toolroll 0.9.89 → 0.9.91

package/dist/server/remote.js

@@ -38,6 +38,9 @@ export function createRemoteHandlers(runtime) {
             const account = who === null ? null : store.accountOf(who.name);
             if (!who || !account || account.revokedAt !== null)
                 return null;
+            // Easy-start C1: team conversations are a remote feature; a laptop's local owner (no password) never reaches them.
+            if (who.via === 'cookie' && who.authority !== 'full')
+                return null;
             if (who.via === 'bearer')
                 passwordProvedAt.set(request, clock().getTime());
             return { name: who.name, generation: account.generation, role: account.role };
@@ -71,7 +74,7 @@ export function createRemoteHandlers(runtime) {
                 return true;
             }
             const who = identify(request, false);
-            return who?.name === actor.name && who.via === 'cookie' && who.session.generation === actor.generation;
+            return who?.name === actor.name && who.via === 'cookie' && who.authority === 'full' && who.session.generation === actor.generation;
         },
         authorizeMutation: (request, actor) => {
             if (actor.principal !== undefined)
@@ -81,11 +84,15 @@ export function createRemoteHandlers(runtime) {
                 return false;
             if (who.via === 'bearer')
                 return request.headers.origin === undefined;
+            if (who.authority !== 'full')
+                return false;
             const origin = request.headers.origin, referer = request.headers.referer;
             const named = typeof origin === 'string' && origin !== 'null' ? origin : typeof referer === 'string' ? referer : null;
             if (named !== null && !allowedHost(named.replace(/^https?:\/\//, '').split('/')[0]))
                 return false;
-            return request.headers['x-csrf-token'] === who.session.csrf;
+            // Easy-start C2: and, on a protected loopback install, the session's key (its header), which a cookie holder on
+            // another port can't read.
+            return request.headers['x-csrf-token'] === who.session.csrf && runtime.browserKeys.check(who, request, null) === null;
         },
         execute: async (actor, input) => {
             const reply = await team.execute(actor, input);
@@ -112,7 +119,8 @@ export function createRemoteHandlers(runtime) {
         requesterKey: joinSourceOf,
         session: request => {
             const who = identify(request, false);
-            if (who === null || who.via !== "cookie")
+            // Easy-start C1: connecting an outside app is a credential act; a local owner's session is never one that consents.
+            if (who === null || who.via !== "cookie" || who.authority !== "full")
                 return null;
             return { name: who.name, role: who.role, csrf: who.session.csrf, generation: who.session.generation,
                 sso: who.session.sso === undefined ? null : { label: ssoSettings()?.label ?? "your identity provider",
@@ -123,13 +131,20 @@ export function createRemoteHandlers(runtime) {
             const named = typeof origin === "string" && origin !== "null" ? origin : typeof referer === "string" ? referer : null;
             return named !== null && allowedHost(named.replace(/^https?:\/\//, "").split("/")[0]);
         },
+        // Easy-start C2: the consent's own post presents the session's key too (its form carries it, filled by the page's
+        // one nonce'd script while the key is required).
+        keyed: (request, form) => {
+            const who = identify(request, false);
+            return who !== null && who.via === "cookie" && runtime.browserKeys.check(who, request, form) === null;
+        },
+        keyFill: () => runtime.browserKeys.required(),
         // The step-up for a credential: the person's password, or (empty) a fresh identity-provider check. What they may
         // grant (their role, their projects) is checked beside it.
         // Proved on this request's live session at the moment of consent (signed in here still, same generation), through
         // the one account step-up: a password typed now, or an explicit re-check (spent). Never a remembered password.
         confirm: (request, session, typed) => {
             const who = identify(request, false);
-            if (who === null || who.via !== "cookie" || who.name !== session.name || who.session.generation !== session.generation)
+            if (who === null || who.via !== "cookie" || who.authority !== "full" || who.name !== session.name || who.session.generation !== session.generation)
                 return false;
             // Connecting an outside app is a credential act: never a session (Passwordless) or a remembered password.
             return freshFacts.run(runtime.freshFactsOf(request, who), () => { const proved = proveAccountNow(store, who.name, typed, { credential: true }); return proved.ok && credentialProof(proved.method); });

package/dist/server/render-new-task.js

@@ -8,6 +8,7 @@ import { html, joinHtml, postForm } from "../html.js";
 import { projectName } from "../project.js";
 import { screen } from "./chrome.js";
 import { btn, composer, disclose, doc, docHeader, dock, field, ideas, input, note, phoneHeader, radios, select, sendButton, textarea, toggleChip } from "./kit.js";
+import { TASK_TEXT_LIMITS } from "../task-text.js";
 const FORM_ID = "nt-form";
 const PLAN_ON = "The agent reads the code and asks you anything unclear, then writes the plan.";
 const PLAN_OFF = "The agent writes the plan straight from your words. Faster for small, obvious changes.";
@@ -59,7 +60,10 @@ suggestions = []) {
         value: text, rows: 4, maxRows: 10, before: bar, error: problem,
         send: sendButton({ label: "File task" }),
         note: html `<span class="k-on-note">${PLAN_ON}</span><span class="k-off-note">${PLAN_OFF}</span>`,
-        textAttrs: { maxlength: 200, autofocus: true },
+        // The box holds what a title holds: a task's words are its title, and the planner reads nothing else of them when no
+        // goal is given, so longer words would be lost, not kept. Filing's whole-word cut (task-text.ts titleWithin) is a
+        // belt for other callers only.
+        textAttrs: { maxlength: TASK_TEXT_LIMITS.title, autofocus: true },
     });
     const options = html `<div class="k-form">\
 ${field({ id: "nt-quality", label: "Checks", control: select({ id: "nt-quality", name: "quality-mode", items: [["default", "Default checks"], ["strict", "Strict (release)"]], current: quality, wide: true }) })}\

package/dist/server/render-pages.d.ts

@@ -341,7 +341,8 @@ export type OnboardCardState = {
     why: string;
 } | {
     enabled: true;
-    roots: readonly string[];
+    roots: readonly string[]; /** Easy-start: the local owner's own session (no password to type; the prover's local-owner branch proves the clone). */
+    localOwner?: boolean;
     record: [string, {
         nameWithOwner: string;
         rootIndex: number;

package/dist/server/render-pages.js

@@ -881,7 +881,7 @@ export function queueScript() {
         `function problem(task,text){var card=region.querySelector('.queue-card[data-task="'+task.replace(/["\\\\]/g,"")+'"]');if(!card)return false;` +
         `var old=card.querySelector(".queue-problem");if(old)old.remove();` +
         `var row=document.createElement("p");row.className="problem queue-problem";row.setAttribute("role","alert");row.textContent=text;card.appendChild(row);return true;}` +
-        `fetch("/queue/move",{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:post.toString(),redirect:"manual"})` +
+        `fetch("/queue/move",{method:"POST",headers:(window.soKeyHeaders||function(h){return h})({"Content-Type":"application/x-www-form-urlencoded"}),body:post.toString(),redirect:"manual"})` +
         `.then(function(r){if(r.ok)return fetch("/queue?fragment=1",{redirect:"manual",cache:"no-store"}).then(function(f){` +
         `if(f.type==="opaqueredirect"||f.status===401||f.status===403){location.href="/login";return false;}return f.ok?f.text():null;});` +
         `if(r.type==="opaqueredirect"||r.status===401||r.status===403){location.href="/login";return false;}` +

package/dist/server/render-people.d.ts

@@ -27,10 +27,46 @@ export declare function ssoStepUps(page: Html, sso: {
     label: string;
     fresh: boolean;
 }, returnTo: string): Html;
+/**
+ * Easy start: for a local owner who has no password yet, every step-up password field (type=password with
+ * autocomplete="current-password", typed-only ones included) becomes "Set a password to do this." and the Set a
+ * password link, carrying this page on: there is no password to type. A new password, a secret or a key field is
+ * never one. The field's own label and hint go with it.
+ */
+export declare function localOwnerStepUps(page: Html, setHref: string): Html;
 export declare function loginPage(problem: string | null, returnTo?: string, sso?: {
     label: string;
     operatorsOnly: boolean;
 } | null): Html;
+/**
+ * Easy-start C2: reconnect this tab after a restart (or when it lost its key): the password again for a full session, an
+ * identity-provider sign-in for one that signs in there, or the terminal for a local owner (no password exists).
+ */
+export declare function reconnectPage(problem: string | null, returnTo: string, how: {
+    kind: "password";
+    name: string;
+} | {
+    kind: "sso";
+    label: string;
+} | {
+    kind: "command";
+}): Html;
+/** Which /password/set field a refusal is about (null: the page itself). */
+export type PasswordSetProblem = {
+    field: "password" | "again" | null;
+    text: string;
+};
+/**
+ * Easy-start C4: the local owner's first password. Two fields and one button; the form carries the session's CSRF token
+ * (render it inside withFormToken) and, through the page's key fill, the browser key and the act that was refused, to continue there. Neither typed
+ * password ever comes back on a refusal.
+ */
+export declare function passwordSetPage(view: {
+    returnTo: string;
+    problem: PasswordSetProblem | null;
+}): Html;
+/** /password/set once a password exists (set earlier, or just now in another tab): sign in with it, and come back. */
+export declare function passwordAlreadySetPage(title: string, returnTo: string, signedIn?: boolean): Html;
 /**
  * The page for an address the console doesn't answer to (onboarding): what was opened, where it answers, and the exact
  * command that admits this address. It stands alone (styles inline, no script, no font), because every other asset

package/dist/server/render-people.js

@@ -54,6 +54,19 @@ export function ssoStepUps(page, sso, returnTo) {
     const labelled = replaceMarkup(page, /<label>[^<]*<input\b([^>]*)>\s*<\/label>/g, (_whole, attributes) => stepUp(attributes) ? swap(attributes) : null);
     return replaceMarkup(labelled, /<input\b([^>]*)>/g, (_whole, attributes) => stepUp(attributes) ? swap(attributes) : null);
 }
+/**
+ * Easy start: for a local owner who has no password yet, every step-up password field (type=password with
+ * autocomplete="current-password", typed-only ones included) becomes "Set a password to do this." and the Set a
+ * password link, carrying this page on: there is no password to type. A new password, a secret or a key field is
+ * never one. The field's own label and hint go with it.
+ */
+export function localOwnerStepUps(page, setHref) {
+    const stepUp = (attributes) => /\btype="password"/.test(attributes) && /\bautocomplete="current-password"/.test(attributes);
+    const instead = () => html `<p class="k-note" data-local-step-up>Set a password to do this. <a class="k-link" href="${setHref}">Set a password</a></p>`;
+    const fields = replaceMarkup(page, /<div class="k-field"><label class="k-label" for="[^"]*">[^<]*<\/label><input\b([^>]*)>(?:<p class="k-hint"[^>]*>[^<]*<\/p>)?(?:<span class="k-err"[^>]*>[^<]*<\/span>)?<\/div>/g, (_whole, attributes) => stepUp(attributes) ? instead() : null);
+    const labelled = replaceMarkup(fields, /<label\b[^>]*>[^<]*(?:<span\b[^>]*>[^<]*<\/span>)?[^<]*<input\b([^>]*)>\s*<\/label>/g, (_whole, attributes) => stepUp(attributes) ? instead() : null);
+    return replaceMarkup(labelled, /<input\b([^>]*)>/g, (_whole, attributes) => stepUp(attributes) ? instead() : null);
+}
 /** An expiry as a person reads it: "Thu 5 Nov, 10:42". */
 function expiryWords(iso) {
     const at = new Date(iso);
@@ -77,7 +90,58 @@ export function loginPage(problem, returnTo = "/", sso = null) {
         ]);
     return shell("Sign in · Toolroll", outPage({
         brand: BRAND_HTML, brandHref: "/login", title: "Sign in", body,
-        foot: html `${sso === null ? html `Forgot it? Your first login was shown when Toolroll started, and saved beside its database as <code>up-login.txt</code> on the computer running it.<br>` : ""}No account? Ask whoever runs this Toolroll for an invite link.`,
+        foot: html `${sso === null ? html `Forgot it? Your first login was shown when Toolroll started, and saved beside its database in <code>.toolroll-secrets/up-login.txt</code> on the computer running it.<br>` : ""}No account? Ask whoever runs this Toolroll for an invite link.`,
+    }), { nav: false });
+}
+/**
+ * Easy-start C2: reconnect this tab after a restart (or when it lost its key): the password again for a full session, an
+ * identity-provider sign-in for one that signs in there, or the terminal for a local owner (no password exists).
+ */
+export function reconnectPage(problem, returnTo, how) {
+    const back = returnTo === "/" ? null : returnTo;
+    const body = how.kind === "command"
+        ? html `<p>Run <code>toolroll open</code> on this computer to reconnect.</p>`
+        : how.kind === "sso"
+            ? btn(`Sign in with ${how.label}`, { variant: "primary", href: `/login/sso${back === null ? "" : `?return=${encodeURIComponent(back)}`}`, className: "k-wide" })
+            : postForm("/login/rekey", joinHtml([
+                outField({ id: "rekey-password", label: `Password for ${how.name}`, name: "token", type: "password", attrs: { autocomplete: "current-password", required: true, autofocus: true } }),
+                btn("Reconnect", { variant: "primary", type: "submit", className: "k-wide" }),
+            ]), { signedOut: true, returnTo: back, attrs: { class: "k-form" } });
+    return shell("Reconnect · Toolroll", outPage({
+        brand: BRAND_HTML, brandHref: "/", title: "Reconnect",
+        body: joinHtml([problem === null ? "" : html `<div class="k-refusal">${notice(problem)}</div>`, body]),
+        foot: html `Toolroll restarted, so this tab needs a fresh connection before it can make changes.`,
+    }), { nav: false });
+}
+/**
+ * Easy-start C4: the local owner's first password. Two fields and one button; the form carries the session's CSRF token
+ * (render it inside withFormToken) and, through the page's key fill, the browser key and the act that was refused, to continue there. Neither typed
+ * password ever comes back on a refusal.
+ */
+export function passwordSetPage(view) {
+    const problem = view.problem;
+    const error = (field) => problem !== null && problem.field === field ? problem.text : null;
+    const back = view.returnTo === "/" ? null : view.returnTo;
+    const form = postForm("/password/set", joinHtml([
+        outField({ id: "password-new", label: "Password", name: "password", type: "password", hint: `At least ${SIGNUP_PASSWORD_MIN} characters.`, error: error("password"),
+            attrs: { autocomplete: "new-password", required: true, minlength: SIGNUP_PASSWORD_MIN, ...(problem === null ? { autofocus: true } : {}) } }),
+        outField({ id: "password-again", label: "Type it again", name: "again", type: "password", error: error("again"),
+            attrs: { autocomplete: "new-password", required: true, minlength: SIGNUP_PASSWORD_MIN } }),
+        btn("Set password", { variant: "primary", type: "submit", className: "k-wide" }),
+    ]), { hidden: { next: back }, attrs: { class: "k-form" } });
+    return shell("Set a password · Toolroll", outPage({
+        brand: BRAND_HTML, brandHref: "/", title: "Set a password",
+        sub: "Agents can work on their own, merge and release only after you set a password.",
+        body: joinHtml([problem !== null && problem.field === null ? html `<div class="k-refusal">${notice(problem.text)}</div>` : "", form,
+            html `<div class="k-acts">${btn("Not now", { variant: "ghost", href: view.returnTo, className: "k-wide" })}</div>`]),
+    }), { nav: false });
+}
+/** /password/set once a password exists (set earlier, or just now in another tab): sign in with it, and come back. */
+export function passwordAlreadySetPage(title, returnTo, signedIn = false) {
+    return shell(`${title} · Toolroll`, outPage({
+        brand: BRAND_HTML, brandHref: "/", title, sub: signedIn ? "You're signed in with it." : "Sign in with it to continue.",
+        body: html `<div class="k-acts">${signedIn ? btn("Continue", { variant: "primary", href: returnTo, className: "k-wide" })
+            : btn("Sign in", { variant: "primary", href: returnTo === "/" ? "/login" : `/login?return=${encodeURIComponent(returnTo)}`, className: "k-wide" })}</div>`,
     }), { nav: false });
 }
 /**

package/dist/server/render-projects.js

@@ -73,7 +73,9 @@ export function cloneReviewHtml(onboard, problem) {
         return null;
     const [nonce, record] = onboard.record;
     const kind = "step-up";
-    const factsNow = approvalFactsNow();
+    // The local owner has no password to type: the clone is its own act (add-project), proved by the session at confirm.
+    const local = onboard.localOwner === true;
+    const factsNow = local ? { ...approvalFactsNow(), passwordless: true } : approvalFactsNow();
     const size = record.diskUsageKib === null ? "Unknown" : `${Math.max(1, Math.round(record.diskUsageKib / 1024))} MiB`;
     const bigOk = record.large
         ? html `<div class="k-checks"><label><input type="checkbox" name="big-ok" value="1" required>${record.nameWithOwner} is ${record.diskUsageKib === null ? "of unknown size" : size}. Clone it anyway</label></div>`
@@ -82,7 +84,7 @@ export function cloneReviewHtml(onboard, problem) {
         status: html `<h2>Clone ${record.nameWithOwner}</h2>`,
         text: html `Review before anything is downloaded. Clones into ${mono(shortPathOf(record.target))} and adds it as a project. Large-file (LFS) objects aren’t downloaded.`,
         acts: approveForm({ action: "/projects/onboard-confirm", kind, facts: factsNow, label: "Clone and add", form: { hidden: { nonce } }, before: bigOk }),
-        terms: `${approvalTerms(kind, factsNow)} The review expires in 10 minutes.`,
+        terms: `${local ? "No password needed on this computer." : approvalTerms(kind, factsNow)} The review expires in 10 minutes.`,
         err: problem === null ? null : refused(problem),
         attrs: { "aria-label": `Clone ${record.nameWithOwner}` },
     })}${facts([["Repository", mono(`github.com/${record.nameWithOwner}`)], ["Size", size], ["Into", mono(shortPathOf(record.target))]])}`;

package/dist/server/render-tasks.d.ts

@@ -119,6 +119,16 @@ export type ApprovalSheetInput = {
     } | null;
     /** Cockpit B2: this person's password is remembered (when, ISO) and these terms may stand on it. */
     freshSince?: string | null;
+    /** Easy-start C5: a laptop's local owner — eligible (no password field), or why not and where to go. */
+    localOwner?: LocalApprovalView | null;
+};
+export type LocalApprovalView = {
+    eligible: true;
+} | {
+    eligible: false;
+    message: string;
+    href: string;
+    action: string;
 };
 /** The approval sheet: one form that restates every term it signs, the password, and Approve & start. */
 export declare function approvalSheetHtml(input: ApprovalSheetInput): Html;
@@ -548,6 +558,8 @@ export declare function taskBodyParts(data: {
     steerRecent?: number[];
     /** Cockpit B2: when this person's remembered password was given, when it may approve these terms. */
     approvalFresh?: string | null;
+    /** Easy-start C5: the viewer is a laptop's local owner — whether this plan is one it approves without a password. */
+    approvalLocal?: LocalApprovalView | null;
     /** Cockpit B2: how the current approval's person was proved (approval proved ledger), when it was a remembered one. */
     approvalProof?: {
         method: string;

package/dist/server/render-tasks.js

@@ -239,9 +239,11 @@ export function approvalSheetHtml(input) {
             parts.lead,
             parts.rows,
             html `<div class="approval-act" id="${input.surface === "task" ? "approval-confirm" : "chat-approval-confirm"}">`,
-            html `${reauth(html `<label class="approval-password"><span class="visually-hidden">Your password</span><input type="password" name="token" autocomplete="current-password" placeholder="Your password" aria-describedby="${parts.passwordNote}"></label>`)}`,
-            input.freshSince == null ? html `<p class="approval-password-note" id="${parts.passwordNote}">Your password signs this approval.</p>`
-                : html `<p class="approval-password-note" id="${parts.passwordNote}" data-approval-fresh>Your password from ${whenTime(input.freshSince)} is remembered on this computer — leave this blank to approve with it, or type it again.</p>`,
+            input.localOwner != null ? html `` : html `${reauth(html `<label class="approval-password"><span class="visually-hidden">Your password</span><input type="password" name="token" autocomplete="current-password" placeholder="Your password" aria-describedby="${parts.passwordNote}"></label>`)}`,
+            input.localOwner?.eligible === true ? html ``
+                : input.localOwner != null ? html `<p class="approval-password-note" id="${parts.passwordNote}">${input.localOwner.message} <a href="${input.localOwner.href}">${input.localOwner.action}</a></p>`
+                    : input.freshSince == null ? html `<p class="approval-password-note" id="${parts.passwordNote}">Your password signs this approval.</p>`
+                        : html `<p class="approval-password-note" id="${parts.passwordNote}" data-approval-fresh>Your password from ${whenTime(input.freshSince)} is remembered on this computer — leave this blank to approve with it, or type it again.</p>`,
             html `<button type="submit" data-primary-action>${parts.submit}</button></div>`,
             html `<p class="approval-after">${parts.after}</p>`,
             html `<div class="approval-secondary">${parts.editor ?? html `<a class="approval-link" href="${input.editHref}">Edit plan</a>`}<a class="approval-link" href="${input.notNowHref}">Not now</a></div>`,
@@ -782,6 +784,9 @@ export function approvalProofWords(proof) {
         return " (from your paired chat)";
     if (proof.method === "carried")
         return " (carried from the release approval)";
+    // Easy-start C5: this computer's owner approving attended work in local mode, with no password.
+    if (proof.method === "local-owner")
+        return " (on this computer, no password)";
     return "";
 }
 const whenText = (iso) => new Intl.DateTimeFormat("en-US", { hour: "numeric", minute: "2-digit" }).format(new Date(iso));
@@ -1653,6 +1658,7 @@ export function taskBodyParts(data) {
         nonce: data.nonce,
         digest: data.approvalDigest ?? scope.digest,
         freshSince: data.approvalFresh ?? null,
+        localOwner: data.approvalLocal ?? null,
         returnTo: null,
         scope,
         planDocument: data.plan === "drafted" ? data.planDocument : null,
@@ -2554,8 +2560,10 @@ export function approveKitOf(input, freshSince) {
         heading: rebuild !== null ? "The plan changed" : input.deliverable === "report" ? "Investigation ready" : "Plan ready",
         text: `Approving signs plan version ${input.scope.digest.slice(0, 12)} and ${after}.${allowing}`,
         kind: "standard",
-        facts: { passwordless: passwordlessRendering(), remembered: until !== null },
+        facts: { passwordless: passwordlessRendering() || input.localOwner?.eligible === true, remembered: until !== null },
         rememberedUntil: until,
+        // Easy-start C5: the owner approving on this computer needs no password, and the line says so (not "Passwordless").
+        ...(input.localOwner?.eligible === true ? { termsWords: "No password needed on this computer." } : {}),
         planHtml: htmlString(joinHtml([parts.lead, parts.rows, parts.editor ?? "", parts.details, parts.editorForm])),
     };
 }

package/dist/server/request-context.d.ts

@@ -45,6 +45,12 @@ export type RequestFacts = {
     passwordless?: boolean;
     /** The browser session's open project (display only: the sidebar's picker names it). */
     openProject?: string | null;
+    /** Easy start: a local owner with no password yet: every step-up field is the Set a password link instead (this href). */
+    localStepUp?: string;
+    /** Easy-start C2: the browser mutation key is required here, so every page that posts carries the key fill script. */
+    keyFill?: boolean;
+    /** Easy-start C2: this session's key is from an earlier console start (or it has none): how to reconnect. */
+    reconnect?: import("./mutation-key.js").Reconnect | null;
 };
 /**
  * The request's own session facts, readable from anywhere below the

package/dist/server/route-table.d.ts

@@ -16,6 +16,7 @@
  * admission: passwords, nonces, webhook signatures, object membership, stale
  * sessions and revoked tokens.
  */
+import type { LocalOwnerAct } from "../local-owner.js";
 /** Who presents the request. `service` is a verified external sender (a signed webhook, an OAuth return carrying its one-time state). */
 export type Caller = "anonymous" | "service" | "cookie" | "bearer" | "oauth" | "coordinator" | "lead";
 /** What the caller must hold: nothing, read, act (an approver or an `act` token), or a fresh password/provider check on top. */
@@ -86,7 +87,22 @@ export interface RouteDeclaration {
     /** Cockpit B2: whether a password remembered on this session may stand in here (`allowlist`), or never. Only the
      * allowlisted acts run their check inside `withFreshness` (scope.ts); every other step-up is `never`. */
     readonly freshness: "never" | "allowlist";
+    /**
+     * Easy-start C1: whether a local owner's session (a laptop install's passwordless owner) may use this row, decided for
+     * every row when the table loads (localMarkOf below). `allow` rows name the act they are (local-owner.ts
+     * LOCAL_OWNER_ACTS); the console's admission refuses a local owner everywhere else before the handler runs.
+     */
+    readonly local: "allow" | "deny";
+    readonly localAct: LocalOwnerAct | null;
 }
+/** Every edge row, decided: allow where a local owner's cookie may reach it, deny where its adapter refuses one (or no
+ * cookie is ever read there). A new edge row fails the table's load until it is listed here. */
+export declare const EDGE_LOCAL: Readonly<Record<string, {
+    local: "allow" | "deny";
+    why: string;
+}>>;
+/** The ids the local marks name, for the inventory test (a mark naming no row is stale). */
+export declare const LOCAL_MARKED_IDS: readonly string[];
 /** The sole route table, in match order. */
 export declare const ROUTES: readonly RouteDeclaration[];
 /** The first row that declares this method and path, or null: an undeclared request never reaches a handler. */

package/dist/server/route-table.js

@@ -45,8 +45,114 @@ function row(stage, domain, id, method, pattern, options = {}) {
         ...(options.roleRefusal === undefined ? {} : { roleRefusal: options.roleRefusal }),
         ...(options.bodyCap === undefined ? {} : { bodyCap: options.bodyCap }),
         freshness: options.freshness ?? "never",
+        ...localMarkOf(stage, method, id),
     });
 }
+// ---- easy-start C1: the local owner's marks --------------------------------------------------------------------------
+// Decided here for every row, failing the table's load for an edge row nobody decided. A console POST is refused to a
+// local owner unless LOCAL_POSTS names its act; a console GET is a read (`read`) unless LOCAL_GET_DENY names it.
+/** The console POST rows a local owner may use, and the act each is. Everything else is refused. */
+const LOCAL_POSTS = Object.freeze({
+    "tasks.add": "file-task",
+    "chat.file": "file-task",
+    "chat.send": "lead-send",
+    "chat.queued-remove": "lead-send",
+    "chat.mate-mint": "lead-send",
+    "chat.mate-follow": "lead-send",
+    "chat.mate-end": "lead-send",
+    "chat.mate-stop": "lead-send",
+    // The confirm door narrows the act to the card's own (lead-doors.ts: LOCAL_OWNER_PROPOSALS and the operation's act).
+    "chat.proposal.confirm": "lead-send",
+    "chat.proposal.dismiss": "lead-send",
+    "task.act.steer": "lead-send",
+    "task.act.approve": "approve-plan",
+    "decision.answer": "answer-question",
+    "task.act.reply": "answer-question",
+    "task.act.stop": "stop-run",
+    "task.act.cancel": "stop-run",
+    "task.act.hold": "pause-run",
+    "task.act.pause": "pause-run",
+    "task.act.unhold": "resume-run",
+    "task.act.resume-arm": "resume-run",
+    "task.act.resume": "resume-run",
+    "task.act.complete": "complete-task",
+    "run.act.revise": "request-revision",
+    "run.act.note": "request-revision",
+    "run.act.comment": "request-revision",
+    "task.act.archive": "archive-task",
+    "task.act.restore": "archive-task",
+    "projects.open": "add-project",
+    "projects.github-list": "add-project",
+    "projects.onboard-preview": "add-project",
+    "projects.onboard-confirm": "add-project",
+    // The welcome's sample project, added the way Projects adds a folder (the same admission and its re-check).
+    "welcome.sample": "add-project",
+    // The welcome's "Use this one" (and Settings → Lead's turn-on): the lead runs on Claude Code or Codex signed in here.
+    "settings.lead-on": "choose-default-agent",
+    // Choosing which open project the pages show: a view filter, never authorization.
+    "projects.select": "read",
+    "agents.seen": "mark-seen",
+    "agents.watch": "watch-agent",
+});
+/** Console GET rows refused to a local owner (none so far: every GET is a read; adapter-inventory.test.ts proves no GET
+ * writes beyond the allowlisted session touch and review nonce). */
+const LOCAL_GET_DENY = new Set([]);
+/** Every edge row, decided: allow where a local owner's cookie may reach it, deny where its adapter refuses one (or no
+ * cookie is ever read there). A new edge row fails the table's load until it is listed here. */
+export const EDGE_LOCAL = Object.freeze({
+    "edge.healthz": { local: "allow", why: "public read" },
+    "edge.instance": { local: "allow", why: "public read (the CLI proves the console)" },
+    "edge.telegram-hook": { local: "deny", why: "signed webhook; never a cookie" },
+    "edge.flow-form": { local: "deny", why: "a flow's public form; never a cookie" },
+    "edge.flow-form-send": { local: "deny", why: "a flow's public form; never a cookie" },
+    "edge.flow-hook": { local: "deny", why: "signed webhook; never a cookie" },
+    "edge.mcp": { local: "deny", why: "bearer only" },
+    "edge.oauth-discovery": { local: "allow", why: "public read" },
+    "edge.oauth-register": { local: "deny", why: "no cookie; registers a client only" },
+    "edge.oauth-token": { local: "deny", why: "OAuth client only" },
+    "edge.oauth-authorize": { local: "deny", why: "consent is a credential act: the adapter refuses a local owner's session" },
+    "edge.oauth-consent": { local: "deny", why: "consent is a credential act: the adapter refuses a local owner's session" },
+    "edge.google-callback": { local: "deny", why: "bound to state a refused settings POST starts" },
+    "edge.connect-callback": { local: "deny", why: "bound to state a refused settings POST starts" },
+    "edge.team-read": { local: "deny", why: "team conversations are a remote feature: authenticate refuses a local owner" },
+    "edge.team-send": { local: "deny", why: "team conversations are a remote feature: authenticate refuses a local owner" },
+    "edge.cli": { local: "deny", why: "bearer only" },
+    "edge.teams": { local: "deny", why: "signed service only" },
+    "edge.browser-asset": { local: "allow", why: "public asset" },
+    "edge.workspace-style": { local: "allow", why: "public asset" },
+    "edge.install-asset": { local: "allow", why: "public asset" },
+    "edge.font": { local: "allow", why: "public asset" },
+    "edge.desktop-health": { local: "allow", why: "public read" },
+    "edge.login-page": { local: "allow", why: "before sign-in" },
+    "edge.login-link": { local: "allow", why: "before sign-in: a one-time link" },
+    "edge.sso-start": { local: "allow", why: "before sign-in" },
+    "edge.sso-callback": { local: "allow", why: "before sign-in" },
+    "edge.sso-finish": { local: "allow", why: "before sign-in" },
+    "edge.signup": { local: "allow", why: "before sign-in" },
+    "edge.login": { local: "allow", why: "before sign-in: a password typed now makes a full session" },
+    "edge.logout": { local: "allow", why: "only narrows: ends this session" },
+    "edge.join": { local: "allow", why: "before sign-in: an invitation" },
+    "edge.join-send": { local: "allow", why: "before sign-in: an invitation" },
+    "edge.rekey-page": { local: "allow", why: "reads only: a local owner is told to run `toolroll open`" },
+    "edge.rekey": { local: "allow", why: "only a password typed now re-keys a full session; a local owner is told to run `toolroll open` and gets no key" },
+    "edge.password-set-page": { local: "allow", why: "reads only: the local owner's form for a first password, or \"already set — sign in\"" },
+    "edge.password-set": { local: "allow", why: "the one credential act a local owner may make: its first password (Origin, CSRF and key proved by the handler; enrollOwnerPassword re-checks local mode, the owner and password_set=0 in its own transaction); a session with a password set is refused" },
+    live: { local: "allow", why: "observational only; the agent watch lease is a keyed POST (agents.watch)" },
+});
+function localMarkOf(stage, method, id) {
+    if (stage === "edge") {
+        const decided = Object.prototype.hasOwnProperty.call(EDGE_LOCAL, id) ? EDGE_LOCAL[id] : undefined;
+        if (decided === undefined)
+            throw new Error(`route table: edge row ${id} has no local-owner mark (EDGE_LOCAL)`);
+        return { local: decided.local, localAct: decided.local === "allow" ? "read" : null };
+    }
+    if (method !== "POST")
+        return LOCAL_GET_DENY.has(id) ? { local: "deny", localAct: null } : { local: "allow", localAct: "read" };
+    const act = Object.prototype.hasOwnProperty.call(LOCAL_POSTS, id) ? LOCAL_POSTS[id] : null;
+    return act === null ? { local: "deny", localAct: null } : { local: "allow", localAct: act };
+}
+/** The ids the local marks name, for the inventory test (a mark naming no row is stale). */
+export const LOCAL_MARKED_IDS = Object.freeze([...Object.keys(LOCAL_POSTS), ...LOCAL_GET_DENY, ...Object.keys(EDGE_LOCAL)]);
 const edge = (domain, id, method, path, options = {}) => row("edge", domain, id, method, path.startsWith("^") ? path : exact(path), options);
 const get = (domain, id, path, options = {}) => row("console", domain, id, "GET", path.startsWith("^") ? path : exact(path), options);
 const post = (domain, id, path, options = {}) => row("console", domain, id, "POST", path.startsWith("^") ? path : exact(path), options);
@@ -100,6 +206,12 @@ edge("people", "edge.sso-finish", "GET", "/login/sso/finish");
 edge("people", "edge.signup", "POST", "/signup");
 edge("people", "edge.login", "POST", "/login");
 edge("people", "edge.logout", "POST", "/logout", { callers: ["anonymous", "cookie"] });
+// Easy-start C2: a browser session's fresh mutation key after a restart: its own password again (the handler proves both).
+edge("people", "edge.rekey-page", "GET", "/login/rekey", { callers: ["anonymous", "cookie"] });
+edge("people", "edge.rekey", "POST", "/login/rekey", { callers: ["anonymous", "cookie"] });
+// Easy-start C4: the local owner sets a first password (only while none is set); the answer is a fresh full session.
+edge("people", "edge.password-set-page", "GET", "/password/set", { callers: ["anonymous", "cookie"] });
+edge("people", "edge.password-set", "POST", "/password/set", { callers: ["anonymous", "cookie"] });
 edge("people", "edge.join", "GET", "^\\/join\\/[A-Za-z0-9_-]{16,64}$", { sample: "/join/abcdefghijklmnop" });
 edge("people", "edge.join-send", "POST", "^\\/join\\/[A-Za-z0-9_-]{16,64}$", { sample: "/join/abcdefghijklmnop" });
 // ---- console reads ---------------------------------------------------------------------------------------------
@@ -165,6 +277,8 @@ get("pages", "fleet", "/fleet", free);
 get("tasks", "tasks.new", "/tasks/new", { limited: "collection", ...free });
 // The first run's own page (Wave E): five guided steps, reads only; it leads Home once the first run is over.
 get("tasks", "welcome", "/welcome", { limited: "collection", ...free });
+// Try a sample project (first-run.ts, sample-project.ts): made in the project folder, then added the way Projects adds a folder.
+post("tasks", "welcome.sample", "/welcome/sample", { callers: ["cookie"], project: "none", ...approver("An approver adds projects.", "/welcome") });
 get("tasks", "task.page", `^\\/t\\/${TASK}$`, { project: "task", limited: "resource", ...free, sample: "/t/one" });
 get("tasks", "task.evidence", `^\\/t\\/${TASK}\\/evidence$`, { project: "task", limited: "resource", ...free, sample: "/t/one/evidence" });
 get("pages", "ledger.export", "/ledger/export", { limited: "unscoped", ...free });
@@ -329,6 +443,8 @@ post("tasks", "sweep.cancel-rest", "^\\/sweeps\\/[1-9][0-9]{0,9}\\/cancel-rest$"
 // (the handler proves it as a credential act); turning it off is one click, so the row itself is not a step-up.
 get("settings", "settings.passwordless", "/settings/passwordless", { ...free, ...operator("An instance operator sets Passwordless.", "/settings") });
 post("settings", "settings.passwordless-send", "/settings/passwordless", { callers: ["cookie"], ...operator("An instance operator sets Passwordless.", "/settings") });
+// Easy-start C5: turning local mode off: an instance operator's step-up from a full session (a local owner is refused).
+post("settings", "settings.local-mode-off", "/settings/local-mode/off", { callers: ["cookie"], scope: "step-up", ...operator("An instance operator turns off local mode.", "/settings/access") });
 // Release approval (docs/plans/auto-approve-green.md): an approver of the project, from a browser. Approving releases
 // automatically takes a typed password (the handler proves it as a credential act); asking again is one click.
 post("settings", "settings.release-approval-send", "/settings/release-approval", { callers: ["cookie"], ...approver("An approver sets how releases are approved.", "/settings/approval") });
@@ -473,6 +589,11 @@ for (const one of ["note", "comment", "revise", "draft-repair", "checks", "add-t
 // Cockpit E: reveal a running attempt's proved checkout in Finder (nothing is launched in it).
 post("tasks", "run.act.reveal", `^\\/r\\/${ID}\\/reveal$`, { project: "run", limited: "resource", callers: ["cookie"], sample: "/r/1/reveal", ...approver("Only an approver can show an agent's files.") });
 post("tasks", "session.editor-links", "/session/editor-links", { viewer: true });
+// Easy-start C1 (N1): reads never write. The shell says a finished result was opened (it leaves the person's unread
+// Done), and holds or releases the short lease that quiets chat pings while an agent's page is open — keyed POSTs, never
+// a page load or the live stream. A watch-only account keeps its own seen marks and watches too.
+post("tasks", "agents.seen", "/agents/seen", { callers: ["cookie"], project: "none", limited: "unscoped", viewer: true });
+post("tasks", "agents.watch", "/agents/watch", { callers: ["cookie"], project: "none", limited: "unscoped", viewer: true });
 post("tasks", "incident.resolve", `^\\/i\\/${ID}\\/resolve$`, { project: "incident", sample: "/i/1/resolve" });
 /** The sole route table, in match order. */
 export const ROUTES = Object.freeze(rows.map(one => Object.freeze(one)));

package/dist/server/runtime.d.ts

@@ -210,6 +210,7 @@ export interface ServerRuntime {
     authorizeMutation: (request: IncomingMessage, who: Who, body: FormView<FormFieldOf<"mutationGuard">>) => {
         status: number;
         message: string;
+        reconnect?: import("./mutation-key.js").Reconnect;
     } | null;
     leadSaid: Map<string, {
         turn: number | null;
@@ -245,10 +246,11 @@ export interface ServerRuntime {
         label: string;
         operatorsOnly: boolean;
     } | null;
-    signInLinks: Map<string, {
-        account: string;
-        expires: number;
-    }>;
+    signInLinks: Map<string, import("./session.js").SignInLink>;
+    /** v147: this console start's key epoch (easy-start C2). */
+    keyEpoch: string;
+    /** Easy-start C2: the browser mutation key (server/mutation-key.ts): the one check, issuing and delivering a key. */
+    browserKeys: import("./mutation-key.js").BrowserKeys;
     linkKey: (code: string) => string;
     fromThisComputer: (request: IncomingMessage) => boolean;
     /** Cockpit B2: the request's live password-freshness facts (null off a browser session). */