toolroll 0.9.89 → 0.9.90

package/dist/browser-workspace.d.ts

@@ -517,6 +517,8 @@ export type BrowserTaskView = {
         /** When a remembered password stops counting (ISO); the page words it in the viewer's zone. */
         rememberedUntil: string | null;
         planHtml: string;
+        /** The terms line in words, when the rule isn't one of the kit's (easy-start C5: a laptop's own owner). */
+        termsWords?: string;
     } | null;
     /** Ship: the pull request's checks, each on one time axis (task ship's twin). Null: no checks read yet. */
     ship?: {
@@ -1628,6 +1630,15 @@ export type BrowserWorkspace = {
     phone?: BrowserPhoneCard;
     /** The Chat landing's live view: who is working now, four counts, and Catch up in tabs. */
     home?: BrowserHome | null;
+    /** Easy-start C2: this tab's mutation key is from an earlier Toolroll start (or it has none): it reads, but needs to
+     * reconnect before it can change anything (the password again, or `toolroll open` for a local owner). */
+    reconnect?: {
+        kind: 'password';
+        href: string;
+    } | {
+        kind: 'command';
+        command: string;
+    };
 };
 /** Home ("/"): one sentence that answers "what needs me?", four counts that agree with the Tasks filters they open,
  * what waits on this person grouped by what it asks, what is running, and the selected item answered in place. */
@@ -1669,6 +1680,8 @@ export type BrowserHomeView = {
         title: string;
         text: string;
     } | null;
+    /** While the first run is open (no first result yet): the welcome's address, linked as Finish setup. */
+    setup?: string | null;
 };
 export type BrowserHomeRow = {
     id: string;

package/dist/builder.js

@@ -1,5 +1,6 @@
 import { legacyNetwork, repositoryEcosystems } from "./egress.js";
-import { CHECK_ACCESS_DEFAULT, checkAccessHere, checkNetworkOf } from "./check-access.js";
+import { CHECK_ACCESS_DEFAULT, checkAccessHere, checkNetworkOf, localModeCap } from "./check-access.js";
+import { localModeOn } from "./local-owner.js";
 import { checkoutGit } from "./teardown-git.js";
 import { isAcpProvider } from "./acp-agents.js";
 import { OBSERVATION_MAILBOX, observationBrief, parseObservationCases, collectObservations } from "./observations.js";
@@ -337,7 +338,9 @@ function commandRunner(store, runId, profile, inner) {
  * run sandboxed while sign-ins are off, and the run is stamped with that, what actually ran), and under sign-ins the network its
  * approval sealed less its agent's own provider hosts (never its checks'). */
 export function checkLaunchOf(store, runId, profile, platform = process.platform) {
-    const access = checkAccessHere(profile.checkAccess ?? CHECK_ACCESS_DEFAULT, platform);
+    // Easy-start C5: while local mode is on, a sealed unsandboxed level launches with at most sign-ins (re-read here, at launch).
+    const asked = checkAccessHere(profile.checkAccess ?? CHECK_ACCESS_DEFAULT, platform);
+    const access = localModeOn(store) ? localModeCap(asked) : asked;
     if (access !== "sign-ins")
         return { access, network: null };
     const taskRef = store.getRun(runId)?.taskRef;

package/dist/chat-actions.d.ts

@@ -1,3 +1,6 @@
+/** Shared, exact-state actions. Models may prepare; only the existing human
+ * confirmation door executes. Protected actions use a one-use review receipt. */
+import { type Authority } from "./local-owner.js";
 import { type Store } from "./store.js";
 import { type VerifiedApprover } from "./principal.js";
 import { CHAT_ACTION_FIELDS, type SharedAction } from "./contracts/chat-actions.js";
@@ -292,6 +295,8 @@ export declare function mintSharedActionReview(store: Store, who: VerifiedApprov
 };
 export type SharedActionOptions = {
     via: "web" | "cli" | "telegram" | "slack" | "discord" | "teams";
+    /** Easy-start C5: a laptop's local owner confirms (the door decided the operation is one of its acts). */
+    authority?: Authority;
     root?: string;
     review?: {
         nonce: string;

package/dist/chat-actions.js

@@ -1,5 +1,6 @@
 /** Shared, exact-state actions. Models may prepare; only the existing human
  * confirmation door executes. Protected actions use a one-use review receipt. */
+import { CHAT_ACTION_LOCAL_ACTS, currentLocalOwner } from "./local-owner.js";
 import { fileTaskProposal } from "./proposal.js";
 import { heuristicSizing } from "./task-sizing.js";
 import { cancelSweepRest, sweepOpen, sweepTable, VERDICT_RULE } from "./lead-sweep.js";
@@ -13,7 +14,7 @@ import { leadTurnKeepsProposals, verifiedAuthor } from "./store.js";
 import { isVerifiedApprover, reproveApprover, } from "./principal.js";
 import { changeSkills, importSkill, skillsView, skillsVersion, testSkill, validateSkill, } from "./project-skills.js";
 import { changeKnowledge, knowledgeVersion, knowledgeView, } from "./project-knowledge.js";
-import { passwordlessSessionFor, approve, authenticateApprover, describeScope, scopeAuthorityOf, freshnessFor, spendingOnlyOnSuccess, ssoNowAvailable, withFreshness, } from "./scope.js";
+import { passwordlessSessionFor, approve, authenticateApprover, describeScope, scopeAuthorityOf, freshnessFor, localApprovalEligible, spendingOnlyOnSuccess, ssoNowAvailable, withFreshness, } from "./scope.js";
 import { readVerifiedArtifact, scanForSecrets } from "./evidence.js";
 import { readAuthModeStrict } from "./keys.js";
 import { acceptAndCompleteAsOperator, assignmentOf } from "./assignment.js";
@@ -1114,6 +1115,9 @@ export function executeSharedAction(store, who, id, payload, now, options) {
     const refuse = (reason, said) => ({ ok: false, reason, said });
     if (store.isDemo())
         return refuse("refused", "The demo authorizes nothing.");
+    // Easy-start C1, a belt under the confirm door's own gate: a local owner runs only an operation that is one of its acts.
+    if ((options.authority === "local-owner" || currentLocalOwner() !== null) && (!isChatAction(payload.operation) || CHAT_ACTION_LOCAL_ACTS[payload.operation] === null))
+        return refuse("refused", "Set a password to do this.");
     let live;
     try {
         const saved = savedActionContext(store, who, id, "confirming");
@@ -1152,6 +1156,8 @@ export function executeSharedAction(store, who, id, payload, now, options) {
         if (config.password &&
             (emptyApproval
                 ? !passwordlessSessionFor(store, who.name) && !ssoNowAvailable(who.name) && withFreshness("approve-standard", () => freshnessFor(who.name)) === null
+                    // Easy-start C5: a local owner's eligible approval takes no password (approve() proves it again in the seal).
+                    && !(options.authority === "local-owner" && currentLocalOwner()?.act === "approve-plan" && typeof req["task"] === "string" && localApprovalEligible(store, who.name, req["task"]).ok)
                 : proved?.ok !== true))
             return refuse("needs-confirm", "Confirm with your password in the secure screen.");
     }

package/dist/chat-delivery.js

@@ -652,6 +652,8 @@ export function applyChatAction(options, event, binding, repos) {
         }
         else {
             const outcome = confirmLeadProposal(store, verified.who, proposal.id, now, {
+                // A paired chat seat speaks for its account's full authority (pairing is a full session's act).
+                authority: "full",
                 via: options.state.provider,
                 evidenceRoot: options.evidenceRoot,
                 confirm: phase === "yes",

package/dist/chat-task-actions.d.ts

@@ -39,6 +39,7 @@ export declare const CHAT_TASK_ACTIONS: {
         readonly detail: "Files a small task to write tests for this change. Nothing runs until it is approved.";
     };
 };
+export type ChatTaskAction = keyof typeof CHAT_TASK_ACTIONS;
 export declare function isChatTaskAction(value: unknown): value is keyof typeof CHAT_TASK_ACTIONS;
 /** Bind cards to a specific execution and its current state, not the family's moving pointer. */
 export declare function chatTaskStamp(store: Store, who: VerifiedApprover, task: string): string | null;

package/dist/check-access.d.ts

@@ -48,4 +48,7 @@ export declare function checkAccessRunsAs(level: CheckAccess, here: {
     platform: NodeJS.Platform;
     fenced: boolean;
     unconfinedAllowed: boolean;
+    localMode?: boolean;
 }): CheckAccess;
+/** Easy-start C5: while local mode is on, a project's checks reach at most its sign-ins, never unsandboxed. */
+export declare const localModeCap: (level: CheckAccess) => CheckAccess;

package/dist/check-access.js

@@ -73,5 +73,8 @@ export const checkAccessHere = (level, platform = process.platform) => level ===
  * on this machine and unconfined running allowed by an operator, without a sandbox whatever is saved (never said to be
  * sandboxed); otherwise the saved level as this platform can give it. */
 export function checkAccessRunsAs(level, here) {
-    return !here.fenced && here.unconfinedAllowed ? "unsandboxed" : checkAccessHere(level, here.platform);
+    const runs = !here.fenced && here.unconfinedAllowed ? "unsandboxed" : checkAccessHere(level, here.platform);
+    return here.localMode === true ? localModeCap(runs) : runs;
 }
+/** Easy-start C5: while local mode is on, a project's checks reach at most its sign-ins, never unsandboxed. */
+export const localModeCap = (level) => level === "unsandboxed" ? "sign-ins" : level;

package/dist/cli-help.d.ts

@@ -2,4 +2,4 @@
  * The top-level usage text, on its own so `toolroll --help` can print it
  * without loading every command family (see cli-fast.ts).
  */
-export declare const HELP = "toolroll \u2014 a control plane for unattended coding agents\n\nUsage\n  toolroll                  in a repository: start Toolroll for it, or open the one already running\n                                   (under an agent or with --json: only says what it would do)\n  toolroll scan [path...]   report what is in flight (also bare `toolroll` outside a repository)\n  toolroll [path...]        the same report for the paths given\n  toolroll pulls            report what is waiting on a person\n  toolroll graph            report which work graph is already here\n  toolroll repos            list connected repositories, and how to adjust\n  toolroll repos add <path> add a project; it is in the console at once (no path: the repo you are in)\n  toolroll repos remove <path>\n                                   take it out of the console; its tasks and results stay\n  toolroll repos add-from-github <owner/name> --root <dir>\n                                   preview, then clone and connect (--yes)\n  toolroll link             put `toolroll` on your PATH\n  toolroll unlink           take it off again\n  toolroll update           update to the latest release: verified, drained, undoable\n                                   (preview first; --yes, --now, --at HH:MM, --rollback)\n  toolroll release <branch> release Toolroll itself: gate, your approval, deploy, merge, tag, publish\n                                   (resumable: rerun to continue; --help)\n  toolroll contract         the machine contract: envelope version + capabilities\n                                   (--commands dumps the declared command guide)\n  toolroll skills install --claude-code [--dir <path>]\n                                   install this binary's guides for Claude Code (preview first)\n  toolroll skills install   teach a repo's agents this queue exists (preview first)\n  toolroll skills list      the guides this exact binary serves\n  toolroll skills get <name>  print one guide (version-matched, never stale)\n  toolroll demo             a seeded throwaway sandbox \u2014 see it working in 90 seconds\n  toolroll up               app + builder for every saved project \u2014 the normal start\n  toolroll onboard          make your agent Toolroll's lead: add this repo, install its skill (--yes), offer starter flows (--starter)\n  toolroll status           running, queued, ready results, release check and plan windows\n  toolroll health           recent server latency, write waits and live streams\n  toolroll integrations     which integrations work, and what to do about the ones that don't (--json)\n  toolroll lead token       mint your lead agent's credential: its own work pings nobody\n  toolroll lead say \"<text>\"  (the lead) one short message in its person's chat\n\nOperating the queue \u2014 `toolroll task` prints the whole surface,\nand any queue command + --help prints it too\n  toolroll approver add <name>\n                               mint the credential that lets a person say yes\n  toolroll ready            what could be dispatched right now\n  toolroll check-progress <run>  current or final approved check progress\n  toolroll task wait <id> [--timeout <seconds>]\n                               wait for this attempt to finish or need a person\n  toolroll task add <title> queue work\n  toolroll task scope <id> --goal <text>\n                               state what success is; approval binds to it\n  toolroll task approve <id>\n                               the yes \u2014 nothing builds without one\n  toolroll claim <id> --runner <name>\n  toolroll heartbeat <lease> / worker release <lease> / reap\n  toolroll tick --runner <name> --token <t> --repo <path>\n                               one unattended pass over the ready set\n  toolroll flows list | show <id> | create | edit | trigger | script | card | archive\n                               set up and inspect flows (writes preview until --yes)\n  toolroll chat --as <you> --token <t>\n                               talk to your lead: one conversation across every\n                               project; it proposes, you confirm (--say \"\u2026\" for one turn)\n  toolroll serve --repo <path>  advanced: run only the console\n                               (--editor vscode with --runner: file links\n                               open in VS Code on the device you browse from)\n  toolroll watch / daemon install   advanced: run only the builder\n  toolroll doctor           check that Toolroll's service holds no key a build could read\n  toolroll reconcile        recover what the last stretch left behind\n\nWith nothing connected it reports everything it can find below the working\ndirectory. Once you connect repositories it reports those instead.\n\nOptions\n  --all         report everything discoverable, ignoring connected repos\n  --depth <n>   directory levels to descend (default: 6)\n  --hidden      include dot-directories, which are skipped by default\n  --dirty       also read each working tree for uncommitted files\n  --local       branches only: no network, no pull requests, no issues\n  --json        emit a machine-readable envelope instead of a report\n  -o <file>     also write that envelope to a file (requires --json)\n  -h, --help    show this\n\nNothing is written, installed, or configured. Every repository is read\nthrough git with --no-optional-locks, so a scan never contends for the\nindex lock with an editor you have open.\n\n--dirty is off by default because reading a working tree is unbounded\nwork: on a large or cloud-synced repo `git status` can take minutes,\nwhere listing branches takes milliseconds.\n\nlink shows what it would do and changes nothing; add --yes to apply it,\nor --to <dir> to choose where. It never uses sudo, never leaves your\nhome directory, and never touches a file it did not create.";
+export declare const HELP = "toolroll \u2014 a control plane for unattended coding agents\n\nUsage\n  toolroll                  at your terminal: start Toolroll here (or attach) and open it in the terminal\n                                   (--web: the browser; --project-root <dir>: where projects live)\n                                   in a repository without a terminal, under an agent or with --json: only says what it would do\n  toolroll open [--web]     open this computer's Toolroll again, signed in\n  toolroll welcome          the three steps to a first result (--json: the model)\n  toolroll password set     add a password (typed twice, at your terminal)\n  toolroll scan [path...]   report what is in flight (also bare `toolroll` outside a repository)\n  toolroll [path...]        the same report for the paths given\n  toolroll pulls            report what is waiting on a person\n  toolroll graph            report which work graph is already here\n  toolroll repos            list connected repositories, and how to adjust\n  toolroll repos add <path> add a project; it is in the console at once (no path: the repo you are in)\n  toolroll repos remove <path>\n                                   take it out of the console; its tasks and results stay\n  toolroll repos add-from-github <owner/name> --root <dir>\n                                   preview, then clone and connect (--yes)\n  toolroll link             put `toolroll` on your PATH\n  toolroll unlink           take it off again\n  toolroll update           update to the latest release: verified, drained, undoable\n                                   (preview first; --yes, --now, --at HH:MM, --rollback)\n  toolroll release <branch> release Toolroll itself: gate, your approval, deploy, merge, tag, publish\n                                   (resumable: rerun to continue; --help)\n  toolroll contract         the machine contract: envelope version + capabilities\n                                   (--commands dumps the declared command guide)\n  toolroll skills install --claude-code [--dir <path>]\n                                   install this binary's guides for Claude Code (preview first)\n  toolroll skills install   teach a repo's agents this queue exists (preview first)\n  toolroll skills list      the guides this exact binary serves\n  toolroll skills get <name>  print one guide (version-matched, never stale)\n  toolroll demo             a seeded throwaway sandbox \u2014 see it working in 90 seconds\n  toolroll up               app + builder for every saved project \u2014 the normal start\n  toolroll onboard          make your agent Toolroll's lead: add this repo, install its skill (--yes), offer starter flows (--starter)\n  toolroll status           running, queued, ready results, release check and plan windows\n  toolroll health           recent server latency, write waits and live streams\n  toolroll integrations     which integrations work, and what to do about the ones that don't (--json)\n  toolroll lead token       mint your lead agent's credential: its own work pings nobody\n  toolroll lead say \"<text>\"  (the lead) one short message in its person's chat\n\nOperating the queue \u2014 `toolroll task` prints the whole surface,\nand any queue command + --help prints it too\n  toolroll approver add <name>\n                               mint the credential that lets a person say yes\n  toolroll ready            what could be dispatched right now\n  toolroll check-progress <run>  current or final approved check progress\n  toolroll task wait <id> [--timeout <seconds>]\n                               wait for this attempt to finish or need a person\n  toolroll task add <title> queue work\n  toolroll task scope <id> --goal <text>\n                               state what success is; approval binds to it\n  toolroll task approve <id>\n                               the yes \u2014 nothing builds without one\n  toolroll claim <id> --runner <name>\n  toolroll heartbeat <lease> / worker release <lease> / reap\n  toolroll tick --runner <name> --token <t> --repo <path>\n                               one unattended pass over the ready set\n  toolroll flows list | show <id> | create | edit | trigger | script | card | archive\n                               set up and inspect flows (writes preview until --yes)\n  toolroll chat --as <you> --token <t>\n                               talk to your lead: one conversation across every\n                               project; it proposes, you confirm (--say \"\u2026\" for one turn)\n  toolroll serve --repo <path>  advanced: run only the console\n                               (--editor vscode with --runner: file links\n                               open in VS Code on the device you browse from)\n  toolroll watch / daemon install   advanced: run only the builder\n  toolroll doctor           check that Toolroll's service holds no key a build could read\n  toolroll reconcile        recover what the last stretch left behind\n\nWith nothing connected it reports everything it can find below the working\ndirectory. Once you connect repositories it reports those instead.\n\nOptions\n  --all         report everything discoverable, ignoring connected repos\n  --depth <n>   directory levels to descend (default: 6)\n  --hidden      include dot-directories, which are skipped by default\n  --dirty       also read each working tree for uncommitted files\n  --local       branches only: no network, no pull requests, no issues\n  --json        emit a machine-readable envelope instead of a report\n  -o <file>     also write that envelope to a file (requires --json)\n  -h, --help    show this\n\nNothing is written, installed, or configured. Every repository is read\nthrough git with --no-optional-locks, so a scan never contends for the\nindex lock with an editor you have open.\n\n--dirty is off by default because reading a working tree is unbounded\nwork: on a large or cloud-synced repo `git status` can take minutes,\nwhere listing branches takes milliseconds.\n\nlink shows what it would do and changes nothing; add --yes to apply it,\nor --to <dir> to choose where. It never uses sudo, never leaves your\nhome directory, and never touches a file it did not create.";

package/dist/cli-help.js

@@ -6,8 +6,12 @@ import { DEFAULT_MAX_DEPTH } from "./scan.js";
 export const HELP = `toolroll — a control plane for unattended coding agents
 
 Usage
-  toolroll                  in a repository: start Toolroll for it, or open the one already running
-                                   (under an agent or with --json: only says what it would do)
+  toolroll                  at your terminal: start Toolroll here (or attach) and open it in the terminal
+                                   (--web: the browser; --project-root <dir>: where projects live)
+                                   in a repository without a terminal, under an agent or with --json: only says what it would do
+  toolroll open [--web]     open this computer's Toolroll again, signed in
+  toolroll welcome          the three steps to a first result (--json: the model)
+  toolroll password set     add a password (typed twice, at your terminal)
   toolroll scan [path...]   report what is in flight (also bare \`toolroll\` outside a repository)
   toolroll [path...]        the same report for the paths given
   toolroll pulls            report what is waiting on a person

package/dist/cli.d.ts

@@ -65,6 +65,12 @@ export type MainOptions = {
     release?: ReleaseCliDeps;
     /** Tests: bare `toolroll` in a repository (quick-start.ts) — its repository, agent check, proofs and actions. */
     quickStart?: Partial<QuickStartSeams>;
+    /** Tests: bare `toolroll` at a person's terminal (easy-start.ts) — the terminal and agent checks, and its seams. */
+    easyStart?: {
+        terminal?: boolean;
+        underAgent?: boolean;
+        seams?: Partial<import("./easy-start.js").EasyStartSeams>;
+    };
 };
 /**
  * Strip `-o <file>` / `--output <file>` before dispatch. The flag belongs to

package/dist/cli.js

@@ -25,6 +25,8 @@ import { GUIDES, guideNamed } from "./guides.js";
 import { parseGithubRepo, previewGithubRepo, cloneGithubRepo, isLargeRepo } from "./onboard.js";
 import { run as execRun } from "./exec.js";
 import { isBareInvocation, runQuickStart } from "./quick-start.js";
+import { easyStartApplies, easyStartArgs } from "./easy-start-args.js";
+import { underAgent } from "./prompt.js";
 import { COMMAND_GUIDE, SURFACE_NOTES, SURFACE_SCHEMA_VERSION } from "./surface.js";
 import { hasCentralProfile, maybeRunConnectCommand } from "./connect-cli.js";
 import { removedCommand, removedMessage } from "./deprecations.js";
@@ -158,6 +160,11 @@ export const OPERATE_COMMANDS = new Set([
     "serve",
     "watch",
     "daemon",
+    "background",
+    "stop",
+    "open",
+    "welcome",
+    "password",
     "bridge",
     "publish",
     "reconcile",
@@ -356,6 +363,22 @@ async function dispatch(argv, write, mainOptions) {
     if (first !== undefined && OPERATE_COMMANDS.has(first)) {
         return runOperate(first, rest, write, mainOptions.operate ?? {});
     }
+    // Easy start (A): bare `toolroll` (or with --web / --project-root) at a person's terminal — no --json, not under a
+    // coding agent — starts this computer's Toolroll and opens the terminal UI. Anything else keeps its behaviour below.
+    if (first !== "scan" && first !== "--json" && easyStartArgs(argv) !== null) {
+        const terminal = mainOptions.easyStart?.terminal ?? (process.stdin.isTTY === true && process.stdout.isTTY === true);
+        const agent = terminal && (mainOptions.easyStart?.underAgent ?? underAgent(process.env));
+        if (easyStartApplies(argv, { stdin: terminal, stdout: terminal, agent })) {
+            const databaseFile = mainOptions.operate?.databaseFile ?? databasePath(process.env, homedir());
+            const easy = await import("./easy-start.js");
+            const seams = easy.defaultEasyStartSeams({
+                databaseFile, write, build: (await import("./monitoring.js")).packageVersion(),
+                ...(mainOptions.operate === undefined ? {} : { operate: mainOptions.operate }),
+                admit: repo => runReposCommand(["add", repo], write, mainOptions.onboard),
+            });
+            return easy.runEasyStart("start", easyStartArgs(argv), { ...seams, ...mainOptions.easyStart?.seams });
+        }
+    }
     // Cockpit B1: the scan by name, and bare `toolroll` in a repository starting (or attaching to) its console.
     if (first === "scan")
         argv = rest;

package/dist/coding-ui.js

@@ -142,6 +142,8 @@ export function codingWorkspaceScript() {
   const draftKey = () => 'standing-orders:coding-draft:' + root.dataset.codingOwner + ':' + (session || 'new:' + (composer.querySelector('[name="repo"]')?.value || root.dataset.codingProject));
   const storage = (operation, key, value) => { try { return sessionStorage[operation](key, value); } catch { return null; } };
   const requestSignal = () => typeof AbortSignal.timeout === 'function' ? AbortSignal.timeout(30000) : undefined;
+  // Easy-start C2: the browser mutation key, when the page's key fill offers one.
+  const keyed = headers => typeof window.soKeyHeaders === 'function' ? window.soKeyHeaders(headers) : headers;
   const saveDraft = () => {
     if (!prompt || !root.dataset.codingOwner) return;
     storage('setItem', draftKey(), JSON.stringify({text:prompt.value, requestId:requestField.value, pending:pendingSend, at:Date.now()}));
@@ -276,7 +278,7 @@ export function codingWorkspaceScript() {
     const area = root.querySelector('#coding-change-content');
     const button = root.querySelector('#coding-refresh-changes'); button.disabled = true;
     try {
-      const response = await fetch(base + '/changes', {method:'POST',headers:{accept:'application/json'},body:new URLSearchParams({csrf}),credentials:'same-origin',cache:'no-store',signal:requestSignal()});
+      const response = await fetch(base + '/changes', {method:'POST',headers:keyed({accept:'application/json'}),body:new URLSearchParams({csrf}),credentials:'same-origin',cache:'no-store',signal:requestSignal()});
       if (response.status === 401 || response.redirected) { signedOut(); return; }
       if (!response.ok) throw new Error('Could not load changes. Try Refresh changes.');
       const changes = await response.json();
@@ -338,7 +340,7 @@ export function codingWorkspaceScript() {
     form.dataset.busy = 'true';
     const buttons = Array.from(form.querySelectorAll('button')); buttons.forEach(button => button.disabled = true);
     try {
-      const response = await fetch(form.getAttribute('action'), {method:'POST',headers:{accept:'application/json','content-type':'application/x-www-form-urlencoded'},credentials:'same-origin',body:data.toString(),signal:requestSignal()});
+      const response = await fetch(form.getAttribute('action'), {method:'POST',headers:keyed({accept:'application/json','content-type':'application/x-www-form-urlencoded'}),credentials:'same-origin',body:data.toString(),signal:requestSignal()});
       if (response.status === 401 || response.redirected) { signedOut(); return; }
       const result = await response.json();
       if (!response.ok || !result.ok) {

package/dist/connect-cli.js

@@ -6,6 +6,7 @@
 import { constants, closeSync, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
+import { savedLoginFile } from './login-secrets.js';
 import { randomBytes } from 'node:crypto';
 import { envelopeJson } from './envelope.js';
 import { databasePath } from './store.js';
@@ -299,7 +300,7 @@ export async function maybeRunConnectCommand(argv, write, options = {}) {
             throw new UsageError('--login-file requires --local-login.');
         let account = value(flags, 'as');
         if (flags['local-login']) {
-            const login = privateFile(value(flags, 'login-file') || join(dirname(databasePath(options.env ?? process.env, options.home ?? homedir())), 'up-login.txt'), 8192).trim().split(/\s+/);
+            const login = privateFile(value(flags, 'login-file') || savedLoginFile(dirname(databasePath(options.env ?? process.env, options.home ?? homedir()))), 8192).trim().split(/\s+/);
             if (login.length !== 2 || account && account !== login[0])
                 throw new UsageError('The local sign-in does not match the requested account.');
             account = login[0];

package/dist/console-instance.d.ts

@@ -35,6 +35,8 @@ export declare function readInstanceState(store: Store): {
     record: InstanceRecord;
 };
 export declare function readInstance(store: Store): InstanceRecord | null;
+/** v147: the key epoch the running console recorded with its claim (easy-start C2), or null: none recorded. */
+export declare function instanceKeyEpoch(store: Store): string | null;
 /** A stopping console forgets itself — only its own record, never a newer start's. */
 export declare function clearInstance(store: Store, secret: string): void;
 export declare const socketProof: (secret: string, challenge: string) => string;
@@ -70,8 +72,15 @@ export declare function askSocket(socketPath: string, request: object, timeoutMs
  * The console's discovery socket: one line in, one line out. `hello` (with a challenge) answers the public facts and
  * the socket proof; every other verb is refused. It reads nothing else and changes nothing. Bound under a fresh name
  * no other process has, so it never clears or replaces anything; its own listener removes it on close.
+ *
+ * Easy start D: the one other verb is `link`, and only when the console passes `link`. The console answers with a fresh
+ * challenge of its own; the asker must answer it with HMAC(secret, "link:" + challenge) — the secret is in the database
+ * (behind the agent fence), so only a process that read it can — and then gets one local owner's one-time sign-in path.
+ * Each challenge is spent by the first answer on its own connection, right or wrong; the "link:" domain keeps a hello or
+ * HTTP proof from ever counting here. The request names no account: what the link signs in as is the console's own
+ * decision (`link` returns null unless local mode is on).
  */
-export declare function openInstanceSocket(databaseFile: string, facts: HelloFacts, secret: () => string | null): Promise<{
+export declare function openInstanceSocket(databaseFile: string, facts: HelloFacts, secret: () => string | null, link?: () => string | null): Promise<{
     ok: true;
     name: string;
     close: () => void;
@@ -79,6 +88,29 @@ export declare function openInstanceSocket(databaseFile: string, facts: HelloFac
     ok: false;
     problem: string;
 }>;
+/** The `link` verb's answer to the console's challenge: bound to this verb, so no other proof ever counts for it. */
+export declare const linkProof: (secret: string, challenge: string) => string;
+/**
+ * Ask the console on `socketPath` for a local owner's one-time sign-in path with the record's secret: `link`, the
+ * console's challenge, then the proof. Null when it gives none (local mode off, a wrong or late answer, anything
+ * malformed). The caller proves the console live first (proveLiveConsole) and opens the path on its proved address.
+ */
+export declare function askLink(socketPath: string, secret: string, timeoutMs?: number, connect?: (path: string) => Socket): Promise<string | null>;
+/**
+ * A local owner's one-time sign-in address from this installation's live console (easy start D, `toolroll open`): the
+ * console is proved live on both channels first, then asked over its socket with the record's secret. The address is
+ * always the proved console's own; null when there is no proved console or it gives no link.
+ */
+export declare function requestLocalLink(databaseFile: string, store: Store, build: string, seams?: AttachSeams & {
+    askLink?: typeof askLink;
+}): Promise<{
+    ok: true;
+    url: string;
+    console: string;
+} | {
+    ok: false;
+    message: string;
+}>;
 /**
  * A record's console: "live" (its socket answers a fresh challenge with the record's secret and pid), "gone" (nobody
  * is listening on its socket, or the socket isn't there), or "unknown" (anything else: slow, malformed, a wrong proof).
@@ -95,6 +127,7 @@ export declare function claimInstance(store: Store, databaseFile: string, facts:
     port: number;
     build: string;
     socket: string;
+    keyEpoch?: string;
 }, now: Date, liveness?: (record: InstanceRecord) => Promise<"live" | "gone" | "unknown">): Promise<string | null>;
 export type AttachProof = {
     ok: true;

package/dist/console-instance.js

@@ -69,6 +69,11 @@ export function readInstance(store) {
     const read = readInstanceState(store);
     return read.state === "ok" ? read.record : null;
 }
+/** v147: the key epoch the running console recorded with its claim (easy-start C2), or null: none recorded. */
+export function instanceKeyEpoch(store) {
+    const row = store.handle.prepare("SELECT key_epoch FROM console_instance WHERE id = 1").get();
+    return row === undefined || row["key_epoch"] == null ? null : String(row["key_epoch"]);
+}
 /** A stopping console forgets itself — only its own record, never a newer start's. */
 export function clearInstance(store, secret) {
     store.handle.prepare("DELETE FROM console_instance WHERE id = 1 AND secret = ?").run(secret);
@@ -189,8 +194,15 @@ export function askSocket(socketPath, request, timeoutMs = 2_000, connect = path
  * The console's discovery socket: one line in, one line out. `hello` (with a challenge) answers the public facts and
  * the socket proof; every other verb is refused. It reads nothing else and changes nothing. Bound under a fresh name
  * no other process has, so it never clears or replaces anything; its own listener removes it on close.
+ *
+ * Easy start D: the one other verb is `link`, and only when the console passes `link`. The console answers with a fresh
+ * challenge of its own; the asker must answer it with HMAC(secret, "link:" + challenge) — the secret is in the database
+ * (behind the agent fence), so only a process that read it can — and then gets one local owner's one-time sign-in path.
+ * Each challenge is spent by the first answer on its own connection, right or wrong; the "link:" domain keeps a hello or
+ * HTTP proof from ever counting here. The request names no account: what the link signs in as is the console's own
+ * decision (`link` returns null unless local mode is on).
  */
-export async function openInstanceSocket(databaseFile, facts, secret) {
+export async function openInstanceSocket(databaseFile, facts, secret, link) {
     const dir = instanceRunDir(databaseFile);
     const problem = prepareRunDir(dir);
     if (problem !== null)
@@ -201,30 +213,60 @@ export async function openInstanceSocket(databaseFile, facts, secret) {
         return { ok: false, problem: pathProblem };
     const server = createServer(socket => {
         let buffer = "";
+        // The link challenge this connection was given, until its one answer arrives.
+        let challenged = null;
+        let done = false;
         socket.setEncoding("utf8");
         socket.setTimeout(5_000, () => socket.destroy());
-        const reply = (body) => { socket.end(`${JSON.stringify(body)}\n`); };
-        socket.on("error", () => socket.destroy());
-        socket.on("data", chunk => {
-            buffer += chunk;
-            if (buffer.length > LINE_CAP)
-                return void socket.destroy();
-            const end = buffer.indexOf("\n");
-            if (end < 0)
-                return;
+        const reply = (body) => { done = true; socket.end(`${JSON.stringify(body)}\n`); };
+        const answerLine = (line) => {
             let asked;
             try {
-                asked = JSON.parse(buffer.slice(0, end));
+                asked = JSON.parse(line);
             }
             catch {
                 return reply({ error: "refused" });
             }
-            const verb = asked !== null && typeof asked === "object" ? asked.verb : undefined;
-            const challenge = asked !== null && typeof asked === "object" ? asked.challenge : undefined;
+            const field = (key) => asked !== null && typeof asked === "object" && !Array.isArray(asked) ? asked[key] : undefined;
             const key = secret();
+            if (challenged !== null) {
+                // The one answer to this connection's challenge: spent now, whatever it says.
+                const expected = key === null ? null : linkProof(key, challenged);
+                challenged = null;
+                if (expected === null || field("verb") !== "link-proof" || !same(field("proof"), expected))
+                    return reply({ error: "refused" });
+                let path = null;
+                try {
+                    path = link?.() ?? null;
+                }
+                catch {
+                    path = null;
+                }
+                return reply(path === null ? { error: "no-link" } : { link: path });
+            }
+            const verb = field("verb");
+            if (verb === "link" && link !== undefined && key !== null) {
+                challenged = randomBytes(32).toString("hex");
+                socket.write(`${JSON.stringify({ challenge: challenged })}\n`);
+                return;
+            }
+            const challenge = field("challenge");
             if (verb !== "hello" || typeof challenge !== "string" || !CHALLENGE.test(challenge) || key === null)
                 return reply({ error: "refused" });
             reply({ ...facts, proof: socketProof(key, challenge) });
+        };
+        socket.on("error", () => socket.destroy());
+        socket.on("data", chunk => {
+            if (done)
+                return;
+            buffer += chunk;
+            if (buffer.length > LINE_CAP)
+                return void socket.destroy();
+            for (let end = buffer.indexOf("\n"); end >= 0 && !done; end = buffer.indexOf("\n")) {
+                const line = buffer.slice(0, end);
+                buffer = buffer.slice(end + 1);
+                answerLine(line);
+            }
         });
     });
     // A Unix bind never replaces an existing path (EADDRINUSE).
@@ -233,6 +275,72 @@ export async function openInstanceSocket(databaseFile, facts, secret) {
         return { ok: false, problem: `couldn't listen on ${socketPath}` };
     return { ok: true, name, close: () => { server.close(); } };
 }
+/** The `link` verb's answer to the console's challenge: bound to this verb, so no other proof ever counts for it. */
+export const linkProof = (secret, challenge) => createHmac("sha256", secret).update(`link:${challenge}`).digest("hex");
+const LINK_PATH = /^\/login\/once\/[A-Za-z0-9_-]{16,128}$/;
+/**
+ * Ask the console on `socketPath` for a local owner's one-time sign-in path with the record's secret: `link`, the
+ * console's challenge, then the proof. Null when it gives none (local mode off, a wrong or late answer, anything
+ * malformed). The caller proves the console live first (proveLiveConsole) and opens the path on its proved address.
+ */
+export function askLink(socketPath, secret, timeoutMs = 5_000, connect = path => createConnection(path)) {
+    return new Promise(resolve => {
+        let settled = false, buffer = "", sentProof = false;
+        const done = (value) => { if (settled)
+            return; settled = true; clearTimeout(timer); socket.destroy(); resolve(value); };
+        const socket = connect(socketPath);
+        const timer = setTimeout(() => done(null), timeoutMs);
+        socket.setEncoding("utf8");
+        socket.on("error", () => done(null));
+        socket.on("connect", () => socket.write(`${JSON.stringify({ verb: "link" })}\n`));
+        socket.on("data", chunk => {
+            buffer += chunk;
+            if (buffer.length > LINE_CAP)
+                return done(null);
+            for (let end = buffer.indexOf("\n"); end >= 0 && !settled; end = buffer.indexOf("\n")) {
+                const line = buffer.slice(0, end);
+                buffer = buffer.slice(end + 1);
+                let parsed;
+                try {
+                    parsed = JSON.parse(line);
+                }
+                catch {
+                    return done(null);
+                }
+                const body = parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+                if (!sentProof) {
+                    const challenge = body["challenge"];
+                    if (typeof challenge !== "string" || !/^[0-9a-f]{64}$/.test(challenge))
+                        return done(null);
+                    sentProof = true;
+                    socket.write(`${JSON.stringify({ verb: "link-proof", proof: linkProof(secret, challenge) })}\n`);
+                }
+                else {
+                    const path = body["link"];
+                    return done(typeof path === "string" && LINK_PATH.test(path) ? path : null);
+                }
+            }
+        });
+        socket.on("end", () => done(null));
+    });
+}
+/**
+ * A local owner's one-time sign-in address from this installation's live console (easy start D, `toolroll open`): the
+ * console is proved live on both channels first, then asked over its socket with the record's secret. The address is
+ * always the proved console's own; null when there is no proved console or it gives no link.
+ */
+export async function requestLocalLink(databaseFile, store, build, seams = {}) {
+    const proof = await proveLiveConsole(databaseFile, store, build, seams);
+    if (!proof.ok)
+        return { ok: false, message: proof.message };
+    const record = readInstance(store);
+    if (record === null || record.pid !== proof.pid || record.port !== proof.port)
+        return { ok: false, message: "the console changed while it was being checked" };
+    const path = await (seams.askLink ?? askLink)(join(instanceRunDir(databaseFile), record.socket), record.secret);
+    if (path === null)
+        return { ok: false, message: "the console gave no sign-in link (local mode is off, or it is still starting)" };
+    return { ok: true, url: new URL(path, proof.url).toString(), console: proof.url };
+}
 /**
  * A record's console: "live" (its socket answers a fresh challenge with the record's secret and pid), "gone" (nobody
  * is listening on its socket, or the socket isn't there), or "unknown" (anything else: slow, malformed, a wrong proof).
@@ -268,8 +376,9 @@ export async function claimInstance(store, databaseFile, facts, now, liveness =
         // Exactly the record that was checked (or none): anything else is another start's newer claim.
         if (rawSecret() !== checked)
             return null;
-        store.handle.prepare("INSERT INTO console_instance (id, secret, pid, port, build, socket, started_at) VALUES (1, ?, ?, ?, ?, ?, ?) ON CONFLICT (id) DO UPDATE SET secret = excluded.secret, pid = excluded.pid, port = excluded.port, build = excluded.build, socket = excluded.socket, started_at = excluded.started_at")
-            .run(secret, facts.pid, facts.port, facts.build, facts.socket, now.toISOString());
+        // v147: the start's key epoch (easy-start C2) is recorded with its claim; a claim without one records none.
+        store.handle.prepare("INSERT INTO console_instance (id, secret, pid, port, build, socket, started_at, key_epoch) VALUES (1, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT (id) DO UPDATE SET secret = excluded.secret, pid = excluded.pid, port = excluded.port, build = excluded.build, socket = excluded.socket, started_at = excluded.started_at, key_epoch = excluded.key_epoch")
+            .run(secret, facts.pid, facts.port, facts.build, facts.socket, now.toISOString(), facts.keyEpoch ?? null);
         return secret;
     });
 }