: defaultProject,
+            project: runtime.defaultProject,
             projectRevision: 1,
         });
         response.setHeader("Set-Cookie", `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`);

package/dist/server/render-pages.d.ts

@@ -112,6 +112,16 @@ export declare function inboxPage(chrome: Chrome, data: {
     unread?: readonly InboxTab[];
 }): Screen;
 /** System: the machinery — workers, background service, workspaces. */
+/** Start a builder: the one command, as text to select (/start-builder, where every "Connect a builder" leads, and
+ * /system#builder). `project`: the open project's name, when the viewer may see it; `connected`: whether a builder
+ * that may build there is checking in (null: say nothing); `managed`: whether this person can start one themselves
+ * (registering a builder takes an instance operator), else who to ask. */
+export declare function startBuilderHtml(data: {
+    heading: "h1" | "h2";
+    project: string | null;
+    connected: boolean | null;
+    managed: boolean;
+}): Html;
 export declare function systemPage(chrome: Chrome, data: {
     agents: {
         phase: "plan" | "build" | "repair" | "review";
@@ -422,22 +432,6 @@ export type ProjectPeek = {
  * GitHub identity. Everything else is null.
  */
 export declare function githubIdentityOf(remoteUrl: string): string | null;
-/**
- * The `origin` remote's url from a repository's OWN .git/config. BOUNDED
- * I/O by construction (ghlist review, finding 1): the final component may
- * not be a symlink (O_NOFOLLOW + lstat), must be a REGULAR file under a
- * size cap, and at most 64 KiB are ever read — a sparse monster or a fifo
- * planted as a "config" reads as null, never as a hang. Parsed LINE BY
- * LINE with real section tracking (finding 2): a `[remote "origin"]`
- * embedded inside some other value never opens the section. null when
- * unreadable or origin-less; a worktree-style `.git` FILE (gitdir pointer)
- * reads null too, which is honest — its identity lives elsewhere. The
- * answer is ADVISORY metadata for offering a button: the /projects/open
- * road re-proves path, ceiling, and git-ness before anything mutates, and
- * a config that lies about its origin can only mislabel a repository the
- * operator was already allowed to open.
- */
-export declare function originUrlOf(repoPath: string): string | null;
 /** The GitHub listing page: the account's repositories with ONE honest
  * action each. Names, descriptions, and paths are gh/filesystem DATA —
  * escaped at the sink like everything else. */
@@ -450,6 +444,8 @@ export declare function githubReposPage(chrome: Chrome, data: {
     csrf: string;
     cloneReady: boolean;
     openProject: string | null;
+    /** A projects folder didn't answer in time: local copies weren't matched this time. */
+    localUnanswered?: boolean;
 }): Screen;
 export declare function projectsPage(chrome: Chrome, recent: {
     path: string;