toolroll 0.9.89 → 0.9.90

package/dist/local-owner.js

@@ -0,0 +1,212 @@
+/**
+ * Local mode's restricted principal (docs: easy-start plan C1). A laptop install made by `up --laptop` starts with one
+ * owner who has no password: the browser and the terminal UI drive it as the **local owner**, a principal that may do
+ * the everyday acts below and nothing that creates or widens a way in. Everything else stays with **full** authority
+ * (a password typed now, an identity-provider sign-in, an API token).
+ *
+ * Types and pure helpers only: enforcement (route marks, the chat confirm gate, the prover's order) reads these.
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+export const AUTHORITIES = Object.freeze(["full", "local-owner"]);
+/** A runtime string as an authority; anything else is null (never "full" by default). */
+export function authorityOf(value) {
+    return value === "full" || value === "local-owner" ? value : null;
+}
+/**
+ * The acts a local owner may do (plan C1). Ids only: each surface (a route row, a chat action, a CLI command) names
+ * the act it is, and an act not in this list is refused to a local owner.
+ */
+export const LOCAL_OWNER_ACTS = Object.freeze([
+    "file-task",
+    "lead-send",
+    "approve-plan",
+    "answer-question",
+    "stop-run",
+    "pause-run",
+    "resume-run",
+    "complete-task",
+    "request-revision",
+    "archive-task",
+    "add-project",
+    "choose-default-agent",
+    "mark-seen",
+    "watch-agent",
+    "read",
+]);
+const ACT_SET = new Set(LOCAL_OWNER_ACTS);
+/** Whether a runtime string names an act a local owner may do. */
+export function localOwnerAct(value) {
+    return typeof value === "string" && ACT_SET.has(value);
+}
+/**
+ * Every lead proposal kind, decided for the local owner. A new kind fails to compile here until someone decides it
+ * (like METHOD_IS_PERSON in person-proof.ts). `action` and `task_action` are allowed only for an operation that is a
+ * LOCAL_OWNER_ACTS act; the confirm gate checks that operation too.
+ */
+export const LOCAL_OWNER_PROPOSALS = Object.freeze({
+    task: "allow",
+    answer: "allow",
+    steer: "allow",
+    cancel: "allow",
+    hold: "allow",
+    unhold: "allow",
+    action: "allow",
+    task_action: "allow",
+    next: "refuse",
+    reserve: "refuse",
+    scope: "refuse",
+    repair: "refuse",
+    agents: "refuse",
+    review: "refuse",
+    control: "refuse",
+});
+/** Kinds whose allow also needs the operation itself to be a local-owner act. */
+export const OPERATION_KINDS = new Set(["action", "task_action"]);
+/**
+ * Whether a local owner may confirm a proposal of this kind. A runtime string: an unknown kind is refused. For
+ * `action`/`task_action`, `act` must be the local-owner act the operation is (null or unknown refuses).
+ */
+export function localOwnerMayConfirm(kind, act = null) {
+    if (typeof kind !== "string" || !Object.prototype.hasOwnProperty.call(LOCAL_OWNER_PROPOSALS, kind))
+        return false;
+    if (LOCAL_OWNER_PROPOSALS[kind] !== "allow")
+        return false;
+    return OPERATION_KINDS.has(kind) ? localOwnerAct(act) : true;
+}
+/**
+ * Whether a local-owner session or link still stands against local mode as read now: on, at the generation it was
+ * bound to, for the same owner. Pure: the caller reads `mode` in the same transaction as the act.
+ */
+export function localBindingStands(mode, binding) {
+    return mode !== null && mode.enabled && binding.localGeneration !== null && mode.generation === binding.localGeneration && mode.owner === binding.account;
+}
+const localOwnerScope = new AsyncLocalStorage();
+/** The local owner this async chain acts as, or null (full authority, or nobody). Work that outlived its request still
+ * reads it (so it is never mistaken for full authority); `localOwnerInFlight` says whether it may still prove anything. */
+export function currentLocalOwner() {
+    return localOwnerScope.getStore() ?? null;
+}
+/** Whether a local owner's act is still in its request (or its terminal command): only then may it prove or write. */
+export function localOwnerInFlight(principal) {
+    return principal.request === null || !principal.request.ended;
+}
+/** Run `body` as a local owner (the console's admission and the CLI's dispatch only). */
+export function asLocalOwner(principal, body) {
+    return localOwnerScope.run(Object.freeze({ ...principal }), body);
+}
+/**
+ * Narrow the current local owner to one act for `body` (a chat card's own act inside the confirm route). Outside a
+ * local owner's chain it changes nothing. It can only ever name an allowlisted act: a caller passing null refuses.
+ */
+export function withLocalAct(act, body) {
+    const current = currentLocalOwner();
+    return current === null ? body() : localOwnerScope.run(Object.freeze({ ...current, act }), body);
+}
+const terminalRequest = new AsyncLocalStorage();
+/**
+ * The terminal UI's door (plan C3): run CLI commands (`runOperate`) inside `fn` as the local owner. runOperate binds the
+ * owner from local mode as it reads it when its database opens, and refuses every command not marked for the local owner
+ * (surface.ts LOCAL_ALLOW). Never read from argv or the environment.
+ */
+export function runAsLocalOwner(fn) {
+    return terminalRequest.run(true, fn);
+}
+/** Whether this chain asked to run commands as the local owner (runOperate reads it; nothing else should). */
+export function localOwnerRequested() {
+    return terminalRequest.getStore() === true;
+}
+/**
+ * The act each lead proposal kind is when a local owner confirms it (null: refused, as LOCAL_OWNER_PROPOSALS says).
+ * `action` and `task_action` take their operation's act instead (CHAT_ACTION_LOCAL_ACTS, CHAT_TASK_ACTION_LOCAL_ACTS).
+ */
+export const PROPOSAL_LOCAL_ACTS = Object.freeze({
+    task: "file-task",
+    answer: "answer-question",
+    steer: "lead-send",
+    cancel: "stop-run",
+    hold: "pause-run",
+    unhold: "resume-run",
+    action: null,
+    task_action: null,
+    next: null,
+    reserve: null,
+    scope: null,
+    repair: null,
+    agents: null,
+    review: null,
+    control: null,
+});
+/** Every chat action (chat-actions.ts CHAT_ACTIONS), decided for the local owner: its act, or null (refused). A new
+ * action fails to compile here until someone decides it. */
+export const CHAT_ACTION_LOCAL_ACTS = Object.freeze({
+    skill_import: null, skill_enable: null, skill_disable: null, skill_restore: null, skill_test: null,
+    knowledge_instructions: null, knowledge_save: null, knowledge_remove: null, knowledge_restore: null,
+    tool_add: null, tool_remove: null,
+    flow_create: null, flow_starter: null, sweep_file: null, sweep_cancel_rest: null, flow_edit: null,
+    flow_card_add: null, flow_card_move: null, flow_card_approve: null, flow_card_send_back: null, flow_card_choose: null,
+    flow_card_cancel: null, flow_card_comment: null, flow_card_assign: null, flow_card_watch: null, flow_script_save: null,
+    flow_trigger_add: null, flow_trigger_pause: null, flow_trigger_resume: null, flow_trigger_remove: null,
+    flow_browser: null, flow_browser_off: null,
+    subagent_create: null, subagent_soul: null, subagent_state: null, subagent_note: null, subagent_ask: null,
+    subagent_answer: null, subagent_tools: null, subagent_memory: null, subagent_routine: null, subagent_undo: null,
+    kit_setup: null, decision_record: null, decision_retire: null, lead_about_you: null,
+    scope_approve: "approve-plan",
+    result_accept: "complete-task",
+    task_cancel: "stop-run",
+    task_resume: "resume-run",
+});
+/** Every task card operation (chat-task-actions.ts), decided for the local owner. */
+export const CHAT_TASK_ACTION_LOCAL_ACTS = Object.freeze({
+    stop: "stop-run",
+    resume: "resume-run",
+    retry: null,
+    plan: null,
+    wait_for: null,
+    stop_waiting: null,
+    run_checks: null,
+    run_full_checks: null,
+    add_tests: null,
+});
+/**
+ * The act a saved proposal is for the local owner, read from its kind and (for operation kinds) its saved operation;
+ * null refuses. A runtime read of saved JSON: anything unknown is null.
+ */
+export function proposalLocalAct(kind, operation) {
+    if (typeof kind !== "string" || !Object.prototype.hasOwnProperty.call(PROPOSAL_LOCAL_ACTS, kind))
+        return null;
+    const own = (table) => typeof operation === "string" && Object.prototype.hasOwnProperty.call(table, operation) ? table[operation] ?? null : null;
+    const act = kind === "action" ? own(CHAT_ACTION_LOCAL_ACTS) : kind === "task_action" ? own(CHAT_TASK_ACTION_LOCAL_ACTS) : PROPOSAL_LOCAL_ACTS[kind];
+    return act !== null && localOwnerMayConfirm(kind, act) ? act : null;
+}
+/** The words every local-owner refusal says, and where it leads: set a first password, or sign in with the one set. */
+export function localOwnerRefusal(passwordSet, returnTo) {
+    return passwordSet
+        ? { message: "Sign in with your password to do this.", action: "Sign in with your password", href: `/login?return=${encodeURIComponent(returnTo)}` }
+        // /password/set continues to the refused page once the password is set (http.ts passwordSetNext re-checks it there).
+        : { message: "Set a password to do this.", action: "Set a password", href: returnTo === "/" ? "/password/set" : `/password/set?next=${encodeURIComponent(returnTo)}` };
+}
+/** Whether local mode is on now (absent is off). Read straight from its one row, so the store's own checks can use it. */
+export function localModeOn(store) {
+    const row = store.handle.prepare("SELECT enabled FROM local_mode WHERE id = 1").get();
+    return row !== undefined && Number(row["enabled"]) === 1;
+}
+/**
+ * The write-time re-check (plan C1): a local owner acting now still stands — local mode on, at the generation it was
+ * bound to, for the same owner; the owner an active approver at the account generation it was bound to; and (a browser)
+ * its session still saved. Read in the caller's transaction: Store.transact runs it inside every write a local owner's
+ * chain makes, and the prover runs it inside the approval's own transaction.
+ */
+export function localOwnerStandsNow(store, principal) {
+    const mode = store.handle.prepare("SELECT owner, generation, enabled FROM local_mode WHERE id = 1").get();
+    if (mode === undefined || Number(mode["enabled"]) !== 1 || Number(mode["generation"]) !== principal.localGeneration || String(mode["owner"]) !== principal.account)
+        return false;
+    const account = store.accountOf(principal.account);
+    if (account === null || account.revokedAt !== null || account.role !== "approver" || account.generation !== principal.accountGeneration)
+        return false;
+    return principal.sessionHash === null || store.webSession(principal.sessionHash) !== null;
+}
+/** What a local owner's write hears when it no longer stands (local mode turned off or moved, the owner changed, the
+ * session ended). */
+export const LOCAL_OWNER_LAPSED = "This local sign-in no longer stands. Run `toolroll open` to sign in again.";
+/** What widening a launch's confinement hears while local mode is on (plan C5). */
+export const LOCAL_MODE_CONFINES = "Turn off local mode first.";

package/dist/login-secrets.d.ts

@@ -0,0 +1,60 @@
+/** The reserved folder's name, beside the database. Toolroll's own; nothing else belongs there. */
+export declare const SECRETS_DIR = ".toolroll-secrets";
+/** The saved login's file name, inside the folder (and, from older versions, directly beside the database). */
+export declare const LOGIN_FILE_NAME = "up-login.txt";
+export declare class UntrustedSecretsFolder extends Error {
+}
+/** The reserved folder for a state folder (the database's folder), by name. */
+export declare const secretsDirOf: (stateDir: string) => string;
+/** Where the saved login lives now. */
+export declare const loginFileOf: (stateDir: string) => string;
+/** Where older versions saved it: directly beside the database. */
+export declare const legacyLoginFileOf: (stateDir: string) => string;
+/**
+ * Make the reserved folder if it isn't there (owner-only), and prove it is a real folder of this user's, owner-only,
+ * reached by no link. Returns its path. Throws UntrustedSecretsFolder when something else holds the name: nothing is
+ * written there then, and the fence still denies the name.
+ */
+export declare function ensureSecretsDir(stateDir: string): string;
+/** The saved-login file to write: inside the reserved folder, made and proven first. Throws when it can't be. */
+export declare function writableLoginFile(stateDir: string): string;
+/** The saved-login file to read: the reserved folder's when anything is there, else the old place's when anything is
+ * there, else the reserved folder's (nothing saved yet). */
+export declare function savedLoginFile(stateDir: string): string;
+export type LoginMigration = {
+    kind: "none";
+} | {
+    kind: "moved";
+    from: string;
+    to: string;
+}
+/** Both existed with the same contents: the old copy was removed. */
+ | {
+    kind: "deduplicated";
+    from: string;
+    to: string;
+}
+/** Both exist and differ: the reserved folder's wins for reads, the old one is left for the person. */
+ | {
+    kind: "both";
+    from: string;
+    to: string;
+}
+/** The old file is a link, not a regular file of this user's, or too large: left exactly where it is. */
+ | {
+    kind: "refused";
+    from: string;
+    reason: string;
+} | {
+    kind: "failed";
+    from: string;
+    reason: string;
+};
+/**
+ * Move a saved login from directly beside the database into the reserved folder. The new file is a fresh one (never
+ * the old file's inode, so no other name for that file — a hard link — reaches it), created owner-only (0600) inside
+ * the owner-only folder and published whole under its name (written to a private temporary name, synced, then
+ * hard-linked in, which fails rather than replace anything), and the old one is removed only after. A link or
+ * anything other than this user's own regular file at the old name is never followed or moved. Never throws.
+ */
+export declare function migrateLegacyLogin(stateDir: string): LoginMigration;

package/dist/login-secrets.js

@@ -0,0 +1,195 @@
+/**
+ * Where Toolroll keeps the saved credentials beside its database: a reserved owner-only folder, `.toolroll-secrets`,
+ * that every agent fence denies whole (agent-fence.ts). It is made before any agent launches, so a credential written
+ * into it later (the first saved login, written while a build already runs) is behind a fence that was fixed at launch.
+ * A file beside the database that appears after launch is not: bubblewrap can't deny a path that isn't there, and a
+ * fence built from a listing can't name one either.
+ *
+ * The saved login moved here from `up-login.txt` directly beside the database. Readers look here first and then at
+ * the old place; the next `up` moves an old file in (migrateLegacyLogin), never through a link, never readable by
+ * anyone else on the way.
+ */
+import { randomBytes } from "node:crypto";
+import { closeSync, constants as fsConstants, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, unlinkSync, writeSync } from "node:fs";
+import { join, resolve } from "node:path";
+/** The reserved folder's name, beside the database. Toolroll's own; nothing else belongs there. */
+export const SECRETS_DIR = ".toolroll-secrets";
+/** The saved login's file name, inside the folder (and, from older versions, directly beside the database). */
+export const LOGIN_FILE_NAME = "up-login.txt";
+/** The largest saved login read. */
+const LOGIN_LIMIT = 8192;
+export class UntrustedSecretsFolder extends Error {
+}
+/** The reserved folder for a state folder (the database's folder), by name. */
+export const secretsDirOf = (stateDir) => join(stateDir, SECRETS_DIR);
+/** Where the saved login lives now. */
+export const loginFileOf = (stateDir) => join(secretsDirOf(stateDir), LOGIN_FILE_NAME);
+/** Where older versions saved it: directly beside the database. */
+export const legacyLoginFileOf = (stateDir) => join(stateDir, LOGIN_FILE_NAME);
+const present = (path) => {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Make the reserved folder if it isn't there (owner-only), and prove it is a real folder of this user's, owner-only,
+ * reached by no link. Returns its path. Throws UntrustedSecretsFolder when something else holds the name: nothing is
+ * written there then, and the fence still denies the name.
+ */
+export function ensureSecretsDir(stateDir) {
+    let base;
+    try {
+        base = realpathSync(stateDir);
+    }
+    catch {
+        throw new UntrustedSecretsFolder("The folder beside the database can't be resolved.");
+    }
+    const folder = join(base, SECRETS_DIR);
+    try {
+        mkdirSync(folder, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw new UntrustedSecretsFolder(`Could not make ${SECRETS_DIR} beside the database (${error.message}).`);
+    }
+    const stat = lstatSync(folder);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || (process.platform !== "win32" && (stat.mode & 0o077) !== 0)
+        || (process.getuid !== undefined && stat.uid !== process.getuid()) || realpathSync(folder) !== resolve(folder)) {
+        throw new UntrustedSecretsFolder(`${SECRETS_DIR} beside the database is not a private folder of yours; nothing was saved there.`);
+    }
+    return folder;
+}
+/** The saved-login file to write: inside the reserved folder, made and proven first. Throws when it can't be. */
+export function writableLoginFile(stateDir) {
+    ensureSecretsDir(stateDir);
+    // By the name the caller knows the state folder by (it is shown to the person); the folder under it was just proven.
+    return loginFileOf(stateDir);
+}
+/** The saved-login file to read: the reserved folder's when anything is there, else the old place's when anything is
+ * there, else the reserved folder's (nothing saved yet). */
+export function savedLoginFile(stateDir) {
+    const current = loginFileOf(stateDir);
+    if (present(current))
+        return current;
+    const legacy = legacyLoginFileOf(stateDir);
+    return present(legacy) ? legacy : current;
+}
+/** The bytes of a file that is a regular file of this user's, opened without following a link and without blocking on
+ * a FIFO, of at most `limit` bytes; null otherwise. */
+function ownRegularBytes(path, limit) {
+    let fd = null;
+    try {
+        fd = openSync(path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK);
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.size > limit || (process.getuid !== undefined && stat.uid !== process.getuid()))
+            return null;
+        const bytes = readFileSync(fd);
+        return bytes.length > limit ? null : { bytes, dev: stat.dev, ino: stat.ino };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== null)
+            closeSync(fd);
+    }
+}
+const fsyncFolder = (folder) => {
+    let fd = null;
+    try {
+        fd = openSync(folder, fsConstants.O_RDONLY);
+        fsyncSync(fd);
+    }
+    catch { /* some filesystems refuse a folder fsync */ }
+    finally {
+        if (fd !== null)
+            closeSync(fd);
+    }
+};
+/**
+ * Move a saved login from directly beside the database into the reserved folder. The new file is a fresh one (never
+ * the old file's inode, so no other name for that file — a hard link — reaches it), created owner-only (0600) inside
+ * the owner-only folder and published whole under its name (written to a private temporary name, synced, then
+ * hard-linked in, which fails rather than replace anything), and the old one is removed only after. A link or
+ * anything other than this user's own regular file at the old name is never followed or moved. Never throws.
+ */
+export function migrateLegacyLogin(stateDir) {
+    const from = legacyLoginFileOf(stateDir);
+    let held;
+    try {
+        held = lstatSync(from);
+    }
+    catch {
+        return { kind: "none" };
+    }
+    if (!held.isFile() || held.isSymbolicLink() || (process.getuid !== undefined && held.uid !== process.getuid())) {
+        return { kind: "refused", from, reason: `${LOGIN_FILE_NAME} beside the database is a link or not your own regular file` };
+    }
+    let folder;
+    try {
+        folder = ensureSecretsDir(stateDir);
+    }
+    catch (error) {
+        return { kind: "failed", from, reason: error.message };
+    }
+    const to = join(folder, LOGIN_FILE_NAME);
+    const old = ownRegularBytes(from, LOGIN_LIMIT);
+    if (old === null || old.dev !== held.dev || old.ino !== held.ino) {
+        return { kind: "refused", from, reason: `${LOGIN_FILE_NAME} beside the database changed, is too large, or is not your own regular file` };
+    }
+    const removeOld = () => {
+        // Only the file that was read: a replacement since then stays for the person.
+        try {
+            const now = lstatSync(from);
+            if (!now.isFile() || now.dev !== old.dev || now.ino !== old.ino)
+                return false;
+            unlinkSync(from);
+            fsyncFolder(stateDir);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    if (present(to)) {
+        const current = ownRegularBytes(to, LOGIN_LIMIT);
+        if (current !== null && current.bytes.equals(old.bytes) && removeOld())
+            return { kind: "deduplicated", from, to };
+        return { kind: "both", from, to };
+    }
+    const temporary = join(folder, `.${LOGIN_FILE_NAME}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`);
+    try {
+        const fd = openSync(temporary, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_NOFOLLOW, 0o600);
+        try {
+            writeSync(fd, old.bytes);
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        try {
+            linkSync(temporary, to);
+        }
+        catch (error) {
+            if (error.code === "EEXIST")
+                return { kind: "both", from, to };
+            throw error;
+        }
+        fsyncFolder(folder);
+    }
+    catch (error) {
+        return { kind: "failed", from, reason: error.message };
+    }
+    finally {
+        try {
+            unlinkSync(temporary);
+        }
+        catch { /* already gone */ }
+    }
+    removeOld();
+    return { kind: "moved", from, to };
+}

package/dist/mcp-oauth.d.ts

@@ -75,6 +75,10 @@ export type OAuthHttpOptions = {
     confirm: (request: IncomingMessage, session: OAuthSession, typed: string) => boolean;
     /** The projects this person may choose: each a project the server knows that they can use now. */
     projectsFor: (account: string) => string[];
+    /** Easy-start C2: the consent post presents the session's browser mutation key (absent: not required). */
+    keyed?: (request: IncomingMessage, form: URLSearchParams) => boolean;
+    /** Easy-start C2: whether the consent page carries the key fill (its one nonce'd script). */
+    keyFill?: () => boolean;
     /** The token exchange's budget by source (request-budget.ts): charged once per request, before its body is read or any code or refresh secret is spent. */
     admitToken?: (request: IncomingMessage) => Admission;
 };

package/dist/mcp-oauth.js

@@ -4,7 +4,8 @@ import { hashSecret, mintApiToken } from "./api-tokens.js";
 import { limitWords } from "./request-budget.js";
 import { sourceKey } from "./source-key.js";
 import { PKCE_CHALLENGE, readOAuthRegistration, readOAuthTokenRequest } from "./contracts/mcp-oauth.js";
-import { html, htmlString, joinHtml, postForm, styleElement } from "./html.js";
+import { html, htmlString, joinHtml, postForm, scriptElement, styleElement } from "./html.js";
+import { KEY_FILL_SCRIPT } from "./server/mutation-key.js";
 import { withFormToken } from "./server/request-context.js";
 /** How long each piece lives. A code is spent at once; a grant ends after 30 days and the person consents again. */
 export const OAUTH_TIMES = { requestMs: 10 * 60_000, codeMs: 60_000, accessSeconds: 3600, grantDays: 30 };
@@ -80,11 +81,13 @@ export function createOAuthHttp(options) {
         response.end(JSON.stringify(body));
     };
     const oauthError = (response, status, error, description) => json(response, status, { error, error_description: description });
-    /** A page of this sign-in: script-free, never framed, posting only to this console. */
-    const page = (response, status, document) => {
+    /** A page of this sign-in: script-free (but for the key fill, on a consent while the browser key is required), never
+     * framed, posting only to this console. */
+    const page = (response, status, document, fill = false) => {
+        const nonce = fill && options.keyFill?.() === true ? randomBytes(16).toString("base64") : null;
         response.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff", "x-frame-options": "DENY",
-            "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'" });
-        response.end(htmlString(document));
+            "content-security-policy": `default-src 'none'; style-src 'unsafe-inline';${nonce === null ? "" : ` script-src 'nonce-${nonce}';`} form-action 'self'; frame-ancestors 'none'; base-uri 'none'` });
+        response.end(nonce === null ? htmlString(document) : htmlString(document).replace(/<\/body><\/html>$/, `${htmlString(scriptElement(KEY_FILL_SCRIPT, { nonce }))}</body></html>`));
     };
     /**
      * On to an address by a page that moves on by itself, never a redirect: a redirect answering a form is held to
@@ -277,7 +280,7 @@ export function createOAuthHttp(options) {
                 response.writeHead(303, { location: `/login?return=${encodeURIComponent(`/oauth/authorize?request=${id}`)}`, "cache-control": "no-store" });
                 return void response.end();
             }
-            return page(response, 200, consentHtml(session, id, one, null, null));
+            return page(response, 200, consentHtml(session, id, one, null, null), true);
         }
         if (request.method !== "POST")
             return problemPage(response, 405, "This sign-in isn't valid", "Start again from your MCP client.");
@@ -291,6 +294,9 @@ export function createOAuthHttp(options) {
         // The person's own act: their session's CSRF value, posted from this console's own page.
         if (text === null || !options.sameSite(request) || !same(form.get("csrf") ?? "", session.csrf))
             return problemPage(response, 403, "This form expired", "Nothing was allowed. Start again from your MCP client.");
+        // Easy-start C2: on a protected loopback install, the key only this console's own page holds.
+        if (options.keyed !== undefined && !options.keyed(request, form))
+            return problemPage(response, 403, "Reconnect to Toolroll", "This tab isn't connected to Toolroll, so nothing was allowed. Open Toolroll, reconnect, then start again from your MCP client.");
         const id = form.get("request") ?? "";
         const one = waiting.get(id);
         if (one === undefined || one.expires <= now.getTime())
@@ -312,7 +318,7 @@ export function createOAuthHttp(options) {
             return problemPage(response, 403, "Sign in first", "Your access changed. Sign in again; nothing was allowed.");
         const access = form.get("access") === "act" ? "act" : "read";
         const chosen = [...new Set(form.getAll("project"))];
-        const again = (status, problem) => page(response, status, consentHtml(session, id, one, problem, { access, projects: chosen }));
+        const again = (status, problem) => page(response, status, consentHtml(session, id, one, problem, { access, projects: chosen }), true);
         if (access === "act" && account.role !== "approver")
             return again(403, "Your account can watch, so the client can only read.");
         const mine = options.projectsFor(session.name);

package/dist/model-choices.d.ts

@@ -186,3 +186,46 @@ export type RecentRun = {
 };
 /** The latest runs' floating or exact choice next to the model their provider reported: no verdict. */
 export declare function recentRuns(store: Store, limit?: number): RecentRun[];
+/** Codex's exact ids for its "Sized by job" preset: the frontier model plans, reviews and builds large or risky
+ * work, the workhorse builds routine work, the small model builds small work (the ids Codex lists as of 2026-11). */
+export declare const CODEX_FRONTIER = "gpt-6-astra";
+export declare const CODEX_WORKHORSE = "gpt-6-sol";
+export declare const CODEX_SMALL = "gpt-6-luna";
+/** The agents a first choice can name ("Use this one", the lead chosen at a first start). */
+export type DefaultAgent = "claude" | "codex";
+/** Each agent's default preset: what a new installation runs on once that agent is chosen and nothing is set yet. */
+export declare const AGENT_PRESETS: Readonly<Record<DefaultAgent, {
+    label: string;
+    words: string;
+    rows: Record<string, string | null>;
+}>>;
+/** An agent's default preset as a change: every slot, exact ids, repairs following each size's builder. */
+export declare function agentPresetChange(agent: DefaultAgent): ModelChange[];
+/** The chat provider a lead runs on, as the agent whose preset it brings; null for a direct API. */
+export declare function defaultAgentOf(provider: string): DefaultAgent | null;
+/**
+ * Who may fill: the local owner choosing its agent now (a browser's "Use this one", act `choose-default-agent`, still
+ * standing, re-checked here), or a laptop install's own first start choosing the agent signed in on this computer
+ * (local mode on). Nothing else: every other change of models is Settings → Models'
+ * operator step-up (applyModelChoices).
+ */
+export type DefaultRoutingDoor = {
+    kind: "local-owner";
+} | {
+    kind: "first-start";
+};
+export type DefaultRoutingResult = {
+    filled: true;
+    rows: number;
+} | {
+    filled: false;
+    reason: "authority" | "already-set" | "invalid";
+    problem: string;
+};
+/**
+ * A new installation's first routing: the chosen agent's default preset, written only while NOTHING is set — no role
+ * row, tier row or other-provider candidate at the installation or any project — so it never overwrites a choice.
+ * Checked and written in one transaction (the caller's, when it has one: the lead's own write rides with it), each row
+ * ledgered, the result checked like any apply; a refusal writes nothing.
+ */
+export declare function fillDefaultRouting(store: Store, agent: DefaultAgent, actor: string, door: DefaultRoutingDoor, now: Date): DefaultRoutingResult;