toolroll 0.9.89 → 0.9.90

package/dist/laptop-service.js

@@ -0,0 +1,268 @@
+/**
+ * The laptop-mode login item, generated and compared — never installed.
+ *
+ * Laptop mode keeps one `toolroll up --laptop` console running for the
+ * person who is logged in: a launchd LaunchAgent on macOS
+ * (~/Library/LaunchAgents/com.toolroll.up.plist), a systemd user unit on
+ * Linux (~/.config/systemd/user/toolroll-up.service). This module only
+ * computes what that definition would be, whether an installed one matches,
+ * and which existing services would conflict with it. Nothing here writes a
+ * unit, loads one, or calls launchctl or systemctl; the handoff that does
+ * (`toolroll background on`) is laptop-background.ts.
+ *
+ * The command is pinned with absolute paths, as daemon.ts pins its services:
+ * launchd and systemd do not inherit an interactive shell's PATH, so the unit
+ * runs the absolute Node binary with the package entry, and the database is
+ * the canonical path (realpath of its folder) so a symlinked folder and its
+ * target are one database. Values with control characters are refused: a
+ * newline would end a systemd line and a NUL cannot appear in either format.
+ *
+ * Conflicts are reported, never touched: the desktop/browser service
+ * (com.toolroll.browser, and com.standing-orders.browser from before the
+ * rename) and any `daemon install` watch whose unit points at the same
+ * database. Whatever cannot be read counts as a conflict, so the caller asks
+ * instead of assuming.
+ */
+import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+// POSIX paths throughout: a LaunchAgent and a systemd unit only ever name POSIX paths.
+import { posix } from "node:path";
+import { definitionDigest, launchdPlist } from "./daemon.js";
+const { basename, dirname, isAbsolute, join } = posix;
+export const LAPTOP_LABEL_DARWIN = "com.toolroll.up";
+export const LAPTOP_LABEL_LINUX = "toolroll-up";
+/** The services laptop mode never runs beside on macOS: the desktop app's browser controller, either name. */
+export const BROWSER_SERVICE_LABELS = ["com.toolroll.browser", "com.standing-orders.browser"];
+/** The watch labels daemon.ts writes (labelFor / legacyLabelFor). */
+const WATCH_PREFIXES = ["com.toolroll.watch.", "com.standing-orders.watch."];
+export const nodeFs = {
+    exists: existsSync,
+    readFile: path => readFileSync(path, "utf8"),
+    readdir: path => readdirSync(path),
+    realpath: path => realpathSync(path),
+};
+// Every C0 control character and DEL: newline and NUL are the dangerous ones,
+// the rest are never part of a real path and are not valid XML 1.0 either.
+const CONTROL = /[\u0000-\u001f\u007f]/;
+function checkPath(name, value) {
+    if (value === "")
+        return `${name} is empty`;
+    if (CONTROL.test(value))
+        return `${name} contains a newline, NUL or other control character`;
+    if (!isAbsolute(value))
+        return `${name} must be an absolute path (got ${value})`;
+    return null;
+}
+/**
+ * The database path the unit names: its folder resolved through realpath,
+ * its file name kept (the file may not exist yet). A relative, empty or
+ * control-character path, or a folder that cannot be resolved, refuses.
+ */
+export function canonicalDatabasePath(db, fs = nodeFs) {
+    const problem = checkPath("the database path", db);
+    if (problem !== null)
+        return { error: problem };
+    const name = basename(db);
+    if (db.endsWith("/") || name === "" || name === "." || name === "..")
+        return { error: `the database path ${db} does not name a file` };
+    let folder;
+    try {
+        folder = fs.realpath(dirname(db));
+    }
+    catch {
+        return { error: `the database folder ${dirname(db)} cannot be resolved` };
+    }
+    const canonical = join(folder, name);
+    const after = checkPath("the database path", canonical);
+    return after === null ? canonical : { error: after };
+}
+function unitPathFor(platform, home) {
+    return platform === "darwin"
+        ? { label: LAPTOP_LABEL_DARWIN, path: join(home, "Library", "LaunchAgents", `${LAPTOP_LABEL_DARWIN}.plist`) }
+        : { label: LAPTOP_LABEL_LINUX, path: join(home, ".config", "systemd", "user", `${LAPTOP_LABEL_LINUX}.service`) };
+}
+/**
+ * The login item for laptop mode, computed without writing anything. On
+ * macOS the text comes from daemon.ts's launchdPlist, so it carries the same
+ * KeepAlive/ExitTimeOut contract and the same service digest (which binds the
+ * runtime's and package's code, read only). On Linux it is a systemd user
+ * unit in daemon.ts's shape, with systemd's `%` and `$` expansion escaped.
+ */
+export function laptopServiceDefinition(args) {
+    const { platform } = args;
+    if (platform !== "darwin" && platform !== "linux")
+        return { error: `laptop mode has no login item for ${platform}; keep \`toolroll up\` running yourself` };
+    for (const [name, value] of [["the home folder", args.home], ["the Node binary", args.node], ["the package folder", args.dist]]) {
+        const problem = checkPath(name, value);
+        if (problem !== null)
+            return { error: problem };
+    }
+    if (!Number.isSafeInteger(args.port) || args.port < 1 || args.port > 65535)
+        return { error: `the port must be a whole number from 1 to 65535 (got ${args.port})` };
+    const pathEnv = args.pathEnv ?? process.env["PATH"] ?? "";
+    if (CONTROL.test(pathEnv))
+        return { error: "the PATH contains a newline, NUL or other control character" };
+    const db = canonicalDatabasePath(args.db, args.fs ?? nodeFs);
+    if (typeof db !== "string")
+        return db;
+    const entry = join(args.dist, "bin.js");
+    const command = [args.node, entry, "up", "--laptop", "--no-open", "--db", db, "--port", String(args.port)];
+    const stateDir = dirname(db);
+    const { label, path } = unitPathFor(platform, args.home);
+    const logPath = join(stateDir, "logs", `${label}.log`);
+    const text = platform === "darwin"
+        ? launchdPlist({ label, command, workingDirectory: stateDir, pathEnv, logPath })
+        : systemdUnit({ command, workingDirectory: stateDir, pathEnv, logPath });
+    return { platform, label, path, text, digest: definitionDigest(text), command, db, logPath };
+}
+/**
+ * The systemd user unit: daemon.ts's watch unit shape (Restart=always,
+ * default.target) plus TimeoutStopSec=60, launchd's ExitTimeOut, so a stop
+ * gets the same drain window on both platforms.
+ */
+function systemdUnit(args) {
+    return `[Unit]
+Description=toolroll laptop console
+
+[Service]
+Environment=${systemdQuote(`PATH=${args.pathEnv}`, false)}
+ExecStart=${args.command.map(part => systemdQuote(part, true)).join(" ")}
+WorkingDirectory=${systemdSpecifiers(args.workingDirectory)}
+Restart=always
+RestartSec=15
+TimeoutStopSec=60
+
+StandardOutput=append:${systemdSpecifiers(args.logPath)}
+StandardError=append:${systemdSpecifiers(args.logPath)}
+
+[Install]
+WantedBy=default.target
+`;
+}
+/** `%` starts a specifier in every systemd setting. */
+function systemdSpecifiers(text) {
+    return text.replace(/%/g, "%%");
+}
+/**
+ * daemon.ts's quoting (double quotes around anything with whitespace,
+ * quotes or backslashes; `"` and `\` escaped), plus `%%` everywhere and, in
+ * a command line, `$$`, since ExecStart expands `$NAME`.
+ */
+function systemdQuote(part, command) {
+    let text = systemdSpecifiers(part);
+    if (command)
+        text = text.replace(/\$/g, "$$$$");
+    return /[\s"'\\]/.test(text) || text === "" ? `"${text.replace(/(["\\])/g, "\\$1")}"` : text;
+}
+/** Whether an installed unit's text is exactly this definition. Null (or undefined) text means no unit is installed. */
+export function compareInstalled(existingText, definition) {
+    if (existingText === null || existingText === undefined)
+        return "absent";
+    return existingText === definition.text && definitionDigest(existingText) === definition.digest ? "same" : "different";
+}
+/**
+ * Existing services laptop mode must not run beside: the browser service on
+ * macOS (whatever database it uses — it is a console of its own), and any
+ * daemon.ts watch whose unit points at this database, by `--db` or by its
+ * `--token-file` sitting in the database's folder (daemon install keeps the
+ * runner token beside the database it was installed from). A unit that
+ * cannot be read is listed too. Laptop mode's own unit is never a conflict.
+ */
+export function detectOtherServices(args) {
+    const fs = args.fs ?? nodeFs;
+    if (args.platform !== "darwin" && args.platform !== "linux")
+        return [];
+    const homeProblem = checkPath("the home folder", args.home);
+    if (homeProblem !== null)
+        return { error: homeProblem };
+    const db = canonicalDatabasePath(args.db, fs);
+    if (typeof db !== "string")
+        return db;
+    const conflicts = [];
+    const darwin = args.platform === "darwin";
+    const folder = darwin ? join(args.home, "Library", "LaunchAgents") : join(args.home, ".config", "systemd", "user");
+    const suffix = darwin ? ".plist" : ".service";
+    if (darwin) {
+        for (const label of BROWSER_SERVICE_LABELS) {
+            const path = join(folder, `${label}${suffix}`);
+            if (fs.exists(path))
+                conflicts.push({ kind: "browser", label, path, reason: `the Toolroll app's service ${label} is installed` });
+        }
+    }
+    let names = [];
+    try {
+        if (fs.exists(folder))
+            names = fs.readdir(folder);
+    }
+    catch {
+        return { error: `${folder} cannot be listed` };
+    }
+    for (const name of [...names].sort()) {
+        if (!name.endsWith(suffix) || !WATCH_PREFIXES.some(prefix => name.startsWith(prefix)))
+            continue;
+        const label = name.slice(0, -suffix.length);
+        const path = join(folder, name);
+        let text;
+        try {
+            text = fs.readFile(path);
+        }
+        catch {
+            conflicts.push({ kind: "watch", label, path, reason: `the watch ${label} could not be read, so it may use this database` });
+            continue;
+        }
+        const argv = darwin ? plistProgramArguments(text) : systemdExecStart(text);
+        const target = watchDatabase(argv, fs);
+        if (target === "unknown") {
+            conflicts.push({ kind: "watch", label, path, reason: `the watch ${label} does not say which database it uses` });
+        }
+        else if (target.db !== undefined ? target.db === db : target.folder === dirname(db)) {
+            conflicts.push({ kind: "watch", label, path, reason: `the watch ${label} runs on this database` });
+        }
+    }
+    return conflicts;
+}
+/** Which database a watch's command line names: its `--db`, else the folder of its `--token-file`. */
+function watchDatabase(argv, fs) {
+    const value = (flag) => {
+        const at = argv.indexOf(flag);
+        if (at >= 0)
+            return argv[at + 1];
+        return argv.find(part => part.startsWith(`${flag}=`))?.slice(flag.length + 1);
+    };
+    const dbFlag = value("--db");
+    if (dbFlag !== undefined) {
+        const db = canonicalDatabasePath(dbFlag, fs);
+        return typeof db === "string" ? { db } : "unknown";
+    }
+    const tokenFile = value("--token-file");
+    if (tokenFile === undefined || !isAbsolute(tokenFile))
+        return "unknown";
+    try {
+        return { folder: fs.realpath(dirname(tokenFile)) };
+    }
+    catch {
+        return { folder: dirname(tokenFile) };
+    }
+}
+/** ProgramArguments from a plist daemon.ts wrote. */
+function plistProgramArguments(text) {
+    const array = /<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/.exec(text)?.[1] ?? "";
+    return [...array.matchAll(/<string>([^<]*)<\/string>/g)].map(match => unxml(match[1] ?? ""));
+}
+/** ExecStart from a systemd unit, split as systemd would for the quoting daemon.ts and this module write. */
+function systemdExecStart(text) {
+    const line = /^ExecStart=(.*)$/m.exec(text)?.[1] ?? "";
+    return (line.match(/"(?:[^"\\]|\\.)*"|\S+/g) ?? []).map(part => (part.startsWith('"') ? part.slice(1, -1).replace(/\\(["\\])/g, "$1") : part).replace(/%%/g, "%").replace(/\$\$/g, "$"));
+}
+function unxml(text) {
+    return text.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+}
+/** The command an installed unit runs, argument by argument (a plist's ProgramArguments, a unit's ExecStart). */
+export function unitCommand(text, platform) {
+    return platform === "darwin" ? plistProgramArguments(text) : systemdExecStart(text);
+}
+/** The value after `flag` in an installed unit's command, or null. */
+export function unitFlag(text, platform, flag) {
+    const argv = unitCommand(text, platform);
+    const at = argv.indexOf(flag);
+    return at >= 0 && argv[at + 1] !== undefined ? argv[at + 1] : null;
+}

package/dist/lead-cli.js

@@ -1,3 +1,4 @@
+import { currentLocalOwner } from "./local-owner.js";
 import { parseFeedbackImage } from "./result-review.js";
 import { configureLeadFollow, leadFollowStatus } from './lead-follow.js';
 import { closedQuestionWords } from "./decision.js";
@@ -324,7 +325,7 @@ export async function runLeadCli(input) {
                 say(done ? `dismissed ${act[2]}` : "that proposal was already acted on");
             }
             else {
-                const outcome = confirmLeadProposal(store, who, proposal.id, now, { confirm: act[3] !== undefined, via: "cli", chatProvider: () => {
+                const outcome = confirmLeadProposal(store, who, proposal.id, now, { authority: currentLocalOwner() === null ? "full" : "local-owner", confirm: act[3] !== undefined, via: "cli", chatProvider: () => {
                         const current = store.getChatConfig();
                         return current === null ? null : { config: current, key: isDirectChatProvider(current.provider) ? keyFor(current, input.databaseFile, env) : null };
                     }, ...(input.evidenceRoot === undefined ? {} : { evidenceRoot: input.evidenceRoot }) });

package/dist/lead-doors.d.ts

@@ -2,6 +2,7 @@ import { type SharedActionOptions } from './chat-actions.js';
 import { type LeadProposal, type Store } from "./store.js";
 import type { VerifiedApprover } from "./principal.js";
 import { type TeamChatProviderResolver } from './team-chat-authorization.js';
+import { type Authority } from "./local-owner.js";
 export type ProposalKind = LeadProposal["kind"];
 export type DoorOutcome = {
     ok: true;
@@ -19,6 +20,11 @@ export type DoorOutcome = {
 };
 export type DoorRefusal = "standing" | "not-yours" | "ceiling-changed" | "not-pending" | "session-ended" | "turn-not-answered" | "turn-running" | "not-confirmable" | "needs-confirm" | "stale" | "claimed" | "not-queued" | "unknown-task" | "unknown-decision" | "already-answered" | "expired" | "outside-ceiling" | "refused";
 export type DoorOptions = {
+    /**
+     * Easy-start C1: whose authority confirms — a full session (or the CLI, a paired phone, a chat relay), or a laptop's
+     * local owner. Named by every caller; the door also reads the local owner its chain acts as, and the stricter wins.
+     */
+    authority: Authority;
     /** Resolved inside the transaction. Without it, only current subscription terms are available. */
     chatProvider?: TeamChatProviderResolver;
     evidenceRoot?: string;

package/dist/lead-doors.js

@@ -30,6 +30,14 @@ import { isTaskSize, PHASES, specWords } from "./phase-routing.js";
 import { isProviderId } from "./provider.js";
 import { applyChatReview } from "./chat-review.js";
 import { applyChatTaskAction } from "./chat-task-actions.js";
+import { currentLocalOwner, localOwnerRefusal, proposalLocalAct, withLocalAct } from "./local-owner.js";
+/** Easy-start C1: whether this door is a local owner's — named by the caller, or the chain's own (the stricter wins). */
+function localDoor(options) {
+    return options.authority !== "full" || currentLocalOwner() !== null;
+}
+function localDoorWords(store, name) {
+    return localOwnerRefusal(store.accountOf(name)?.passwordSet === true, "/chat").message;
+}
 /** A coordinator proposal lives seven days (§9); the door refuses an older one whatever the sweep did (v3 review, finding 3). */
 export const COORDINATOR_PROPOSAL_TTL_MS = 7 * 24 * 3_600_000;
 function payloadString(payload, key) {
@@ -154,6 +162,11 @@ export function confirmLeadProposal(store, who, proposalId, now, options) {
             if (sharedActionNeedsReview(action) && !challenged && (options.via !== "web" || options.actionReview === undefined || options.confirm !== true))
                 return { ok: false, kind: proposal.kind, reason: "needs-confirm", said: "Review this action in the secure confirmation screen." };
         }
+        // Easy-start C1, before the CAS: a local owner confirms only a kind it may (LOCAL_OWNER_PROPOSALS) and, for an
+        // operation kind, only an operation that is one of its acts. The card stays pending for a full session.
+        const localAct = localDoor(options) ? proposalLocalAct(proposal.kind, proposal.kind === "action" ? sharedActionPayload(proposal.payload)?.operation : proposal.payload["operation"]) : null;
+        if (localDoor(options) && localAct === null)
+            return { ok: false, kind: proposal.kind, reason: "refused", said: localDoorWords(store, who.name) };
         // An irreversible answer takes the explicit field BEFORE the CAS: a
         // missing confirmation leaves the card pending, not refused.
         const needsConfirm = proposal.kind === "answer" && proposal.payload["reversible"] === false && options.confirm !== true;
@@ -162,9 +175,11 @@ export function confirmLeadProposal(store, who, proposalId, now, options) {
         if (!store.casLeadProposal(proposalId, "pending", "confirming", who.name, null, now)) {
             return { ok: false, kind: proposal.kind, reason: "not-pending", said: "this proposal was already acted on" };
         }
+        // Both executors run as the card's own act: the prover answers "local-owner" only for it.
+        const execute = (body) => localAct === null ? body() : withLocalAct(localAct, body);
         const outcome = proposal.kind === "action"
-            ? { ...executeSharedAction(store, who, proposal.id, sharedActionPayload(proposal.payload), now, { via: options.via, ...(options.evidenceRoot === undefined ? {} : { root: options.evidenceRoot }), ...(options.actionReview === undefined ? {} : { review: options.actionReview }), ...(options.confirm === undefined ? {} : { confirm: options.confirm }) }), kind: proposal.kind }
-            : executeProposal(store, who, proposal.kind, proposal.payload, now, { ...options, deferSignal: defer });
+            ? { ...execute(() => executeSharedAction(store, who, proposal.id, sharedActionPayload(proposal.payload), now, { via: options.via, authority: localAct === null ? "full" : "local-owner", ...(options.evidenceRoot === undefined ? {} : { root: options.evidenceRoot }), ...(options.actionReview === undefined ? {} : { review: options.actionReview }), ...(options.confirm === undefined ? {} : { confirm: options.confirm }) })), kind: proposal.kind }
+            : execute(() => executeProposal(store, who, proposal.kind, proposal.payload, now, { ...options, deferSignal: defer }));
         if (!outcome.ok && outcome.reason === "needs-confirm") {
             store.casLeadProposal(proposalId, "confirming", "pending", null, null, now);
             return outcome;
@@ -221,6 +236,9 @@ export function confirmCoordinatorProposal(store, who, proposalId, now, options)
     if (!isVerifiedApprover(who))
         return { ok: false, kind: null, reason: "standing", said: "your approver standing changed — sign in again" };
     const signals = [];
+    // Easy-start C1: a coordinator's proposal is never a local owner's to confirm (work a coordinator files needs a password).
+    if (localDoor(options))
+        return { ok: false, kind: null, reason: "refused", said: localDoorWords(store, who.name) };
     const result = store.transact(() => {
         if (!reproveApprover(store, who).ok)
             return { ok: false, kind: null, reason: "standing", said: "your approver standing changed — sign in again" };

package/dist/live-records.d.ts

@@ -64,7 +64,7 @@ export declare const OUTSIDE_PROJECT = "a file outside the project";
 export declare const SOME_FILE = "a file";
 /** Whether a line looks like it carries a credential (best effort). */
 export declare function liveSecretHit(line: string): boolean;
-/** Controls, ANSI escapes and bidi overrides out; tabs to spaces. */
+/** Controls, ANSI escapes and bidi overrides out; tabs to spaces (terminal-text.ts, the one sanitizer). */
 export declare function cleanLiveText(text: string): string;
 /** An escape a line ended in the middle of, which the next line finishes: CSI, OSC, or a bare ESC. */
 export type EscapeCarry = "" | "C" | "O" | "E";

package/dist/live-records.js

@@ -16,6 +16,7 @@
 import { isAbsolute, relative, resolve, sep } from "node:path";
 import { scanForSecrets } from "./evidence.js";
 import { topLevelEvent } from "./stream-scope.js";
+import { cleanTerminalLine } from "./terminal-text.js";
 export const LIVE_ACTIVITY_KINDS = ["session", "message", "edit", "command", "read", "search", "lookup", "plan", "delegate", "tool"];
 /** A record's serialized size limit: a longer one is replaced by `cut`. */
 export const LIVE_RECORD_CAP = 8 * 1024;
@@ -46,7 +47,6 @@ const LIVE_SECRET_SHAPES = [
     /\b[a-z][a-z0-9+.-]*:\/\/[^\s/@]+@/i,
     /[?&](?:access_token|token|key|api_key|apikey|secret|sig|signature|password|pwd|auth|code)=[^&\s]+/i,
 ];
-const BIDI_CONTROLS = /[‪-‮⁦-⁩]/g;
 /** A line that is only a long run of mixed-case base64 — a key body whose BEGIN line was elsewhere (a hash is not). */
 function keyBodyShaped(line) {
     const bare = line.trim();
@@ -58,18 +58,9 @@ export function liveSecretHit(line) {
         return true;
     return keyBodyShaped(line) || LIVE_SECRET_SHAPES.some(shape => shape.test(line));
 }
-/** Controls, ANSI escapes and bidi overrides out; tabs to spaces. */
+/** Controls, ANSI escapes and bidi overrides out; tabs to spaces (terminal-text.ts, the one sanitizer). */
 export function cleanLiveText(text) {
-    return text
-        // Escape sequences in every form: CSI (7- or 8-bit, any parameter bytes including ':'), OSC, and the rest.
-        .replace(/(?:\x1b\[|\u009b)[0-?]*[ -/]*[@-~]/g, "")
-        .replace(/(?:\x1b\]|\u009d)[^\x07\x1b\u009c]*(?:\x07|\x1b\\|\u009c)?/g, "")
-        .replace(/\x1b[ -/]*[0-~]/g, "")
-        .replace(/\t/g, " ")
-        .replace(/[\x00-\x1f\x7f-\x9f]/g, "")
-        // Every invisible format character (zero-width, direction marks and overrides, joiners, BOM): never shown.
-        .replace(/\p{Cf}/gu, "")
-        .replace(BIDI_CONTROLS, "");
+    return cleanTerminalLine(text);
 }
 /** Letters, digits and dashes only, after folding look-alike letters and dashes. */
 const reduceForm = (text) => text.normalize("NFKC").replace(/[\u2010-\u2015\u2212\u2E3A\u2E3B\uFE58\uFE63\uFF0D]/g, "-").toUpperCase().replace(/[^A-Z0-9-]/g, "");

package/dist/local-owner.d.ts

@@ -0,0 +1,124 @@
+import type { LeadProposalKind, Store } from "./store.js";
+import type { ChatAction } from "./chat-actions.js";
+import type { ChatTaskAction } from "./chat-task-actions.js";
+/** Who a browser session or a terminal command speaks as. Saved sessions from before local mode read "full". */
+export type Authority = "full" | "local-owner";
+export declare const AUTHORITIES: readonly Authority[];
+/** A runtime string as an authority; anything else is null (never "full" by default). */
+export declare function authorityOf(value: unknown): Authority | null;
+/**
+ * The acts a local owner may do (plan C1). Ids only: each surface (a route row, a chat action, a CLI command) names
+ * the act it is, and an act not in this list is refused to a local owner.
+ */
+export declare const LOCAL_OWNER_ACTS: readonly ["file-task", "lead-send", "approve-plan", "answer-question", "stop-run", "pause-run", "resume-run", "complete-task", "request-revision", "archive-task", "add-project", "choose-default-agent", "mark-seen", "watch-agent", "read"];
+export type LocalOwnerAct = (typeof LOCAL_OWNER_ACTS)[number];
+/** Whether a runtime string names an act a local owner may do. */
+export declare function localOwnerAct(value: unknown): value is LocalOwnerAct;
+/**
+ * Every lead proposal kind, decided for the local owner. A new kind fails to compile here until someone decides it
+ * (like METHOD_IS_PERSON in person-proof.ts). `action` and `task_action` are allowed only for an operation that is a
+ * LOCAL_OWNER_ACTS act; the confirm gate checks that operation too.
+ */
+export declare const LOCAL_OWNER_PROPOSALS: Readonly<Record<LeadProposalKind, "allow" | "refuse">>;
+/** Kinds whose allow also needs the operation itself to be a local-owner act. */
+export declare const OPERATION_KINDS: ReadonlySet<LeadProposalKind>;
+/**
+ * Whether a local owner may confirm a proposal of this kind. A runtime string: an unknown kind is refused. For
+ * `action`/`task_action`, `act` must be the local-owner act the operation is (null or unknown refuses).
+ */
+export declare function localOwnerMayConfirm(kind: unknown, act?: unknown): boolean;
+/** Local mode as saved (store.ts `local_mode`, one row): who the owner is, its generation, and whether it is on. */
+export type LocalMode = {
+    owner: string;
+    generation: number;
+    enabled: boolean;
+    initializedAt: string;
+    changedAt: string;
+};
+/**
+ * Whether a local-owner session or link still stands against local mode as read now: on, at the generation it was
+ * bound to, for the same owner. Pure: the caller reads `mode` in the same transaction as the act.
+ */
+export declare function localBindingStands(mode: LocalMode | null, binding: {
+    account: string;
+    localGeneration: number | null;
+}): boolean;
+/** Where a local owner's act came from, for the ledger: the console in a browser, or the terminal UI in-process. */
+export type LocalTransport = "browser" | "terminal";
+/**
+ * A local owner acting now: who, the local-mode and account generations its session (or terminal start) was bound to,
+ * the transport, and the act the surface it came through is (a route row, a CLI row, a chat card). Only the console's
+ * admission and the CLI's dispatch create one; a request's input never names it.
+ */
+export type LocalPrincipal = {
+    readonly account: string;
+    readonly localGeneration: number;
+    readonly accountGeneration: number;
+    readonly transport: LocalTransport;
+    readonly act: LocalOwnerAct;
+    /** The browser session's saved hash (web_session.id_hash): a write re-reads that it is still saved. Null in the terminal. */
+    readonly sessionHash: string | null;
+    /**
+     * The browser request it was admitted for, marked ended when its answer is sent. Work that outlives the request (a
+     * timer or a turn started in its async chain) is never the local owner proving anything: the prover refuses it, and
+     * the write-time re-check no longer applies to it. Null in the terminal (a command runs to its end).
+     */
+    readonly request: {
+        ended: boolean;
+    } | null;
+};
+/** The local owner this async chain acts as, or null (full authority, or nobody). Work that outlived its request still
+ * reads it (so it is never mistaken for full authority); `localOwnerInFlight` says whether it may still prove anything. */
+export declare function currentLocalOwner(): LocalPrincipal | null;
+/** Whether a local owner's act is still in its request (or its terminal command): only then may it prove or write. */
+export declare function localOwnerInFlight(principal: LocalPrincipal): boolean;
+/** Run `body` as a local owner (the console's admission and the CLI's dispatch only). */
+export declare function asLocalOwner<T>(principal: LocalPrincipal, body: () => T): T;
+/**
+ * Narrow the current local owner to one act for `body` (a chat card's own act inside the confirm route). Outside a
+ * local owner's chain it changes nothing. It can only ever name an allowlisted act: a caller passing null refuses.
+ */
+export declare function withLocalAct<T>(act: LocalOwnerAct, body: () => T): T;
+/**
+ * The terminal UI's door (plan C3): run CLI commands (`runOperate`) inside `fn` as the local owner. runOperate binds the
+ * owner from local mode as it reads it when its database opens, and refuses every command not marked for the local owner
+ * (surface.ts LOCAL_ALLOW). Never read from argv or the environment.
+ */
+export declare function runAsLocalOwner<T>(fn: () => T): T;
+/** Whether this chain asked to run commands as the local owner (runOperate reads it; nothing else should). */
+export declare function localOwnerRequested(): boolean;
+/**
+ * The act each lead proposal kind is when a local owner confirms it (null: refused, as LOCAL_OWNER_PROPOSALS says).
+ * `action` and `task_action` take their operation's act instead (CHAT_ACTION_LOCAL_ACTS, CHAT_TASK_ACTION_LOCAL_ACTS).
+ */
+export declare const PROPOSAL_LOCAL_ACTS: Readonly<Record<LeadProposalKind, LocalOwnerAct | null>>;
+/** Every chat action (chat-actions.ts CHAT_ACTIONS), decided for the local owner: its act, or null (refused). A new
+ * action fails to compile here until someone decides it. */
+export declare const CHAT_ACTION_LOCAL_ACTS: Readonly<Record<ChatAction, LocalOwnerAct | null>>;
+/** Every task card operation (chat-task-actions.ts), decided for the local owner. */
+export declare const CHAT_TASK_ACTION_LOCAL_ACTS: Readonly<Record<ChatTaskAction, LocalOwnerAct | null>>;
+/**
+ * The act a saved proposal is for the local owner, read from its kind and (for operation kinds) its saved operation;
+ * null refuses. A runtime read of saved JSON: anything unknown is null.
+ */
+export declare function proposalLocalAct(kind: unknown, operation: unknown): LocalOwnerAct | null;
+/** The words every local-owner refusal says, and where it leads: set a first password, or sign in with the one set. */
+export declare function localOwnerRefusal(passwordSet: boolean, returnTo: string): {
+    message: string;
+    action: string;
+    href: string;
+};
+/** Whether local mode is on now (absent is off). Read straight from its one row, so the store's own checks can use it. */
+export declare function localModeOn(store: Pick<Store, "handle">): boolean;
+/**
+ * The write-time re-check (plan C1): a local owner acting now still stands — local mode on, at the generation it was
+ * bound to, for the same owner; the owner an active approver at the account generation it was bound to; and (a browser)
+ * its session still saved. Read in the caller's transaction: Store.transact runs it inside every write a local owner's
+ * chain makes, and the prover runs it inside the approval's own transaction.
+ */
+export declare function localOwnerStandsNow(store: Pick<Store, "handle" | "accountOf" | "webSession">, principal: LocalPrincipal): boolean;
+/** What a local owner's write hears when it no longer stands (local mode turned off or moved, the owner changed, the
+ * session ended). */
+export declare const LOCAL_OWNER_LAPSED = "This local sign-in no longer stands. Run `toolroll open` to sign in again.";
+/** What widening a launch's confinement hears while local mode is on (plan C5). */
+export declare const LOCAL_MODE_CONFINES = "Turn off local mode first.";