toolroll 0.9.88 → 0.9.90

package/dist/scope.d.ts

@@ -1,5 +1,6 @@
 export { ACCEPTANCE_LIMITS, EVIDENCE_KINDS, type EvidenceKind } from "./contracts/acceptance-terms.js";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { type LocalTransport } from "./local-owner.js";
 import { isAcpProfile, type AcpProviderId } from "./acp-agents.js";
 export { isAcpProfile };
 import { type NetworkProfile } from "./egress.js";
@@ -651,7 +652,9 @@ export type FreshOp = "approve-standard" | "chat-send" | "reply-question";
 /** "session": Passwordless is on and this is the person's own live browser session (docs/plans/passwordless.md). */
 /** "remote-token" / "lead-token": a machine credential stood in for the person (a remote run's API token, a lead's
  * token) — fine for ordinary acts it is allowed, never for a credential act (it would mint a way in with no password). */
-export type AuthMethod = "password-now" | "sso-now" | "fresh-password" | "fresh-sso" | "session" | "cli-login" | "remote-token" | "lead-token";
+/** "local-owner" (easy-start C1): the local owner of a laptop install, in an allowlisted act (local-owner.ts) — a person,
+ * never a credential act, and its approvals stand only while local mode stays on at their generation. */
+export type AuthMethod = "password-now" | "sso-now" | "fresh-password" | "fresh-sso" | "session" | "cli-login" | "remote-token" | "lead-token" | "local-owner";
 /**
  * The local CLI's remembered login, marked for the one command that read it (operate.ts credentialsFrom): with
  * Passwordless on, a proof made with it records "cli-login" — never a typed password — and no credential act accepts it.
@@ -794,7 +797,10 @@ export declare function approve(store: Store, taskId: string, by: string, now: D
 /** The ledger act that records how an approval's person was proved (password-now, sso-now, fresh-password, fresh-sso). */
 export declare const APPROVAL_PROOF = "approval proved";
 /** The proof row's detail: when the person was proved, the generation, and the exact digest they said yes to. */
-export declare const approvalProofDetail: (at: number, generation: number, digest: string) => string;
+export declare const approvalProofDetail: (at: number, generation: number, digest: string, local?: {
+    generation: number;
+    transport: LocalTransport;
+}) => string;
 /** The proof of THIS approval: the approver's own row for these exact bytes (never another approval's words). */
 export declare function approvalProofOf(store: Store, taskId: string, by: string, digest: string): {
     method: string;
@@ -1007,3 +1013,19 @@ export declare function releaseApprovalOf(store: Store, taskId: string, _now?: D
 /** When a password typed at `at` (ISO) stops standing in, for a page's words (ISO); null when `at` isn't a time. Words
  * only: freshnessFor decides whether it stands in, at the moment of use. */
 export declare function freshUntil(at: string): string | null;
+export type LocalApprovalRefusal = "local-mode-off" | "not-owner" | "no-scope" | "release" | "protected" | "escalated" | "coordinator" | "unsandboxed";
+/**
+ * Whether the local owner may approve this task without a password (easy-start plan C5). ONE rule, read by the
+ * preview (the task page's approve form and the chat review render no password field when it is ok), the chat
+ * precheck (an empty field passes) and the seal itself (approve(), inside its transaction). Refused: local mode off or
+ * another person; no plan; release or deploy terms; protected or two-person work; an escalated profile; work a
+ * coordinator filed; a project whose checks are stored as unsandboxed (or a plan that sealed that). Plans a lead or
+ * a scout proposed are allowed.
+ */
+export declare function localApprovalEligible(store: Store, by: string, taskId: string): {
+    ok: true;
+} | {
+    ok: false;
+    reason: LocalApprovalRefusal;
+    message: string;
+};

package/dist/scope.js

@@ -6,6 +6,7 @@ import { currentPasswordSource, passwordGuardOf, provenPasswordAccount } from ".
 import { validateScopeText } from "./task-text.js";
 import { contractChangesOf } from "./contract-changes.js";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { currentLocalOwner, localModeOn, localOwnerInFlight, localOwnerRefusal, localOwnerStandsNow } from "./local-owner.js";
 import { projectAuthority } from "./project-access.js";
 import { activeRemote } from "./remote-run.js";
 import { claimActor, currentActor } from "./actor.js";
@@ -824,7 +825,9 @@ export function authenticateAccount(store, by, secret) {
     const hash = account?.credentialHash ?? dummy;
     if (!hash.startsWith("scrypt$"))
         verifyCredential(dummy, secret);
-    const matches = verifyCredential(hash, secret);
+    // v147: an account with no password set (a local-mode owner) has a random hash; the KDF still runs (same timing), and
+    // nothing it is given ever matches.
+    const matches = verifyCredential(hash, secret) && account !== null && account.passwordSet;
     if (account === null || !matches) {
         guard.failed(by, now, source, account !== null);
         return { ok: false, reason: "unknown" };
@@ -902,6 +905,16 @@ export function ssoNowAvailable(by, now = Date.now()) {
  */
 export function proveAccountNow(store, by, token, options = {}) {
     const now = Date.now();
+    // Easy-start C1: a local owner is decided FIRST, before Passwordless and freshness, whatever was typed. An allowlisted
+    // act of its own, still standing (re-read here, inside the caller's transaction), is "local-owner"; anything else —
+    // a credential act, a read, another person, local mode moved — proves nothing. It never upgrades to a typed password.
+    // A lead's token or a remote API token in that chain is never the local owner (it stays a machine's proof below).
+    const local = activeRemote() === null && currentActor()?.lead !== true ? currentLocalOwner() : null;
+    if (local !== null) {
+        if (options.credential === true || local.account !== by || local.act === "read" || !localOwnerInFlight(local) || !localOwnerStandsNow(store, local))
+            return { ok: false, reason: "not-an-approver" };
+        return { ok: true, method: "local-owner", at: now };
+    }
     const facts = freshFacts.getStore();
     if (facts != null && facts.actor === by && !facts.live())
         return { ok: false, reason: "not-an-approver" };
@@ -1072,6 +1085,16 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         // credential, not a person at a ceremony. Refused before any vote or proof row is written.
         if (!personProof(authenticated.method))
             return { ok: false, reason: "machine-proof" };
+        // Easy-start C5: a local owner approves only as the approve-plan act, and only eligible work (one shared rule:
+        // localApprovalEligible, read again here inside the seal's transaction).
+        const local = authenticated.method === "local-owner" ? currentLocalOwner() : null;
+        if (authenticated.method === "local-owner") {
+            if (local === null || local.act !== "approve-plan")
+                return { ok: false, reason: "policy", message: localOwnerRefusal(store.accountOf(by)?.passwordSet === true, "/").message };
+            const eligible = localApprovalEligible(store, by, taskId);
+            if (!eligible.ok)
+                return { ok: false, reason: "policy", message: eligible.message };
+        }
         const scope = store.getScope(taskId);
         if (scope === null)
             return { ok: false, reason: "no-scope" };
@@ -1121,7 +1144,7 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         // How the person was proved, beside every yes they give (a vote kept for protected work, or the seal): a password
         // typed now, a re-check now, or a remembered one — with when, the credential generation and the exact digest.
         const proved = () => store.recordAction({ at: now.toISOString(), actor: by, repo: store.lookupRef(taskId)?.repo ?? null, taskId, runId: null, action: APPROVAL_PROOF,
-            outcome: authenticated.method, source: "work", detail: approvalProofDetail(authenticated.at, store.accountOf(by)?.generation ?? 0, scope.digest) });
+            outcome: authenticated.method, source: "work", detail: approvalProofDetail(authenticated.at, store.accountOf(by)?.generation ?? 0, scope.digest, local === null ? undefined : { generation: local.localGeneration, transport: local.transport }) });
         if (gate.verdict === "vote") {
             // The same person again adds nothing: no new vote, no proof row (and the approval roads refund a re-check).
             if (gate.already)
@@ -1161,7 +1184,7 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
 /** The ledger act that records how an approval's person was proved (password-now, sso-now, fresh-password, fresh-sso). */
 export const APPROVAL_PROOF = "approval proved";
 /** The proof row's detail: when the person was proved, the generation, and the exact digest they said yes to. */
-export const approvalProofDetail = (at, generation, digest) => `${new Date(at).toISOString()} · generation ${generation} · digest ${digest}`;
+export const approvalProofDetail = (at, generation, digest, local) => `${new Date(at).toISOString()} · generation ${generation}${local === undefined ? "" : ` · local ${local.generation} ${local.transport}`} · digest ${digest}`;
 /** The proof of THIS approval: the approver's own row for these exact bytes (never another approval's words). */
 export function approvalProofOf(store, taskId, by, digest) {
     const rows = store.handle.prepare("SELECT outcome, detail FROM action_ledger WHERE task_id = ? AND action = ? AND actor = ? ORDER BY id DESC LIMIT 50").all(taskId, APPROVAL_PROOF, by);
@@ -1398,6 +1421,10 @@ export function proofDetailOf(detail) {
         }
     }
     const parts = detail.split(" · ");
+    // Easy-start C5: a local owner's proof names its local generation and transport between the two (approvalProofDetail).
+    const local = parts.length === 4 ? parts.splice(2, 1)[0] : null;
+    if (local !== null && !/^local \d+ (browser|terminal)$/.test(local))
+        return null;
     if (parts.length !== 3 || !parts[2].startsWith("digest ") || !/^generation \d+$/.test(parts[1]) || Number.isNaN(Date.parse(parts[0])))
         return null;
     return { at: parts[0], digest: parts[2].slice("digest ".length) };
@@ -1616,3 +1643,47 @@ export function freshUntil(at) {
     const ms = Date.parse(at);
     return Number.isFinite(ms) ? new Date(ms + FRESH_WINDOW_MS).toISOString() : null;
 }
+const LOCAL_APPROVAL_WORDS = {
+    "local-mode-off": "Local mode is off: approve with your password.",
+    "not-owner": "Only this computer's owner approves here without a password.",
+    "no-scope": "This task has no plan to approve yet.",
+    release: "Releases and deploys need your password.",
+    protected: "Protected work needs your password and a second approver.",
+    escalated: "Work with wider permissions needs your password.",
+    coordinator: "Work a coordinator filed needs your password.",
+    unsandboxed: "This project's checks run without a sandbox, so approving needs your password.",
+};
+/**
+ * Whether the local owner may approve this task without a password (easy-start plan C5). ONE rule, read by the
+ * preview (the task page's approve form and the chat review render no password field when it is ok), the chat
+ * precheck (an empty field passes) and the seal itself (approve(), inside its transaction). Refused: local mode off or
+ * another person; no plan; release or deploy terms; protected or two-person work; an escalated profile; work a
+ * coordinator filed; a project whose checks are stored as unsandboxed (or a plan that sealed that). Plans a lead or
+ * a scout proposed are allowed.
+ */
+export function localApprovalEligible(store, by, taskId) {
+    const no = (reason) => ({ ok: false, reason, message: LOCAL_APPROVAL_WORDS[reason] });
+    if (!localModeOn(store))
+        return no("local-mode-off");
+    const owner = store.handle.prepare("SELECT owner FROM local_mode WHERE id = 1").get()?.["owner"];
+    if (owner !== by)
+        return no("not-owner");
+    const scope = store.getScope(taskId);
+    if (scope === null)
+        return no("no-scope");
+    if (deployGateScope(scope) || releaseCheckScope(scope))
+        return no("release");
+    const gate = store.approvalGate(taskId, by, "person");
+    if (gate.verdict !== "seal" || gate.protectedWork)
+        return no("protected");
+    if (scope.profile == null || levelOfProfile(scope.profile) === "escalated")
+        return no("escalated");
+    const ref = store.handle.prepare("SELECT repo, coordinator_cid FROM task_ref WHERE backend = 'built-in' AND external_id = ?").get(taskId);
+    if (ref === undefined || ref["coordinator_cid"] != null)
+        return no("coordinator");
+    // The stored level, never the launch cap: a project saved as unsandboxed is refused even though local mode confines it.
+    const stored = ref["repo"] == null ? undefined : store.handle.prepare("SELECT level FROM project_check_access WHERE repo = ?").get(ref["repo"])?.["level"];
+    if (stored === "unsandboxed" || scope.profile.checkAccess === "unsandboxed")
+        return no("unsandboxed");
+    return { ok: true };
+}

package/dist/serve.js

@@ -1,6 +1,7 @@
 import { secretFolder } from "./tool-secret-store.js";
 import { acceptedIdentities, recoverLearning } from "./project-learning.js";
-import { syncProjectIdentities } from "./project-identity.js";
+import { consoleFolderGate, syncProjectIdentities } from "./project-identity.js";
+import { inFolderScope } from "./folder-gate.js";
 import { firstTasksOffThread, recoverLearningOffThread } from "./learning-look.js";
 import { loadOrCreateVapidKeys } from "./push.js";
 import { checkoutPlan } from "./checkout-cleanup.js";
@@ -153,19 +154,22 @@ import { createPagesHandlers } from './server/pages.js';
 import { createPeopleHandlers } from './server/people-tokens.js';
 import { createSettingsHandlers } from './server/settings.js';
 import { requestContext } from "./server/request-context.js";
+import { asLocalOwner, localModeOn, localOwnerRefusal, localOwnerStandsNow } from "./local-owner.js";
+import { defaultAgentOf, fillDefaultRouting } from "./model-choices.js";
 import { chromeScript, DEMO_BANNER, DEMO_BANNER_SHORT, focusDocument, KBD_HELP, pinnedTheme, QUEUE_VIEW, refuse, screen, SENSITIVE_INPUT, shell, sidebarScript } from "./server/chrome.js";
-import { BODY_CAP, form, loginHref, matchTaskPath, page, projectChatHref, redactedPath, redirect, respond, safeReturn, SHUTDOWN_WAIT_MS, taskChatHref } from "./server/http.js";
+import { BODY_CAP, form, loginHref, passwordSetNext, refusalNext, matchTaskPath, page, projectChatHref, redactedPath, redirect, respond, safeReturn, SHUTDOWN_WAIT_MS, taskChatHref } from "./server/http.js";
 import { decisionsFor, LEAD_BY_DEFAULT_FACT, leadBrowserMessages, leadChatVersion, NOT_STARTED_SESSION, TASK_COMPOSER_MODES, teamProposalCardParts } from "./server/render-chat.js";
 import {} from "./server/render-pages.js";
-import { serverErrorPage, ssoStepUps, wrongHostPage } from "./server/render-people.js";
+import { localOwnerStepUps, serverErrorPage, ssoStepUps, wrongHostPage } from "./server/render-people.js";
 import { NO_PROJECT, NO_TOUCH_FRAGMENTS, NONCE_CAP, NONCE_TTL_MS, PersistentSessions, SESSION_ABSOLUTE_MS, SESSION_IDLE_MS, sessionWithinLifetime, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH } from "./server/session.js";
 import { createTasksHandlers } from './server/tasks.js';
 import { KIT_BEHAVIOR_MARKUP, KIT_STANDALONE_SCRIPT } from './server/kit-standalone.js';
 import { createWelcomeHandlers } from './server/welcome.js';
+import { createBrowserKeys, KEY_FILL_SCRIPT, pagePathOf } from './server/mutation-key.js';
 import { DEFAULT_GUARD_POLICY, passwordGuardOf, provenPasswordAccount, SourceBudget, withPasswordSource } from "./sign-in-guard.js";
 import { sourceKey } from "./source-key.js";
 import { readSsoSettings } from "./sso-settings.js";
-import { LEAD_THREAD } from "./store.js";
+import { LEAD_THREAD, localOwnerBinding } from "./store.js";
 import { waitingUpdate } from "./toolroll-update.js";
 import { PACKAGE_VERSION } from "./version.js";
 import { loadConsoleUrl } from "./webhooks.js";
@@ -210,6 +214,7 @@ export function createDecisionServer(options) {
         get signInBudget() { return signInBudget; },
         get passwordAllowed() { return passwordAllowed; },
         get sessions() { return sessions; },
+        get browserKeys() { return browserKeys; },
     });
     const { store, evidenceRoot } = options;
     let coding = options.codingWorkspace ?? null;
@@ -362,17 +367,13 @@ export function createDecisionServer(options) {
     const linkKey = (code) => createHash("sha256").update(code).digest("hex");
     function mintSignInLink(account) {
         const known = store.accountOf(account);
-        if (known === null || known.role !== "approver" || known.revokedAt !== null)
+        // A full link is for an account with a password: a local owner without one gets only mintLocalLink's.
+        if (known === null || known.role !== "approver" || known.revokedAt !== null || !known.passwordSet)
             return null;
-        for (const [key, one] of signInLinks)
-            if (one.expires < Date.now())
-                signInLinks.delete(key);
-        while (signInLinks.size >= 20)
-            signInLinks.delete(signInLinks.keys().next().value);
-        const code = randomBytes(32).toString("base64url");
-        signInLinks.set(linkKey(code), { account, expires: Date.now() + SIGN_IN_LINK_MS });
-        return `${SIGN_IN_LINK_PATH}${code}`;
+        return holdSignInLink({ kind: "full", account, expires: Date.now() + SIGN_IN_LINK_MS });
     }
+    /** v147: this console start's key epoch (easy-start C2): the browser-key wave binds each session's mutation key to it. */
+    const keyEpoch = options.keyEpoch ?? randomBytes(16).toString("hex");
     /** This computer, and nothing in front of it: a loopback peer that names a loopback address, with no sign of a proxy —
      * any forwarding header at all (Forwarded, X-Forwarded-*, X-Real-IP, Via, …) disqualifies the request. */
     const fromThisComputer = (request) => {
@@ -670,7 +671,7 @@ export function createDecisionServer(options) {
         instrumentRequest(store.telemetry, request, response);
         // Every password checked while answering counts against where this request came from (sign-in-guard.ts).
         // A GET or HEAD only reads (docs/plans/get-side-effects.md): store reads that would tidy up as they go don't.
-        const answer = () => handle(request, response);
+        const answer = () => consoleFolders(options, identities, () => handle(request, response));
         void withPasswordSource(joinSourceOf(request), () => request.method === "GET" || request.method === "HEAD" ? asReadOnlyRequest(answer) : answer()).catch(error => {
             // Every unhandled error is logged (v99): the path and the message, never the request's body or query. The reference
             // is what a person's error page shows, so the log line can be found from it.
@@ -753,6 +754,20 @@ export function createDecisionServer(options) {
         const locals = port === null ? [] : [`localhost:${port}`, `127.0.0.1:${port}`, `[::1]:${port}`, ...tailnet.map(name => `${name}:${port}`)];
         return [...locals, ...(options.allowedHosts ?? []), ...(publicOrigin === null ? [] : [publicOrigin.host])].includes(host);
     };
+    /** Easy-start C2: a protected loopback install (bound to loopback only, no --allow-host, no public URL, no tailnet
+     * names) has one browser host, and there every browser mutation also presents the session's key (mutation-key.ts). */
+    const browserKeys = createBrowserKeys({
+        enabled: options.browserKey === true,
+        epoch: keyEpoch,
+        protectedHost: () => {
+            const address = server.address(), port = servedPort();
+            if (typeof address !== "object" || address === null || port === null)
+                return null;
+            if ((options.allowedHosts ?? []).length > 0 || publicOrigin !== null || tailnet.length > 0)
+                return null;
+            return address.address === "127.0.0.1" ? `127.0.0.1:${port}` : address.address === "::1" ? `[::1]:${port}` : null;
+        },
+    });
     /** The exact command that starts this console again as it runs now, plus a listening address or one more allowed host. */
     const consoleCommand = (change) => {
         const port = servedPort() ?? 4180;
@@ -823,6 +838,17 @@ export function createDecisionServer(options) {
         if (!allowedHost(request.headers.host)) {
             return respond(response, 421, "text/html; charset=utf-8", wrongHostPage(wrongHost(request.headers.host)));
         }
+        // Easy-start C2: a protected loopback install has one browser origin, whose storage holds the session's mutation key.
+        // A browser's page read at another loopback name (localhost, [::1]) moves there; machine callers and protocol
+        // adapters (an API token, MCP's own addresses) are left where they are.
+        const canonical = browserKeys.canonicalHost();
+        if (canonical !== null && request.headers.host !== canonical && (method === "GET" || method === "HEAD") && request.headers.authorization === undefined
+            && (edgeRoute === null || edgeRoute.domain === "people")) {
+            request.resume();
+            response.writeHead(308, { location: `http://${canonical}${hook.pathname}${hook.search}`, "cache-control": "no-store", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff" });
+            response.end();
+            return;
+        }
         // A real domain (public-access.ts): HSTS for the public https host reached over HTTPS, and no API token over
         // plain HTTP from outside this computer and the tailnet — refused before anything reads or checks it.
         const transport = transportOf({ peer: request.socket.remoteAddress, joinSource: forwardedSourceOf(request), forwardedProto: request.headers["x-forwarded-proto"], forwarded: request.headers["forwarded"] });
@@ -914,6 +940,13 @@ export function createDecisionServer(options) {
             ...(workspaceRead && typeof request.headers['if-none-match'] === 'string' ? { workspaceIfNoneMatch: request.headers['if-none-match'] } : {}),
             workspaceRequest: url.searchParams.get('request'),
             timeline,
+            // Easy-start C2: every page that posts carries the key fill while the key is required; a session whose key is from
+            // an earlier start (or has none) is told to reconnect.
+            keyFill: browserKeys.required(),
+            // Easy start: a local owner with no password sees "Set a password to do this." where a step-up field would be.
+            ...(who.via === "cookie" && who.authority === "local-owner" && store.accountOf(who.name)?.passwordSet === false
+                ? { localStepUp: localOwnerRefusal(false, method === "GET" ? passwordSetNext(pagePathOf(url)) : "/").href } : {}),
+            reconnect: browserKeys.stale(who, method === "GET" ? safeReturn(pagePathOf(url)) : "/"),
         };
         response.once("finish", () => keepSlowRequest(store, timeline, matchedRoute?.id ?? "unmatched", response.statusCode, clock()));
         if (method === "GET" || method === "POST")
@@ -931,6 +964,12 @@ export function createDecisionServer(options) {
                         return restricted()
                             ? refuse(response, who, 403, "This area requires instance access. Your account operates within its assigned projects.", "/projects")
                             : refuse(response, who, 404, "There's no page at this address.", "/chat");
+                    // Easy-start C1: a local owner's session reaches only the rows marked for it (route-table.ts `local`), decided
+                    // first, before the route's policy reads anything and before any handler runs, GET and POST alike.
+                    if (who.via === "cookie" && who.authority !== "full" && (route.local !== "allow" || localPrincipalOf(who, route) === null)) {
+                        request.resume();
+                        return refuseLocalOwner(response, who, method, url, request.headers.accept);
+                    }
                     const policy = evaluateRoutePolicy(route, { caller: who.via, capability: who.via === "bearer" && who.principal !== undefined ? who.principal.scope : who.role === "approver" ? "act" : "read", viewer: who.role === "viewer", token: who.via === "bearer" && who.principal !== undefined }, source => projectRequestAllowed(route, source, url, who, request, response, body));
                     if (!policy.ok) {
                         if (policy.reason === "project")
@@ -983,14 +1022,20 @@ export function createDecisionServer(options) {
                     }
                     return handlePost(route, url, who, request, response, body);
                 };
+                // Easy-start C1: an allowed row runs as the local owner, in the act the row is (execute refuses every other): the
+                // prover answers "local-owner" only for that act, and every write it makes re-proves it still stands.
+                const local = who.via === "cookie" && who.authority !== "full" && matchedRoute?.stage === "console" && matchedRoute.local === "allow" ? localPrincipalOf(who, matchedRoute) : null;
+                if (local !== null)
+                    response.once("close", () => { local.request.ended = true; });
+                const run = () => local === null ? execute() : asLocalOwner(local, execute);
                 if (method === "GET")
-                    return projectAuthority.run({ actor: who.name, repo: target.repo }, execute);
+                    return projectAuthority.run({ actor: who.name, repo: target.repo }, run);
                 // Request acceptance is separate from durable work completion. Never
                 // persist a body, query string, token, password, or arbitrary URL.
                 const entry = { at: clock().toISOString(), actor: who.name, ...target, source: "request", ...(who.via === "bearer" && who.token !== undefined ? { detail: `API token: ${who.token}` } : {}) };
                 store.recordAction({ ...entry, outcome: "requested" });
                 try {
-                    await projectAuthority.run({ actor: who.name, repo: target.repo }, execute);
+                    await projectAuthority.run({ actor: who.name, repo: target.repo }, run);
                     const createdTask = requestContext.getStore()?.createdTask;
                     const placement = createdTask === undefined ? null : store.lookupRef(createdTask);
                     store.recordAction({ ...entry, ...(placement === null ? {} : { repo: placement.repo, taskId: placement.externalId }), at: clock().toISOString(), outcome: response.statusCode >= 500 ? "error" : response.statusCode >= 400 ? "refused" : "accepted" });
@@ -1194,8 +1239,15 @@ export function createDecisionServer(options) {
         if (provider === null)
             return;
         const now = clock();
-        store.setChatConfig({ provider, model: "default", dailyTurns: 50, weeklyCeilingMicrousd: 0, priceInMicrousd: 0, priceOutMicrousd: 0 }, "toolroll", now);
-        store.recordInstallationFact(LEAD_BY_DEFAULT_FACT, provider, now);
+        store.transact(() => {
+            store.setChatConfig({ provider, model: "default", dailyTurns: 50, weeklyCeilingMicrousd: 0, priceInMicrousd: 0, priceOutMicrousd: 0 }, "toolroll", now);
+            store.recordInstallationFact(LEAD_BY_DEFAULT_FACT, provider, now);
+            // A laptop install (local mode on): the agent chosen here also starts the models, on its default preset, while
+            // nothing is chosen yet, so the owner's first task plans without a password (model-choices.ts fillDefaultRouting).
+            const agent = defaultAgentOf(provider);
+            if (agent !== null && localModeOn(store))
+                fillDefaultRouting(store, agent, "toolroll", { kind: "first-start" }, now);
+        });
     }
     // Look once at start, so the lead is on by the time the browser opens.
     if (options.leadByDefault === true && !store.isDemo() && store.getChatConfig() === null)
@@ -1516,9 +1568,16 @@ export function createDecisionServer(options) {
             if (s.workspace?.view?.kind === "flow")
                 s = { ...s, workspace: { ...s.workspace, view: { ...s.workspace.view, stepUp: { label: ssoFacts.label, fresh: ssoFacts.fresh, confirmHref: `/login/sso?reauth=1&return=${encodeURIComponent(back)}` } } } };
         }
+        // Easy start: a local owner with no password has none to type: each step-up field says how to set one instead.
+        const localStepUp = requestContext.getStore()?.localStepUp;
+        if (localStepUp !== undefined) {
+            s = { ...s, body: localOwnerStepUps(s.body, localStepUp), ...(s.workspace?.pageHtml == null ? {} : { workspace: { ...s.workspace, pageHtml: localOwnerStepUps(s.workspace.pageHtml, localStepUp) } }) };
+        }
         // D5: team chat (the central team service) is deprecated; /chat?team=1 still opens this release, but nothing links to it.
         const sensitive = authored || s.forceSensitive === true;
         const requestFacts = requestContext.getStore();
+        // Easy-start C2: while the browser mutation key is required, every page's one nonce'd script also fills the key.
+        const keyFill = requestFacts?.keyFill === true ? KEY_FILL_SCRIPT : "";
         // The settings frame (settings-kit.ts): its breadcrumb, for the shell and the workspace alike.
         if (s.chrome !== undefined && s.chrome.crumbs === undefined) {
             const crumbs = settingsCrumbs(new URL(requestFacts?.returnTo ?? '/', 'http://standing-orders.local').pathname, s.title, htmlString(s.body));
@@ -1667,6 +1726,8 @@ export function createDecisionServer(options) {
                 ...(extras.firstRun === undefined ? {} : { firstRun: extras.firstRun }),
                 ...(extras.phone === undefined ? {} : { phone: extras.phone }),
                 ...(extras.home == null ? {} : { home: extras.home }),
+                // Easy-start C2: this tab's key is from an earlier start (or it has none): one way to reconnect.
+                ...(requestFacts.reconnect == null ? {} : { reconnect: requestFacts.reconnect }),
             };
             if (requestFacts.workspaceRead) {
                 const validator = requestFacts.workspaceValidator;
@@ -1692,13 +1753,18 @@ export function createDecisionServer(options) {
             // A page with its own view keeps its script; the chat page runs the result script.
             const functional = conversation === null || extras.view ? (s.functional?.script ?? '') : RESULT_REVIEW_SCRIPT;
             const document = shell(s.title, s.body, { chrome: s.chrome, sensitive });
-            return page(response, status, browserWorkspaceDocument(document, workspace, nonce, functional + MOBILE_VIEWPORT_SCRIPT), nonce, true);
+            return page(response, status, browserWorkspaceDocument(document, workspace, nonce, functional + MOBILE_VIEWPORT_SCRIPT + keyFill), nonce, true);
         }
         // A one-time secret on screen (a token, an invite link, a pairing code): the
         // page carries no script of any kind, so it leaves the workspace for a
         // focused page in the same look: the brand, the one card, and the way back.
-        if (s.forceSensitive === true)
-            return page(response, status, focusDocument(s.title, s.body));
+        // Easy-start C2: but for the key fill when it has a form that posts (the fill reads nothing on the page).
+        if (s.forceSensitive === true) {
+            if (keyFill === "" || !/<form\b[^>]*method="post"/i.test(htmlString(s.body)))
+                return page(response, status, focusDocument(s.title, s.body));
+            const nonce = randomBytes(16).toString("base64");
+            return page(response, status, focusDocument(s.title, s.body, { nonce, script: keyFill }), nonce);
+        }
         const chromeLayer = !sensitive && s.chrome !== undefined;
         const functional = s.functional?.script ?? "";
         // Sensitive pages strip the palette and keys but keep the sidebar toggle.
@@ -1706,7 +1772,7 @@ export function createDecisionServer(options) {
         // Kit markup the workspace bundle would have wired (a composer, an overlay, a switch, an idea) gets the kit's own small
         // behaviour here (kit-standalone.ts); never on a sensitive page, which carries no chrome additions.
         const kitBehavior = chromeLayer && KIT_BEHAVIOR_MARKUP.test(htmlString(s.body)) ? KIT_STANDALONE_SCRIPT : "";
-        const script = functional + (chromeLayer ? chromeScript() + WORKSPACE_MOTION_SCRIPT + kitBehavior : sensitiveChrome);
+        const script = functional + (chromeLayer ? chromeScript() + WORKSPACE_MOTION_SCRIPT + kitBehavior : sensitiveChrome) + keyFill;
         const nonce = script === "" ? undefined : randomBytes(16).toString("base64");
         const body = chromeLayer
             ? html `${s.body}\n${paletteTagCached(s.chrome?.project ?? null)}\n${KBD_HELP}`
@@ -1971,7 +2037,7 @@ export function createDecisionServer(options) {
         // and role were admitted by the route table.
         const denied = authorizeMutation(request, who, readForm(posted, CONSOLE_FORMS.mutationGuard));
         if (denied !== null)
-            return refuse(response, who, denied.status, denied.message);
+            return refuse(response, who, denied.status, denied.message, "/", denied.reconnect?.kind === "password" ? { label: "Reconnect", href: denied.reconnect.href } : undefined);
         // Standing can change after a token was minted: a viewer's act stays refused, cookie and bearer alike, except
         // the row's session-local acts.
         if (who.role === "viewer" && !route.viewer)
@@ -1986,7 +2052,9 @@ export function createDecisionServer(options) {
     // deterministic scan is idle without new meaningful work; shutdown drains it.
     let leadMaintenance = null;
     let leadClosing = false;
-    server.once('listening', () => {
+    // Started in the console's folder scope (folder-gate.ts), so their own timers and the personal queue's kick (which
+    // restores the context it was started in, never a request's) read folders as the console's work does.
+    server.once('listening', () => consoleFolders(options, identities, () => {
         team.start();
         personalQueue.start();
         leadMaintenance = startMaintenance({ intervalMs: 5_000, shouldStop: () => leadClosing,
@@ -1996,7 +2064,7 @@ export function createDecisionServer(options) {
             // Pending delivery is durable and is read again on the next pass; a failure is said where follow status is read.
             onError: error => recordLeadFollowFailure(store, error, clock()),
         });
-    });
+    }));
     // Background checks (docs/plans/get-side-effects.md): what pages show about this computer's agent sign-ins and the
     // services Toolroll uses is asked here, on a timer, and a page reads the last answer. A page visit never starts a
     // process or a network call, and never acts on what a check finds: lifting a sign-in pause and the lead-by-default
@@ -2011,7 +2079,7 @@ export function createDecisionServer(options) {
             }
             catch { /* a page says secrets can't be read; the next action reports why */ }
             backgroundChecks = startMaintenance({ intervalMs: options.backgroundChecksMs ?? BACKGROUND_CHECKS_MS, shouldStop: () => leadClosing,
-                run: async () => {
+                run: () => consoleFolders(options, identities, async () => {
                     const now = Date.now();
                     const waits = [];
                     if (now - agentsCheckedAt >= (options.backgroundChecksMs ?? LOCAL_AGENTS_EVERY_MS)) {
@@ -2109,7 +2177,7 @@ export function createDecisionServer(options) {
                         catch { /* shown as last saved */ }
                     }
                     await Promise.all(waits);
-                },
+                }),
                 onError: () => { }, });
             void backgroundChecks.runNow();
         });
@@ -2303,6 +2371,8 @@ export function createDecisionServer(options) {
         get firstTasks() { return firstTasks; },
         get authenticateCredential() { return authenticateCredential; },
         get identities() { return identities; },
+        get keyEpoch() { return keyEpoch; },
+        get browserKeys() { return browserKeys; },
     };
     const tasksHandlers = createTasksHandlers(handlerRuntime);
     const pagesHandlers = createPagesHandlers(handlerRuntime);
@@ -2312,6 +2382,7 @@ export function createDecisionServer(options) {
     const peopleHandlers = createPeopleHandlers(handlerRuntime);
     const remoteRuntime = {
         get identify() { return identify; },
+        get browserKeys() { return browserKeys; },
         get freshFactsOf() { return freshFactsOf; },
         get store() { return store; },
         get admitPasswordSource() { return admitPasswordSource; },
@@ -2370,7 +2441,46 @@ export function createDecisionServer(options) {
         }
         return withEdgePolicy(route, () => registry.edge(route, { ...ctx, route }));
     }
-    return Object.assign(server, { mintSignInLink, closeCoding });
+    /** Easy-start C1: the local owner a browser session acts as on an allowed row, bound to its session's saved row and
+     * the generations it was made under; null when it no longer stands (refused like any other row). */
+    function localPrincipalOf(who, route) {
+        const sessionHash = sessions.hashOf(who.session);
+        if (route.localAct === null || who.session.localGeneration === null || sessionHash === null)
+            return null;
+        const principal = { account: who.name, localGeneration: who.session.localGeneration, accountGeneration: who.session.generation,
+            transport: "browser", act: route.localAct, sessionHash, request: { ended: false } };
+        return localOwnerStandsNow(store, principal) ? principal : null;
+    }
+    /** What a local owner hears on a row not marked for it: set a first password, or sign in with the one set. */
+    function refuseLocalOwner(response, who, method, url, accept) {
+        // The page it was refused on, built here from the request (never from a header): a form's nearest page above it.
+        const words = localOwnerRefusal(store.accountOf(who.name)?.passwordSet === true, refusalNext(method, url));
+        // Which refusal this was, for the shell (it offers the same way on) and the route inventory's rule table.
+        response.setHeader("x-toolroll-refused", "local-owner");
+        if (String(accept ?? "").includes("application/json"))
+            return respond(response, 403, "application/json", JSON.stringify({ ok: false, said: words.message, href: words.href }));
+        return refuse(response, who, 403, words.message, words.href, { label: words.action, href: words.href });
+    }
+    // Defined last, so the reviewed functions above keep their places (password-freshness.test.ts).
+    function holdSignInLink(link) {
+        for (const [key, one] of signInLinks)
+            if (one.expires < Date.now())
+                signInLinks.delete(key);
+        while (signInLinks.size >= 20)
+            signInLinks.delete(signInLinks.keys().next().value);
+        const code = randomBytes(32).toString("base64url");
+        signInLinks.set(linkKey(code), link);
+        return `${SIGN_IN_LINK_PATH}${code}`;
+    }
+    /** Easy-start C4: a local owner's one-time link. It names no account: local mode's own owner, read now, while local
+     * mode is on and the owner is active. Redemption reads local mode again and issues only a local-owner session. */
+    function mintLocalLink() {
+        const binding = localOwnerBinding(store);
+        if (binding === null)
+            return null;
+        return holdSignInLink({ kind: "local-owner", ...binding, expires: Date.now() + SIGN_IN_LINK_MS });
+    }
+    return Object.assign(server, { mintSignInLink, mintLocalLink, keyEpoch, closeCoding });
 }
 export { PAGE_CSS, pinnedTheme, SENSITIVE_INPUT } from "./server/chrome.js";
 export { redactedPath, SHUTDOWN_WAIT_MS } from "./server/http.js";
@@ -2415,3 +2525,22 @@ function startupCeiling(repos, roots, identities, canon) {
         configuredPaths,
     };
 }
+/** Each console's folder gate (folder-gate.ts), made once for its options. */
+const consoleGates = new WeakMap();
+/**
+ * Runs the console's own work (a request, a background pass) in its folder scope: with identities resolved off its
+ * thread (up and serve), it reads a person's folder synchronously only while that folder answered a look lately; its
+ * own data (the database's folder, evidence, build checkouts) is read freely. Without identities (embedders, tests):
+ * as before. Work that isn't the console's (a worker in the same process) never runs in it.
+ */
+function consoleFolders(options, identities, work) {
+    if (options.identities === undefined)
+        return work();
+    let gate = consoleGates.get(options);
+    if (gate === undefined) {
+        const databaseFile = options.store.databaseFile();
+        gate = consoleFolderGate(identities, [options.configDir, options.evidenceRoot, options.poolRoot, databaseFile === null ? undefined : dirname(databaseFile)]);
+        consoleGates.set(options, gate);
+    }
+    return inFolderScope(gate, work);
+}

package/dist/server/chat.js

@@ -1,4 +1,6 @@
 import { freshFacts, freshlyApprovable, freshnessFor, spendingOnlyOnSuccess, withFreshness } from "../scope.js";
+import { CHAT_ACTION_LOCAL_ACTS, localOwnerRefusal } from "../local-owner.js";
+import { localApprovalEligible } from "../scope.js";
 import { handlersOf } from './handler-registry.js';
 import { DEPRECATED_PAGE } from "../deprecations.js";
 /** chat handlers, moved without changing their route bodies. */
@@ -410,7 +412,12 @@ export function createChatHandlers(runtime) {
                 const gate = store.approvalGate(task, who.name, 'person');
                 return freshlyApprovable(store, task, scope, gate.verdict === 'seal' && !gate.protectedWork) ? new Date(fresh.at) : null;
             })();
-            const passwordField = !CHAT_ACTIONS[action.operation].password ? '' : reauth(freshSince === null
+            // Easy-start C5: a laptop's local owner confirms its own acts without a password (an approval only when it is
+            // eligible: localApprovalEligible, the rule the seal applies again); anything else says how to get a password.
+            const reviewTask = typeof action.request['task'] === 'string' ? action.request['task'] : null;
+            const localOk = who.authority === 'local-owner' && CHAT_ACTION_LOCAL_ACTS[action.operation] !== null && (action.operation !== 'scope_approve' || (reviewTask !== null && localApprovalEligible(store, who.name, reviewTask).ok));
+            const localWords = who.authority === 'local-owner' && !localOk ? localOwnerRefusal(store.accountOf(who.name)?.passwordSet === true, '/chat') : null;
+            const passwordField = !CHAT_ACTIONS[action.operation].password || localOk ? '' : localWords !== null ? html `<p class="approval-password-note">${localWords.message} <a href="${localWords.href}">${localWords.action}</a></p>` : reauth(freshSince === null
                 ? html `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label>`
                 : html `<label>Your password<input type="password" name="token" autocomplete="current-password"></label><p class="approval-password-note" data-approval-fresh>Your password from ${whenTime(freshSince.toISOString())} is remembered on this computer — leave this blank to approve with it, or type it again.</p>`);
             const content = html `<section class="shared-action"><h1>${action.title}</h1>${evidenceLink}${terms}${postForm(`/chat/proposal/${id}/confirm`, html `<label class="arm"><input type="checkbox" name="confirm" value="yes" required>I confirm this exact action</label>${passwordField}<button>${CHAT_ACTIONS[action.operation].label}</button>`, { returnTo: '/chat', hidden: { nonce: review.nonce } })}</section>`;
@@ -781,7 +788,7 @@ export function createChatHandlers(runtime) {
         }
         // A scope approval's re-check is spent only if the whole confirmation commits (one transaction: the proposal's
         // settlement included). Any other action spends it whatever comes of it (its effects aren't all in the database).
-        const confirmIt = () => confirmLeadProposal(store, principal, id, now, { chatProvider: teamChatProvider, confirm: body.get("confirm") === "yes", via: "web", evidenceRoot, ...(body.has("nonce") ? { actionReview: { nonce: body.get("nonce") ?? "", password: body.get("token") ?? "" } } : {}) });
+        const confirmIt = () => confirmLeadProposal(store, principal, id, now, { authority: who.authority, chatProvider: teamChatProvider, confirm: body.get("confirm") === "yes", via: "web", evidenceRoot, ...(body.has("nonce") ? { actionReview: { nonce: body.get("nonce") ?? "", password: body.get("token") ?? "" } } : {}) });
         const proposed = store.getLeadProposal(id);
         const approving = proposed?.kind === "action" && sharedActionPayload(proposed.payload)?.operation === "scope_approve";
         const outcome = approving ? spendingOnlyOnSuccess(confirmIt, result => !result.ok || ("already" in result && result.already === true)) : confirmIt();
@@ -847,7 +854,7 @@ export function createChatHandlers(runtime) {
             dismissCoordinatorProposal(store, principal, id, now);
             return redirect(response, back);
         }
-        const outcome = confirmCoordinatorProposal(store, principal, id, now, { confirm: body.get("confirm") === "yes", via: "web" });
+        const outcome = confirmCoordinatorProposal(store, principal, id, now, { authority: who.authority, confirm: body.get("confirm") === "yes", via: "web" });
         if (!outcome.ok && (outcome.reason === "not-yours" || outcome.reason === "standing")) {
             return refuse(response, who, outcome.reason === "standing" ? 403 : 404, outcome.said, back);
         }

package/dist/server/chrome.d.ts

@@ -21,7 +21,12 @@ export declare function isOverdue(decision: Decision, now: Date): boolean;
  * a way back — the error path is the one place a console must not stop
  * being a console. Bearer callers still get plain text; they parse, not read.
  */
-export declare function refuse(response: ServerResponse, who: Who | null, status: number, message: string, backHref?: string): void;
+export declare function refuse(response: ServerResponse, who: Who | null, status: number, message: string, backHref?: string, 
+/** The one action that fixes it, in place of "Go back" (easy-start C2: Reconnect). */
+act?: {
+    label: string;
+    href: string;
+}): void;
 /** The demo's one-line promise, on every page. */
 export declare const DEMO_BANNER = "Demo: a scripted lead and sample projects. Nothing calls a model, reaches outside or spends. For your own project, run npx toolroll up in its folder.";
 /** The demo notice on a phone: one line. */
@@ -233,7 +238,10 @@ export declare function personChip(name: string): Html;
 /** The brand, as the workspace sidebar shows it. */
 export declare const BRAND_HTML: Html;
 /** A page on its own, in the workspace's look but with no script: the brand, then the page. */
-export declare function focusDocument(title: string, body: Html): Html;
+export declare function focusDocument(title: string, body: Html, live?: {
+    nonce: string;
+    script: string;
+}): Html;
 export declare function chatMoney(microusd: number | null): string;
 export declare function relativeAge(iso: string, now: Date): string;
 /** The project chip every all-scope row wears: null is UNPLACED, said so. */