toolroll 0.9.89 → 0.9.91

package/dist/serve.js

@@ -154,19 +154,22 @@ import { createPagesHandlers } from './server/pages.js';
 import { createPeopleHandlers } from './server/people-tokens.js';
 import { createSettingsHandlers } from './server/settings.js';
 import { requestContext } from "./server/request-context.js";
+import { asLocalOwner, localModeOn, localOwnerRefusal, localOwnerStandsNow } from "./local-owner.js";
+import { defaultAgentOf, fillDefaultRouting } from "./model-choices.js";
 import { chromeScript, DEMO_BANNER, DEMO_BANNER_SHORT, focusDocument, KBD_HELP, pinnedTheme, QUEUE_VIEW, refuse, screen, SENSITIVE_INPUT, shell, sidebarScript } from "./server/chrome.js";
-import { BODY_CAP, form, loginHref, matchTaskPath, page, projectChatHref, redactedPath, redirect, respond, safeReturn, SHUTDOWN_WAIT_MS, taskChatHref } from "./server/http.js";
+import { BODY_CAP, form, loginHref, passwordSetNext, refusalNext, matchTaskPath, page, projectChatHref, redactedPath, redirect, respond, safeReturn, SHUTDOWN_WAIT_MS, taskChatHref } from "./server/http.js";
 import { decisionsFor, LEAD_BY_DEFAULT_FACT, leadBrowserMessages, leadChatVersion, NOT_STARTED_SESSION, TASK_COMPOSER_MODES, teamProposalCardParts } from "./server/render-chat.js";
 import {} from "./server/render-pages.js";
-import { serverErrorPage, ssoStepUps, wrongHostPage } from "./server/render-people.js";
+import { localOwnerStepUps, serverErrorPage, ssoStepUps, wrongHostPage } from "./server/render-people.js";
 import { NO_PROJECT, NO_TOUCH_FRAGMENTS, NONCE_CAP, NONCE_TTL_MS, PersistentSessions, SESSION_ABSOLUTE_MS, SESSION_IDLE_MS, sessionWithinLifetime, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH } from "./server/session.js";
 import { createTasksHandlers } from './server/tasks.js';
 import { KIT_BEHAVIOR_MARKUP, KIT_STANDALONE_SCRIPT } from './server/kit-standalone.js';
 import { createWelcomeHandlers } from './server/welcome.js';
+import { createBrowserKeys, KEY_FILL_SCRIPT, pagePathOf } from './server/mutation-key.js';
 import { DEFAULT_GUARD_POLICY, passwordGuardOf, provenPasswordAccount, SourceBudget, withPasswordSource } from "./sign-in-guard.js";
 import { sourceKey } from "./source-key.js";
 import { readSsoSettings } from "./sso-settings.js";
-import { LEAD_THREAD } from "./store.js";
+import { LEAD_THREAD, localOwnerBinding } from "./store.js";
 import { waitingUpdate } from "./toolroll-update.js";
 import { PACKAGE_VERSION } from "./version.js";
 import { loadConsoleUrl } from "./webhooks.js";
@@ -211,6 +214,7 @@ export function createDecisionServer(options) {
         get signInBudget() { return signInBudget; },
         get passwordAllowed() { return passwordAllowed; },
         get sessions() { return sessions; },
+        get browserKeys() { return browserKeys; },
     });
     const { store, evidenceRoot } = options;
     let coding = options.codingWorkspace ?? null;
@@ -363,17 +367,13 @@ export function createDecisionServer(options) {
     const linkKey = (code) => createHash("sha256").update(code).digest("hex");
     function mintSignInLink(account) {
         const known = store.accountOf(account);
-        if (known === null || known.role !== "approver" || known.revokedAt !== null)
+        // A full link is for an account with a password: a local owner without one gets only mintLocalLink's.
+        if (known === null || known.role !== "approver" || known.revokedAt !== null || !known.passwordSet)
             return null;
-        for (const [key, one] of signInLinks)
-            if (one.expires < Date.now())
-                signInLinks.delete(key);
-        while (signInLinks.size >= 20)
-            signInLinks.delete(signInLinks.keys().next().value);
-        const code = randomBytes(32).toString("base64url");
-        signInLinks.set(linkKey(code), { account, expires: Date.now() + SIGN_IN_LINK_MS });
-        return `${SIGN_IN_LINK_PATH}${code}`;
+        return holdSignInLink({ kind: "full", account, expires: Date.now() + SIGN_IN_LINK_MS });
     }
+    /** v147: this console start's key epoch (easy-start C2): the browser-key wave binds each session's mutation key to it. */
+    const keyEpoch = options.keyEpoch ?? randomBytes(16).toString("hex");
     /** This computer, and nothing in front of it: a loopback peer that names a loopback address, with no sign of a proxy —
      * any forwarding header at all (Forwarded, X-Forwarded-*, X-Real-IP, Via, …) disqualifies the request. */
     const fromThisComputer = (request) => {
@@ -754,6 +754,20 @@ export function createDecisionServer(options) {
         const locals = port === null ? [] : [`localhost:${port}`, `127.0.0.1:${port}`, `[::1]:${port}`, ...tailnet.map(name => `${name}:${port}`)];
         return [...locals, ...(options.allowedHosts ?? []), ...(publicOrigin === null ? [] : [publicOrigin.host])].includes(host);
     };
+    /** Easy-start C2: a protected loopback install (bound to loopback only, no --allow-host, no public URL, no tailnet
+     * names) has one browser host, and there every browser mutation also presents the session's key (mutation-key.ts). */
+    const browserKeys = createBrowserKeys({
+        enabled: options.browserKey === true,
+        epoch: keyEpoch,
+        protectedHost: () => {
+            const address = server.address(), port = servedPort();
+            if (typeof address !== "object" || address === null || port === null)
+                return null;
+            if ((options.allowedHosts ?? []).length > 0 || publicOrigin !== null || tailnet.length > 0)
+                return null;
+            return address.address === "127.0.0.1" ? `127.0.0.1:${port}` : address.address === "::1" ? `[::1]:${port}` : null;
+        },
+    });
     /** The exact command that starts this console again as it runs now, plus a listening address or one more allowed host. */
     const consoleCommand = (change) => {
         const port = servedPort() ?? 4180;
@@ -824,6 +838,17 @@ export function createDecisionServer(options) {
         if (!allowedHost(request.headers.host)) {
             return respond(response, 421, "text/html; charset=utf-8", wrongHostPage(wrongHost(request.headers.host)));
         }
+        // Easy-start C2: a protected loopback install has one browser origin, whose storage holds the session's mutation key.
+        // A browser's page read at another loopback name (localhost, [::1]) moves there; machine callers and protocol
+        // adapters (an API token, MCP's own addresses) are left where they are.
+        const canonical = browserKeys.canonicalHost();
+        if (canonical !== null && request.headers.host !== canonical && (method === "GET" || method === "HEAD") && request.headers.authorization === undefined
+            && (edgeRoute === null || edgeRoute.domain === "people")) {
+            request.resume();
+            response.writeHead(308, { location: `http://${canonical}${hook.pathname}${hook.search}`, "cache-control": "no-store", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff" });
+            response.end();
+            return;
+        }
         // A real domain (public-access.ts): HSTS for the public https host reached over HTTPS, and no API token over
         // plain HTTP from outside this computer and the tailnet — refused before anything reads or checks it.
         const transport = transportOf({ peer: request.socket.remoteAddress, joinSource: forwardedSourceOf(request), forwardedProto: request.headers["x-forwarded-proto"], forwarded: request.headers["forwarded"] });
@@ -915,6 +940,13 @@ export function createDecisionServer(options) {
             ...(workspaceRead && typeof request.headers['if-none-match'] === 'string' ? { workspaceIfNoneMatch: request.headers['if-none-match'] } : {}),
             workspaceRequest: url.searchParams.get('request'),
             timeline,
+            // Easy-start C2: every page that posts carries the key fill while the key is required; a session whose key is from
+            // an earlier start (or has none) is told to reconnect.
+            keyFill: browserKeys.required(),
+            // Easy start: a local owner with no password sees "Set a password to do this." where a step-up field would be.
+            ...(who.via === "cookie" && who.authority === "local-owner" && store.accountOf(who.name)?.passwordSet === false
+                ? { localStepUp: localOwnerRefusal(false, method === "GET" ? passwordSetNext(pagePathOf(url)) : "/").href } : {}),
+            reconnect: browserKeys.stale(who, method === "GET" ? safeReturn(pagePathOf(url)) : "/"),
         };
         response.once("finish", () => keepSlowRequest(store, timeline, matchedRoute?.id ?? "unmatched", response.statusCode, clock()));
         if (method === "GET" || method === "POST")
@@ -932,6 +964,12 @@ export function createDecisionServer(options) {
                         return restricted()
                             ? refuse(response, who, 403, "This area requires instance access. Your account operates within its assigned projects.", "/projects")
                             : refuse(response, who, 404, "There's no page at this address.", "/chat");
+                    // Easy-start C1: a local owner's session reaches only the rows marked for it (route-table.ts `local`), decided
+                    // first, before the route's policy reads anything and before any handler runs, GET and POST alike.
+                    if (who.via === "cookie" && who.authority !== "full" && (route.local !== "allow" || localPrincipalOf(who, route) === null)) {
+                        request.resume();
+                        return refuseLocalOwner(response, who, method, url, request.headers.accept);
+                    }
                     const policy = evaluateRoutePolicy(route, { caller: who.via, capability: who.via === "bearer" && who.principal !== undefined ? who.principal.scope : who.role === "approver" ? "act" : "read", viewer: who.role === "viewer", token: who.via === "bearer" && who.principal !== undefined }, source => projectRequestAllowed(route, source, url, who, request, response, body));
                     if (!policy.ok) {
                         if (policy.reason === "project")
@@ -984,14 +1022,20 @@ export function createDecisionServer(options) {
                     }
                     return handlePost(route, url, who, request, response, body);
                 };
+                // Easy-start C1: an allowed row runs as the local owner, in the act the row is (execute refuses every other): the
+                // prover answers "local-owner" only for that act, and every write it makes re-proves it still stands.
+                const local = who.via === "cookie" && who.authority !== "full" && matchedRoute?.stage === "console" && matchedRoute.local === "allow" ? localPrincipalOf(who, matchedRoute) : null;
+                if (local !== null)
+                    response.once("close", () => { local.request.ended = true; });
+                const run = () => local === null ? execute() : asLocalOwner(local, execute);
                 if (method === "GET")
-                    return projectAuthority.run({ actor: who.name, repo: target.repo }, execute);
+                    return projectAuthority.run({ actor: who.name, repo: target.repo }, run);
                 // Request acceptance is separate from durable work completion. Never
                 // persist a body, query string, token, password, or arbitrary URL.
                 const entry = { at: clock().toISOString(), actor: who.name, ...target, source: "request", ...(who.via === "bearer" && who.token !== undefined ? { detail: `API token: ${who.token}` } : {}) };
                 store.recordAction({ ...entry, outcome: "requested" });
                 try {
-                    await projectAuthority.run({ actor: who.name, repo: target.repo }, execute);
+                    await projectAuthority.run({ actor: who.name, repo: target.repo }, run);
                     const createdTask = requestContext.getStore()?.createdTask;
                     const placement = createdTask === undefined ? null : store.lookupRef(createdTask);
                     store.recordAction({ ...entry, ...(placement === null ? {} : { repo: placement.repo, taskId: placement.externalId }), at: clock().toISOString(), outcome: response.statusCode >= 500 ? "error" : response.statusCode >= 400 ? "refused" : "accepted" });
@@ -1195,8 +1239,15 @@ export function createDecisionServer(options) {
         if (provider === null)
             return;
         const now = clock();
-        store.setChatConfig({ provider, model: "default", dailyTurns: 50, weeklyCeilingMicrousd: 0, priceInMicrousd: 0, priceOutMicrousd: 0 }, "toolroll", now);
-        store.recordInstallationFact(LEAD_BY_DEFAULT_FACT, provider, now);
+        store.transact(() => {
+            store.setChatConfig({ provider, model: "default", dailyTurns: 50, weeklyCeilingMicrousd: 0, priceInMicrousd: 0, priceOutMicrousd: 0 }, "toolroll", now);
+            store.recordInstallationFact(LEAD_BY_DEFAULT_FACT, provider, now);
+            // A laptop install (local mode on): the agent chosen here also starts the models, on its default preset, while
+            // nothing is chosen yet, so the owner's first task plans without a password (model-choices.ts fillDefaultRouting).
+            const agent = defaultAgentOf(provider);
+            if (agent !== null && localModeOn(store))
+                fillDefaultRouting(store, agent, "toolroll", { kind: "first-start" }, now);
+        });
     }
     // Look once at start, so the lead is on by the time the browser opens.
     if (options.leadByDefault === true && !store.isDemo() && store.getChatConfig() === null)
@@ -1517,9 +1568,16 @@ export function createDecisionServer(options) {
             if (s.workspace?.view?.kind === "flow")
                 s = { ...s, workspace: { ...s.workspace, view: { ...s.workspace.view, stepUp: { label: ssoFacts.label, fresh: ssoFacts.fresh, confirmHref: `/login/sso?reauth=1&return=${encodeURIComponent(back)}` } } } };
         }
+        // Easy start: a local owner with no password has none to type: each step-up field says how to set one instead.
+        const localStepUp = requestContext.getStore()?.localStepUp;
+        if (localStepUp !== undefined) {
+            s = { ...s, body: localOwnerStepUps(s.body, localStepUp), ...(s.workspace?.pageHtml == null ? {} : { workspace: { ...s.workspace, pageHtml: localOwnerStepUps(s.workspace.pageHtml, localStepUp) } }) };
+        }
         // D5: team chat (the central team service) is deprecated; /chat?team=1 still opens this release, but nothing links to it.
         const sensitive = authored || s.forceSensitive === true;
         const requestFacts = requestContext.getStore();
+        // Easy-start C2: while the browser mutation key is required, every page's one nonce'd script also fills the key.
+        const keyFill = requestFacts?.keyFill === true ? KEY_FILL_SCRIPT : "";
         // The settings frame (settings-kit.ts): its breadcrumb, for the shell and the workspace alike.
         if (s.chrome !== undefined && s.chrome.crumbs === undefined) {
             const crumbs = settingsCrumbs(new URL(requestFacts?.returnTo ?? '/', 'http://standing-orders.local').pathname, s.title, htmlString(s.body));
@@ -1668,6 +1726,8 @@ export function createDecisionServer(options) {
                 ...(extras.firstRun === undefined ? {} : { firstRun: extras.firstRun }),
                 ...(extras.phone === undefined ? {} : { phone: extras.phone }),
                 ...(extras.home == null ? {} : { home: extras.home }),
+                // Easy-start C2: this tab's key is from an earlier start (or it has none): one way to reconnect.
+                ...(requestFacts.reconnect == null ? {} : { reconnect: requestFacts.reconnect }),
             };
             if (requestFacts.workspaceRead) {
                 const validator = requestFacts.workspaceValidator;
@@ -1693,13 +1753,18 @@ export function createDecisionServer(options) {
             // A page with its own view keeps its script; the chat page runs the result script.
             const functional = conversation === null || extras.view ? (s.functional?.script ?? '') : RESULT_REVIEW_SCRIPT;
             const document = shell(s.title, s.body, { chrome: s.chrome, sensitive });
-            return page(response, status, browserWorkspaceDocument(document, workspace, nonce, functional + MOBILE_VIEWPORT_SCRIPT), nonce, true);
+            return page(response, status, browserWorkspaceDocument(document, workspace, nonce, functional + MOBILE_VIEWPORT_SCRIPT + keyFill), nonce, true);
         }
         // A one-time secret on screen (a token, an invite link, a pairing code): the
         // page carries no script of any kind, so it leaves the workspace for a
         // focused page in the same look: the brand, the one card, and the way back.
-        if (s.forceSensitive === true)
-            return page(response, status, focusDocument(s.title, s.body));
+        // Easy-start C2: but for the key fill when it has a form that posts (the fill reads nothing on the page).
+        if (s.forceSensitive === true) {
+            if (keyFill === "" || !/<form\b[^>]*method="post"/i.test(htmlString(s.body)))
+                return page(response, status, focusDocument(s.title, s.body));
+            const nonce = randomBytes(16).toString("base64");
+            return page(response, status, focusDocument(s.title, s.body, { nonce, script: keyFill }), nonce);
+        }
         const chromeLayer = !sensitive && s.chrome !== undefined;
         const functional = s.functional?.script ?? "";
         // Sensitive pages strip the palette and keys but keep the sidebar toggle.
@@ -1707,7 +1772,7 @@ export function createDecisionServer(options) {
         // Kit markup the workspace bundle would have wired (a composer, an overlay, a switch, an idea) gets the kit's own small
         // behaviour here (kit-standalone.ts); never on a sensitive page, which carries no chrome additions.
         const kitBehavior = chromeLayer && KIT_BEHAVIOR_MARKUP.test(htmlString(s.body)) ? KIT_STANDALONE_SCRIPT : "";
-        const script = functional + (chromeLayer ? chromeScript() + WORKSPACE_MOTION_SCRIPT + kitBehavior : sensitiveChrome);
+        const script = functional + (chromeLayer ? chromeScript() + WORKSPACE_MOTION_SCRIPT + kitBehavior : sensitiveChrome) + keyFill;
         const nonce = script === "" ? undefined : randomBytes(16).toString("base64");
         const body = chromeLayer
             ? html `${s.body}\n${paletteTagCached(s.chrome?.project ?? null)}\n${KBD_HELP}`
@@ -1972,7 +2037,7 @@ export function createDecisionServer(options) {
         // and role were admitted by the route table.
         const denied = authorizeMutation(request, who, readForm(posted, CONSOLE_FORMS.mutationGuard));
         if (denied !== null)
-            return refuse(response, who, denied.status, denied.message);
+            return refuse(response, who, denied.status, denied.message, "/", denied.reconnect?.kind === "password" ? { label: "Reconnect", href: denied.reconnect.href } : undefined);
         // Standing can change after a token was minted: a viewer's act stays refused, cookie and bearer alike, except
         // the row's session-local acts.
         if (who.role === "viewer" && !route.viewer)
@@ -2306,6 +2371,8 @@ export function createDecisionServer(options) {
         get firstTasks() { return firstTasks; },
         get authenticateCredential() { return authenticateCredential; },
         get identities() { return identities; },
+        get keyEpoch() { return keyEpoch; },
+        get browserKeys() { return browserKeys; },
     };
     const tasksHandlers = createTasksHandlers(handlerRuntime);
     const pagesHandlers = createPagesHandlers(handlerRuntime);
@@ -2315,6 +2382,7 @@ export function createDecisionServer(options) {
     const peopleHandlers = createPeopleHandlers(handlerRuntime);
     const remoteRuntime = {
         get identify() { return identify; },
+        get browserKeys() { return browserKeys; },
         get freshFactsOf() { return freshFactsOf; },
         get store() { return store; },
         get admitPasswordSource() { return admitPasswordSource; },
@@ -2373,7 +2441,46 @@ export function createDecisionServer(options) {
         }
         return withEdgePolicy(route, () => registry.edge(route, { ...ctx, route }));
     }
-    return Object.assign(server, { mintSignInLink, closeCoding });
+    /** Easy-start C1: the local owner a browser session acts as on an allowed row, bound to its session's saved row and
+     * the generations it was made under; null when it no longer stands (refused like any other row). */
+    function localPrincipalOf(who, route) {
+        const sessionHash = sessions.hashOf(who.session);
+        if (route.localAct === null || who.session.localGeneration === null || sessionHash === null)
+            return null;
+        const principal = { account: who.name, localGeneration: who.session.localGeneration, accountGeneration: who.session.generation,
+            transport: "browser", act: route.localAct, sessionHash, request: { ended: false } };
+        return localOwnerStandsNow(store, principal) ? principal : null;
+    }
+    /** What a local owner hears on a row not marked for it: set a first password, or sign in with the one set. */
+    function refuseLocalOwner(response, who, method, url, accept) {
+        // The page it was refused on, built here from the request (never from a header): a form's nearest page above it.
+        const words = localOwnerRefusal(store.accountOf(who.name)?.passwordSet === true, refusalNext(method, url));
+        // Which refusal this was, for the shell (it offers the same way on) and the route inventory's rule table.
+        response.setHeader("x-toolroll-refused", "local-owner");
+        if (String(accept ?? "").includes("application/json"))
+            return respond(response, 403, "application/json", JSON.stringify({ ok: false, said: words.message, href: words.href }));
+        return refuse(response, who, 403, words.message, words.href, { label: words.action, href: words.href });
+    }
+    // Defined last, so the reviewed functions above keep their places (password-freshness.test.ts).
+    function holdSignInLink(link) {
+        for (const [key, one] of signInLinks)
+            if (one.expires < Date.now())
+                signInLinks.delete(key);
+        while (signInLinks.size >= 20)
+            signInLinks.delete(signInLinks.keys().next().value);
+        const code = randomBytes(32).toString("base64url");
+        signInLinks.set(linkKey(code), link);
+        return `${SIGN_IN_LINK_PATH}${code}`;
+    }
+    /** Easy-start C4: a local owner's one-time link. It names no account: local mode's own owner, read now, while local
+     * mode is on and the owner is active. Redemption reads local mode again and issues only a local-owner session. */
+    function mintLocalLink() {
+        const binding = localOwnerBinding(store);
+        if (binding === null)
+            return null;
+        return holdSignInLink({ kind: "local-owner", ...binding, expires: Date.now() + SIGN_IN_LINK_MS });
+    }
+    return Object.assign(server, { mintSignInLink, mintLocalLink, keyEpoch, closeCoding });
 }
 export { PAGE_CSS, pinnedTheme, SENSITIVE_INPUT } from "./server/chrome.js";
 export { redactedPath, SHUTDOWN_WAIT_MS } from "./server/http.js";

package/dist/server/chat.js

@@ -1,4 +1,6 @@
 import { freshFacts, freshlyApprovable, freshnessFor, spendingOnlyOnSuccess, withFreshness } from "../scope.js";
+import { CHAT_ACTION_LOCAL_ACTS, localOwnerRefusal } from "../local-owner.js";
+import { localApprovalEligible } from "../scope.js";
 import { handlersOf } from './handler-registry.js';
 import { DEPRECATED_PAGE } from "../deprecations.js";
 /** chat handlers, moved without changing their route bodies. */
@@ -410,7 +412,12 @@ export function createChatHandlers(runtime) {
                 const gate = store.approvalGate(task, who.name, 'person');
                 return freshlyApprovable(store, task, scope, gate.verdict === 'seal' && !gate.protectedWork) ? new Date(fresh.at) : null;
             })();
-            const passwordField = !CHAT_ACTIONS[action.operation].password ? '' : reauth(freshSince === null
+            // Easy-start C5: a laptop's local owner confirms its own acts without a password (an approval only when it is
+            // eligible: localApprovalEligible, the rule the seal applies again); anything else says how to get a password.
+            const reviewTask = typeof action.request['task'] === 'string' ? action.request['task'] : null;
+            const localOk = who.authority === 'local-owner' && CHAT_ACTION_LOCAL_ACTS[action.operation] !== null && (action.operation !== 'scope_approve' || (reviewTask !== null && localApprovalEligible(store, who.name, reviewTask).ok));
+            const localWords = who.authority === 'local-owner' && !localOk ? localOwnerRefusal(store.accountOf(who.name)?.passwordSet === true, '/chat') : null;
+            const passwordField = !CHAT_ACTIONS[action.operation].password || localOk ? '' : localWords !== null ? html `<p class="approval-password-note">${localWords.message} <a href="${localWords.href}">${localWords.action}</a></p>` : reauth(freshSince === null
                 ? html `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label>`
                 : html `<label>Your password<input type="password" name="token" autocomplete="current-password"></label><p class="approval-password-note" data-approval-fresh>Your password from ${whenTime(freshSince.toISOString())} is remembered on this computer — leave this blank to approve with it, or type it again.</p>`);
             const content = html `<section class="shared-action"><h1>${action.title}</h1>${evidenceLink}${terms}${postForm(`/chat/proposal/${id}/confirm`, html `<label class="arm"><input type="checkbox" name="confirm" value="yes" required>I confirm this exact action</label>${passwordField}<button>${CHAT_ACTIONS[action.operation].label}</button>`, { returnTo: '/chat', hidden: { nonce: review.nonce } })}</section>`;
@@ -781,7 +788,7 @@ export function createChatHandlers(runtime) {
         }
         // A scope approval's re-check is spent only if the whole confirmation commits (one transaction: the proposal's
         // settlement included). Any other action spends it whatever comes of it (its effects aren't all in the database).
-        const confirmIt = () => confirmLeadProposal(store, principal, id, now, { chatProvider: teamChatProvider, confirm: body.get("confirm") === "yes", via: "web", evidenceRoot, ...(body.has("nonce") ? { actionReview: { nonce: body.get("nonce") ?? "", password: body.get("token") ?? "" } } : {}) });
+        const confirmIt = () => confirmLeadProposal(store, principal, id, now, { authority: who.authority, chatProvider: teamChatProvider, confirm: body.get("confirm") === "yes", via: "web", evidenceRoot, ...(body.has("nonce") ? { actionReview: { nonce: body.get("nonce") ?? "", password: body.get("token") ?? "" } } : {}) });
         const proposed = store.getLeadProposal(id);
         const approving = proposed?.kind === "action" && sharedActionPayload(proposed.payload)?.operation === "scope_approve";
         const outcome = approving ? spendingOnlyOnSuccess(confirmIt, result => !result.ok || ("already" in result && result.already === true)) : confirmIt();
@@ -847,7 +854,7 @@ export function createChatHandlers(runtime) {
             dismissCoordinatorProposal(store, principal, id, now);
             return redirect(response, back);
         }
-        const outcome = confirmCoordinatorProposal(store, principal, id, now, { confirm: body.get("confirm") === "yes", via: "web" });
+        const outcome = confirmCoordinatorProposal(store, principal, id, now, { authority: who.authority, confirm: body.get("confirm") === "yes", via: "web" });
         if (!outcome.ok && (outcome.reason === "not-yours" || outcome.reason === "standing")) {
             return refuse(response, who, outcome.reason === "standing" ? 403 : 404, outcome.said, back);
         }

package/dist/server/chrome.d.ts

@@ -21,7 +21,12 @@ export declare function isOverdue(decision: Decision, now: Date): boolean;
  * a way back — the error path is the one place a console must not stop
  * being a console. Bearer callers still get plain text; they parse, not read.
  */
-export declare function refuse(response: ServerResponse, who: Who | null, status: number, message: string, backHref?: string): void;
+export declare function refuse(response: ServerResponse, who: Who | null, status: number, message: string, backHref?: string, 
+/** The one action that fixes it, in place of "Go back" (easy-start C2: Reconnect). */
+act?: {
+    label: string;
+    href: string;
+}): void;
 /** The demo's one-line promise, on every page. */
 export declare const DEMO_BANNER = "Demo: a scripted lead and sample projects. Nothing calls a model, reaches outside or spends. For your own project, run npx toolroll up in its folder.";
 /** The demo notice on a phone: one line. */
@@ -233,7 +238,10 @@ export declare function personChip(name: string): Html;
 /** The brand, as the workspace sidebar shows it. */
 export declare const BRAND_HTML: Html;
 /** A page on its own, in the workspace's look but with no script: the brand, then the page. */
-export declare function focusDocument(title: string, body: Html): Html;
+export declare function focusDocument(title: string, body: Html, live?: {
+    nonce: string;
+    script: string;
+}): Html;
 export declare function chatMoney(microusd: number | null): string;
 export declare function relativeAge(iso: string, now: Date): string;
 /** The project chip every all-scope row wears: null is UNPLACED, said so. */

package/dist/server/chrome.js

@@ -92,7 +92,9 @@ export function isOverdue(decision, now) {
  * a way back — the error path is the one place a console must not stop
  * being a console. Bearer callers still get plain text; they parse, not read.
  */
-export function refuse(response, who, status, message, backHref = "/") {
+export function refuse(response, who, status, message, backHref = "/", 
+/** The one action that fixes it, in place of "Go back" (easy-start C2: Reconnect). */
+act) {
     if (who === null || who.via === "bearer") {
         return respond(response, status, "text/plain; charset=utf-8", message);
     }
@@ -103,7 +105,7 @@ export function refuse(response, who, status, message, backHref = "/") {
     // The words are the caller's exactly (older callers wrote lower-case fragments; k-refusal capitalises the first letter).
     const body = html `<div class="k-refusal">${status === 404
         ? kitNotFound(path, generic ? {} : { title: message, text: "Home has what needs you; Tasks has every task." })
-        : kitDoc(kitDocHeader({ title: "Request refused", back: [backHref, "Back"] }), kitNotice(message), kitActs(kitBtn("Go back", { href: backHref })))}</div>`;
+        : kitDoc(kitDocHeader({ title: "Request refused", back: [backHref, "Back"] }), kitNotice(message), kitActs(act === undefined ? kitBtn("Go back", { href: backHref }) : kitBtn(act.label, { href: act.href, variant: "primary" })))}</div>`;
     // A signed-in browser keeps the workspace around it: the same navigation as every page.
     const framed = requestContext.getStore()?.refusal;
     if (framed !== undefined && who.via === "cookie")
@@ -111,7 +113,7 @@ export function refuse(response, who, status, message, backHref = "/") {
     return page(response, status, shell(status === 404 ? "Not found" : "Request refused", outPage({
         brand: BRAND_HTML, title: status === 404 ? "Not found" : "Request refused",
         body: html `<div class="k-refusal">${kitNotice(status === 404 && generic ? `There\u2019s no page at ${path}.` : message)}</div>`,
-        foot: html `<a class="k-link" href="${status === 404 ? "/" : backHref}">${status === 404 ? "Go to Home" : "Go back"}</a>`,
+        foot: act === undefined ? html `<a class="k-link" href="${status === 404 ? "/" : backHref}">${status === 404 ? "Go to Home" : "Go back"}</a>` : html `<a class="k-link" href="${act.href}">${act.label}</a>`,
     })));
 }
 /** The demo's one-line promise, on every page. */
@@ -652,8 +654,8 @@ export function personChip(name) {
 /** The brand, as the workspace sidebar shows it. */
 export const BRAND_HTML = html `<span class="so-brand-mark" aria-hidden="true"><i></i><i></i><i></i></span>Toolroll`;
 /** A page on its own, in the workspace's look but with no script: the brand, then the page. */
-export function focusDocument(title, body) {
-    return shell(title, html `<div class="focus-page"><a class="so-wordmark focus-brand" href="/chat">${BRAND_HTML}</a>${body}</div>`);
+export function focusDocument(title, body, live) {
+    return shell(title, html `<div class="focus-page"><a class="so-wordmark focus-brand" href="/chat">${BRAND_HTML}</a>${body}</div>`, live === undefined ? {} : { live });
 }
 export function chatMoney(microusd) {
     return microusd === null ? "unknown" : `$${(microusd / 1_000_000).toFixed(2)}`;

package/dist/server/console.css

@@ -2783,3 +2783,13 @@ html.so-swap::view-transition-old(*):only-child { animation: so-card-out 160ms e
   .put-away-item { min-height: 44px; }
   .put-away-days button, .task-archived button, .work-row-status form.inline button { min-height: 44px; }
 }
+/* The welcome (/welcome): three steps from the kit's pieces. A form holding one button sits in its row of acts. */
+.welcome-step .k-note { margin: 0; }
+.welcome-rows { display: grid; }
+.welcome-rows .k-sl-t { display: block; overflow-wrap: anywhere; }
+.welcome-rows .k-mono { overflow-wrap: anywhere; }
+.welcome-form, .welcome .k-srec-a form { display: contents; }
+.welcome .k-btn { min-height: 0; }
+@media (max-width: 40rem) { .welcome form > .k-btn[type=submit] { width: auto; } }
+/* On a phone the step's primary lives in the dock: its copy in the step is hidden. */
+@media (max-width: 760px) { .welcome .k-btn.k-docked { display: none; } }

package/dist/server/guards.d.ts

@@ -42,6 +42,8 @@ export interface GuardsRuntime {
     signInBudget: SourceBudget;
     passwordAllowed: (name: string) => boolean;
     sessions: PersistentSessions;
+    /** Easy-start C2: the browser mutation key's one check (server/mutation-key.ts). */
+    browserKeys: Pick<import("./mutation-key.js").BrowserKeys, "check">;
 }
 export declare function createSharedGuards(runtime: GuardsRuntime): {
     authenticateApprover: (who: Who, token: string, repo?: string | null) => ReturnType<typeof checkApproverPassword>;
@@ -49,6 +51,7 @@ export declare function createSharedGuards(runtime: GuardsRuntime): {
     authorizeMutation: (request: IncomingMessage, who: Who, body: FormView<FormFieldOf<"mutationGuard">>) => {
         status: number;
         message: string;
+        reconnect?: import("./mutation-key.js").Reconnect;
     } | null;
     projectOf: (who: Who, request: IncomingMessage) => string | null | undefined;
     resolveRouteProject: (source: RouteDeclaration['project'], url: URL, who: Who, request: IncomingMessage, body: URLSearchParams | null) => string | null;

package/dist/server/guards.js

@@ -9,7 +9,8 @@ import { REMOTE_MESSAGES, reproveRemote } from "../operate-remote.js";
 import { canonicalProject, rowVisible } from "../project.js";
 import { authenticateAccount, authenticateApprover as checkApproverPassword, credentialProof } from "../scope.js";
 import { SourceBudget } from "../sign-in-guard.js";
-import {} from "../store.js";
+import { localModeOf } from "../store.js";
+import { currentLocalOwner, localBindingStands, localOwnerStandsNow } from "../local-owner.js";
 import { requestContext } from "./request-context.js";
 import { refuse } from "./chrome.js";
 import { matchTaskPath } from "./http.js";
@@ -105,6 +106,19 @@ export function createSharedGuards(runtime) {
             if (body.get("csrf") !== who.session.csrf) {
                 return { status: 403, message: "stale form — reload and try again" };
             }
+            // Easy-start C2: on a protected loopback install the CSRF token is rendered into pages any cookie holder can read,
+            // so a mutation also presents the session's key, which only this console's own origin holds.
+            const keyed = runtime.browserKeys.check(who, request, body.sent);
+            if (keyed !== null)
+                return keyed;
+            // Easy-start C1 (after the CSRF and key proofs, so a forged post learns nothing more): a local owner's session
+            // mutates only inside the console's admission of a row marked for it (which set the local owner this chain acts
+            // as), and only while that still stands; anywhere else it is refused.
+            if (who.authority !== "full") {
+                const local = currentLocalOwner();
+                if (local === null || local.account !== who.name || !localOwnerStandsNow(runtime.store, local))
+                    return { status: 403, message: "Set a password to do this." };
+            }
         }
         return null;
     }
@@ -316,7 +330,7 @@ export function createSharedGuards(runtime) {
         if (match === null)
             return null;
         const session = lookupSession(match[1], touch);
-        return session === null ? null : { name: session.name, via: "cookie", session, role: session.role };
+        return session === null ? null : { name: session.name, via: "cookie", session, role: session.role, authority: session.authority };
     }
     /**
      * Constant-time against the session table, small as it is — and every hit
@@ -350,6 +364,12 @@ export function createSharedGuards(runtime) {
                 runtime.sessions.delete(id);
                 return null;
             }
+            // v147: a local owner's session stands only while local mode is on, at the generation it was made under, for its
+            // owner. Off, moved or changed hands: the session is ended, never read as full.
+            if (session.authority !== "full" && !localBindingStands(localModeOf(runtime.store), { account: session.name, localGeneration: session.localGeneration })) {
+                runtime.sessions.delete(id);
+                return null;
+            }
             // Ended in another process (or from Sessions): the cached copy is dropped, never used.
             if (!runtime.sessions.stillSaved(id)) {
                 Map.prototype.delete.call(runtime.sessions, id);

package/dist/server/http.d.ts

@@ -151,6 +151,12 @@ export type ServeOptions = {
     ssoFetch?: typeof fetch;
     /** Cockpit B1: this `up` console's instance secret (null: none — the instance route answers 404). */
     instanceSecret?: () => string | null;
+    /** v147 (easy-start C2): this console start's key epoch, minted once per start (absent: the server mints its own).
+     * A session's mutation key is bound to it; a key from another start is stale. */
+    keyEpoch?: string;
+    /** Easy-start C2: the browser mutation key. On (a real console start, operate.ts startConsole), a protected loopback
+     * install's browser sessions carry a key every mutation must present (server/mutation-key.ts). Off: unchanged. */
+    browserKey?: boolean;
     /** v137: whether this console is draining (its `up` is stopping): /healthz says so at once, and pages say Toolroll is restarting. */
     draining?: () => boolean;
     /** Cockpit E: how Finder is asked to reveal a proved checkout (tests pass their own; never a launch). True: shown. */
@@ -307,3 +313,19 @@ export declare function form(request: IncomingMessage, cap?: number): Promise<UR
 /** A refused chat setting (POST /chat/config): back on the lead's settings it is a ?problem=, which the page's section
  * shows in place with the edits kept; elsewhere it stays the chat's said line. */
 export declare function chatRefusal(back: string, words: string): string;
+/** The longest page a refusal's "Set a password" link carries on to. */
+export declare const PASSWORD_SET_NEXT_MAX = 512;
+/**
+ * Where /password/set continues once the first password is set (easy-start C4): a page of this console a browser can
+ * open, as path and query only — one leading slash, never two, no backslash, no scheme or host (also once decoded),
+ * no control characters, at most PASSWORD_SET_NEXT_MAX characters, never the sign-in, sign-out, sign-up, join or
+ * password roads, never a region fetch, query keys that could carry a secret dropped. Anything else is home ("/").
+ */
+export declare function passwordSetNext(raw: string | null | undefined): string;
+/**
+ * The page a refused request was on, for its "Set a password" link: a page read is itself; a refused form is its own
+ * address when a browser can open it (a settings page posting to itself), else the nearest page above it
+ * (`/t/x/complete` → `/t/x`, `/flows/example` → `/flows`), since
+ * the console sends no Referer to name the page the form was on. Checked by passwordSetNext; else home.
+ */
+export declare function refusalNext(method: string, url: URL): string;

package/dist/server/http.js

@@ -19,6 +19,7 @@ import {} from "../toolroll-update.js";
 import { timingSafeEqual } from "node:crypto";
 import {} from "node:http";
 import { SIGN_IN_LINK_PATH } from "./session.js";
+import { matchRoute } from "./route-table.js";
 import {} from "../folder-look.js";
 import {} from "../project-identity.js";
 import {} from "../learning-look.js";
@@ -257,3 +258,60 @@ export async function form(request, cap = BODY_CAP) {
 export function chatRefusal(back, words) {
     return back === "/settings/lead" ? `/settings/lead?problem=${encodeURIComponent(words)}` : chatReturnWithSaid(back, words);
 }
+/** The longest page a refusal's "Set a password" link carries on to. */
+export const PASSWORD_SET_NEXT_MAX = 512;
+/**
+ * Where /password/set continues once the first password is set (easy-start C4): a page of this console a browser can
+ * open, as path and query only — one leading slash, never two, no backslash, no scheme or host (also once decoded),
+ * no control characters, at most PASSWORD_SET_NEXT_MAX characters, never the sign-in, sign-out, sign-up, join or
+ * password roads, never a region fetch, query keys that could carry a secret dropped. Anything else is home ("/").
+ */
+export function passwordSetNext(raw) {
+    if (typeof raw !== "string" || raw === "" || raw.length > PASSWORD_SET_NEXT_MAX)
+        return "/";
+    if (!raw.startsWith("/") || raw.startsWith("//") || raw.includes("\\") || /[\u0000-\u001f\u007f]/.test(raw))
+        return "/";
+    let parsed;
+    try {
+        parsed = new URL(raw, "http://standing-orders.local");
+    }
+    catch {
+        return "/";
+    }
+    if (parsed.origin !== "http://standing-orders.local" || parsed.username !== "" || parsed.password !== "")
+        return "/";
+    let decoded;
+    try {
+        decoded = decodeURIComponent(parsed.pathname);
+    }
+    catch {
+        return "/";
+    }
+    if (/^\/\/|\\|[\u0000-\u001f\u007f]|^\/[a-z][a-z0-9+.-]*:/i.test(decoded) || /^\/(login|logout|signup|join|password)(\/|$)/.test(decoded))
+        return "/";
+    if (parsed.searchParams.has("fragment") || matchRoute("GET", parsed.pathname, "console") === null)
+        return "/";
+    for (const key of [...parsed.searchParams.keys()])
+        if (/token|password|secret|csrf|code|key|auth/i.test(key))
+            parsed.searchParams.delete(key);
+    const query = parsed.searchParams.toString();
+    const next = `${parsed.pathname}${query === "" ? "" : `?${query}`}`;
+    return next.length > PASSWORD_SET_NEXT_MAX ? "/" : next;
+}
+/**
+ * The page a refused request was on, for its "Set a password" link: a page read is itself; a refused form is its own
+ * address when a browser can open it (a settings page posting to itself), else the nearest page above it
+ * (`/t/x/complete` → `/t/x`, `/flows/example` → `/flows`), since
+ * the console sends no Referer to name the page the form was on. Checked by passwordSetNext; else home.
+ */
+export function refusalNext(method, url) {
+    if (method === "GET" || method === "HEAD")
+        return passwordSetNext(url.pathname + url.search);
+    const parts = url.pathname.split("/").filter(part => part !== "");
+    for (; parts.length > 0; parts.pop()) {
+        const page = passwordSetNext(`/${parts.join("/")}`);
+        if (page !== "/")
+            return page;
+    }
+    return "/";
+}

package/dist/server/live.js

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { boardRunOf, holdAgentView, releaseAgentView } from "../agent-board.js";
+import { boardRunOf } from "../agent-board.js";
 import { agentRunFingerprint } from "../agents-board.js";
 import { createLiveRooms, LiveConnection } from "../live-bus.js";
 import { reproveRemote } from "../operate-remote.js";
@@ -269,20 +269,10 @@ export function createLiveHandlers(runtime, live) {
                 if (run === null || repo === null || !visible(repo) || !store.accountCanAccess(who.name, repo))
                     return json(response, 404, { error: "run" });
                 // A repair is its build's own activity: its room is the build's.
-                const signedIn = sameBrowser(request, browser), runId = boardRunOf(store, run.id), view = randomBytes(12).toString("hex");
-                // The watch is a short lease in the database, renewed on every keep-alive and released when the page goes:
-                // the process that sends chat pings reads it there (agent-board.ts watchingAgent).
-                const watch = () => { try {
-                    holdAgentView(store, view, who.name, runId, clock());
-                }
-                catch { /* a missed renewal only lets a ping through */ } };
+                const signedIn = sameBrowser(request, browser), runId = boardRunOf(store, run.id);
+                // The watch lease (agent-board.ts watchingAgent) is held by the shell's keyed POST /agents/watch on each keep-alive
+                // and released on unload (easy-start N1): this stream only reads, so a stolen cookie can't hold one to quiet pings.
                 joins.push(connection => {
-                    watch();
-                    connection.onKeepAlive(watch);
-                    connection.onClose(() => { try {
-                        releaseAgentView(store, view, clock());
-                    }
-                    catch { /* it lapses on its own */ } });
                     agentRooms.join(runId, { name: who.name, room: name, connection,
                         valid: () => signedIn() && rowVisible(liveCeiling(), repo) && store.accountCanAccess(who.name, repo) });
                 });