toolroll 0.9.88 → 0.9.90

package/dist/server/chrome.js

@@ -92,7 +92,9 @@ export function isOverdue(decision, now) {
  * a way back — the error path is the one place a console must not stop
  * being a console. Bearer callers still get plain text; they parse, not read.
  */
-export function refuse(response, who, status, message, backHref = "/") {
+export function refuse(response, who, status, message, backHref = "/", 
+/** The one action that fixes it, in place of "Go back" (easy-start C2: Reconnect). */
+act) {
     if (who === null || who.via === "bearer") {
         return respond(response, status, "text/plain; charset=utf-8", message);
     }
@@ -103,7 +105,7 @@ export function refuse(response, who, status, message, backHref = "/") {
     // The words are the caller's exactly (older callers wrote lower-case fragments; k-refusal capitalises the first letter).
     const body = html `<div class="k-refusal">${status === 404
         ? kitNotFound(path, generic ? {} : { title: message, text: "Home has what needs you; Tasks has every task." })
-        : kitDoc(kitDocHeader({ title: "Request refused", back: [backHref, "Back"] }), kitNotice(message), kitActs(kitBtn("Go back", { href: backHref })))}</div>`;
+        : kitDoc(kitDocHeader({ title: "Request refused", back: [backHref, "Back"] }), kitNotice(message), kitActs(act === undefined ? kitBtn("Go back", { href: backHref }) : kitBtn(act.label, { href: act.href, variant: "primary" })))}</div>`;
     // A signed-in browser keeps the workspace around it: the same navigation as every page.
     const framed = requestContext.getStore()?.refusal;
     if (framed !== undefined && who.via === "cookie")
@@ -111,7 +113,7 @@ export function refuse(response, who, status, message, backHref = "/") {
     return page(response, status, shell(status === 404 ? "Not found" : "Request refused", outPage({
         brand: BRAND_HTML, title: status === 404 ? "Not found" : "Request refused",
         body: html `<div class="k-refusal">${kitNotice(status === 404 && generic ? `There\u2019s no page at ${path}.` : message)}</div>`,
-        foot: html `<a class="k-link" href="${status === 404 ? "/" : backHref}">${status === 404 ? "Go to Home" : "Go back"}</a>`,
+        foot: act === undefined ? html `<a class="k-link" href="${status === 404 ? "/" : backHref}">${status === 404 ? "Go to Home" : "Go back"}</a>` : html `<a class="k-link" href="${act.href}">${act.label}</a>`,
     })));
 }
 /** The demo's one-line promise, on every page. */
@@ -652,8 +654,8 @@ export function personChip(name) {
 /** The brand, as the workspace sidebar shows it. */
 export const BRAND_HTML = html `<span class="so-brand-mark" aria-hidden="true"><i></i><i></i><i></i></span>Toolroll`;
 /** A page on its own, in the workspace's look but with no script: the brand, then the page. */
-export function focusDocument(title, body) {
-    return shell(title, html `<div class="focus-page"><a class="so-wordmark focus-brand" href="/chat">${BRAND_HTML}</a>${body}</div>`);
+export function focusDocument(title, body, live) {
+    return shell(title, html `<div class="focus-page"><a class="so-wordmark focus-brand" href="/chat">${BRAND_HTML}</a>${body}</div>`, live === undefined ? {} : { live });
 }
 export function chatMoney(microusd) {
     return microusd === null ? "unknown" : `$${(microusd / 1_000_000).toFixed(2)}`;

package/dist/server/console.css

@@ -2783,3 +2783,13 @@ html.so-swap::view-transition-old(*):only-child { animation: so-card-out 160ms e
   .put-away-item { min-height: 44px; }
   .put-away-days button, .task-archived button, .work-row-status form.inline button { min-height: 44px; }
 }
+/* The welcome (/welcome): three steps from the kit's pieces. A form holding one button sits in its row of acts. */
+.welcome-step .k-note { margin: 0; }
+.welcome-rows { display: grid; }
+.welcome-rows .k-sl-t { display: block; overflow-wrap: anywhere; }
+.welcome-rows .k-mono { overflow-wrap: anywhere; }
+.welcome-form, .welcome .k-srec-a form { display: contents; }
+.welcome .k-btn { min-height: 0; }
+@media (max-width: 40rem) { .welcome form > .k-btn[type=submit] { width: auto; } }
+/* On a phone the step's primary lives in the dock: its copy in the step is hidden. */
+@media (max-width: 760px) { .welcome .k-btn.k-docked { display: none; } }

package/dist/server/guards.d.ts

@@ -42,6 +42,8 @@ export interface GuardsRuntime {
     signInBudget: SourceBudget;
     passwordAllowed: (name: string) => boolean;
     sessions: PersistentSessions;
+    /** Easy-start C2: the browser mutation key's one check (server/mutation-key.ts). */
+    browserKeys: Pick<import("./mutation-key.js").BrowserKeys, "check">;
 }
 export declare function createSharedGuards(runtime: GuardsRuntime): {
     authenticateApprover: (who: Who, token: string, repo?: string | null) => ReturnType<typeof checkApproverPassword>;
@@ -49,6 +51,7 @@ export declare function createSharedGuards(runtime: GuardsRuntime): {
     authorizeMutation: (request: IncomingMessage, who: Who, body: FormView<FormFieldOf<"mutationGuard">>) => {
         status: number;
         message: string;
+        reconnect?: import("./mutation-key.js").Reconnect;
     } | null;
     projectOf: (who: Who, request: IncomingMessage) => string | null | undefined;
     resolveRouteProject: (source: RouteDeclaration['project'], url: URL, who: Who, request: IncomingMessage, body: URLSearchParams | null) => string | null;

package/dist/server/guards.js

@@ -9,7 +9,8 @@ import { REMOTE_MESSAGES, reproveRemote } from "../operate-remote.js";
 import { canonicalProject, rowVisible } from "../project.js";
 import { authenticateAccount, authenticateApprover as checkApproverPassword, credentialProof } from "../scope.js";
 import { SourceBudget } from "../sign-in-guard.js";
-import {} from "../store.js";
+import { localModeOf } from "../store.js";
+import { currentLocalOwner, localBindingStands, localOwnerStandsNow } from "../local-owner.js";
 import { requestContext } from "./request-context.js";
 import { refuse } from "./chrome.js";
 import { matchTaskPath } from "./http.js";
@@ -105,6 +106,19 @@ export function createSharedGuards(runtime) {
             if (body.get("csrf") !== who.session.csrf) {
                 return { status: 403, message: "stale form — reload and try again" };
             }
+            // Easy-start C2: on a protected loopback install the CSRF token is rendered into pages any cookie holder can read,
+            // so a mutation also presents the session's key, which only this console's own origin holds.
+            const keyed = runtime.browserKeys.check(who, request, body.sent);
+            if (keyed !== null)
+                return keyed;
+            // Easy-start C1 (after the CSRF and key proofs, so a forged post learns nothing more): a local owner's session
+            // mutates only inside the console's admission of a row marked for it (which set the local owner this chain acts
+            // as), and only while that still stands; anywhere else it is refused.
+            if (who.authority !== "full") {
+                const local = currentLocalOwner();
+                if (local === null || local.account !== who.name || !localOwnerStandsNow(runtime.store, local))
+                    return { status: 403, message: "Set a password to do this." };
+            }
         }
         return null;
     }
@@ -316,7 +330,7 @@ export function createSharedGuards(runtime) {
         if (match === null)
             return null;
         const session = lookupSession(match[1], touch);
-        return session === null ? null : { name: session.name, via: "cookie", session, role: session.role };
+        return session === null ? null : { name: session.name, via: "cookie", session, role: session.role, authority: session.authority };
     }
     /**
      * Constant-time against the session table, small as it is — and every hit
@@ -350,6 +364,12 @@ export function createSharedGuards(runtime) {
                 runtime.sessions.delete(id);
                 return null;
             }
+            // v147: a local owner's session stands only while local mode is on, at the generation it was made under, for its
+            // owner. Off, moved or changed hands: the session is ended, never read as full.
+            if (session.authority !== "full" && !localBindingStands(localModeOf(runtime.store), { account: session.name, localGeneration: session.localGeneration })) {
+                runtime.sessions.delete(id);
+                return null;
+            }
             // Ended in another process (or from Sessions): the cached copy is dropped, never used.
             if (!runtime.sessions.stillSaved(id)) {
                 Map.prototype.delete.call(runtime.sessions, id);

package/dist/server/http.d.ts

@@ -151,6 +151,12 @@ export type ServeOptions = {
     ssoFetch?: typeof fetch;
     /** Cockpit B1: this `up` console's instance secret (null: none — the instance route answers 404). */
     instanceSecret?: () => string | null;
+    /** v147 (easy-start C2): this console start's key epoch, minted once per start (absent: the server mints its own).
+     * A session's mutation key is bound to it; a key from another start is stale. */
+    keyEpoch?: string;
+    /** Easy-start C2: the browser mutation key. On (a real console start, operate.ts startConsole), a protected loopback
+     * install's browser sessions carry a key every mutation must present (server/mutation-key.ts). Off: unchanged. */
+    browserKey?: boolean;
     /** v137: whether this console is draining (its `up` is stopping): /healthz says so at once, and pages say Toolroll is restarting. */
     draining?: () => boolean;
     /** Cockpit E: how Finder is asked to reveal a proved checkout (tests pass their own; never a launch). True: shown. */
@@ -307,3 +313,19 @@ export declare function form(request: IncomingMessage, cap?: number): Promise<UR
 /** A refused chat setting (POST /chat/config): back on the lead's settings it is a ?problem=, which the page's section
  * shows in place with the edits kept; elsewhere it stays the chat's said line. */
 export declare function chatRefusal(back: string, words: string): string;
+/** The longest page a refusal's "Set a password" link carries on to. */
+export declare const PASSWORD_SET_NEXT_MAX = 512;
+/**
+ * Where /password/set continues once the first password is set (easy-start C4): a page of this console a browser can
+ * open, as path and query only — one leading slash, never two, no backslash, no scheme or host (also once decoded),
+ * no control characters, at most PASSWORD_SET_NEXT_MAX characters, never the sign-in, sign-out, sign-up, join or
+ * password roads, never a region fetch, query keys that could carry a secret dropped. Anything else is home ("/").
+ */
+export declare function passwordSetNext(raw: string | null | undefined): string;
+/**
+ * The page a refused request was on, for its "Set a password" link: a page read is itself; a refused form is its own
+ * address when a browser can open it (a settings page posting to itself), else the nearest page above it
+ * (`/t/x/complete` → `/t/x`, `/flows/example` → `/flows`), since
+ * the console sends no Referer to name the page the form was on. Checked by passwordSetNext; else home.
+ */
+export declare function refusalNext(method: string, url: URL): string;

package/dist/server/http.js

@@ -19,6 +19,7 @@ import {} from "../toolroll-update.js";
 import { timingSafeEqual } from "node:crypto";
 import {} from "node:http";
 import { SIGN_IN_LINK_PATH } from "./session.js";
+import { matchRoute } from "./route-table.js";
 import {} from "../folder-look.js";
 import {} from "../project-identity.js";
 import {} from "../learning-look.js";
@@ -257,3 +258,60 @@ export async function form(request, cap = BODY_CAP) {
 export function chatRefusal(back, words) {
     return back === "/settings/lead" ? `/settings/lead?problem=${encodeURIComponent(words)}` : chatReturnWithSaid(back, words);
 }
+/** The longest page a refusal's "Set a password" link carries on to. */
+export const PASSWORD_SET_NEXT_MAX = 512;
+/**
+ * Where /password/set continues once the first password is set (easy-start C4): a page of this console a browser can
+ * open, as path and query only — one leading slash, never two, no backslash, no scheme or host (also once decoded),
+ * no control characters, at most PASSWORD_SET_NEXT_MAX characters, never the sign-in, sign-out, sign-up, join or
+ * password roads, never a region fetch, query keys that could carry a secret dropped. Anything else is home ("/").
+ */
+export function passwordSetNext(raw) {
+    if (typeof raw !== "string" || raw === "" || raw.length > PASSWORD_SET_NEXT_MAX)
+        return "/";
+    if (!raw.startsWith("/") || raw.startsWith("//") || raw.includes("\\") || /[\u0000-\u001f\u007f]/.test(raw))
+        return "/";
+    let parsed;
+    try {
+        parsed = new URL(raw, "http://standing-orders.local");
+    }
+    catch {
+        return "/";
+    }
+    if (parsed.origin !== "http://standing-orders.local" || parsed.username !== "" || parsed.password !== "")
+        return "/";
+    let decoded;
+    try {
+        decoded = decodeURIComponent(parsed.pathname);
+    }
+    catch {
+        return "/";
+    }
+    if (/^\/\/|\\|[\u0000-\u001f\u007f]|^\/[a-z][a-z0-9+.-]*:/i.test(decoded) || /^\/(login|logout|signup|join|password)(\/|$)/.test(decoded))
+        return "/";
+    if (parsed.searchParams.has("fragment") || matchRoute("GET", parsed.pathname, "console") === null)
+        return "/";
+    for (const key of [...parsed.searchParams.keys()])
+        if (/token|password|secret|csrf|code|key|auth/i.test(key))
+            parsed.searchParams.delete(key);
+    const query = parsed.searchParams.toString();
+    const next = `${parsed.pathname}${query === "" ? "" : `?${query}`}`;
+    return next.length > PASSWORD_SET_NEXT_MAX ? "/" : next;
+}
+/**
+ * The page a refused request was on, for its "Set a password" link: a page read is itself; a refused form is its own
+ * address when a browser can open it (a settings page posting to itself), else the nearest page above it
+ * (`/t/x/complete` → `/t/x`, `/flows/example` → `/flows`), since
+ * the console sends no Referer to name the page the form was on. Checked by passwordSetNext; else home.
+ */
+export function refusalNext(method, url) {
+    if (method === "GET" || method === "HEAD")
+        return passwordSetNext(url.pathname + url.search);
+    const parts = url.pathname.split("/").filter(part => part !== "");
+    for (; parts.length > 0; parts.pop()) {
+        const page = passwordSetNext(`/${parts.join("/")}`);
+        if (page !== "/")
+            return page;
+    }
+    return "/";
+}

package/dist/server/live.js

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { boardRunOf, holdAgentView, releaseAgentView } from "../agent-board.js";
+import { boardRunOf } from "../agent-board.js";
 import { agentRunFingerprint } from "../agents-board.js";
 import { createLiveRooms, LiveConnection } from "../live-bus.js";
 import { reproveRemote } from "../operate-remote.js";
@@ -269,20 +269,10 @@ export function createLiveHandlers(runtime, live) {
                 if (run === null || repo === null || !visible(repo) || !store.accountCanAccess(who.name, repo))
                     return json(response, 404, { error: "run" });
                 // A repair is its build's own activity: its room is the build's.
-                const signedIn = sameBrowser(request, browser), runId = boardRunOf(store, run.id), view = randomBytes(12).toString("hex");
-                // The watch is a short lease in the database, renewed on every keep-alive and released when the page goes:
-                // the process that sends chat pings reads it there (agent-board.ts watchingAgent).
-                const watch = () => { try {
-                    holdAgentView(store, view, who.name, runId, clock());
-                }
-                catch { /* a missed renewal only lets a ping through */ } };
+                const signedIn = sameBrowser(request, browser), runId = boardRunOf(store, run.id);
+                // The watch lease (agent-board.ts watchingAgent) is held by the shell's keyed POST /agents/watch on each keep-alive
+                // and released on unload (easy-start N1): this stream only reads, so a stolen cookie can't hold one to quiet pings.
                 joins.push(connection => {
-                    watch();
-                    connection.onKeepAlive(watch);
-                    connection.onClose(() => { try {
-                        releaseAgentView(store, view, clock());
-                    }
-                    catch { /* it lapses on its own */ } });
                     agentRooms.join(runId, { name: who.name, room: name, connection,
                         valid: () => signedIn() && rowVisible(liveCeiling(), repo) && store.accountCanAccess(who.name, repo) });
                 });

package/dist/server/mutation-key.d.ts

@@ -0,0 +1,70 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { Session, Who } from "./session.js";
+/** The request header a fetch carries the key in. */
+export declare const KEY_HEADER = "x-toolroll-key";
+/** The form field a server-rendered form carries it in (not `key`: forms already use that for idempotency and API keys). */
+export declare const KEY_FIELD = "toolroll-key";
+/** A terminal socket offers `toolroll` (the protocol the server selects) and `toolroll.key.<key>` (never echoed back). */
+export declare const KEY_PROTOCOL = "toolroll";
+export declare const KEY_PROTOCOL_PREFIX = "toolroll.key.";
+/** Where the browser keeps it: `{ epoch, key }` in the console origin's localStorage. */
+export declare const KEY_STORAGE = "toolroll.key";
+/** How a person gets a fresh key: their password again (a full session), or the terminal (a local owner). */
+export type Reconnect = {
+    kind: "password";
+    href: string;
+} | {
+    kind: "command";
+    command: string;
+};
+export type KeyRefusal = {
+    status: 403 | 409;
+    message: string;
+    reconnect: Reconnect;
+};
+export declare const RESTARTED = "Toolroll restarted \u2014 reconnect to make changes.";
+export declare const RESTARTED_LOCAL = "Toolroll restarted \u2014 run `toolroll open` to reconnect.";
+export declare const NOT_CONNECTED = "This tab isn't connected to Toolroll \u2014 reconnect to make changes.";
+export declare const NOT_CONNECTED_LOCAL = "This tab isn't connected to Toolroll \u2014 run `toolroll open` to reconnect.";
+/** The page a request reads, without the workspace read's own parameters: where a reconnect comes back to. */
+export declare function pagePathOf(url: URL): string;
+export declare const keyHashOf: (key: string) => string;
+/** The one key a request presents (header, form field or socket protocol), or null for none, a malformed one, or two
+ * different ones: two keys in one request is a smuggling attempt, never a preference. */
+export declare function presentedKey(request: IncomingMessage, body: {
+    getAll(name: string): string[];
+} | null): string | null;
+/** Constant-time: the presented key's hash against the session's. */
+export declare function keyMatches(presented: string, hash: string | null): boolean;
+export type BrowserKeys = {
+    /** Whether mutations need the key now (a protected loopback install, with the key turned on for this console). */
+    required(): boolean;
+    /** The console's one browser origin (http://127.0.0.1:<port>) while required, else null. */
+    canonicalHost(): string | null;
+    /** The one mutation check: null to proceed, else the refusal (with how to reconnect). Bearer callers pass. */
+    check(who: Who, request: IncomingMessage, body: {
+        getAll(name: string): string[];
+    } | null): KeyRefusal | null;
+    /** A browser session whose key is from an earlier console start (or none at all) while the key is required. */
+    stale(who: Who, back?: string): Reconnect | null;
+    /** Gives a session being made (or reconnected) a fresh key: its hash and this start's epoch go on the session, the key
+     * comes back to deliver once. Null while not required, or off the canonical origin (that origin's storage would hold it). */
+    issue(session: Pick<Session, "keyEpoch" | "keyHash">, request: IncomingMessage): string | null;
+    /** The no-store page that puts the key in this origin's storage and moves on to `to` (a same-site path). */
+    deliver(response: ServerResponse, key: string, to: string, cookies?: readonly string[]): void;
+};
+export declare function createBrowserKeys(deps: {
+    /** The console turned the key on (a real console start; tests and the demo leave it off unless they ask). */
+    enabled: boolean;
+    epoch: string;
+    /** On a protected loopback install (bound to loopback only, no --allow-host, no public URL, no tailnet names), read
+     * per request: the console's one browser host (`127.0.0.1:<port>`, or `[::1]:<port>` for an IPv6-only bind). Else null. */
+    protectedHost: () => string | null;
+}): BrowserKeys;
+/**
+ * Every page that can post, while the key is required: fills the key into each same-origin POST form's data (the
+ * `formdata` event fires for a native submit, requestSubmit(), submit() and `new FormData(form)` alike) and offers
+ * `window.soKeyHeaders(headers)` to the page's own fetches. It reads nothing on the page and sends the key nowhere but
+ * this origin. Without a stored key it does nothing, and the server answers "reconnect".
+ */
+export declare const KEY_FILL_SCRIPT: string;

package/dist/server/mutation-key.js

@@ -0,0 +1,142 @@
+/**
+ * The browser mutation key (easy-start C2, amendment A1): the second factor every browser mutation carries on a
+ * protected loopback install, beside the session's CSRF token.
+ *
+ * Why: cookies are not isolated by port (RFC 6265 §8.5). Any server on another port of this computer receives the
+ * session cookie and can read every page, CSRF token included. So on a console that only this computer can reach, a
+ * mutation also needs a key that lives only in the browser's storage for the console's own origin
+ * (http://127.0.0.1:<port>): 32 random bytes per session, of which the server keeps only a hash and the console start
+ * (key epoch) it was issued under. The key is delivered once, in a response that cannot be fetched again (a one-time
+ * link, a password sign-in, an identity-provider finish, a password reconnect), by a no-store page whose one nonce'd
+ * script writes it to localStorage and moves on. It is never rendered into a page or JSON.
+ *
+ * The key is bound to the console start (N3): a process that held the port while Toolroll was stopped could read the
+ * saved key, so every restart mints a new epoch and every older key reads as "Toolroll restarted — reconnect".
+ *
+ * A protected loopback install: the console is bound to a loopback address only, with no --allow-host, no public URL
+ * and no tailnet names. Everywhere else nothing here applies.
+ */
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { html, htmlString, scriptElement } from "../html.js";
+import { HANDOFF_STYLE } from "./http.js";
+/** The request header a fetch carries the key in. */
+export const KEY_HEADER = "x-toolroll-key";
+/** The form field a server-rendered form carries it in (not `key`: forms already use that for idempotency and API keys). */
+export const KEY_FIELD = "toolroll-key";
+/** A terminal socket offers `toolroll` (the protocol the server selects) and `toolroll.key.<key>` (never echoed back). */
+export const KEY_PROTOCOL = "toolroll";
+export const KEY_PROTOCOL_PREFIX = "toolroll.key.";
+/** Where the browser keeps it: `{ epoch, key }` in the console origin's localStorage. */
+export const KEY_STORAGE = "toolroll.key";
+const KEY_SHAPE = /^[0-9a-f]{64}$/;
+export const RESTARTED = "Toolroll restarted — reconnect to make changes.";
+export const RESTARTED_LOCAL = "Toolroll restarted — run `toolroll open` to reconnect.";
+export const NOT_CONNECTED = "This tab isn't connected to Toolroll — reconnect to make changes.";
+export const NOT_CONNECTED_LOCAL = "This tab isn't connected to Toolroll — run `toolroll open` to reconnect.";
+/** The page a request reads, without the workspace read's own parameters: where a reconnect comes back to. */
+export function pagePathOf(url) {
+    const page = new URL(url.pathname + url.search, "http://standing-orders.local");
+    page.searchParams.delete("format");
+    page.searchParams.delete("request");
+    return page.pathname + page.search;
+}
+export const keyHashOf = (key) => createHash("sha256").update(key, "utf8").digest("hex");
+/** The one key a request presents (header, form field or socket protocol), or null for none, a malformed one, or two
+ * different ones: two keys in one request is a smuggling attempt, never a preference. */
+export function presentedKey(request, body) {
+    const found = [];
+    const header = request.headers[KEY_HEADER];
+    if (Array.isArray(header))
+        return null;
+    if (typeof header === "string" && header !== "")
+        found.push(header);
+    if (body !== null)
+        found.push(...body.getAll(KEY_FIELD).filter(one => one !== ""));
+    const protocols = request.headers["sec-websocket-protocol"];
+    if (typeof protocols === "string") {
+        for (const one of protocols.split(",").map(part => part.trim()))
+            if (one.startsWith(KEY_PROTOCOL_PREFIX))
+                found.push(one.slice(KEY_PROTOCOL_PREFIX.length));
+    }
+    // The same key by two roads (a form's field and its fetch's header) is one key; two different keys is none.
+    const distinct = [...new Set(found)];
+    if (distinct.length !== 1)
+        return null;
+    const key = distinct[0];
+    return KEY_SHAPE.test(key) ? key : null;
+}
+/** Constant-time: the presented key's hash against the session's. */
+export function keyMatches(presented, hash) {
+    if (hash === null || !KEY_SHAPE.test(hash))
+        return false;
+    const a = Buffer.from(keyHashOf(presented), "hex"), b = Buffer.from(hash, "hex");
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+export function createBrowserKeys(deps) {
+    const canonicalHost = () => deps.enabled ? deps.protectedHost() : null;
+    const required = () => canonicalHost() !== null;
+    // A refused post comes back to Home (its own address may answer only posts); a page's notice, to that page.
+    const reconnectOf = (who, back = "/") => who.authority === "full"
+        ? { kind: "password", href: back === "/" ? "/login/rekey" : `/login/rekey?return=${encodeURIComponent(back)}` }
+        : { kind: "command", command: "toolroll open" };
+    const stale = (who, back) => {
+        if (!required() || who.via !== "cookie")
+            return null;
+        const session = who.session;
+        return session.keyEpoch !== deps.epoch || session.keyHash === null ? reconnectOf(who, back) : null;
+    };
+    return {
+        required,
+        canonicalHost,
+        check(who, request, body) {
+            if (!required() || who.via !== "cookie")
+                return null;
+            const local = who.authority !== "full";
+            const reconnect = reconnectOf(who);
+            if (stale(who) !== null)
+                return { status: 409, message: local ? RESTARTED_LOCAL : RESTARTED, reconnect };
+            const presented = presentedKey(request, body);
+            if (presented === null || !keyMatches(presented, who.session.keyHash))
+                return { status: 403, message: local ? NOT_CONNECTED_LOCAL : NOT_CONNECTED, reconnect };
+            return null;
+        },
+        stale,
+        issue(session, request) {
+            const canonical = canonicalHost();
+            if (canonical === null || request.headers.host !== canonical)
+                return null;
+            const key = randomBytes(32).toString("hex");
+            session.keyHash = keyHashOf(key);
+            session.keyEpoch = deps.epoch;
+            return key;
+        },
+        deliver(response, key, to, cookies = []) {
+            const nonce = randomBytes(16).toString("base64");
+            const target = /^\/(?![/\\])/.test(to) ? to : "/";
+            // JSON inside a script: `<` escaped so nothing in it can close the element.
+            const data = JSON.stringify({ storage: KEY_STORAGE, value: JSON.stringify({ epoch: deps.epoch, key }), to: target }).replace(/</g, "\\u003c");
+            response.writeHead(200, {
+                "content-type": "text/html; charset=utf-8", "cache-control": "no-store", pragma: "no-cache", "referrer-policy": "no-referrer",
+                "x-content-type-options": "nosniff", "x-frame-options": "DENY",
+                "content-security-policy": `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`,
+                ...(cookies.length === 0 ? {} : { "set-cookie": [...cookies] }),
+            });
+            const script = `(function(){var d=${data};try{localStorage.setItem(d.storage,d.value)}catch(e){}location.replace(d.to)})();`;
+            response.end(htmlString(html `<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Toolroll</title>${HANDOFF_STYLE}<p>Opening Toolroll… <a href="${target}">Continue</a></p>${scriptElement(script, { nonce })}</html>`));
+        },
+    };
+}
+/**
+ * Every page that can post, while the key is required: fills the key into each same-origin POST form's data (the
+ * `formdata` event fires for a native submit, requestSubmit(), submit() and `new FormData(form)` alike) and offers
+ * `window.soKeyHeaders(headers)` to the page's own fetches. It reads nothing on the page and sends the key nowhere but
+ * this origin. Without a stored key it does nothing, and the server answers "reconnect".
+ */
+export const KEY_FILL_SCRIPT = `(function(){if(window.soKeyHeaders)return;` +
+    `function k(){try{var v=JSON.parse(localStorage.getItem(${JSON.stringify(KEY_STORAGE)})||"null");return v&&typeof v.key==="string"&&/^[0-9a-f]{64}$/.test(v.key)?v.key:null}catch(e){return null}}` +
+    `window.soKeyHeaders=function(h){h=h||{};var x=k();if(x)h[${JSON.stringify(KEY_HEADER)}]=x;return h};` +
+    // The form's own method and action through HTMLFormElement's getters: a control named "method" or "action" (the
+    // skill form's <select name="method">) shadows f.method / f.action, which would skip the key or misread the target.
+    `var P=HTMLFormElement.prototype,G=function(n){return Object.getOwnPropertyDescriptor(P,n).get};var M=G("method"),A=G("action");` +
+    `document.addEventListener("formdata",function(e){var f=e.target,m,a;try{m=M.call(f);a=A.call(f)}catch(x){return}if(String(m).toLowerCase()!=="post")return;` +
+    `try{if(new URL(a,location.href).origin!==location.origin)return}catch(x){return}var x=k();if(x)e.formData.set(${JSON.stringify(KEY_FIELD)},x)},true);})();`;

package/dist/server/pages.js

@@ -29,7 +29,6 @@ import { LEDGER_CSV_HEADER, ledgerCsvRows } from "../ledger-csv.js";
 import { ledgerBody } from "../ledger-view.js";
 import { agentRowOf, agentsListOf, agentFactsFor, sealedDiffOf } from "../agents-board.js";
 import { computersOf, phasesOf, systemOf } from "./agents-computers.js";
-import { markAgentSeen } from "../agent-board.js";
 import { agentsLiveOf } from "../agents-live.js";
 import { readChildWindow } from "../live-children-read.js";
 import { leadFiledLinks } from "./agents-live-filed.js";
@@ -192,7 +191,9 @@ export function createPagesHandlers(runtime) {
         // One scope for the page and the chrome around it: the project its address names (proved by the router), else all.
         const chrome = chromeFor(project, "none");
         const projects = chrome.projects ?? [];
-        const view = homeView({ store, now, access: workAccess(), evidenceRoot, project, projects, chat: chrome.chat === true, canAnswer: who.role === "approver" });
+        const view = { ...homeView({ store, now, access: workAccess(), evidenceRoot, project, projects, chat: chrome.chat === true, canAnswer: who.role === "approver" }),
+            // Until the first result: the welcome's three steps stay one link away.
+            setup: firstRunStepsNow(now) !== null ? "/welcome" : null };
         return sendScreen(response, 200, screen("Home", html `<div data-kit-page><h1>Home</h1><p>${view.say}</p><p><a href="/work">Tasks</a></p></div>`, { chrome, workspace: { view } }));
     }
     // Search (UI revamp wave B): the ⌘K menu's "See all results". The places come from the page; the tasks here are the
@@ -450,9 +451,8 @@ export function createPagesHandlers(runtime) {
             const run = store.getRun(Number(asked));
             const facts = run === null || !runVisible(run) ? null : agentFactsFor(store, run.id, access, who.name);
             if (facts !== null) {
-                // Opening a finished agent is viewing it: it leaves this person's unread Done.
-                if (facts.outcome !== null && markAgentSeen(store, who.name, facts.runId, now))
-                    facts.seen = true;
+                // Opening a finished agent is viewing it: the shell says so with a keyed POST /agents/seen (easy-start N1: a page
+                // load never writes), which leaves this person's unread Done.
                 const live = facts.outcome === null;
                 const composer = live ? steerControlsFor(store, facts.taskId, facts.runId, now, who.role === "approver") : null;
                 const sealed = live ? null : sealedDiffOf(store, evidenceRoot, facts.runId);
@@ -703,7 +703,7 @@ export function createPagesHandlers(runtime) {
         // connects its builder; there is no separate restart or binding step.
         // The admission asks again, inside its registry lock and its transaction, about the repo it proves.
         const stillAllowed = (repo) => identities.generation() === decidedOn && visible(repo);
-        const admitted = await admitProject(store, { registryFile: options.registryPath ?? null, path: canonical, actor: { label: who.name, origin: "console" }, now, stillAllowed });
+        const admitted = await admitProject(store, { registryFile: options.registryPath ?? null, path: canonical, actor: { label: who.name, origin: "console" }, now, stillAllowed, resolveFolder: identities.resolveNow });
         if (!admitted.ok) {
             return void projectsScreen(response, who, admitted.reason === "not-git" ? "that path is not a git repository" : `that project is valid, but it could not be added — ${admitted.message}`, admitted.reason === "moved" ? 409 : 400, safeReturn(body.get("return")), "open");
         }
@@ -843,7 +843,10 @@ export function createPagesHandlers(runtime) {
             return projectsScreen(response, who, "naming where repositories live takes --project-root", 400, "/", "clone");
         // CONFIRM: password, then session liveness AGAIN via lookupSession
         // (finding 22/33) — the record is consumed from the RETURNED live
-        // session, synchronously, before the first await.
+        // session, synchronously, before the first await. A full session types
+        // its password (or Passwordless stands in); a laptop's local owner has
+        // none: inside this row's add-project admission the prover's local-owner
+        // branch proves it (scope.ts proveAccountNow), whatever the field holds.
         const password = body.get("token") ?? "";
         if (!authenticateApprover(who, password).ok) {
             return projectsScreen(response, who, "cloning takes your password, typed again", 403, "/", "clone");
@@ -891,7 +894,7 @@ export function createPagesHandlers(runtime) {
             return projectsScreen(response, who, `the clone landed at ${cloned.target} but did not prove under the ceiling — it was left in place; enroll it by hand`, 400, "/", "clone");
         }
         const stillAllowed = (repo) => identities.generation() === decidedOn && visible(repo);
-        const joined = await admitProject(store, { registryFile: options.registryPath ?? null, path: admitted, actor: { label: who.name, origin: "console" }, now, stillAllowed });
+        const joined = await admitProject(store, { registryFile: options.registryPath ?? null, path: admitted, actor: { label: who.name, origin: "console" }, now, stillAllowed, resolveFolder: identities.resolveNow });
         if (!joined.ok) {
             return projectsScreen(response, who, `${cloned.target} is cloned but not added — ${joined.message}`, joined.reason === "moved" ? 409 : 400, "/", "clone");
         }
@@ -953,7 +956,7 @@ export function createPagesHandlers(runtime) {
                                 ? "Choose a projects folder once: toolroll up --project-root <dir>"
                                 : "choose which folder this server may use with --project-root <dir>",
                         }
-                        : { enabled: true, roots: ceiling.roots, record: [...(who.session.onboard?.entries() ?? [])][0] ?? null };
+                        : { enabled: true, roots: ceiling.roots, localOwner: who.authority !== "full", record: [...(who.session.onboard?.entries() ?? [])][0] ?? null };
         const peeks = {};
         for (const one of recent)
             peeks[one.path] = peekOf(one.path, now);