toolroll 0.9.88 → 0.9.90

package/dist/server/people-tokens.js

@@ -3,7 +3,7 @@ import { adapterPolicy } from "./route-policy.js";
 /** settings handlers, moved without changing their route bodies. */
 import { mintApiToken, TOKEN_DAYS } from "../api-tokens.js";
 import { CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
-import { html, htmlString, joinHtml, postForm, reauth } from "../html.js";
+import { html, htmlString, joinHtml, postForm, reauth, replaceMarkup, scriptElement } from "../html.js";
 import { credentialsHtml, tokenShownHtml } from "../credentials-ui.js";
 import { projectName } from "../project.js";
 import { requestLimitsHtml, tokenLimitWords } from "../request-budget-ui.js";
@@ -22,10 +22,13 @@ import { accessFromGroups, accountNameFor, exchangeOidcCode, newOidcVisit, oidcA
 import { personAuditHtml, personHref } from "../people-audit-ui.js";
 import { cursorOf as auditCursorOf, remoteAudit } from "../remote-audit.js";
 import { credentialProof, hashPassword, proveAccountNow } from "../scope.js";
-import { form, HANDOFF_STYLE, loginHref, loginReturn, page, SIGN_IN_COOKIE, signInSpent, startedHere } from "./http.js";
-import { joinDeadPage, joinFormPage, loginPage, SIGNUP_NAME, SIGNUP_PASSWORD_MIN, signupPage } from "./render-people.js";
-import { liveInviteTerms } from "../store.js";
-import { SESSION_COOKIE, SIGN_IN_LINK_PATH } from "./session.js";
+import { form, HANDOFF_STYLE, loginHref, loginReturn, page, passwordSetNext, SIGN_IN_COOKIE, signInSpent, startedHere } from "./http.js";
+import { joinDeadPage, joinFormPage, loginPage, passwordAlreadySetPage, passwordSetPage, reconnectPage, SIGNUP_NAME, SIGNUP_PASSWORD_MIN, signupPage } from "./render-people.js";
+import { enrollOwnerPassword, liveInviteTerms, localOwnerBinding } from "../store.js";
+import { KEY_FILL_SCRIPT } from "./mutation-key.js";
+import { LOCAL_OWNER_LAPSED } from "../local-owner.js";
+import { withFormToken } from "./request-context.js";
+import { FULL_SESSION, SESSION_COOKIE, SIGN_IN_LINK_PATH } from "./session.js";
 import { setupCodeMatches, signupCookie, signupFromHere } from "./signup-gate.js";
 /** Clock skew allowed between the provider and this server when reading auth_time — forward only (a provider clock
  * running ahead). auth_time is in whole seconds, so a check made in the visit's own second is floored below startedAt:
@@ -42,7 +45,7 @@ export function sameVisitCheck(authTime, startedAt, now) {
     return Math.min(Math.max(at, startedAt), now);
 }
 export function createPeopleHandlers(runtime) {
-    const { joinBySource, ssoOffer, ssoVisits, ssoSettings, options, clock, ssoHandoffs, managedRepos, store, visible, admissionList, sendScreen, chromeFor, restricted, sessions, consoleProjects, authenticateApprover, authenticateCredential, bustBadge, projectOf, signInLinks, linkKey, fromThisComputer, recordSignIn, passwordAllowed, arrival, cookieSecure, consoleOrigin, providerFor, providerKnown, joinSourceOf, signInBudget, signInActor, minutesWords } = runtime;
+    const { joinBySource, ssoOffer, ssoVisits, ssoSettings, options, clock, ssoHandoffs, managedRepos, store, visible, admissionList, sendScreen, chromeFor, restricted, sessions, consoleProjects, authenticateApprover, authenticateCredential, bustBadge, projectOf, signInLinks, linkKey, fromThisComputer, recordSignIn, passwordAllowed, arrival, cookieSecure, consoleOrigin, providerFor, providerKnown, joinSourceOf, signInBudget, signInActor, minutesWords, browserKeys } = runtime;
     // v101: Settings → Sessions & tokens: where you're signed in, and your API tokens. An instance operator can see everyone's.
     async function sessionsPage(ctx) {
         const { url, who, response, project } = ctx;
@@ -279,11 +282,29 @@ export function createPeopleHandlers(runtime) {
         if (!passwordAllowed(held.account))
             return page(response, 403, loginPage(`Sign in with ${ssoSettings()?.label ?? "your identity provider"}.`, "/chat", ssoOffer()));
         const id = randomBytes(32).toString("hex");
-        sessions.set(id, { ...arrival(request), name: held.account, csrf: randomBytes(32).toString("hex"), role: account.role, generation: account.generation, createdAt: Date.now(), sawBoardAt: null, lastSeen: Date.now(),
-            project: runtime.defaultProject, projectRevision: 1 });
-        recordSignIn(held.account, "signed in", "one-time link");
-        response.setHeader("Set-Cookie", `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`);
-        return redirect(response, "/chat");
+        const keyed = keyFor(request);
+        const base = { ...arrival(request), name: held.account, csrf: randomBytes(32).toString("hex"), role: account.role, generation: account.generation, createdAt: Date.now(), sawBoardAt: null, lastSeen: Date.now(),
+            project: runtime.defaultProject, projectRevision: 1 };
+        if (held.kind === "local-owner") {
+            // Easy-start C4: a local owner's link becomes only a local-owner session, and only if local mode, read again in
+            // the same transaction as the session is saved, is still on at the link's generation for the same owner, and the
+            // owner's account generation hasn't moved (a password set since ended this road).
+            const made = store.transact(() => {
+                const now = localOwnerBinding(store);
+                if (now === null || now.account !== held.account || now.localGeneration !== held.localGeneration || now.accountGeneration !== held.accountGeneration)
+                    return false;
+                sessions.set(id, { ...base, generation: now.accountGeneration, authority: "local-owner", localGeneration: now.localGeneration, ...keyed.fields });
+                return true;
+            });
+            if (!made)
+                return page(response, 410, loginPage("That sign-in link no longer works. Run toolroll again to open Toolroll.", "/chat", ssoOffer()));
+            recordSignIn(held.account, "signed in", "local link");
+        }
+        else {
+            sessions.set(id, { ...base, ...FULL_SESSION, ...keyed.fields });
+            recordSignIn(held.account, "signed in", "one-time link");
+        }
+        return signedInTo(response, keyed.key, "/chat", [`${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`]);
     }
     // v100: sign-in with the identity provider. ?reauth=1 asks it to check the person again (a step-up);
     // ?link=1 links the signed-in account to it. The browser that starts it holds the visit's state.
@@ -374,11 +395,11 @@ export function createPeopleHandlers(runtime) {
         }
         const account = store.accountOf(signedIn.account);
         const id = randomBytes(32).toString("hex");
-        sessions.set(id, { ...arrival(request), name: signedIn.account, csrf: randomBytes(32).toString("hex"), role: account.role, generation: account.generation, createdAt: Date.now(), sawBoardAt: null, lastSeen: Date.now(),
+        const keyed = keyFor(request);
+        sessions.set(id, { ...arrival(request), ...FULL_SESSION, ...keyed.fields, name: signedIn.account, csrf: randomBytes(32).toString("hex"), role: account.role, generation: account.generation, createdAt: Date.now(), sawBoardAt: null, lastSeen: Date.now(),
             project: runtime.defaultProject, projectRevision: 1, sso: { at: handoff.checkedAt ?? 0 } });
         recordSignIn(signedIn.account, "signed in", settings.label);
-        response.setHeader("Set-Cookie", [signInSpent("/login/sso/finish"), `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`]);
-        return redirect(response, handoff.returnTo);
+        return signedInTo(response, keyed.key, handoff.returnTo, [signInSpent("/login/sso/finish"), `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`]);
     }
     async function signupSend(ctx) {
         const { request, response } = ctx;
@@ -428,8 +449,11 @@ export function createPeopleHandlers(runtime) {
         if (authenticated === null || !authenticated.ok)
             return page(response, 500, loginPage("The account was created, but signing in failed. Sign in with it now."));
         const id = randomBytes(32).toString("hex");
+        const keyed = keyFor(request);
         sessions.set(id, {
             ...arrival(request),
+            ...FULL_SESSION,
+            ...keyed.fields,
             name,
             csrf: randomBytes(32).toString("hex"),
             role: authenticated.role,
@@ -442,8 +466,7 @@ export function createPeopleHandlers(runtime) {
             // A password typed on this computer starts this session's freshness window (cockpit B2); from anywhere else, never.
             ...(fromThisComputer(request) ? { passwordAt: Date.now() } : {}),
         });
-        response.setHeader("Set-Cookie", `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`);
-        return redirect(response, "/");
+        return signedInTo(response, keyed.key, "/", [`${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`]);
     }
     async function loginSend(ctx) {
         const { request, response } = ctx;
@@ -479,8 +502,11 @@ export function createPeopleHandlers(runtime) {
         }
         recordSignIn(name, "signed in", "browser");
         const id = randomBytes(32).toString("hex");
+        const keyed = keyFor(request);
         sessions.set(id, {
             ...arrival(request),
+            ...FULL_SESSION,
+            ...keyed.fields,
             name: name,
             csrf: randomBytes(32).toString("hex"),
             role: authenticated.role,
@@ -494,8 +520,7 @@ export function createPeopleHandlers(runtime) {
             // else (a phone, a proxy) it signs in and proves nothing more.
             ...(fromThisComputer(request) ? { passwordAt: Date.now() } : {}),
         });
-        response.setHeader("Set-Cookie", `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`);
-        return redirect(response, returnTo);
+        return signedInTo(response, keyed.key, returnTo, [`${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`]);
     }
     async function logout(ctx) {
         const { request, response } = ctx;
@@ -567,8 +592,11 @@ export function createPeopleHandlers(runtime) {
         }
         // The cookie mints only AFTER the commit — same shape as login.
         const id = randomBytes(32).toString("hex");
+        const keyed = keyFor(request);
         sessions.set(id, {
             ...arrival(request),
+            ...FULL_SESSION,
+            ...keyed.fields,
             name,
             csrf: randomBytes(32).toString("hex"),
             role: made.role,
@@ -579,8 +607,7 @@ export function createPeopleHandlers(runtime) {
             project: runtime.defaultProject,
             projectRevision: 1,
         });
-        response.setHeader("Set-Cookie", `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`);
-        return redirect(response, "/");
+        return signedInTo(response, keyed.key, "/", [`${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`]);
     }
     /** The invite code in /join/:code (the route's pattern has already proven its shape). */
     function joinCodeOf(url) {
@@ -674,6 +701,195 @@ export function createPeopleHandlers(runtime) {
             return { ok: false, message: "Choose projects available on this instance." };
         return { ok: true, projects };
     }
+    /** Easy-start C2: a session's key fields when it is made: on a protected loopback install, a fresh key (only its hash
+     * and this start's epoch kept) to deliver once; else none. */
+    function keyFor(request) {
+        const fields = { keyEpoch: null, keyHash: null };
+        const key = browserKeys.issue(fields, request);
+        return { fields, key };
+    }
+    /** A sign-in's answer: its cookies, then on to `to` — through the key's one delivery when there is a key. */
+    function signedInTo(response, key, to, cookies) {
+        if (key !== null)
+            return browserKeys.deliver(response, key, to, cookies);
+        response.setHeader("Set-Cookie", cookies.length === 1 ? cookies[0] : [...cookies]);
+        return redirect(response, to);
+    }
+    // Easy-start C2: Reconnect. A browser session keeps reading after a restart, but its mutation key was bound to the
+    // console start that issued it. A full session gets a fresh key here by typing its password again (a cookie alone
+    // never does: a cookie holder on another port has the cookie); a local owner, by running `toolroll open`.
+    async function rekeyPage(ctx) {
+        const { url, who, response } = ctx;
+        const returnTo = loginReturn(url.searchParams.get("return"));
+        if (who?.via !== "cookie")
+            return redirect(response, loginHref(returnTo));
+        if (!browserKeys.required())
+            return redirect(response, returnTo);
+        return page(response, 200, reconnectPage(null, returnTo, howToReconnect(who)));
+    }
+    function howToReconnect(who) {
+        if (who.authority !== "full")
+            return { kind: "command" };
+        if (!passwordAllowed(who.name))
+            return { kind: "sso", label: ssoSettings()?.label ?? "your identity provider" };
+        return { kind: "password", name: who.name };
+    }
+    async function rekeySend(ctx) {
+        const { who, request, response } = ctx;
+        const body = readForm(await form(request), CONSOLE_FORMS.rekey);
+        const returnTo = loginReturn(body.get("return"));
+        if (who?.via !== "cookie")
+            return redirect(response, loginHref(returnTo));
+        if (!browserKeys.required())
+            return redirect(response, returnTo);
+        // Only this console's own page: a present Origin must name it (the password below is the proof either way).
+        const origin = request.headers.origin;
+        if (typeof origin === "string" && origin !== "null" && origin !== `http://${browserKeys.canonicalHost()}`) {
+            return page(response, 403, reconnectPage("Reconnect from Toolroll's own page.", returnTo, howToReconnect(who)));
+        }
+        const how = howToReconnect(who);
+        if (how.kind !== "password")
+            return page(response, 403, reconnectPage(null, returnTo, how));
+        const source = joinSourceOf(request), at = Date.now();
+        const wait = signInBudget.waitFor(source, at);
+        if (wait > 0) {
+            recordSignIn(who.name, "sign-in refused", "too many tries", "reconnect");
+            response.setHeader("Retry-After", String(Math.ceil(wait / 1000)));
+            return page(response, 429, reconnectPage(`Too many tries. Try again in ${minutesWords(wait)}.`, returnTo, how));
+        }
+        // Only a password typed now: never a session, Passwordless or a remembered password (an empty one simply fails).
+        const proved = authenticateAccount(store, who.name, body.get("token") ?? "");
+        if (!proved.ok) {
+            if (proved.reason === "locked") {
+                recordSignIn(who.name, "sign-in refused", "locked", "reconnect");
+                response.setHeader("Retry-After", String(Math.ceil(proved.retryAfterMs / 1000)));
+                return page(response, 429, reconnectPage(`Too many wrong passwords. Try again in ${minutesWords(proved.retryAfterMs)}.`, returnTo, how));
+            }
+            signInBudget.failed(source, at);
+            recordSignIn(who.name, "sign-in refused", "wrong password", "reconnect");
+            return page(response, 403, reconnectPage("That password isn't right.", returnTo, how));
+        }
+        // The same person under the same credential generation and standing this session signed in with; anything else
+        // signs in again instead.
+        if (proved.generation !== who.session.generation || proved.role !== who.session.role)
+            return redirect(response, loginHref(returnTo));
+        const key = browserKeys.issue(who.session, request);
+        if (key === null)
+            return page(response, 421, reconnectPage(`Open Toolroll at http://${browserKeys.canonicalHost()} to reconnect.`, returnTo, how));
+        sessions.persist(who.session);
+        recordSignIn(who.name, "reconnected", "browser");
+        return browserKeys.deliver(response, key, returnTo);
+    }
+    // Easy-start C4: /password/set, the one credential act a local owner's session may make: its first password, only
+    // while the account has none. The answer is a fresh full session (and a fresh browser key), and on to the act that
+    // was refused. Every other session, and an account that has a password, is told to sign in with it.
+    /** A /password/set page: no-store, and on a protected loopback install the key fill rides it (its form posts the key). */
+    function passwordSetAnswer(response, status, document) {
+        response.setHeader("Cache-Control", "no-store");
+        if (!browserKeys.required())
+            return page(response, status, document);
+        const nonce = randomBytes(16).toString("base64");
+        return page(response, status, replaceMarkup(document, /<\/body><\/html>$/, () => html `${scriptElement(KEY_FILL_SCRIPT, { nonce })}</body></html>`), nonce);
+    }
+    async function passwordSetForm(ctx) {
+        const { url, who, response } = ctx;
+        // Where to go once it is set: `next` (a refusal's link), or `return` (older links), checked either way.
+        const returnTo = passwordSetNext(url.searchParams.get("next") ?? url.searchParams.get("return"));
+        if (who === null || who === undefined)
+            return redirect(response, loginHref(returnTo));
+        if (who.via !== "cookie")
+            return respond(response, 403, "text/plain; charset=utf-8", "This address needs a browser sign-in.");
+        if (who.authority === "full" || store.accountOf(who.name)?.passwordSet !== false)
+            return passwordSetAnswer(response, 200, passwordAlreadySetPage("A password is already set", returnTo, who.authority === "full"));
+        return passwordSetAnswer(response, 200, withFormToken(who.session.csrf, () => passwordSetPage({ returnTo, problem: null })));
+    }
+    async function passwordSetSend(ctx) {
+        const { who, request, response } = ctx;
+        const media = String(request.headers["content-type"] ?? "").split(";")[0]?.trim().toLowerCase();
+        if (media !== "application/x-www-form-urlencoded") {
+            request.resume();
+            return respond(response, 415, "text/plain; charset=utf-8", "forms only");
+        }
+        const body = readForm(await form(request), CONSOLE_FORMS.passwordSet);
+        const returnTo = passwordSetNext(body.get("next") ?? body.get("return"));
+        if (who === null || who === undefined)
+            return redirect(response, loginHref(returnTo));
+        if (who.via !== "cookie")
+            return respond(response, 403, "text/plain; charset=utf-8", "This address needs a browser sign-in.");
+        for (const field of ["csrf", "password", "again", "next", "return"]) {
+            if (body.getAll(field).length > 1)
+                return respond(response, 400, "text/plain; charset=utf-8", `duplicated ${field} field`);
+        }
+        const account = store.accountOf(who.name);
+        // A full session, or an account that has a password: only signing in with it.
+        if (who.authority === "full" || account === null || account.passwordSet)
+            return passwordSetAnswer(response, 409, passwordAlreadySetPage("A password is already set", returnTo, who.authority === "full"));
+        const again = (problem, status) => passwordSetAnswer(response, status, withFormToken(who.session.csrf, () => passwordSetPage({ returnTo, problem })));
+        // The console's own page only: a present Origin (or Referer) must name it; the session's CSRF token and (on a protected
+        // loopback install) its browser key are proved as for every other mutation.
+        const origin = request.headers.origin, referer = request.headers.referer;
+        const named = typeof origin === "string" && origin !== "null" ? origin : typeof referer === "string" ? referer : null;
+        if (named !== null && !runtime.allowedHost(named.replace(/^https?:\/\//, "").split("/")[0]))
+            return again({ field: null, text: "Set your password from Toolroll's own page." }, 403);
+        if (body.get("csrf") !== who.session.csrf)
+            return again({ field: null, text: "This form had expired, so it was reloaded. Enter the password again." }, 403);
+        const keyed = browserKeys.check(who, request, body.sent);
+        if (keyed !== null)
+            return again({ field: null, text: keyed.message }, keyed.status);
+        if (account.revokedAt !== null || account.generation !== who.session.generation || !sessions.savedNow(who.session) || who.session.localGeneration === null) {
+            return again({ field: null, text: LOCAL_OWNER_LAPSED }, 409);
+        }
+        // Rate-limited like signing in: the same per-address budget, and each refused try spends from it.
+        const source = joinSourceOf(request), at = Date.now();
+        const wait = signInBudget.waitFor(source, at);
+        if (wait > 0) {
+            response.setHeader("Retry-After", String(Math.ceil(wait / 1000)));
+            return again({ field: null, text: `Too many tries. Try again in ${minutesWords(wait)}.` }, 429);
+        }
+        const password = body.get("password") ?? "";
+        // The strength rule sign-up and joining use.
+        if (password.length < SIGNUP_PASSWORD_MIN) {
+            signInBudget.failed(source, at);
+            return again({ field: "password", text: `Use at least ${SIGNUP_PASSWORD_MIN} characters.` }, 400);
+        }
+        if ((body.get("again") ?? "") !== password) {
+            signInBudget.failed(source, at);
+            return again({ field: "again", text: "The two passwords don't match. Type them again." }, 400);
+        }
+        // Hashed before the transaction (scrypt is slow); enrollOwnerPassword then checks and writes in one IMMEDIATE
+        // transaction: still no password, local mode on at this session's generation, the account its active owner. It ends
+        // every session the account had (this one included).
+        const enrolled = enrollOwnerPassword(store, who.name, hashPassword(password), who.session.localGeneration, clock());
+        if (!enrolled.ok) {
+            if (enrolled.reason === "already-set")
+                return passwordSetAnswer(response, 409, passwordAlreadySetPage("A password was just set", returnTo));
+            return again({ field: null, text: LOCAL_OWNER_LAPSED }, 409);
+        }
+        const cookieId = new RegExp(`(?:^|;\\s*)${SESSION_COOKIE}=([0-9a-f]{64})`).exec(request.headers.cookie ?? "")?.[1];
+        if (cookieId !== undefined)
+            sessions.delete(cookieId);
+        recordSignIn(who.name, "signed in", "browser", "first password set");
+        // A fresh full session, made only after the commit, with a fresh key delivered once (no-store) on a protected install.
+        const id = randomBytes(32).toString("hex");
+        const issued = keyFor(request);
+        sessions.set(id, {
+            ...arrival(request),
+            ...FULL_SESSION,
+            ...issued.fields,
+            name: who.name,
+            csrf: randomBytes(32).toString("hex"),
+            role: account.role,
+            generation: enrolled.generation,
+            createdAt: Date.now(),
+            sawBoardAt: null,
+            lastSeen: Date.now(),
+            project: who.session.project ?? runtime.defaultProject,
+            projectRevision: 1,
+            // A password typed on this computer starts this session's freshness window (cockpit B2), as signing in does.
+            ...(fromThisComputer(request) ? { passwordAt: Date.now() } : {}),
+        });
+        return signedInTo(response, issued.key, returnTo, [`${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`]);
+    }
     const registrations = handlersOf("people", {
         "people.page": peoplePage,
         "settings.sessions": sessionsPage,
@@ -691,8 +907,12 @@ export function createPeopleHandlers(runtime) {
         "edge.signup": signupSend,
         "edge.login": loginSend,
         "edge.logout": logout,
+        "edge.rekey-page": rekeyPage,
+        "edge.rekey": rekeySend,
         "edge.join": joinPage,
         "edge.join-send": joinSend,
+        "edge.password-set-page": passwordSetForm,
+        "edge.password-set": passwordSetSend,
     });
     return { registrations, takeJoinAttempt, ssoCallback, readAccessForm };
 }

package/dist/server/remote.d.ts

@@ -51,6 +51,8 @@ export interface RemoteRuntime {
     teamsSourceBudget: SourceAdmission;
     teamsTenantBudget: SourceAdmission;
     freshFactsOf: (request: IncomingMessage, who: Who | null) => FreshFacts | null;
+    /** Easy-start C2: the browser mutation key (server/mutation-key.ts). */
+    browserKeys: import("./mutation-key.js").BrowserKeys;
 }
 export declare function createRemoteHandlers(runtime: RemoteRuntime): {
     registrations: import("./handler-registry.js").Registration[];

package/dist/server/remote.js

@@ -38,6 +38,9 @@ export function createRemoteHandlers(runtime) {
             const account = who === null ? null : store.accountOf(who.name);
             if (!who || !account || account.revokedAt !== null)
                 return null;
+            // Easy-start C1: team conversations are a remote feature; a laptop's local owner (no password) never reaches them.
+            if (who.via === 'cookie' && who.authority !== 'full')
+                return null;
             if (who.via === 'bearer')
                 passwordProvedAt.set(request, clock().getTime());
             return { name: who.name, generation: account.generation, role: account.role };
@@ -71,7 +74,7 @@ export function createRemoteHandlers(runtime) {
                 return true;
             }
             const who = identify(request, false);
-            return who?.name === actor.name && who.via === 'cookie' && who.session.generation === actor.generation;
+            return who?.name === actor.name && who.via === 'cookie' && who.authority === 'full' && who.session.generation === actor.generation;
         },
         authorizeMutation: (request, actor) => {
             if (actor.principal !== undefined)
@@ -81,11 +84,15 @@ export function createRemoteHandlers(runtime) {
                 return false;
             if (who.via === 'bearer')
                 return request.headers.origin === undefined;
+            if (who.authority !== 'full')
+                return false;
             const origin = request.headers.origin, referer = request.headers.referer;
             const named = typeof origin === 'string' && origin !== 'null' ? origin : typeof referer === 'string' ? referer : null;
             if (named !== null && !allowedHost(named.replace(/^https?:\/\//, '').split('/')[0]))
                 return false;
-            return request.headers['x-csrf-token'] === who.session.csrf;
+            // Easy-start C2: and, on a protected loopback install, the session's key (its header), which a cookie holder on
+            // another port can't read.
+            return request.headers['x-csrf-token'] === who.session.csrf && runtime.browserKeys.check(who, request, null) === null;
         },
         execute: async (actor, input) => {
             const reply = await team.execute(actor, input);
@@ -112,7 +119,8 @@ export function createRemoteHandlers(runtime) {
         requesterKey: joinSourceOf,
         session: request => {
             const who = identify(request, false);
-            if (who === null || who.via !== "cookie")
+            // Easy-start C1: connecting an outside app is a credential act; a local owner's session is never one that consents.
+            if (who === null || who.via !== "cookie" || who.authority !== "full")
                 return null;
             return { name: who.name, role: who.role, csrf: who.session.csrf, generation: who.session.generation,
                 sso: who.session.sso === undefined ? null : { label: ssoSettings()?.label ?? "your identity provider",
@@ -123,13 +131,20 @@ export function createRemoteHandlers(runtime) {
             const named = typeof origin === "string" && origin !== "null" ? origin : typeof referer === "string" ? referer : null;
             return named !== null && allowedHost(named.replace(/^https?:\/\//, "").split("/")[0]);
         },
+        // Easy-start C2: the consent's own post presents the session's key too (its form carries it, filled by the page's
+        // one nonce'd script while the key is required).
+        keyed: (request, form) => {
+            const who = identify(request, false);
+            return who !== null && who.via === "cookie" && runtime.browserKeys.check(who, request, form) === null;
+        },
+        keyFill: () => runtime.browserKeys.required(),
         // The step-up for a credential: the person's password, or (empty) a fresh identity-provider check. What they may
         // grant (their role, their projects) is checked beside it.
         // Proved on this request's live session at the moment of consent (signed in here still, same generation), through
         // the one account step-up: a password typed now, or an explicit re-check (spent). Never a remembered password.
         confirm: (request, session, typed) => {
             const who = identify(request, false);
-            if (who === null || who.via !== "cookie" || who.name !== session.name || who.session.generation !== session.generation)
+            if (who === null || who.via !== "cookie" || who.authority !== "full" || who.name !== session.name || who.session.generation !== session.generation)
                 return false;
             // Connecting an outside app is a credential act: never a session (Passwordless) or a remembered password.
             return freshFacts.run(runtime.freshFactsOf(request, who), () => { const proved = proveAccountNow(store, who.name, typed, { credential: true }); return proved.ok && credentialProof(proved.method); });

package/dist/server/render-new-task.js

@@ -8,6 +8,7 @@ import { html, joinHtml, postForm } from "../html.js";
 import { projectName } from "../project.js";
 import { screen } from "./chrome.js";
 import { btn, composer, disclose, doc, docHeader, dock, field, ideas, input, note, phoneHeader, radios, select, sendButton, textarea, toggleChip } from "./kit.js";
+import { TASK_TEXT_LIMITS } from "../task-text.js";
 const FORM_ID = "nt-form";
 const PLAN_ON = "The agent reads the code and asks you anything unclear, then writes the plan.";
 const PLAN_OFF = "The agent writes the plan straight from your words. Faster for small, obvious changes.";
@@ -59,7 +60,10 @@ suggestions = []) {
         value: text, rows: 4, maxRows: 10, before: bar, error: problem,
         send: sendButton({ label: "File task" }),
         note: html `<span class="k-on-note">${PLAN_ON}</span><span class="k-off-note">${PLAN_OFF}</span>`,
-        textAttrs: { maxlength: 200, autofocus: true },
+        // The box holds what a title holds: a task's words are its title, and the planner reads nothing else of them when no
+        // goal is given, so longer words would be lost, not kept. Filing's whole-word cut (task-text.ts titleWithin) is a
+        // belt for other callers only.
+        textAttrs: { maxlength: TASK_TEXT_LIMITS.title, autofocus: true },
     });
     const options = html `<div class="k-form">\
 ${field({ id: "nt-quality", label: "Checks", control: select({ id: "nt-quality", name: "quality-mode", items: [["default", "Default checks"], ["strict", "Strict (release)"]], current: quality, wide: true }) })}\

package/dist/server/render-pages.d.ts

@@ -341,7 +341,8 @@ export type OnboardCardState = {
     why: string;
 } | {
     enabled: true;
-    roots: readonly string[];
+    roots: readonly string[]; /** Easy-start: the local owner's own session (no password to type; the prover's local-owner branch proves the clone). */
+    localOwner?: boolean;
     record: [string, {
         nameWithOwner: string;
         rootIndex: number;

package/dist/server/render-pages.js

@@ -881,7 +881,7 @@ export function queueScript() {
         `function problem(task,text){var card=region.querySelector('.queue-card[data-task="'+task.replace(/["\\\\]/g,"")+'"]');if(!card)return false;` +
         `var old=card.querySelector(".queue-problem");if(old)old.remove();` +
         `var row=document.createElement("p");row.className="problem queue-problem";row.setAttribute("role","alert");row.textContent=text;card.appendChild(row);return true;}` +
-        `fetch("/queue/move",{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:post.toString(),redirect:"manual"})` +
+        `fetch("/queue/move",{method:"POST",headers:(window.soKeyHeaders||function(h){return h})({"Content-Type":"application/x-www-form-urlencoded"}),body:post.toString(),redirect:"manual"})` +
         `.then(function(r){if(r.ok)return fetch("/queue?fragment=1",{redirect:"manual",cache:"no-store"}).then(function(f){` +
         `if(f.type==="opaqueredirect"||f.status===401||f.status===403){location.href="/login";return false;}return f.ok?f.text():null;});` +
         `if(r.type==="opaqueredirect"||r.status===401||r.status===403){location.href="/login";return false;}` +

package/dist/server/render-people.d.ts

@@ -27,10 +27,46 @@ export declare function ssoStepUps(page: Html, sso: {
     label: string;
     fresh: boolean;
 }, returnTo: string): Html;
+/**
+ * Easy start: for a local owner who has no password yet, every step-up password field (type=password with
+ * autocomplete="current-password", typed-only ones included) becomes "Set a password to do this." and the Set a
+ * password link, carrying this page on: there is no password to type. A new password, a secret or a key field is
+ * never one. The field's own label and hint go with it.
+ */
+export declare function localOwnerStepUps(page: Html, setHref: string): Html;
 export declare function loginPage(problem: string | null, returnTo?: string, sso?: {
     label: string;
     operatorsOnly: boolean;
 } | null): Html;
+/**
+ * Easy-start C2: reconnect this tab after a restart (or when it lost its key): the password again for a full session, an
+ * identity-provider sign-in for one that signs in there, or the terminal for a local owner (no password exists).
+ */
+export declare function reconnectPage(problem: string | null, returnTo: string, how: {
+    kind: "password";
+    name: string;
+} | {
+    kind: "sso";
+    label: string;
+} | {
+    kind: "command";
+}): Html;
+/** Which /password/set field a refusal is about (null: the page itself). */
+export type PasswordSetProblem = {
+    field: "password" | "again" | null;
+    text: string;
+};
+/**
+ * Easy-start C4: the local owner's first password. Two fields and one button; the form carries the session's CSRF token
+ * (render it inside withFormToken) and, through the page's key fill, the browser key and the act that was refused, to continue there. Neither typed
+ * password ever comes back on a refusal.
+ */
+export declare function passwordSetPage(view: {
+    returnTo: string;
+    problem: PasswordSetProblem | null;
+}): Html;
+/** /password/set once a password exists (set earlier, or just now in another tab): sign in with it, and come back. */
+export declare function passwordAlreadySetPage(title: string, returnTo: string, signedIn?: boolean): Html;
 /**
  * The page for an address the console doesn't answer to (onboarding): what was opened, where it answers, and the exact
  * command that admits this address. It stands alone (styles inline, no script, no font), because every other asset

package/dist/server/render-people.js

@@ -54,6 +54,19 @@ export function ssoStepUps(page, sso, returnTo) {
     const labelled = replaceMarkup(page, /<label>[^<]*<input\b([^>]*)>\s*<\/label>/g, (_whole, attributes) => stepUp(attributes) ? swap(attributes) : null);
     return replaceMarkup(labelled, /<input\b([^>]*)>/g, (_whole, attributes) => stepUp(attributes) ? swap(attributes) : null);
 }
+/**
+ * Easy start: for a local owner who has no password yet, every step-up password field (type=password with
+ * autocomplete="current-password", typed-only ones included) becomes "Set a password to do this." and the Set a
+ * password link, carrying this page on: there is no password to type. A new password, a secret or a key field is
+ * never one. The field's own label and hint go with it.
+ */
+export function localOwnerStepUps(page, setHref) {
+    const stepUp = (attributes) => /\btype="password"/.test(attributes) && /\bautocomplete="current-password"/.test(attributes);
+    const instead = () => html `<p class="k-note" data-local-step-up>Set a password to do this. <a class="k-link" href="${setHref}">Set a password</a></p>`;
+    const fields = replaceMarkup(page, /<div class="k-field"><label class="k-label" for="[^"]*">[^<]*<\/label><input\b([^>]*)>(?:<p class="k-hint"[^>]*>[^<]*<\/p>)?(?:<span class="k-err"[^>]*>[^<]*<\/span>)?<\/div>/g, (_whole, attributes) => stepUp(attributes) ? instead() : null);
+    const labelled = replaceMarkup(fields, /<label\b[^>]*>[^<]*(?:<span\b[^>]*>[^<]*<\/span>)?[^<]*<input\b([^>]*)>\s*<\/label>/g, (_whole, attributes) => stepUp(attributes) ? instead() : null);
+    return replaceMarkup(labelled, /<input\b([^>]*)>/g, (_whole, attributes) => stepUp(attributes) ? instead() : null);
+}
 /** An expiry as a person reads it: "Thu 5 Nov, 10:42". */
 function expiryWords(iso) {
     const at = new Date(iso);
@@ -77,7 +90,58 @@ export function loginPage(problem, returnTo = "/", sso = null) {
         ]);
     return shell("Sign in · Toolroll", outPage({
         brand: BRAND_HTML, brandHref: "/login", title: "Sign in", body,
-        foot: html `${sso === null ? html `Forgot it? Your first login was shown when Toolroll started, and saved beside its database as <code>up-login.txt</code> on the computer running it.<br>` : ""}No account? Ask whoever runs this Toolroll for an invite link.`,
+        foot: html `${sso === null ? html `Forgot it? Your first login was shown when Toolroll started, and saved beside its database in <code>.toolroll-secrets/up-login.txt</code> on the computer running it.<br>` : ""}No account? Ask whoever runs this Toolroll for an invite link.`,
+    }), { nav: false });
+}
+/**
+ * Easy-start C2: reconnect this tab after a restart (or when it lost its key): the password again for a full session, an
+ * identity-provider sign-in for one that signs in there, or the terminal for a local owner (no password exists).
+ */
+export function reconnectPage(problem, returnTo, how) {
+    const back = returnTo === "/" ? null : returnTo;
+    const body = how.kind === "command"
+        ? html `<p>Run <code>toolroll open</code> on this computer to reconnect.</p>`
+        : how.kind === "sso"
+            ? btn(`Sign in with ${how.label}`, { variant: "primary", href: `/login/sso${back === null ? "" : `?return=${encodeURIComponent(back)}`}`, className: "k-wide" })
+            : postForm("/login/rekey", joinHtml([
+                outField({ id: "rekey-password", label: `Password for ${how.name}`, name: "token", type: "password", attrs: { autocomplete: "current-password", required: true, autofocus: true } }),
+                btn("Reconnect", { variant: "primary", type: "submit", className: "k-wide" }),
+            ]), { signedOut: true, returnTo: back, attrs: { class: "k-form" } });
+    return shell("Reconnect · Toolroll", outPage({
+        brand: BRAND_HTML, brandHref: "/", title: "Reconnect",
+        body: joinHtml([problem === null ? "" : html `<div class="k-refusal">${notice(problem)}</div>`, body]),
+        foot: html `Toolroll restarted, so this tab needs a fresh connection before it can make changes.`,
+    }), { nav: false });
+}
+/**
+ * Easy-start C4: the local owner's first password. Two fields and one button; the form carries the session's CSRF token
+ * (render it inside withFormToken) and, through the page's key fill, the browser key and the act that was refused, to continue there. Neither typed
+ * password ever comes back on a refusal.
+ */
+export function passwordSetPage(view) {
+    const problem = view.problem;
+    const error = (field) => problem !== null && problem.field === field ? problem.text : null;
+    const back = view.returnTo === "/" ? null : view.returnTo;
+    const form = postForm("/password/set", joinHtml([
+        outField({ id: "password-new", label: "Password", name: "password", type: "password", hint: `At least ${SIGNUP_PASSWORD_MIN} characters.`, error: error("password"),
+            attrs: { autocomplete: "new-password", required: true, minlength: SIGNUP_PASSWORD_MIN, ...(problem === null ? { autofocus: true } : {}) } }),
+        outField({ id: "password-again", label: "Type it again", name: "again", type: "password", error: error("again"),
+            attrs: { autocomplete: "new-password", required: true, minlength: SIGNUP_PASSWORD_MIN } }),
+        btn("Set password", { variant: "primary", type: "submit", className: "k-wide" }),
+    ]), { hidden: { next: back }, attrs: { class: "k-form" } });
+    return shell("Set a password · Toolroll", outPage({
+        brand: BRAND_HTML, brandHref: "/", title: "Set a password",
+        sub: "Agents can work on their own, merge and release only after you set a password.",
+        body: joinHtml([problem !== null && problem.field === null ? html `<div class="k-refusal">${notice(problem.text)}</div>` : "", form,
+            html `<div class="k-acts">${btn("Not now", { variant: "ghost", href: view.returnTo, className: "k-wide" })}</div>`]),
+    }), { nav: false });
+}
+/** /password/set once a password exists (set earlier, or just now in another tab): sign in with it, and come back. */
+export function passwordAlreadySetPage(title, returnTo, signedIn = false) {
+    return shell(`${title} · Toolroll`, outPage({
+        brand: BRAND_HTML, brandHref: "/", title, sub: signedIn ? "You're signed in with it." : "Sign in with it to continue.",
+        body: html `<div class="k-acts">${signedIn ? btn("Continue", { variant: "primary", href: returnTo, className: "k-wide" })
+            : btn("Sign in", { variant: "primary", href: returnTo === "/" ? "/login" : `/login?return=${encodeURIComponent(returnTo)}`, className: "k-wide" })}</div>`,
     }), { nav: false });
 }
 /**

package/dist/server/render-projects.js

@@ -73,7 +73,9 @@ export function cloneReviewHtml(onboard, problem) {
         return null;
     const [nonce, record] = onboard.record;
     const kind = "step-up";
-    const factsNow = approvalFactsNow();
+    // The local owner has no password to type: the clone is its own act (add-project), proved by the session at confirm.
+    const local = onboard.localOwner === true;
+    const factsNow = local ? { ...approvalFactsNow(), passwordless: true } : approvalFactsNow();
     const size = record.diskUsageKib === null ? "Unknown" : `${Math.max(1, Math.round(record.diskUsageKib / 1024))} MiB`;
     const bigOk = record.large
         ? html `<div class="k-checks"><label><input type="checkbox" name="big-ok" value="1" required>${record.nameWithOwner} is ${record.diskUsageKib === null ? "of unknown size" : size}. Clone it anyway</label></div>`
@@ -82,7 +84,7 @@ export function cloneReviewHtml(onboard, problem) {
         status: html `<h2>Clone ${record.nameWithOwner}</h2>`,
         text: html `Review before anything is downloaded. Clones into ${mono(shortPathOf(record.target))} and adds it as a project. Large-file (LFS) objects aren’t downloaded.`,
         acts: approveForm({ action: "/projects/onboard-confirm", kind, facts: factsNow, label: "Clone and add", form: { hidden: { nonce } }, before: bigOk }),
-        terms: `${approvalTerms(kind, factsNow)} The review expires in 10 minutes.`,
+        terms: `${local ? "No password needed on this computer." : approvalTerms(kind, factsNow)} The review expires in 10 minutes.`,
         err: problem === null ? null : refused(problem),
         attrs: { "aria-label": `Clone ${record.nameWithOwner}` },
     })}${facts([["Repository", mono(`github.com/${record.nameWithOwner}`)], ["Size", size], ["Into", mono(shortPathOf(record.target))]])}`;