toolroll 0.9.89 → 0.9.91

package/dist/operate.js

@@ -108,16 +108,17 @@ import { homedir, hostname } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { releaseStalledUpdate, waitingUpdate } from "./toolroll-update.js";
 import { dur } from "./design/kit.js";
-import { openStore, openStoreNoMigrate, archiveTaskFamily, restoreTaskFamily, shipChecksForTask, elapsedSeconds, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
+import { openStore, openStoreNoMigrate, initLocalMode, enrollOwnerPassword, installationCreatedBy, laptopPortOf, recordLaptopPort, localModeOf, localOwnerBinding, archiveTaskFamily, restoreTaskFamily, shipChecksForTask, elapsedSeconds, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import { claimInstance, clearInstance, openInstanceSocket } from "./console-instance.js";
+import { backgroundOff, backgroundOn, backgroundShow, laptopStatus, laptopStop } from "./laptop-background.js";
 import { authorizePlanUnderMode } from "./plan-auto.js";
 import { ghDispatchAdapter, mirrorTaskId, syncPass } from "./sync.js";
 import { LIVE_FILE_BOUND, LIVE_RETAIN_MS, sweepLiveLogs } from "./live.js";
 import { addRepos, removeRepos, updateRepos, loadRepos, loadProjectRegistry, updateProjectRegistry, registryRemovals } from "./repos.js";
 import { deleteProject, holdingsWords, projectHoldings, projectRunning } from "./project-delete.js";
 import { pushPass } from "./push.js";
-import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, openSync, readFileSync, readSync, realpathSync, renameSync, unlinkSync, writeSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, mkdirSync, openSync, readFileSync, readSync, realpathSync, renameSync, unlinkSync, writeSync, writeFileSync } from "node:fs";
 import { BRANCH_PREFIX, envTwins, envValue, existingOrFirst, taskBranches } from "./names.js";
 import { claimActor, currentActor, withActor } from "./actor.js";
 import { parseLeadToken } from "./api-tokens.js";
@@ -125,6 +126,8 @@ import { MAX_NETWORK_HOSTS, normalizeHost } from "./egress.js";
 import { isWritesMode, writesWords } from "./writes-mode.js";
 import { linuxFenceAvailable, macosFenceAvailable } from "./agent-fence.js";
 import { parseMachLookup, parseReadDeny, readDenyWords } from "./project-sandbox.js";
+import { LOCAL_POLICY } from "./surface.js";
+import { asLocalOwner, currentLocalOwner, LOCAL_MODE_CONFINES, localModeOn, localOwnerRefusal, localOwnerRequested } from "./local-owner.js";
 import { CHECK_ACCESS_WARNINGS, checkAccessRunsAs, checkAccessWords, isCheckAccess, signInHostsMissing, signInsUnavailableWords, widerThan } from "./check-access.js";
 import { CLI_PASSWORD_SOURCE, withPasswordSource } from "./sign-in-guard.js";
 import { admissionRecorded, admitProject, commandLineActor } from "./project-admission.js";
@@ -210,6 +213,7 @@ import { stopProcessTree } from "./process-tree.js";
 import { mintCoordinator, revokeCoordinator, listCoordinators } from "./coordinator.js";
 import { serveMcp } from "./mcp.js";
 import { createInterface } from "node:readline";
+import { hashPassword } from "./scope.js";
 import { propose, approve, addApprover, authenticateAccount, authenticateApprover as passwordApprover, describeScope, approvalOf, hashToken as hashApproverToken, modeFilingCoverage, acceptanceLinesToInput, parseAcceptanceCriteria, splitAcceptanceRubric, rubricIsPlaceholder, isCommitSha, credentialProof, rememberedLogin, personApprovalOf } from "./scope.js";
 import { CHAT_APPROVE_ALL, presetTerms, modeTermsJson, modeDigestOf, modeTermsFromJson, modeWords, MODE_MAX_DAYS } from "./modes.js";
 import { WorktreePool } from "./worktree.js";
@@ -258,6 +262,7 @@ import { latestRelease, newerRelease, notifySecurityRelease, notifyVersionLive,
 import { installMethod } from "./install-method.js";
 import { PACKAGE_VERSION } from "./version.js";
 import { machineActing } from "./scope.js";
+import { loginFileOf, migrateLegacyLogin, savedLoginFile, writableLoginFile } from "./login-secrets.js";
 /**
  * 0 done · 1 broke · 2 bad usage · 3 ran fine, the answer is no.
  *
@@ -450,16 +455,24 @@ External trackers — build what a tracker nominates, under local approvals
                                         [--max <n>] tasks (default 1),
                                         [--base <ref>] for first attempts.
                                         Never pushes.
+  toolroll background on|off|show    keep this computer's Toolroll running when you log in (on), stop
+                                        that (off, only Toolroll's own login item), or how it stands
+  toolroll stop                      stop this computer's Toolroll once its running work is saved
   toolroll up [--project-root <dir>] one command to a working cockpit:
                                         app + builder + browser. Mints
                                         your login on first run (saved to
-                                        up-login.txt beside the database),
+                                        .toolroll-secrets/up-login.txt
+                                        beside the database),
                                         remembers the projects folder, and
                                         reconnects every saved repository.
                                         Add local or GitHub projects in the
                                         app; they start without a restart.
                                         --repo still adds an exact path;
                                         --no-open skips the browser;
+                                        --laptop: this computer only, with
+                                        ~/Projects when no folder is
+                                        chosen (a new install signs in
+                                        here without a password);
                                         the app and the builder run as two
                                         processes (--single-process: one);
                                         --host 0.0.0.0 --allow-host name:port
@@ -742,7 +755,7 @@ export const OPERATE_BOOLEAN_FLAGS = new Set([
     "no-carry",
     "json", "yes", "all", "brief", "local", "history", "latest-watch", "dry-run", "file",
     "clear", "follow", "ready", "all-tasks", "inbound-only", "help", "undo", "anyone", "allow-dispatch", "allow-merge", "merge-delete-branch",
-    "no-open", "single-process", "remove", "no-verify", "no-follow", "end", "report", "off", "tmux",
+    "no-open", "single-process", "laptop", "web", "remove", "no-verify", "no-follow", "end", "report", "off", "tmux",
     "self-heal", "plan-auto", "chat-approve", "full-access", "repair-auto", "review-retry-auto", "no-local",
     "html", "csv", "alerts-only",
     // project network: what its builds may reach (--open | --allowlist).
@@ -851,6 +864,11 @@ async function runOperateLocal(command, argv, write, options = {}) {
         }
         return EXIT.ok;
     }
+    // Easy-start C3: the terminal UI's local owner runs only commands marked for it — decided here, before any command
+    // that answers without the database (mcp, a public-address check, restore) could run. Bound after the database opens.
+    if (localOwnerRequested() && localOwnerRowAct(command, positional, flags) === null) {
+        return fail(write, json, command, "refused", "Set a password, or sign in with your password, to do this.", EXIT.refused);
+    }
     const file = text(flags, "db") ?? options.databaseFile ?? databasePath(process.env, homedir());
     const now = options.now ?? new Date();
     try {
@@ -887,7 +905,9 @@ async function runOperateLocal(command, argv, write, options = {}) {
     }
     let store;
     try {
-        store = (options.openDatabase ?? openStore)(file);
+        // v147: `up --laptop` records who made a NEW database (installation_fact created-by), the fact local mode starts from.
+        const laptop = command === "up" && flags.has("laptop") && options.upRole === undefined;
+        store = options.openDatabase !== undefined ? options.openDatabase(file) : openStore(file, laptop ? { createdBy: "laptop" } : {});
     }
     catch (error) {
         return databaseFailure(write, json, command, file, error);
@@ -895,6 +915,21 @@ async function runOperateLocal(command, argv, write, options = {}) {
     // Toolroll's folder for the secrets it holds, beside this database: made before any build can run.
     if (file !== ":memory:")
         startToolSecrets(store, file, () => new Date(), { eager: SECRETS_FIRST.has(command) });
+    // Easy-start C3: the terminal UI's commands run as the local owner (runAsLocalOwner; never argv or the environment):
+    // bound here from local mode as it reads now, and only a command marked for the local owner (surface.ts LOCAL_ALLOW).
+    if (localOwnerRequested()) {
+        const admitted = localOwnerCommand(store, command, positional, flags);
+        if (!admitted.ok) {
+            store.close();
+            return fail(write, json, command, "refused", admitted.message, EXIT.refused);
+        }
+        try {
+            return await dispatchOn(command, positional, flags, parsed.repoList, { store, write, json, file, now }, options, run => asLocalOwner(admitted.principal, run));
+        }
+        finally {
+            store.close();
+        }
+    }
     // The lead (a lead token, as --token or TOOLROLL_LEAD_TOKEN) acts for its owner in single commands; its work
     // pings nobody. Anyone else who signs in inside one of these commands is who acted. Services name nobody.
     const presentedFlag = text(flags, "token");
@@ -981,6 +1016,8 @@ async function dispatchOn(command, positional, flags, repoList, base, options, e
             ...(options.installBin === undefined ? {} : { installBin: options.installBin }),
             ...(options.onboardSeams === undefined ? {} : { onboardSeams: options.onboardSeams }),
             ...(options.upSeams === undefined ? {} : { upSeams: options.upSeams }),
+            ...(options.laptopSeams === undefined ? {} : { laptopSeams: options.laptopSeams }),
+            ...(options.easySeams === undefined ? {} : { easySeams: options.easySeams }),
             ...(options.upRole === undefined ? {} : { upRole: options.upRole }),
             ...(options.folderLook === undefined ? {} : { folderLook: options.folderLook }),
             ...(upNeedsOneProcess(options) ? { upOneProcess: true } : {}),
@@ -1331,7 +1368,7 @@ async function dispatch(command, positional, flags, context) {
             return runTokensCommand(positional, flags, {
                 store: context.store, write: context.write, json: context.json, clock: context.clock,
                 caller: activeRemote() !== null ? "remote" : currentActor()?.lead === true || context.leadToken !== undefined ? "lead" : "local",
-                rememberedName: readLoginFile(join(dirname(context.databaseFile), UP_LOGIN_FILE))?.name ?? null,
+                rememberedName: readLoginFile(savedLoginFile(dirname(context.databaseFile)))?.name ?? null,
                 interactive, ask, askHidden, readStdin: readBoundedStdin,
             });
         case "keys":
@@ -1364,6 +1401,16 @@ async function dispatch(command, positional, flags, context) {
             return onboardCommand(flags, context);
         case "daemon":
             return daemonCommand(positional, flags, context);
+        case "background":
+            return backgroundCommand(positional, flags, context);
+        case "stop":
+            return stopCommand(positional, flags, context);
+        case "open":
+            return openCommand(positional, flags, context);
+        case "welcome":
+            return welcomeCommand(positional, flags, context);
+        case "password":
+            return passwordCommand(positional, flags, context);
         case "bridge":
             return bridgeCommand(positional, flags, context);
         case "publish":
@@ -4006,6 +4053,9 @@ async function startConsole(options) {
         ...(options.editorLinks === undefined ? {} : { editorLinks: options.editorLinks }),
         ...(options.instanceSecret === undefined ? {} : { instanceSecret: options.instanceSecret }),
         ...(options.draining === undefined ? {} : { draining: options.draining }),
+        ...(options.keyEpoch === undefined ? {} : { keyEpoch: options.keyEpoch }),
+        // Easy-start C2: on a protected loopback install, every browser mutation also presents the session's key.
+        browserKey: true,
     });
     await new Promise((resolve, reject) => {
         server.once("error", reject);
@@ -6844,9 +6894,23 @@ function readLoginFile(path) {
 /** The approver decision tree (arc 2 findings 8/21/29/32), exhaustively. */
 async function resolveUpApprover(context, flags, canPrompt) {
     const { store, clock } = context;
-    const loginFile = join(dirname(context.databaseFile), UP_LOGIN_FILE);
-    const asFlag = text(flags, "as");
+    const stateDir = dirname(context.databaseFile);
     const notes = [];
+    // Easy-start C4: local mode first, before any login file is read or moved and before any prompt. Its owner, active,
+    // starts this `up` with local authority: the console can mint only a local-owner link from it, never a full one.
+    const local = localOwnerBinding(store);
+    if (local !== null)
+        return { approver: local.account, approvers: [local.account], verified: false, passwordFile: null, mintedPassword: null, notes, startAuthority: "local" };
+    // An older version's login beside the database moves into the reserved folder every fence denies (login-secrets.ts).
+    const migration = migrateLegacyLogin(stateDir);
+    if (migration.kind === "moved")
+        notes.push(`moved your saved login into ${migration.to} (owner-only, kept from agents)`);
+    else if (migration.kind === "both")
+        notes.push(`${migration.from} was left in place: ${migration.to} already holds a different login, and that one is used`);
+    else if (migration.kind === "refused" || migration.kind === "failed")
+        notes.push(`your saved login stays at ${migration.from} for now: ${migration.reason}`);
+    let loginFile = savedLoginFile(stateDir);
+    const asFlag = text(flags, "as");
     let names = store.listApprovers().map(one => one.name);
     if (names.length === 0) {
         // Adoption first (finding 27/32): an orphan file from a crashed
@@ -6856,7 +6920,7 @@ async function resolveUpApprover(context, flags, canPrompt) {
             const adopted = store.bootstrapApproverIfNone(orphan.name, hashApproverToken(orphan.password), clock());
             if (adopted.ok) {
                 notes.push(`adopted the login from ${UP_LOGIN_FILE} — a previous start was interrupted before it finished`);
-                return { approver: orphan.name, approvers: [orphan.name], verified: true, passwordFile: loginFile, mintedPassword: null, notes };
+                return { approver: orphan.name, approvers: [orphan.name], verified: true, passwordFile: loginFile, mintedPassword: null, notes, startAuthority: "full" };
             }
             names = store.listApprovers().map(one => one.name); // a winner appeared; fall through
         }
@@ -6867,21 +6931,22 @@ async function resolveUpApprover(context, flags, canPrompt) {
             const name = asFlag ?? process.env["USER"] ?? process.env["USERNAME"] ?? "operator";
             const password = mintSecret(12);
             try {
+                loginFile = writableLoginFile(stateDir);
                 writeLoginFileDurably(loginFile, name, password);
             }
             catch (error) {
                 return {
-                    refusal: `could not create ${UP_LOGIN_FILE} beside the database (${describe(error)}) — if a file is already there, another \`up\` may be starting; wait a moment, your login will be in it`,
+                    refusal: `could not create ${loginFileOf(stateDir)} (${describe(error)}) — if a file is already there, another \`up\` may be starting; wait a moment, your login will be in it`,
                 };
             }
             const made = store.bootstrapApproverIfNone(name, hashApproverToken(password), clock());
             if (made.ok) {
-                return { approver: name, approvers: [name], verified: true, passwordFile: loginFile, mintedPassword: password, notes };
+                return { approver: name, approvers: [name], verified: true, passwordFile: loginFile, mintedPassword: password, notes, startAuthority: "full" };
             }
             // Lost the race. Keep the file if the winner IS our identity (an
             // adopter beat us to our own file); otherwise it is ours to remove.
             if (authenticateApprover(store, name, password).ok) {
-                return { approver: name, approvers: store.listApprovers().map(one => one.name), verified: true, passwordFile: loginFile, mintedPassword: null, notes };
+                return { approver: name, approvers: store.listApprovers().map(one => one.name), verified: true, passwordFile: loginFile, mintedPassword: null, notes, startAuthority: "full" };
             }
             try {
                 unlinkSync(loginFile);
@@ -6936,19 +7001,20 @@ async function resolveUpApprover(context, flags, canPrompt) {
         // nothing typed. An account that predates `up` joins the same road.
         if (verified && remembered !== null && readLoginFile(loginFile) === null) {
             try {
+                loginFile = writableLoginFile(stateDir);
                 writeLoginFileDurably(loginFile, selected, remembered);
                 passwordFile = loginFile;
-                notes.push(`remembered your login on this machine in ${UP_LOGIN_FILE} (owner-only) — the next \`up\` asks for nothing`);
+                notes.push(`remembered your login on this machine in ${loginFile} (owner-only) — the next \`up\` asks for nothing`);
             }
             catch {
-                notes.push(`could not save your login beside the database — the next \`up\` will ask again`);
+                notes.push(`could not save your login in ${loginFileOf(stateDir)} — the next \`up\` will ask again`);
             }
         }
         if (!verified) {
             notes.push(`could not verify ${selected}'s password — the console will still ask at login. If it is lost: another approver can add you (\`approver add\`), or restore the database/${UP_LOGIN_FILE}.`);
         }
     }
-    return { approver: selected, approvers: names, verified, passwordFile, mintedPassword: null, notes };
+    return { approver: selected, approvers: names, verified, passwordFile, mintedPassword: null, notes, startAuthority: verified ? "full" : "none" };
 }
 /** The platform browser opener — detached, silent, never load-bearing. */
 export function openBrowser(url) {
@@ -7004,7 +7070,7 @@ async function onboardCommand(flags, context) {
     const served = portGiven === undefined ? readUpConsoleUrl(dirname(context.databaseFile)) : null;
     const home = seams.home ?? homedir();
     const env = seams.env ?? process.env;
-    const loginFile = join(dirname(context.databaseFile), UP_LOGIN_FILE);
+    const loginFile = savedLoginFile(dirname(context.databaseFile));
     const gitRun = context.gitRunner ?? ((file, args, opts) => run(file, [...args], { ...(opts?.cwd === undefined ? {} : { cwd: opts.cwd }), timeoutMs: 10_000 }));
     const registryPath = registryPathOf(context);
     const checker = createConnectionChecker({ home, env });
@@ -7096,7 +7162,7 @@ async function upCommand(flags, context) {
         return demoFence;
     // 1. Validation, before anything at all.
     const portGiven = text(flags, "port");
-    const port = Number(portGiven ?? 4180);
+    let port = Number(portGiven ?? 4180);
     if (portGiven !== undefined && (!Number.isInteger(port) || port < 1 || port >= 65536))
         return fail(write, json, "up", "usage", "--port is a whole number under 65536", EXIT.usage);
     const editorGiven = text(flags, "editor");
@@ -7120,6 +7186,11 @@ async function upCommand(flags, context) {
     const allowFlag = text(flags, "allow-host");
     // --public-url: `up` serves a real domain exactly as `serve` does (one process is the whole team server).
     const publicUrlFlag = text(flags, "public-url");
+    // --laptop (easy-start A): this computer only. A laptop start never listens beyond loopback or names another address.
+    const laptop = flags.has("laptop");
+    if (laptop && (!["127.0.0.1", "localhost", "::1"].includes(hostFlag) || allowFlag !== undefined || publicUrlFlag !== undefined)) {
+        return fail(write, json, "up", "usage", "--laptop serves this computer only: leave out --host, --allow-host and --public-url", EXIT.usage);
+    }
     const progress = (line) => {
         // v99: with TOOLROLL_LOG_FORMAT=json, each line is one JSON event on stderr for a log shipper.
         if (envValue(process.env, "LOG_FORMAT") === "json")
@@ -7205,8 +7276,13 @@ async function upCommand(flags, context) {
     }
     // Saved projects that are only away for now still start the service: it serves an empty, restrictive set until they
     // answer (never the unscoped mode), and connects each as it comes back.
-    if (repos.length === 0 && projectRoots.length === 0 && deferredRepos.length === 0)
-        return fail(write, json, "up", "no-projects", "choose where your projects live once: `toolroll up --project-root <dir>`", EXIT.refused);
+    if (repos.length === 0 && projectRoots.length === 0 && deferredRepos.length === 0) {
+        // A laptop start with nowhere chosen yet uses ~/Projects (made if it isn't there) instead of refusing.
+        const fallback = laptop ? upLaptopProjectsRoot(context.upSeams?.home ?? homedir()) : null;
+        if (fallback === null)
+            return fail(write, json, "up", "no-projects", "choose where your projects live once: `toolroll up --project-root <dir>`", EXIT.refused);
+        projectRoots.push(fallback);
+    }
     // A person at a terminal reads three lines (onboarding); the folders are for --verbose, a service log, or an agent.
     const quietStart = !json && !flags.has("verbose") && (context.upSeams?.terminal ?? process.stdout.isTTY === true) && !underAgent(context.upSeams?.env ?? process.env);
     if (!quietStart) {
@@ -7217,11 +7293,29 @@ async function upCommand(flags, context) {
     }
     // 3. Reserve the port BEFORE any identity or enrollment mutation
     // (finding 7/19): a busy port must refuse while the world is untouched.
-    const probe = createNetServer();
-    const reserved = await new Promise(resolveProbe => {
-        probe.once("error", () => resolveProbe(false));
-        probe.listen(port, "127.0.0.1", () => resolveProbe(true));
-    });
+    // A laptop start with no --port: the port this install saved, else (a NEW laptop install only) the first free one from
+    // `up`'s default on (upLaptopPortCandidates), saved once it is reserved. Every other install keeps its port.
+    const candidates = laptop && portGiven === undefined ? upLaptopPortCandidates(store, context.upSeams?.laptopPorts) : [port];
+    let probe = createNetServer();
+    let reserved = false;
+    for (const candidate of candidates) {
+        // A port this database's own console has held is never stepped past: that is this install, restarting or running.
+        if (candidate !== candidates[0] && lifecycleOf(store, `console:${candidate}`) !== null)
+            break;
+        probe = createNetServer();
+        port = candidate;
+        reserved = await new Promise(resolveProbe => {
+            probe.once("error", () => resolveProbe(false));
+            probe.listen(candidate, "127.0.0.1", () => resolveProbe(true));
+        });
+        if (reserved || lifecycleOf(store, `console:${candidate}`) !== null)
+            break;
+    }
+    if (reserved && laptop && portGiven === undefined && candidates.length > 1) {
+        recordLaptopPort(store, port, new Date());
+        if (port !== candidates[0])
+            progress(`port ${candidates[0]} is in use by another program, so Toolroll uses ${port} on this computer`);
+    }
     if (!reserved) {
         // The console that holds it said it is stopping: a restart is under way, so say that instead of "another one runs".
         const holder = lifecycleOf(store, `console:${port}`);
@@ -7237,7 +7331,13 @@ async function upCommand(flags, context) {
     let runnerToken = "";
     let approver = null;
     try {
-        // 4. The approver (findings 2/8/17/21/27/29/32).
+        // 4. The approver (findings 2/8/17/21/27/29/32). A laptop start first turns local mode on for a database it just
+        // made with no account yet, when this machine has a fence (easy-start plan F); anywhere else this changes nothing.
+        if (flags.has("laptop")) {
+            const made = upLaptopLocalMode(context, text(flags, "as"));
+            if (made.ok)
+                progress("local mode is on: this computer's browser signs in without a password");
+        }
         const approverPlan = await resolveUpApprover(context, flags, canPrompt);
         if ("refusal" in approverPlan)
             return fail(write, json, "up", "login", approverPlan.refusal, EXIT.refused);
@@ -7248,7 +7348,8 @@ async function upCommand(flags, context) {
         // recovering runner authority on an UNVERIFIED operator identity was a
         // registration road around the ceremony. No verified password, no
         // runner — the login file or another approver restores the road.
-        if (!approverPlan.verified)
+        // Easy-start C4: local mode's owner is the other start authority (no password exists to verify); "none" refuses.
+        if (approverPlan.startAuthority === "none")
             return fail(write, json, "up", "login", `${approverPlan.approver}'s password could not be verified — a runner only registers under a proven operator. Type it correctly, restore ${UP_LOGIN_FILE}, or have another approver re-add you.`, EXIT.refused);
         // 5. The runner, through the atomic door (findings 1/16/26/31), with
         // the suffix budget (finding 24) for generated names only.
@@ -7413,6 +7514,7 @@ async function upCommand(flags, context) {
     const consoleConfig = {
         host: hostFlag, port, allowedHosts: allowFlag === undefined ? null : allowFlag.split(",").map(one => one.trim()).filter(one => one !== ""),
         publicUrl: publicUrlFlag ?? null, localRunner: runnerName, poolRoot: pool, repos: [...repos], projectRoots, registryPath, editor: editorGiven !== undefined,
+        startAuthority: approver?.startAuthority ?? "none",
     };
     const pendingLinks = new Map();
     let linkRequests = 0;
@@ -7556,12 +7658,16 @@ async function upCommand(flags, context) {
             // one-time sign-in link (single use, ten minutes, this computer only); it is never printed. The password stays
             // saved beside the database, for later and for other devices, and is never printed either.
             const account = approverPlan2.approver;
-            // The console mints it (its sign-in secrets stay there); it comes back only to be opened, never printed.
-            const link = account === null || flags.has("no-open") ? null : await new Promise(resolveLink => {
+            const localStart = approverPlan2.startAuthority === "local";
+            // The console mints it (its sign-in secrets stay there); it comes back only to be opened, never printed. Its kind
+            // is this start's authority: a local start asks for a local owner's link (it names no account), a full one for the
+            // account's; the console mints only the kind it was started with.
+            const request = upLinkRequest(approverPlan2.startAuthority, account);
+            const link = request === null || flags.has("no-open") ? null : await new Promise(resolveLink => {
                 const id = ++linkRequests;
                 const timer = setTimeout(() => { pendingLinks.delete(id); resolveLink(null); }, 10_000);
                 pendingLinks.set(id, value => { clearTimeout(timer); resolveLink(value); });
-                consoleRole?.send({ type: "sign-in-link", id, account });
+                consoleRole?.send({ type: "sign-in-link", id, ...request });
             });
             // Every start says where the saved password is and the exact command that shows it, browser or not (Settings
             // revamp S4, D2). Only the path is printed, never what the file holds: absolute (a relative --db names this
@@ -7573,7 +7679,17 @@ async function upCommand(flags, context) {
                 : showCommand === null ? `sign in as ${account} with your password` : `sign in as ${account}`;
             write("");
             write(`Toolroll is on ${url}`);
-            if (link !== null) {
+            if (localStart) {
+                // Local mode (easy-start C4): there is no password to point at; a new start opens a new one-time link.
+                if (link !== null) {
+                    write("Opening it in your browser now, already signed in.");
+                    write("If it doesn't open, stop it with Ctrl-C and run the same command again.");
+                    (context.upSeams?.openBrowser ?? openBrowser)(new URL(link, url).toString());
+                }
+                else
+                    write("To sign in from this computer's browser, run the same command again without --no-open.");
+            }
+            else if (link !== null) {
                 write("Opening it in your browser now, already signed in.");
                 write(`If it doesn't open, go to that address and ${signInWords}.`);
                 (context.upSeams?.openBrowser ?? openBrowser)(new URL(link, url).toString());
@@ -8410,7 +8526,7 @@ async function statusCommand(positional, flags, context) {
     if (positional.length > 0)
         return fail(context.write, context.json, command, "usage", "Use `toolroll status [--json]`.", EXIT.usage);
     // Whose lead the status line follows: the lead's own person, else the remembered login; nobody shows no lead.
-    const viewer = currentActor()?.account ?? readLoginFile(join(dirname(context.databaseFile), UP_LOGIN_FILE))?.name ?? null;
+    const viewer = currentActor()?.account ?? readLoginFile(savedLoginFile(dirname(context.databaseFile)))?.name ?? null;
     // A remote person limited to some projects sees only those (remoteLensOf): their tasks and counts, and nothing
     // that belongs to the installation or other projects (updates, integrations, builds by project, unsent replies).
     const lens = context.principal?.lens ?? null;
@@ -8442,7 +8558,10 @@ async function statusCommand(positional, flags, context) {
     const unsent = context.store.unsentTelegramReplies(null, null, new Date(context.clock().getTime() - UNSENT_REPLY_MS));
     const unsentLine = unsentRepliesLine(unsent);
     const unsentReplies = unsent.length === 0 ? {} : { unsentReplies: unsent.map(one => ({ ...one, retry: "toolroll bridge telegram retry" })) };
-    return succeed(context.write, context.json, command, { ...status, projects, ...update, ...integrations, ...updateWaiting, ...unsentReplies, ...(legacyWebhookWarning === null ? {} : { legacyWebhookWarning }) }, () => [...(waiting === null ? [] : [waiting.words]), ...(unsentLine === null ? [] : [unsentLine]), ...renderInstallationStatus(status), ...(projectsLine === null ? [] : [projectsLine]), ...(line === null ? [] : [line]), ...(brokenLine === null ? [] : [brokenLine]), ...(legacyWebhookWarning === null ? [] : [legacyWebhookWarning])]);
+    // This installation's console and background service (easy-start D), beside its updates and integrations: a person
+    // limited to some projects returned above without it; an all-project caller reads what a local one does.
+    const laptop = { laptop: await laptopStatus(context.store, context.databaseFile, context.laptopSeams) };
+    return succeed(context.write, context.json, command, { ...status, projects, ...laptop, ...update, ...integrations, ...updateWaiting, ...unsentReplies, ...(legacyWebhookWarning === null ? {} : { legacyWebhookWarning }) }, () => [...(waiting === null ? [] : [waiting.words]), ...(unsentLine === null ? [] : [unsentLine]), ...renderInstallationStatus(status), ...(projectsLine === null ? [] : [projectsLine]), ...(line === null ? [] : [line]), ...(brokenLine === null ? [] : [brokenLine]), ...(legacyWebhookWarning === null ? [] : [legacyWebhookWarning])]);
 }
 function unsentRepliesLine(unsent) {
     if (unsent.length === 0)
@@ -9405,7 +9524,7 @@ function noteActingPerson(flags, context) {
             authenticateAccount(context.store, name, token);
         return;
     }
-    const remembered = readLoginFile(join(dirname(context.databaseFile), UP_LOGIN_FILE));
+    const remembered = readLoginFile(savedLoginFile(dirname(context.databaseFile)));
     if (remembered !== null && (name === undefined || name === remembered.name))
         claimActor(remembered.name);
 }
@@ -10281,7 +10400,7 @@ async function proposalsCommand(positional, flags, context) {
         for (const line of answerContextLines(store, row.payload))
             write(line);
     }
-    const outcome = confirmCoordinatorProposal(store, verified.who, id, now, { confirm: flags.has("yes"), via: "cli" });
+    const outcome = confirmCoordinatorProposal(store, verified.who, id, now, { authority: currentLocalOwner() === null ? "full" : "local-owner", confirm: flags.has("yes"), via: "cli" });
     if (!outcome.ok)
         return fail(write, json, "proposals confirm", outcome.reason, outcome.reason === "needs-confirm" ? `${outcome.said} — read the consequences above, then pass --yes` : outcome.said, EXIT.refused);
     return succeed(write, json, "proposals confirm", { proposal: id, kind: outcome.kind, said: outcome.said, ...(outcome.taskId === null ? {} : { task: outcome.taskId }) }, () => [
@@ -10344,6 +10463,10 @@ function credentialsFrom(flags, context) {
     const remote = activeRemote();
     if (remote !== null)
         return { name: remote.account, token: remote.secret };
+    // Easy-start C3: the terminal UI's local owner has no password; the prover proves its allowlisted act instead.
+    const local = currentLocalOwner();
+    if (local !== null)
+        return { name: local.account, token: "" };
     // The lead signs in as its owner with its own token, never the owner's password.
     const lead = currentActor();
     if (context.leadToken !== undefined && lead?.lead === true)
@@ -10351,7 +10474,7 @@ function credentialsFrom(flags, context) {
     let name = text(flags, "as");
     let token = text(flags, "token");
     if (token === undefined) {
-        const remembered = readLoginFile(join(dirname(context.databaseFile), UP_LOGIN_FILE));
+        const remembered = readLoginFile(savedLoginFile(dirname(context.databaseFile)));
         if (remembered !== null && (name === undefined || name === remembered.name)) {
             name = remembered.name;
             token = remembered.password;
@@ -10365,6 +10488,10 @@ function credentialsFrom(flags, context) {
 }
 async function askCredentials(flags, context) {
     let { name, token } = credentialsFrom(flags, context);
+    // Easy-start C3: the local owner is never asked for a password (the prover decides its act, refusing all others).
+    const local = currentLocalOwner();
+    if (local !== null)
+        return { name: local.account, token: "" };
     if ((name === undefined || token === undefined) && interactive() && !context.json) {
         name ??= await ask("username: ");
         token ??= await askHidden("password: ");
@@ -10810,6 +10937,9 @@ async function unconfinedAgentsCommand(positional, flags, context) {
             : "Builds this machine can't confine at the OS don't start."];
     if (wanted === undefined)
         return succeed(write, json, command, { allowed: store.unfencedAgentsAllowed() }, () => words(store.unfencedAgentsAllowed()));
+    // Easy-start C5: while local mode is on, this installation always confines; said before any password is asked for.
+    if (wanted === "allow" && localModeOn(store))
+        return fail(write, json, command, "refused", LOCAL_MODE_CONFINES, EXIT.refused);
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : credentialApprover(store, acting.name, acting.token);
     if (acting === null || !verified?.ok || !store.isInstanceOperator(acting.name))
@@ -11732,7 +11862,7 @@ async function projectCheckAccessCommand(positional, flags, context) {
     // How it actually runs here: with no OS fence and unconfined running allowed, without a sandbox whatever is saved; on
     // a saved sign-ins level (off for now) runs sandboxed. Said, never hidden.
     const fenced = context.fenceAvailable?.() ?? (macosFenceAvailable() || linuxFenceAvailable());
-    const runsAs = (one) => checkAccessRunsAs(one, { platform, fenced, unconfinedAllowed: context.store.unfencedAgentsAllowed() });
+    const runsAs = (one) => checkAccessRunsAs(one, { platform, fenced, unconfinedAllowed: context.store.unfencedAgentsAllowed(), localMode: localModeOn(context.store) });
     const here = runsAs(current);
     const words = (one) => {
         if (runsAs(one) === "unsandboxed" && one !== "unsandboxed")
@@ -11751,6 +11881,9 @@ async function projectCheckAccessCommand(positional, flags, context) {
     if (unavailable !== null)
         return fail(context.write, context.json, command, "refused", unavailable, EXIT.refused);
     const widening = widerThan(wanted, current);
+    // Easy-start C5: while local mode is on, this installation always confines; said before any password is asked for.
+    if (wanted === "unsandboxed" && localModeOn(context.store))
+        return fail(context.write, context.json, command, "refused", LOCAL_MODE_CONFINES, EXIT.refused);
     const acting = await askCredentials(flags, context);
     const proved = acting === null ? null : authenticateApprover(context.store, acting.name, acting.token, repo);
     if (widening) {
@@ -12090,9 +12223,13 @@ async function runUpConsoleRole(context, config, port, build) {
     // v137: this console's lifecycle (service_lifecycle "console:<port>"): started, a short heartbeat, draining once
     // its `up` stops, stopped at the end. While draining, /healthz and every page say Toolroll is restarting.
     let draining = false;
+    // v147 (easy-start C2): this start's key epoch, minted once and recorded with the instance claim below. A browser's
+    // mutation key from any other start is stale.
+    const keyEpoch = randomBytes(16).toString("hex");
     let console_;
     try {
         console_ = await startConsole({
+            keyEpoch,
             instanceSecret: () => instanceSecret,
             draining: () => draining,
             context,
@@ -12153,7 +12290,7 @@ async function runUpConsoleRole(context, config, port, build) {
         else if (message.type === "sign-in-link") {
             let link = null;
             try {
-                link = console_.server.mintSignInLink(message.account);
+                link = consoleSignInLink(console_.server, config.startAuthority, message);
             }
             catch {
                 link = null;
@@ -12166,9 +12303,11 @@ async function runUpConsoleRole(context, config, port, build) {
     // isn't offered; the console runs either way. The socket is taken FIRST: only the console that owns it publishes a
     // record. A second console on the same database (another port) never replaces the first one's record.
     let mintedSecret = null;
-    const instanceSocket = await openInstanceSocket(context.databaseFile, { pid: process.pid, build: packageVersion(), database: context.databaseFile, port: console_.port }, () => mintedSecret);
+    const instanceSocket = await openInstanceSocket(context.databaseFile, { pid: process.pid, build: packageVersion(), database: context.databaseFile, port: console_.port }, () => mintedSecret, 
+    // Easy start D: `toolroll open`'s link verb. mintLocalLink names no account and mints only while local mode is on.
+    () => console_.server.mintLocalLink());
     if (instanceSocket.ok) {
-        mintedSecret = await claimInstance(store, context.databaseFile, { pid: process.pid, port: console_.port, build: packageVersion(), socket: instanceSocket.name }, clock());
+        mintedSecret = await claimInstance(store, context.databaseFile, { pid: process.pid, port: console_.port, build: packageVersion(), socket: instanceSocket.name, keyEpoch: console_.server.keyEpoch }, clock());
         instanceSecret = mintedSecret;
         if (mintedSecret === null)
             progress("attach: another console is running on this database — `toolroll` in a repository opens that one");
@@ -12906,7 +13045,7 @@ async function tidyTasksCommand(positional, flags, context) {
     // the apply reads the same person's projects, so an unchanged list keeps its digest.
     // Whose lists: `--as <you>`, else this machine's saved login (`toolroll up`), else everything (an unrestricted
     // person's list; a person limited to some projects previews with --as).
-    const previewAs = text(flags, "as") ?? readLoginFile(join(dirname(context.databaseFile), UP_LOGIN_FILE))?.name;
+    const previewAs = text(flags, "as") ?? readLoginFile(savedLoginFile(dirname(context.databaseFile)))?.name;
     const daysArg = `${days === TIDY_DEFAULT_DAYS ? "" : ` --days ${days}`}${previewAs === undefined ? "" : ` --as ${previewAs}`}`;
     // `--as` only ever narrows: the named person's projects within the caller's own lens, never beyond it.
     const lens = context.principal?.lens ?? null;
@@ -12997,3 +13136,285 @@ function taskShipCommand(positional, context) {
         ...checks.map(one => `  ${(one.workflow === null ? one.name : `${one.workflow} / ${one.name}`).padEnd(32)} ${(SHIP_CHECK_WORDS[one.state] ?? one.state).padEnd(9)} ${one.seconds === null ? "–" : dur(one.seconds)}`),
     ]);
 }
+// ---- easy-start wave 1a: the laptop start and its start authority (plan A, C4, F) ---------------------------------
+/** `up --laptop` with no projects folder chosen yet: ~/Projects, made owner-only if it isn't there, as its real path.
+ * Null when it can't be made or isn't a folder (the ordinary refusal then applies). */
+function upLaptopProjectsRoot(home) {
+    const folder = join(home, "Projects");
+    try {
+        mkdirSync(folder, { recursive: true, mode: 0o700 });
+    }
+    catch {
+        return null;
+    }
+    return canonicalProject(folder);
+}
+/**
+ * Local mode for a laptop start (plan F): only for a database this start's `--laptop` made (created-by laptop) with no
+ * account yet, and only where this machine has a fence (diagnostic: on Linux without bubblewrap the ordinary password
+ * flow runs). The owner is named like today's minted login: --as, else the user's name. Idempotent: a later start, a
+ * racing start or an install with accounts changes nothing.
+ */
+function upLaptopLocalMode(context, asFlag) {
+    const fence = context.upSeams?.fenceAvailable ?? (() => process.platform === "darwin" ? macosFenceAvailable() : linuxFenceAvailable());
+    const owner = asFlag ?? process.env["USER"] ?? process.env["USERNAME"] ?? "operator";
+    // Cheap reads first: the fence probe runs only for a database that could still be initialized.
+    if (installationCreatedBy(context.store) !== "laptop" || localModeOf(context.store) !== null || context.store.listApprovers().length > 0)
+        return { ok: false, reason: "already" };
+    return initLocalMode(context.store, { owner, fenceAvailable: fence(), now: context.clock() });
+}
+/** The sign-in link `up` asks its console for, by this start's authority: none for "none". */
+export function upLinkRequest(authority, account) {
+    if (authority === "local")
+        return { kind: "local" };
+    if (authority === "full" && account !== null)
+        return { kind: "full", account };
+    return null;
+}
+/**
+ * The console's answer to a link request (plan C4): only the kind its own start was authorised for, whatever the
+ * request says. A local start mints only a local owner's link (mintLocalLink names no account); a full start only the
+ * named account's; "none", or a request of the other kind, mints nothing.
+ */
+export function consoleSignInLink(server, startAuthority, message) {
+    if (message.kind === "local")
+        return startAuthority === "local" ? server.mintLocalLink() : null;
+    return startAuthority === "full" ? server.mintSignInLink(message.account) : null;
+}
+/**
+ * Easy-start C3: whether the terminal UI's local owner may run this command, and as whom. The row is read from the
+ * parsed words (like a remote run's): a command with no row, or a row not marked for the local owner (surface.ts
+ * LOCAL_POLICY), is refused before any command code runs. So are credentials named on the command line (a lead token,
+ * a password): the local owner's authority is its own. Bound to local mode as it reads now; every write it then makes
+ * re-proves that (Store.transact).
+ */
+function localOwnerCommand(store, command, positional, flags) {
+    const binding = localOwnerBinding(store);
+    if (binding === null)
+        return { ok: false, message: "Local mode is off. Sign in with your password in the browser." };
+    const act = localOwnerRowAct(command, positional, flags);
+    if (act === null)
+        return { ok: false, message: localOwnerRefusal(store.accountOf(binding.account)?.passwordSet === true, "/").message };
+    return { ok: true, principal: { account: binding.account, localGeneration: binding.localGeneration, accountGeneration: binding.accountGeneration, transport: "terminal", act, sessionHash: null, request: null } };
+}
+/** The act a command is for the local owner (surface.ts LOCAL_POLICY, its row read from the parsed words), or null:
+ * no row, a row not marked for it, or credentials named on the command line. */
+function localOwnerRowAct(command, positional, flags) {
+    if (["as", "token", "token-file", "token-env"].some(name => flags.has(name)))
+        return null;
+    const row = remoteRowOf(command, positional);
+    // A project's trusted remote (whose main may complete landed work) is set with full authority only.
+    if (row?.invocation === "repos add" && flags.has("remote"))
+        return null;
+    const mark = row === null ? undefined : LOCAL_POLICY.get(row.invocation);
+    return mark === undefined || mark.local !== "allow" ? null : mark.act;
+}
+// ---- easy-start wave 2c: the background service and `stop` (plan D) ---------------------------------------------------
+/** The handoff's seams: the test's own, else this process's terminal (a person may confirm only at one) and prompt. */
+function laptopSeamsOf(context) {
+    const terminal = !context.json && process.stdin.isTTY === true && process.stdout.isTTY === true && !underAgent(process.env);
+    return { terminal, confirm: promptConfirm, ...context.laptopSeams };
+}
+/**
+ * `toolroll background on|off|show`: keep this computer's Toolroll running in the background (a login item), stop
+ * doing that, or say how it stands. This computer's own service: never for a remote caller, never on a demo database.
+ */
+async function backgroundCommand(positional, flags, context) {
+    const { write, json } = context;
+    const [action = "show", ...rest] = positional;
+    const command = `background ${action}`;
+    if (!["on", "off", "show"].includes(action) || rest.length > 0)
+        return fail(write, json, "background", "usage", "Use `toolroll background on|off|show [--port <n>]`.", EXIT.usage);
+    for (const name of flags.keys())
+        if (!["db", "json", "port"].includes(name))
+            return fail(write, json, command, "usage", `--${name} is not a background option.`, EXIT.usage);
+    if (context.principal !== undefined)
+        return fail(write, json, command, "not-remote", "The background service is this computer's own; run it there.", EXIT.refused);
+    const portGiven = text(flags, "port");
+    const port = portGiven === undefined ? null : Number(portGiven);
+    if (port !== null && (!Number.isInteger(port) || port < 1 || port >= 65536))
+        return fail(write, json, command, "usage", "--port is a whole number under 65536", EXIT.usage);
+    const seams = laptopSeamsOf(context);
+    if (action === "show") {
+        const shown = await backgroundShow(context.store, context.databaseFile, port, seams);
+        if (!shown.ok)
+            return fail(write, json, command, shown.reason, shown.message, EXIT.refused);
+        const show = shown.show;
+        const state = show.installed === "absent" ? "off" : show.loaded ? "on" : "installed, not running";
+        return succeed(write, json, command, { ...show, background: show.installed === "absent" ? "off" : "on" }, () => [
+            `Background: ${state}${show.installed === "different" ? " (set up for a different version or port; `toolroll background on` updates it)" : ""}`,
+            show.running === null ? "Toolroll isn't running." : `Toolroll is running at ${show.running.url}`,
+            ...show.conflicts.map(one => `Also here: ${one.reason}`),
+        ]);
+    }
+    const demo = refuseDemo(context, command);
+    if (demo !== null)
+        return demo;
+    if (action === "off") {
+        const off = await backgroundOff(context.store, context.databaseFile, seams);
+        if (!off.ok)
+            return fail(write, json, command, off.reason, off.message, off.reason === "supervisor" || off.reason === "still-running" ? EXIT.failed : EXIT.refused);
+        return succeed(write, json, command, off, () => [off.action === "already-off" ? "Toolroll wasn't set to run in the background." : "Toolroll no longer runs in the background. Start it with `toolroll` when you need it."]);
+    }
+    const on = await backgroundOn(context.store, context.databaseFile, port, seams);
+    if (!on.ok) {
+        const code = ["agent", "conflict", "declined", "running-elsewhere", "unsupported", "console-unproven", "invalid-unit", "unreadable"].includes(on.reason) ? EXIT.refused : EXIT.failed;
+        if (json) {
+            write(envelopeJson({ ok: false, command, reason: on.reason, message: on.message, ...(on.rolledBack === undefined ? {} : { rolledBack: on.rolledBack }) }));
+            return code;
+        }
+        write(`✗ ${on.message}.`);
+        for (const line of on.rolledBack ?? [])
+            write(`  ${line}`);
+        return code;
+    }
+    return succeed(write, json, command, on, () => [on.action === "unchanged" ? `Toolroll already runs in the background at ${on.url}.` : `Toolroll now runs in the background at ${on.url}. It starts when you log in.`]);
+}
+/**
+ * `toolroll stop`: the background service stopped through its supervisor (it comes back at login), or else the
+ * foreground `up` that runs this database's console, stopped by SIGTERM to its controller (found and proved through
+ * its signed process record), waited for until every process it named has exited. Never the console child itself.
+ */
+async function stopCommand(positional, flags, context) {
+    const { write, json } = context;
+    const command = "stop";
+    if (positional.length > 0)
+        return fail(write, json, command, "usage", "Use `toolroll stop`.", EXIT.usage);
+    for (const name of flags.keys())
+        if (!["db", "json"].includes(name))
+            return fail(write, json, command, "usage", `--${name} is not a stop option.`, EXIT.usage);
+    if (context.principal !== undefined)
+        return fail(write, json, command, "not-remote", "Stopping Toolroll is done on its own computer.", EXIT.refused);
+    const stopped = await laptopStop(context.store, context.databaseFile, laptopSeamsOf(context));
+    if (!stopped.ok)
+        return fail(write, json, command, stopped.reason, stopped.message, stopped.reason === "still-running" || stopped.reason === "supervisor" ? EXIT.failed : EXIT.refused);
+    return succeed(write, json, command, stopped, () => [
+        stopped.action === "not-running" ? "Toolroll isn't running."
+            : stopped.action === "service-stopped" ? "Toolroll stopped. It starts again when you log in — run `toolroll background off` to stop that."
+                : "Toolroll stopped.",
+    ]);
+}
+/** A person at this terminal: stdin and stdout a TTY, not --json, not under a coding agent (a UX guard, plan F1). */
+function personAtTerminal(context) {
+    return !context.json && (context.easySeams?.terminal ?? (process.stdin.isTTY === true && process.stdout.isTTY === true && !underAgent(process.env)));
+}
+/**
+ * `toolroll open [--web]`: make sure this computer's Toolroll runs (the background service if installed, else `up
+ * --laptop` as a child of this process), then open the terminal UI on it as the local owner — or, with --web, this
+ * computer's browser, signed in through the console's socket `link` verb. Never prints a sign-in link.
+ */
+async function openCommand(positional, flags, context) {
+    const { write, json } = context;
+    const command = "open";
+    if (positional.length > 0)
+        return fail(write, json, command, "usage", "Use `toolroll open [--web]`.", EXIT.usage);
+    for (const name of flags.keys())
+        if (!["db", "json", "web"].includes(name))
+            return fail(write, json, command, "usage", `--${name} is not an open option.`, EXIT.usage);
+    if (context.principal !== undefined)
+        return fail(write, json, command, "not-remote", "Toolroll opens on its own computer.", EXIT.refused);
+    if (!personAtTerminal(context))
+        return fail(write, json, command, "not-a-terminal", "Run `toolroll open` yourself at a terminal: it opens Toolroll here, signed in.", EXIT.refused);
+    const easy = await import("./easy-start.js");
+    const seams = easy.defaultEasyStartSeams({ databaseFile: context.databaseFile, write, build: packageVersion(), admit: async () => EXIT.ok });
+    return easy.runEasyStart("open", { web: flags.has("web"), projectRoot: null }, { ...seams, ...context.easySeams?.seams });
+}
+/**
+ * `toolroll welcome`: the three steps to a first result (Agent · Project · First task), from the same model the
+ * console's /welcome shows. `--json` prints the model; at a terminal it walks the steps one at a time, checking each
+ * again when the person says it's done. Reads only.
+ */
+async function welcomeCommand(positional, flags, context) {
+    const { write, json } = context;
+    const command = "welcome";
+    if (positional.length > 0)
+        return fail(write, json, command, "usage", "Use `toolroll welcome [--json]`.", EXIT.usage);
+    for (const name of flags.keys())
+        if (!["db", "json"].includes(name))
+            return fail(write, json, command, "usage", `--${name} is not a welcome option.`, EXIT.usage);
+    const { welcomeHere, welcomeLines, welcomeStepLines, WELCOME_STEPS } = await import("./welcome-facts.js");
+    const read = async () => (await welcomeHere(context.store, context.databaseFile, context.clock(), context.easySeams?.check === undefined ? {} : { check: context.easySeams.check })).model;
+    let model = await read();
+    if (json || !personAtTerminal(context) || localOwnerRequested())
+        return succeed(write, json, command, { ...model }, () => welcomeLines(model));
+    const askNow = context.easySeams?.ask ?? ask;
+    write(model.left === 0 ? "Setup is done." : `Welcome to Toolroll. ${model.left} ${model.left === 1 ? "step" : "steps"} to your first result.`);
+    for (const key of WELCOME_STEPS) {
+        for (;;) {
+            write("");
+            for (const line of welcomeStepLines(model, key))
+                write(line);
+            if (model[key].done)
+                break;
+            const said = (await askNow("Press Enter once it's done, s to skip, q to stop: ")).trim().toLowerCase();
+            if (said === "q")
+                return EXIT.ok;
+            if (said === "s")
+                break;
+            model = await read();
+        }
+    }
+    write("");
+    write(model.left === 0 ? "You're set. Run `toolroll` to open Toolroll." : "Run `toolroll` to open Toolroll; the steps left are there too.");
+    return EXIT.ok;
+}
+/**
+ * `toolroll password set`: the local owner's first password (plan C4), typed twice, hidden, at a person's own
+ * terminal — never from a flag, a file or the environment, never under a coding agent. Only while local mode is on and
+ * its owner has none: one transaction (store.ts enrollOwnerPassword) checks that again, writes the hash, moves the
+ * account's generation and ends every session. Local mode stays on. With a password already set, it is refused: sign
+ * in with it in the browser.
+ */
+async function passwordCommand(positional, flags, context) {
+    const { write, json, store } = context;
+    const [action, ...rest] = positional;
+    const command = action === undefined ? "password" : `password ${action}`;
+    if (action !== "set" || rest.length > 0)
+        return fail(write, json, command, "usage", "Use `toolroll password set`.", EXIT.usage);
+    for (const name of flags.keys())
+        if (!["db", "json"].includes(name))
+            return fail(write, json, command, "usage", `--${name} is not a password set option: the password is only ever typed.`, EXIT.usage);
+    if (context.principal !== undefined)
+        return fail(write, json, command, "not-remote", "A password is set on Toolroll's own computer.", EXIT.refused);
+    if (localOwnerRequested() || !personAtTerminal(context))
+        return fail(write, json, command, "not-a-terminal", "Set your password yourself at a terminal: run `toolroll password set`.", EXIT.refused);
+    const binding = localOwnerBinding(store);
+    if (binding === null)
+        return fail(write, json, command, "not-local", "This Toolroll already signs in with a password. Sign in with it in the browser.", EXIT.refused);
+    if (store.accountOf(binding.account)?.passwordSet === true)
+        return fail(write, json, command, "already-set", "A password is already set. Sign in with it in the browser.", EXIT.refused);
+    const typeHidden = context.easySeams?.askHidden ?? askHidden;
+    write(`Choose a password for ${binding.account}. It signs you in from other devices and approves what this computer's browser can't.`);
+    const chosen = await typeHidden("New password: ");
+    if (chosen.length < 8)
+        return fail(write, json, command, "weak-password", "A password needs at least 8 characters. Nothing changed.", EXIT.refused);
+    const again = await typeHidden("Type it again: ");
+    if (again !== chosen)
+        return fail(write, json, command, "mismatch", "The two passwords didn't match. Nothing changed.", EXIT.refused);
+    const enrolled = enrollOwnerPassword(store, binding.account, hashPassword(chosen), binding.localGeneration, context.clock());
+    if (!enrolled.ok) {
+        const words = enrolled.reason === "already-set" ? "A password was just set. Sign in with it in the browser."
+            : enrolled.reason === "local-mode-changed" ? "Local mode changed while you were typing. Nothing changed."
+                : "Only this computer's owner sets the first password. Nothing changed.";
+        return fail(write, json, command, enrolled.reason, words, EXIT.refused);
+    }
+    return succeed(write, json, command, { account: binding.account, generation: enrolled.generation }, () => [
+        "Password set.",
+        "Open browser tabs and the terminal UI sign in again: run `toolroll open`, or sign in with your password.",
+    ]);
+}
+/**
+ * Easy start: the ports `up --laptop` (no --port) tries, in order. The port this install saved, alone; else, for a NEW
+ * laptop install (made by `up --laptop`, nothing saved yet), `up`'s default and the next nineteen, so a console that
+ * isn't this database's (another Toolroll, the desktop app's) never stops a first start; else (an install made any other
+ * way) `up`'s default alone, as before. `fromSeam` replaces the default range in tests.
+ */
+export function upLaptopPortCandidates(store, fromSeam) {
+    const saved = laptopPortOf(store);
+    if (saved !== null)
+        return [saved];
+    const range = fromSeam ?? Array.from({ length: 20 }, (_, index) => 4180 + index);
+    if (installationCreatedBy(store) !== "laptop")
+        return [range[0] ?? 4180];
+    return [...range];
+}