toolroll 0.9.59 → 0.9.61

package/dist/project-tools.js

@@ -540,7 +540,7 @@ function safeLine(text) {
 }
 const toml = (value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 const tomlList = (values) => `[${values.map(toml).join(",")}]`;
-/** Claude: only these servers (`--strict-mcp-config`), written to a private 0600 file removed after the run. */
+/** Claude: only these servers, written to a private 0600 file removed after the run (the provider adds `--strict-mcp-config`). */
 export function claudeToolArgs(launch) {
     const servers = {};
     for (const tool of launch.tools) {
@@ -563,49 +563,27 @@ export function claudeToolArgs(launch) {
     const file = join(dir, "mcp.json");
     writeFileSync(file, JSON.stringify({ mcpServers: servers }), { mode: 0o600 });
     return {
-        argv: ["--strict-mcp-config", "--mcp-config", file],
+        argv: ["--mcp-config", file],
         // A first `npx` download can take longer than the default start-up wait.
         env: launch.tools.length > 0 ? { MCP_TIMEOUT: "60000" } : {},
         omitEnv: [],
         cleanup: () => rmSync(dir, { recursive: true, force: true }),
     };
 }
-/** The operator's Codex model settings a build keeps when its tools are replaced: how it thinks, never what it can reach. */
-const CARRIED_CODEX_SETTINGS = ["model_reasoning_effort", "model_reasoning_summary", "model_verbosity", "service_tier", "personality"];
-export function carriedCodexSettings(includeModel, codexHome = process.env["CODEX_HOME"] ?? join(homedir(), ".codex")) {
-    let text = "";
-    try {
-        text = readFileSync(join(codexHome, "config.toml"), "utf8");
-    }
-    catch {
-        return [];
-    }
-    const wanted = includeModel ? ["model", ...CARRIED_CODEX_SETTINGS] : CARRIED_CODEX_SETTINGS;
-    const argv = [];
-    for (const line of text.split("\n")) {
-        if (/^\s*\[/.test(line))
-            break;
-        const match = /^\s*([a-z_]+)\s*=\s*("[^"\\\n]{0,80}"|[A-Za-z0-9_.-]{1,40})\s*(?:#.*)?$/.exec(line);
-        if (match !== null && wanted.includes(match[1]))
-            argv.push("-c", `${match[1]}=${match[2]}`);
-    }
-    return argv;
-}
 /** Where the tool launcher lives beside this module, built. */
 export function toolLauncherPath() {
     return fileURLToPath(new URL("./tool-launcher.js", import.meta.url));
 }
 /**
- * Codex: the operator's config.toml is ignored whole (its MCP servers
- * with it), ChatGPT apps and plugins are off, the model settings above
- * are carried, and each tool is named by `-c` and started through the
- * launcher. Codex gives its own environment to the agent's shell whatever
+ * Codex: each tool is named by `-c` and started through the launcher. The
+ * operator's config.toml, rules, apps, plugins and hooks are already off
+ * (the provider's CODEX_BUILD_ISOLATION_ARGV), and nothing of config.toml
+ * is carried. Codex gives its own environment to the agent's shell whatever
  * its policy says, so no secret rides it: each tool's values sit in the
  * run's private 0600 file and reach only that tool's process.
  */
-export function codexToolArgs(launch, options) {
-    // ChatGPT apps, connectors and plugins are the operator's account, not the project's: all off (plugins carry their own MCP servers).
-    const argv = ["--ignore-user-config", ...carriedCodexSettings(options.includeModel, options.codexHome), "-c", "apps._default.enabled=false", "-c", "features.plugins=false"];
+export function codexToolArgs(launch, options = {}) {
+    const argv = [];
     if (launch.tools.length === 0)
         return { argv, env: {}, omitEnv: [], cleanup: () => undefined };
     const dir = mkdtempSync(join(tmpdir(), "so-tools-"));
@@ -701,9 +679,8 @@ export function prepareRunTools(store, runId, provider, options) {
     const launch = limitedTo(toolLaunchFor(store, runId, options.home), options.readOnly, options.withheld);
     const enabledTools = options.readOnly === undefined ? {} : { enabledTools: options.readOnly };
     const prepared = provider === "claude" ? claudeToolArgs(launch)
-        : provider === "codex" ? codexToolArgs(launch, { includeModel: options.includeModel, ...enabledTools })
-            : provider === "openrouter" ? codexToolArgs(launch, { includeModel: false, ...enabledTools })
-                : { argv: [...GEMINI_NO_TOOLS_ARGV], env: {}, omitEnv: [], cleanup: () => undefined };
+        : provider === "codex" || provider === "openrouter" ? codexToolArgs(launch, enabledTools)
+            : { argv: [...GEMINI_NO_TOOLS_ARGV], env: {}, omitEnv: [], cleanup: () => undefined };
     const skipped = provider === "gemini"
         ? [...launch.skipped, ...launch.tools.map(one => ({ name: one.spec.name, reason: "Gemini builds can't use project tools yet" }))]
         : launch.skipped;
@@ -725,13 +702,12 @@ function limitedTo(launch, readOnly, withheld = {}) {
     };
 }
 /** When a launch's tools cannot be prepared, it still gets none of anything else's: the same isolation with an empty list. */
-export function noToolsArgs(provider, includeModel) {
-    const none = { tools: [], skipped: [] };
+export function noToolsArgs(provider) {
     if (provider === "claude")
-        return { argv: ["--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}'], env: {}, omitEnv: [], cleanup: () => undefined };
+        return { argv: ["--mcp-config", '{"mcpServers":{}}'], env: {}, omitEnv: [], cleanup: () => undefined };
     if (provider === "gemini")
         return { argv: [...GEMINI_NO_TOOLS_ARGV], env: {}, omitEnv: [], cleanup: () => undefined };
-    return codexToolArgs(none, { includeModel: provider === "codex" && includeModel });
+    return codexToolArgs({ tools: [], skipped: [] });
 }
 /** Add one tool (and, for an import, the values it brings) to a project's builds. */
 export function addToolTo(store, repo, input, source, by, now, options = {}) {

package/dist/provider.d.ts

@@ -64,6 +64,26 @@ export type Invocation = {
      * Codex renders it as its own sandbox profile; Claude as deny rules for
      * its file tools (its shell is fenced by the macOS sandbox around it). */
     fence?: readonly string[];
+    /** More paths Claude's own file tools refuse, beside the fence: home
+     * configuration its CLI still reads itself (so the sandbox around the
+     * whole process can't deny them). */
+    fileToolFence?: readonly string[];
+    /** The task's own folder (its worktree). A Claude build loads no settings
+     * files, so this is where the repository's CLAUDE.md is read from. */
+    workspace?: string;
+    /** A running build's steering folder (steer-mailbox.ts): the absolute path
+     * and the worktree-relative name its brief uses. Claude renders a
+     * PostToolUse hook that says when a note is waiting; every other provider
+     * relies on the brief's own rule to look. */
+    steerFolder?: {
+        dir: string;
+        name: string;
+    };
+    /** Live input (live-input.ts): the brief arrives as the first stdin message
+     * and stdin stays open, so the argv carries `--input-format stream-json`
+     * and never the brief (Claude drops a `-p` prompt once stdin carries
+     * input). Set by the gateway only, for a transport that streams input. */
+    streamInput?: boolean;
     /** Claude's structured-output floor for a non-review phase: the scout's
      * report rides the terminal result event instead of a file plan mode
      * would refuse to write. Ignored by providers without `--json-schema`. */
@@ -107,6 +127,9 @@ export type ParsedEnvelope = {
     tokensIn: number | null;
     tokensOut: number | null;
     costUsd: number | null;
+    /** The run spent but its cost could not be read (Claude's main result was too large to keep): the gateway charges
+     * the run's dollar cap, or records it unmeasured when none applied. Absent = the cost is what costUsd says. */
+    costUnknown?: boolean;
     usageRaw: string | null;
     /**
      * Whether the provider was seen to initialize (codex: thread.started;
@@ -144,6 +167,9 @@ export type ParsedEnvelope = {
 type Adapter = {
     binary: string;
     argv(invocation: Invocation): string[];
+    /** Environment the launch needs beside the argv (Claude: read the
+     * workspace's CLAUDE.md through `--add-dir`). */
+    env?(invocation: Invocation): Record<string, string>;
     /** Prompt input for transports that use stdin instead of a bounded OS argument. */
     stdin?(invocation: Invocation): string | undefined;
     parse(stdout: string): ParsedEnvelope;
@@ -159,8 +185,47 @@ type Adapter = {
     clampTimeout(phase: Phase, requestedMs: number): number;
 };
 export declare const OPENROUTER_ENV_KEY = "OPENROUTER_API_KEY";
+/**
+ * A build's own setup (plan, build and repair; never a review, which keeps
+ * the isolation above). No settings file loads — not the user's, the
+ * repository's or the local one — so none of their hooks, plugins or
+ * permissions reach the run; Toolroll's one `--settings` (the fence and the
+ * steering hook) is all there is. MCP servers come only from `--mcp-config`:
+ * the project's named tools, or an explicit empty list. The repository's
+ * CLAUDE.md still loads, through `--add-dir` on the workspace. Sign-in is
+ * the CLI's own (keychain or ~/.claude), which no setting source governs.
+ * `-p` never shows the workspace trust prompt (Claude Code 2.1.290), so a
+ * fresh worktree can't wedge a headless run. Checked against 2.1.290 with
+ * planted user, project and local hooks and MCP servers: none loaded.
+ */
+export declare const CLAUDE_BUILD_ISOLATION_ARGV: readonly string[];
 /** Claude's own tools that only make sense with a person to wake them. */
 export declare const HEADLESS_DISALLOWED_TOOLS: readonly string[];
+/**
+ * Whether a failed launch was an installed CLI too old for a build's own
+ * setup: it names one of those flags as unknown. Then nothing ran, and the
+ * run says so plainly instead of reading as a failed sign-in or bad work.
+ */
+export declare function isolationUnsupported(provider: ProviderId, stderr: string): string | null;
+/**
+ * Codex's own fail-closed equivalent of `CLAUDE_REVIEW_ISOLATION_ARGV`:
+ * read-only sandbox rather than the ordinary `workspace-write` (a reviewer
+ * dispatched to codex was, until this, handed a write-capable sandbox —
+ * the same class of leak the claude side had), approvals that REFUSE
+ * rather than wait on a prompt a headless turn can never answer, and the
+ * user's own `~/.codex/config.toml` — which can name arbitrary MCP
+ * servers, exactly the surface `--strict-mcp-config` closes for claude —
+ * ignored outright.
+ */
+/**
+ * A Codex build's own setup, the equivalent of Claude's: the operator's
+ * config.toml (its MCP servers, model choices, profiles) and execpolicy
+ * rules ignored, ChatGPT apps and plugins off (plugins carry their own MCP
+ * servers), and hooks off. Sign-in still comes from CODEX_HOME, which
+ * `--ignore-user-config` leaves alone. The project's named tools follow as
+ * `-c mcp_servers.*` (project-tools.ts).
+ */
+export declare const CODEX_BUILD_ISOLATION_ARGV: readonly string[];
 /**
  * The diagnostic discipline (Phase 3 B6/C6): the harness's own words are
  * untrusted bytes headed for refusal screens and notifications — controls
@@ -180,11 +245,10 @@ export declare const ALL_CREDENTIAL_ENV: readonly string[];
 export declare function adapterFor(provider: ProviderId): Adapter;
 /**
  * The provider audit: what each harness supports, what we actually pass,
- * and what user-global configuration can leak into an unattended run.
- * REPORT BEFORE ENFORCEMENT (Codex roadmap review, item 10): none of this
- * changes an invocation — it states facts an operator reads on `providers`,
- * so hermetic mode can later be turned on per provider from evidence
- * instead of hope. `enforced` is a literal false until that day.
+ * and what user-global configuration still reaches an unattended run.
+ * None of this changes an invocation — it states facts an operator reads
+ * on `providers`. Claude and Codex builds now run in their own setup
+ * (`enforced`); Gemini's flag is still only reported.
  */
 export type ProviderAudit = {
     /** How output reaches us — and therefore which signals can exist at all. */
@@ -209,13 +273,14 @@ export type ProviderAudit = {
      */
     terminalContract: "required" | "none";
     isolation: {
-        /** The harness's hermetic flag, if it has one. We do not pass it. */
+        /** The harness's hermetic flag, if it has one. */
         flag: string | null;
         /** Whether that flag preserves resume. false = documented conflict. */
         resumeSafe: boolean | null;
-        enforced: false;
+        /** Whether every build, fresh or resumed, passes it. */
+        enforced: boolean;
     };
-    /** User-global surfaces that can reach an invocation today. */
+    /** What still reaches a build: its own sources and the user surfaces left. */
     configSurface: readonly string[];
 };
 /** Read-only facts about a provider — safe anywhere, spawns nothing. */

package/dist/provider.js

@@ -19,8 +19,9 @@
  * shell the model itself launches (Codex provider review, Q5).
  */
 import { claudeFenceSettings, codexFenceArgv } from "./agent-fence.js";
+import { claudeSteerHooks } from "./steer-mailbox.js";
 import {} from "./exec.js";
-import { runStreamJsonl, runClaudeStreamJsonl, runGeminiStreamJsonl } from "./exec.js";
+import { runStreamJsonl, runClaudeStreamJsonl, runGeminiStreamJsonl, CLAUDE_COST_UNKNOWN } from "./exec.js";
 import { scanForSecrets } from "./evidence.js";
 import { FINDINGS_MODEL_SCHEMA } from "./contracts/review-findings.js";
 import { REVIEW_OUTPUT_LIMITS } from "./structured-output.js";
@@ -166,11 +167,26 @@ const CLAUDE_REVIEW_JSON_SCHEMA = {
     required: ["version"],
     additionalProperties: false,
 };
+/**
+ * A build's own setup (plan, build and repair; never a review, which keeps
+ * the isolation above). No settings file loads — not the user's, the
+ * repository's or the local one — so none of their hooks, plugins or
+ * permissions reach the run; Toolroll's one `--settings` (the fence and the
+ * steering hook) is all there is. MCP servers come only from `--mcp-config`:
+ * the project's named tools, or an explicit empty list. The repository's
+ * CLAUDE.md still loads, through `--add-dir` on the workspace. Sign-in is
+ * the CLI's own (keychain or ~/.claude), which no setting source governs.
+ * `-p` never shows the workspace trust prompt (Claude Code 2.1.290), so a
+ * fresh worktree can't wedge a headless run. Checked against 2.1.290 with
+ * planted user, project and local hooks and MCP servers: none loaded.
+ */
+export const CLAUDE_BUILD_ISOLATION_ARGV = ["--setting-sources", "", "--strict-mcp-config"];
+const EMPTY_MCP_CONFIG = '{"mcpServers":{}}';
 /** Claude's own tools that only make sense with a person to wake them. */
 export const HEADLESS_DISALLOWED_TOOLS = ["ScheduleWakeup", "CronCreate", "Monitor"];
 const claudeArgv = (invocation) => [
     "-p",
-    invocation.brief,
+    ...(invocation.streamInput === true ? ["--input-format", "stream-json"] : [invocation.brief]),
     ...(invocation.resumeSession === null ? [] : ["--resume", invocation.resumeSession]),
     // stream-json (arc 1): the terminal result event IS the old buffered
     // envelope, now arriving as one line of many — the streaming transport
@@ -196,12 +212,47 @@ const claudeArgv = (invocation) => [
             // turn that a -p process never gets. Denied at the harness too.
             "--disallowedTools", HEADLESS_DISALLOWED_TOOLS.join(","),
             ...(invocation.allowedTools === undefined || invocation.allowedTools.length === 0 ? [] : ["--allowedTools", invocation.allowedTools.join(",")]),
+            ...CLAUDE_BUILD_ISOLATION_ARGV,
+            ...(invocation.workspace === undefined ? [] : ["--add-dir", invocation.workspace]),
             ...(invocation.toolArgv ?? []),
             ...(invocation.extraMcpServers === undefined ? [] : ["--mcp-config", JSON.stringify({ mcpServers: invocation.extraMcpServers })]),
-            ...(invocation.fence !== undefined && invocation.fence.length > 0 ? ["--settings", claudeFenceSettings(invocation.fence)] : []),
+            // Strict with nothing named still names its empty list.
+            ...((invocation.toolArgv ?? []).includes("--mcp-config") || invocation.extraMcpServers !== undefined ? [] : ["--mcp-config", EMPTY_MCP_CONFIG]),
+            ...claudeSettingsArgv(invocation),
             ...(invocation.jsonSchema === undefined ? [] : ["--json-schema", JSON.stringify(invocation.jsonSchema)])
         ]),
 ];
+/** The build's one --settings: no personal memory, plus the fence and steering doorbell. */
+function claudeSettingsArgv(invocation) {
+    const denied = [...(invocation.fence ?? []), ...(invocation.fileToolFence ?? [])];
+    return ["--settings", JSON.stringify({
+            autoMemoryEnabled: false,
+            ...(denied.length > 0 ? JSON.parse(claudeFenceSettings(denied)) : {}),
+            ...(invocation.steerFolder === undefined ? {} : { hooks: claudeSteerHooks(invocation.steerFolder.dir, invocation.steerFolder.name) }),
+        })];
+}
+/** With no settings sources, only `--add-dir` folders' CLAUDE.md load, and only with this set. */
+const claudeEnv = (invocation) => invocation.phase === "review" || invocation.workspace === undefined ? {} : { CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD: "1" };
+/** The flags a build's own setup depends on, by provider. */
+const ISOLATION_FLAGS = {
+    claude: ["--setting-sources", "--strict-mcp-config", "--settings", "--add-dir", "--mcp-config"],
+    codex: ["--ignore-user-config", "--ignore-rules"],
+    openrouter: ["--ignore-user-config", "--ignore-rules"],
+};
+/**
+ * Whether a failed launch was an installed CLI too old for a build's own
+ * setup: it names one of those flags as unknown. Then nothing ran, and the
+ * run says so plainly instead of reading as a failed sign-in or bad work.
+ */
+export function isolationUnsupported(provider, stderr) {
+    const flags = ISOLATION_FLAGS[provider] ?? [];
+    const said = stderr.slice(0, 8192);
+    const flag = flags.find(one => new RegExp(`(unknown|unexpected|unrecognized) (option|argument)[^\\n]{0,8}${one.replace(/-/g, "\\-")}\\b`, "i").test(said));
+    if (flag === undefined)
+        return null;
+    const name = provider === "claude" ? "Claude Code" : "Codex";
+    return `The installed ${name} doesn't support ${flag}, which builds need to run without your own hooks, plugins and MCP servers. Update ${name} and try again.`;
+}
 /**
  * The turn's own words, preferring the schema-validated structured field
  * (present only under `--json-schema`) over the plain result string — the
@@ -256,6 +307,7 @@ function claudeEnvelopeOf(result, sessionFromInit, initObserved, initSessionConf
         tokensIn: typeof input === "number" && input >= 0 ? input : null,
         tokensOut: typeof output === "number" && output >= 0 ? output : null,
         costUsd: typeof cost === "number" && cost >= 0 ? cost : null,
+        ...(result !== null && result[CLAUDE_COST_UNKNOWN] === true ? { costUnknown: true } : {}),
         usageRaw: result?.usage === undefined ? null : JSON.stringify(result.usage).slice(0, USAGE_JSON_CAP),
         initObserved,
         // Structural, never prose (finding 15): consumed means the primary
@@ -365,6 +417,21 @@ const codexSandboxArgv = (mode, resuming) => resuming ? ["-c", `sandbox_mode="${
  * servers, exactly the surface `--strict-mcp-config` closes for claude —
  * ignored outright.
  */
+/**
+ * A Codex build's own setup, the equivalent of Claude's: the operator's
+ * config.toml (its MCP servers, model choices, profiles) and execpolicy
+ * rules ignored, ChatGPT apps and plugins off (plugins carry their own MCP
+ * servers), and hooks off. Sign-in still comes from CODEX_HOME, which
+ * `--ignore-user-config` leaves alone. The project's named tools follow as
+ * `-c mcp_servers.*` (project-tools.ts).
+ */
+export const CODEX_BUILD_ISOLATION_ARGV = [
+    "--ignore-user-config",
+    "--ignore-rules",
+    "-c", "apps._default.enabled=false",
+    "-c", "features.plugins=false",
+    "-c", "features.hooks=false",
+];
 const CODEX_REVIEW_ISOLATION_ARGV = (resuming) => [
     "--ignore-user-config",
     ...codexSandboxArgv("read-only", resuming),
@@ -395,6 +462,7 @@ const codexArgv = (extra) => (invocation) => {
         ...(invocation.resumeSession === null ? [] : ["resume", invocation.resumeSession]),
         "--json",
         "--skip-git-repo-check",
+        ...(invocation.phase === "review" ? [] : CODEX_BUILD_ISOLATION_ARGV),
         ...(invocation.phase === "review"
             ? CODEX_REVIEW_ISOLATION_ARGV(resuming)
             // The agent fence: Codex's own sandbox with Toolroll's secrets
@@ -714,6 +782,7 @@ const ADAPTERS = {
     claude: {
         binary: "claude",
         argv: claudeArgv,
+        env: claudeEnv,
         parse: claudeParse,
         defaultRunner: runClaudeStreamJsonl,
         extraOmitEnv: foreignCredentialEnv("claude"),
@@ -777,13 +846,14 @@ const AUDITS = {
         initSignal: "system-init",
         sessionIdentity: "announced",
         terminalContract: "none",
-        // Restricted mode is resume-safe and is enforced for sealed reviewer
-        // turns. `enforced` remains false here because this provider-wide audit
-        // also covers ordinary build turns, where the flag is not applied.
-        isolation: { flag: "--restricted", resumeSafe: true, enforced: false },
+        // Builds: no settings sources and strict MCP, fresh and resumed alike
+        // (CLAUDE_BUILD_ISOLATION_ARGV). Reviews keep --restricted --safe-mode.
+        isolation: { flag: CLAUDE_BUILD_ISOLATION_ARGV.filter(one => one !== "").join(" "), resumeSafe: true, enforced: true },
         configSurface: [
-            "~/.claude/CLAUDE.md and settings (hooks, MCP servers, plugins)",
-            "repository CLAUDE.md / .claude directory",
+            "Toolroll's own --settings (the fence and steering hook)",
+            "the project's named tools (Settings → Tools)",
+            "repository CLAUDE.md",
+            "organisation-managed settings",
         ],
     },
     codex: {
@@ -792,10 +862,11 @@ const AUDITS = {
         initSignal: "thread.started",
         sessionIdentity: "announced",
         terminalContract: "none",
-        // --ephemeral exists and is deliberately not passed: repair resumes
-        // sessions, and ephemeral runs have none to resume.
-        isolation: { flag: "--ephemeral", resumeSafe: false, enforced: false },
-        configSurface: ["~/.codex/config.toml", "repository AGENTS.md"],
+        // Builds ignore config.toml and execpolicy rules, with apps, plugins and
+        // hooks off (CODEX_BUILD_ISOLATION_ARGV); sign-in stays in CODEX_HOME.
+        // Never --ephemeral: repair resumes sessions.
+        isolation: { flag: "--ignore-user-config --ignore-rules", resumeSafe: true, enforced: true },
+        configSurface: ["the project's named tools (Settings → Tools)", "~/.codex/AGENTS.md and repository AGENTS.md", "sign-in from CODEX_HOME"],
     },
     openrouter: {
         transport: "streaming-jsonl",
@@ -803,10 +874,9 @@ const AUDITS = {
         initSignal: "thread.started",
         sessionIdentity: "announced",
         terminalContract: "none",
-        isolation: { flag: "--ephemeral", resumeSafe: false, enforced: false },
-        // The constant -c overrides pin the model provider per invocation, so
-        // user config cannot reroute the spend — but the file still loads.
-        configSurface: ["~/.codex/config.toml (model_provider pinned per invocation)", "repository AGENTS.md"],
+        // Codex's build setup, with the model provider pinned by constant -c overrides.
+        isolation: { flag: "--ignore-user-config --ignore-rules", resumeSafe: true, enforced: true },
+        configSurface: ["the project's named tools (Settings → Tools)", "~/.codex/AGENTS.md and repository AGENTS.md", `${OPENROUTER_ENV_KEY}`],
     },
     gemini: {
         transport: "streaming-jsonl",

package/dist/result-completion.d.ts

@@ -6,6 +6,13 @@
 import type { Store } from "./store.js";
 /** The ledger action a person's (or lead's) completion of a result writes. */
 export declare const COMPLETION_ACTION = "assignment handoff checked";
+/** The actor of an automatic completion: the result's work already landed (landed-cleanup.ts). Its ledger detail is
+ * the plain-English reason ("its pull request merged"), the one place every surface reads it from. */
+export declare const LANDED_ACTOR = "system:landed";
+/** Who may complete a result, as a completion's ledger actor: a person, a lead, or Toolroll when the work landed. */
+export declare const COMPLETER_ACTOR: RegExp;
+/** Why Toolroll marked a result complete, from its completion's actor and detail; null for a person's completion. */
+export declare function landedReasonOf(actor: string | null | undefined, detail: string | null | undefined): string | null;
 /** Whether a task's family is marked complete. Completion is recorded on the
  * family's root against its current version's latest result, so the root, a
  * superseded revision and the current version all read Complete together. */

package/dist/result-completion.js

@@ -1,6 +1,15 @@
 import { readVerifiedArtifact } from "./evidence.js";
 /** The ledger action a person's (or lead's) completion of a result writes. */
 export const COMPLETION_ACTION = "assignment handoff checked";
+/** The actor of an automatic completion: the result's work already landed (landed-cleanup.ts). Its ledger detail is
+ * the plain-English reason ("its pull request merged"), the one place every surface reads it from. */
+export const LANDED_ACTOR = "system:landed";
+/** Who may complete a result, as a completion's ledger actor: a person, a lead, or Toolroll when the work landed. */
+export const COMPLETER_ACTOR = /^(?:(?:operator|coordinator|lead):.+|system:landed)$/;
+/** Why Toolroll marked a result complete, from its completion's actor and detail; null for a person's completion. */
+export function landedReasonOf(actor, detail) {
+    return actor === LANDED_ACTOR ? detail?.trim() || "its work is already in main" : null;
+}
 /** Whether a task's family is marked complete. Completion is recorded on the
  * family's root against its current version's latest result, so the root, a
  * superseded revision and the current version all read Complete together. */

package/dist/runner.d.ts

@@ -121,8 +121,10 @@ export declare function removeRunnerRepoAuthed(store: Store, args: {
 export declare const RUNNER_NAME_MAX = 60;
 /** The most tasks one worker may be set to run at once (the console's register form says the same). */
 export declare const RUNNER_CAPACITY_MAX = 64;
-/** A capacity as typed: a whole number from 1 to RUNNER_CAPACITY_MAX, or null. */
-export declare function parseRunnerCapacity(value: string): number | null;
+/** A capacity as typed; changing an existing worker may use zero to drain it. */
+export declare function parseRunnerCapacity(value: string, { allowZero }?: {
+    allowZero?: boolean | undefined;
+}): number | null;
 export declare function validRunnerName(name: string): boolean;
 /** A generated base name: lowercase [a-z0-9-], collapsed, trimmed. The
  * suffix budget (finding 24) is the CALLER's arithmetic — truncate the

package/dist/runner.js

@@ -165,10 +165,10 @@ export function removeRunnerRepoAuthed(store, args, now) {
 export const RUNNER_NAME_MAX = 60;
 /** The most tasks one worker may be set to run at once (the console's register form says the same). */
 export const RUNNER_CAPACITY_MAX = 64;
-/** A capacity as typed: a whole number from 1 to RUNNER_CAPACITY_MAX, or null. */
-export function parseRunnerCapacity(value) {
+/** A capacity as typed; changing an existing worker may use zero to drain it. */
+export function parseRunnerCapacity(value, { allowZero = false } = {}) {
     const capacity = Number(value.trim());
-    return value.trim() !== "" && Number.isInteger(capacity) && capacity >= 1 && capacity <= RUNNER_CAPACITY_MAX ? capacity : null;
+    return value.trim() !== "" && Number.isInteger(capacity) && capacity >= (allowZero ? 0 : 1) && capacity <= RUNNER_CAPACITY_MAX ? capacity : null;
 }
 export function validRunnerName(name) {
     if (name === "" || name.length > RUNNER_NAME_MAX)

package/dist/serve.js

@@ -7,14 +7,15 @@ import { CodingWorkspace } from './coding-workspace.js';
 import { CONSOLE_FORMS, readForm } from "./contracts/console-api.js";
 import { createFlowRooms, flowFingerprint } from "./flow-live.js";
 import {} from "./google-mail.js";
-import { configureLeadFollow, runLeadFollowPass } from './lead-follow.js';
+import { configureLeadFollow, recordLeadFollowFailure, runLeadFollowPass } from './lead-follow.js';
 import { leadNameOf } from "./lead-identity.js";
 import { createLiveBus, followWorkspace } from "./live-bus.js";
 import { startMaintenance } from './maintenance.js';
 import { connectionsOf, localConnectOf, oneClickOf } from "./mcp-connect.js";
 import { MOBILE_VIEWPORT_SCRIPT } from "./mobile-viewport.js";
 import { projectAuthority } from "./project-access.js";
-import { discoverTools, projectToolsOf, secretsSetFor, TOOL_CATALOG } from "./project-tools.js";
+import { discoverTools, projectToolsOf, secretsSetFor, TOOL_CATALOG, toolStanding } from "./project-tools.js";
+import { toolRefusal } from "./policy.js";
 import { isEdgeAddress, refuseEdge } from "./server/edge-refusal.js";
 import { announcePasswordBearer, isPasswordBearer, PASSWORD_BEARER_REFUSED, passwordBearerAccepted } from "./password-bearer.js";
 import { createSharedGuards } from "./server/guards.js";
@@ -390,7 +391,24 @@ export function createDecisionServer(options) {
         repo, name: projectName(repo), holdings: projectHoldings(store, repo), running: projectRunning(store, repo, clock()),
         canDelete: who.via === "cookie" && store.isInstanceOperator(who.name),
         builds: projectBuildsOf(repo, who),
+        access: projectAccessOf(repo),
     });
+    /** Settings → Project → Build access: the project's named tools and whether each loads for its builds. */
+    const projectAccessOf = (repo) => {
+        try {
+            const policy = store.orgPolicy();
+            return { tools: projectToolsOf(store, repo).map(tool => {
+                    const refused = toolRefusal(policy, tool.name);
+                    const set = secretsSetFor(repo, tool.spec, toolHome);
+                    // As a launch decides (toolLaunchFor): a tool the organisation doesn't allow, or missing a secret, is left out.
+                    return refused !== null ? { name: tool.name, loads: false, words: refused }
+                        : { name: tool.name, loads: tool.spec.secrets.every(one => one.optional || set.includes(one.name)), words: toolStanding(tool, set).words };
+                }) };
+        }
+        catch {
+            return { problem: "Couldn't read this project's tools right now." };
+        }
+    };
     /** Settings → Project → Builds at once: the saved number, its workers' capacity, and what builds now. */
     const projectBuildsOf = (repo, who) => {
         const capacities = store.listRunners().filter(one => one.retiredAt === null && one.repos.includes(repo)).map(one => one.capacity);
@@ -1570,7 +1588,8 @@ export function createDecisionServer(options) {
             run: () => runLeadFollowPass({ store, repos: managedRepos, evidenceRoot, clock,
                 provider: () => { const enabled = chatEnablement(); return enabled.ok ? { config: enabled.config, key: enabled.key } : null; },
                 fetcher: chatFetcher, ...(options.subscriptionChatRunner ? { subscriptionRunner: options.subscriptionChatRunner } : {}) }),
-            onError: () => { },
+            // Pending delivery is durable and is read again on the next pass; a failure is said where follow status is read.
+            onError: error => recordLeadFollowFailure(store, error, clock()),
         });
     });
     // Keep native process custody until shutdown has verified agent/tool exit.

package/dist/server/chrome.d.ts

@@ -42,9 +42,12 @@ export declare const DEMO_BANNER_SHORT = "Demo: sample projects. Nothing calls a
  * inset into it. Semantic names only; every surface (server pages, the
  * React workspace, the pre-script fallback) reads these.
  *
- * The console's stylesheet lives in console.css, shipped beside this module:
- * the palette above in light, dark and pinned themes, then the page rules.
- * Its bytes are the served sheet's (WORKSPACE_STYLE hashes them). */
+ * The palette above, in light, dark and pinned themes, is Signal's generated
+ * tokens.css (src/design, built by youi from the design-language repo); the
+ * console's own rules follow in console.css, shipped beside this module.
+ * Their bytes are the served sheet's (WORKSPACE_STYLE hashes them). The React
+ * workspace's stylesheet loads after this one and never redefines a token, so
+ * a person's accent (accentHead) still wins over the generated default. */
 export declare const STYLE: string;
 /** Appearance: a three-way segmented switch, one tap per choice. */
 export declare const THEME_CONTROLS_CSS = ".task-repo select{width:100%;min-height:2.75rem;font-size:1rem}.task-repo-add{margin:.35rem .1rem .5rem}.task-repo-add a{display:inline-flex;align-items:center;min-height:2.25rem}details.result-request-open.result-request-form>summary{border:0;background:transparent;padding:.5rem 0;min-height:2.75rem;font-weight:600;display:list-item;list-style:revert}details.result-request-open.result-request-form>summary::-webkit-details-marker{display:revert}form.js-autosave button[type=submit]{display:none}.provider-row{border-bottom:1px solid var(--so-line);padding:.35rem 0}.provider-row:first-of-type{border-top:1px solid var(--so-line)}.provider-head{display:flex;align-items:center;gap:.75rem;margin:.4rem 0 0}.provider-status{display:inline-flex;align-items:center;gap:.4rem;color:var(--so-muted);font-size:.875rem}.provider-status i{width:.5rem;height:.5rem;border-radius:50%;background:var(--so-muted)}.provider-status--ok i{background:var(--so-success)}.provider-status--warn i{background:var(--so-attention)}.provider-status--off i{background:transparent;border:1.5px solid var(--so-muted)}details.provider-manage>summary{cursor:pointer;color:var(--so-accent-text);font-size:.875rem;min-height:2.5rem;display:list-item;padding-block:.5rem}.card.props .row{display:grid;gap:.1rem;margin:0 0 .75rem}.card.props .row>.meta{display:block;font-size:.75rem}.card.props .row>.meta::first-letter{text-transform:uppercase}.card.props .row>.mono{font-family:var(--font-sans);font-size:.875rem}.card.props .row>.mono .seal{font-family:var(--font-mono);font-size:.8125rem}details.evidence-files{margin:1rem 0}details.evidence-files>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:600}details.evidence-files ul{list-style:none;margin:0;padding:0}details.evidence-files li{display:flex;justify-content:space-between;gap:1rem;padding:.5rem 0;border-bottom:1px solid var(--so-line)}.result-action .result-feedback-link{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;text-decoration:none}@media(hover:hover) and (pointer:fine){.result-action .result-feedback-link:hover{background:var(--so-raised)}}.so-sr-only{position:absolute!important;width:1px!important;height:1px!important;padding:0!important;margin:-1px!important;overflow:hidden!important;clip:rect(0,0,0,0)!important;white-space:nowrap!important;border:0!important}.verdict{margin:.5rem 0 .75rem}.verdict-chips{display:flex;flex-wrap:wrap;gap:.4rem;list-style:none;padding:0;margin:0}.verdict-chip{display:inline-flex;align-items:center;gap:.3rem;min-height:1.75rem;padding:.2rem .65rem;border-radius:999px;font-size:.8125rem;font-weight:600;background:var(--so-neutral-soft);color:var(--so-neutral-ink)}.verdict-chip svg{width:.9rem;height:.9rem}.verdict-chip--success{background:var(--so-success-soft);color:var(--so-success)}.verdict-chip--danger{background:var(--so-danger-soft);color:var(--so-danger)}.verdict-chip--warning{background:var(--so-warning-soft);color:var(--so-warning)}.verdict-chip--info{background:var(--so-info-soft);color:var(--so-info)}.verdict-by{margin:.4rem 0 0}details.result-request-open{margin:.5rem 0}details.result-request-open>summary{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;cursor:pointer;list-style:none}details.result-request-open>summary::-webkit-details-marker{display:none}details.result-request-open[open]>summary{margin-bottom:.75rem}.settings-tiles{display:grid;gap:1.25rem;margin:0 0 2rem}.settings-tiles h2{margin:0 0 .5rem;font-size:.875rem;font-weight:600;color:var(--so-muted)}.settings-tiles section>div{display:grid;grid-template-columns:repeat(auto-fill,minmax(8.5rem,1fr));gap:.5rem}.settings-tiles a>span{display:grid;gap:.1rem;min-width:0}.settings-tiles .provider-status{font-weight:400;font-size:.8125rem}.settings-tiles a{display:flex;align-items:center;gap:.6rem;min-height:3rem;padding:.65rem .8rem;border:1px solid var(--so-line);border-radius:.625rem;background:var(--so-paper);color:var(--so-ink);text-decoration:none;font-weight:550;font-size:.875rem}@media(hover:hover) and (pointer:fine){.settings-tiles a:hover{border-color:var(--so-input-line);background:var(--so-raised)}}.settings-tiles a>svg{width:1.1rem;height:1.1rem;flex-shrink:0;color:var(--so-accent-text)}details.settings-more{margin:.25rem 0 1.25rem}details.settings-more>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:550}details.settings-more>summary .meta{font-weight:400;margin-left:.35rem}.settings-changed{margin-top:-.25rem}.appearance{margin:0 0 28px}.appearance h2{margin:0 0 10px}.theme-switch{display:inline-flex;flex-wrap:nowrap;max-width:100%;gap:4px;padding:4px;margin:0;border:1px solid var(--so-line);border-radius:10px;background:var(--so-raised)}.theme-switch .theme-choice,.so-native-region .theme-switch .theme-choice{flex:1 1 0;width:auto;white-space:nowrap;min-height:40px;padding:8px 16px;border:0;border-radius:7px;background:transparent;color:var(--so-muted);font:inherit;font-weight:550;box-shadow:none;cursor:pointer}@media(hover:hover) and (pointer:fine){.theme-switch .theme-choice:hover{color:var(--so-ink)}}.theme-switch .theme-choice[aria-pressed=\"true\"]{background:var(--so-paper);color:var(--so-ink);box-shadow:0 1px 2px rgb(0 0 0 / .1)}.appearance .meta{margin:8px 0 0}@media(max-width:600px){.theme-switch .theme-choice{min-height:44px}}.update-notes{white-space:pre-wrap;overflow-wrap:anywhere;font:inherit;max-height:18rem;overflow:auto}";

package/dist/server/chrome.js

@@ -127,10 +127,14 @@ export const DEMO_BANNER_SHORT = "Demo: sample projects. Nothing calls a model o
  * inset into it. Semantic names only; every surface (server pages, the
  * React workspace, the pre-script fallback) reads these.
  *
- * The console's stylesheet lives in console.css, shipped beside this module:
- * the palette above in light, dark and pinned themes, then the page rules.
- * Its bytes are the served sheet's (WORKSPACE_STYLE hashes them). */
-export const STYLE = readFileSync(join(import.meta.dirname, "console.css"), "utf8");
+ * The palette above, in light, dark and pinned themes, is Signal's generated
+ * tokens.css (src/design, built by youi from the design-language repo); the
+ * console's own rules follow in console.css, shipped beside this module.
+ * Their bytes are the served sheet's (WORKSPACE_STYLE hashes them). The React
+ * workspace's stylesheet loads after this one and never redefines a token, so
+ * a person's accent (accentHead) still wins over the generated default. */
+export const STYLE = readFileSync(join(import.meta.dirname, "..", "design", "tokens.css"), "utf8") +
+    readFileSync(join(import.meta.dirname, "console.css"), "utf8");
 /** Appearance: a three-way segmented switch, one tap per choice. */
 export const THEME_CONTROLS_CSS = `.task-repo select{width:100%;min-height:2.75rem;font-size:1rem}.task-repo-add{margin:.35rem .1rem .5rem}.task-repo-add a{display:inline-flex;align-items:center;min-height:2.25rem}details.result-request-open.result-request-form>summary{border:0;background:transparent;padding:.5rem 0;min-height:2.75rem;font-weight:600;display:list-item;list-style:revert}details.result-request-open.result-request-form>summary::-webkit-details-marker{display:revert}form.js-autosave button[type=submit]{display:none}.provider-row{border-bottom:1px solid var(--so-line);padding:.35rem 0}.provider-row:first-of-type{border-top:1px solid var(--so-line)}.provider-head{display:flex;align-items:center;gap:.75rem;margin:.4rem 0 0}.provider-status{display:inline-flex;align-items:center;gap:.4rem;color:var(--so-muted);font-size:.875rem}.provider-status i{width:.5rem;height:.5rem;border-radius:50%;background:var(--so-muted)}.provider-status--ok i{background:var(--so-success)}.provider-status--warn i{background:var(--so-attention)}.provider-status--off i{background:transparent;border:1.5px solid var(--so-muted)}details.provider-manage>summary{cursor:pointer;color:var(--so-accent-text);font-size:.875rem;min-height:2.5rem;display:list-item;padding-block:.5rem}.card.props .row{display:grid;gap:.1rem;margin:0 0 .75rem}.card.props .row>.meta{display:block;font-size:.75rem}.card.props .row>.meta::first-letter{text-transform:uppercase}.card.props .row>.mono{font-family:var(--font-sans);font-size:.875rem}.card.props .row>.mono .seal{font-family:var(--font-mono);font-size:.8125rem}details.evidence-files{margin:1rem 0}details.evidence-files>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:600}details.evidence-files ul{list-style:none;margin:0;padding:0}details.evidence-files li{display:flex;justify-content:space-between;gap:1rem;padding:.5rem 0;border-bottom:1px solid var(--so-line)}.result-action .result-feedback-link{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;text-decoration:none}@media(hover:hover) and (pointer:fine){.result-action .result-feedback-link:hover{background:var(--so-raised)}}.so-sr-only{position:absolute!important;width:1px!important;height:1px!important;padding:0!important;margin:-1px!important;overflow:hidden!important;clip:rect(0,0,0,0)!important;white-space:nowrap!important;border:0!important}.verdict{margin:.5rem 0 .75rem}.verdict-chips{display:flex;flex-wrap:wrap;gap:.4rem;list-style:none;padding:0;margin:0}.verdict-chip{display:inline-flex;align-items:center;gap:.3rem;min-height:1.75rem;padding:.2rem .65rem;border-radius:999px;font-size:.8125rem;font-weight:600;background:var(--so-neutral-soft);color:var(--so-neutral-ink)}.verdict-chip svg{width:.9rem;height:.9rem}.verdict-chip--success{background:var(--so-success-soft);color:var(--so-success)}.verdict-chip--danger{background:var(--so-danger-soft);color:var(--so-danger)}.verdict-chip--warning{background:var(--so-warning-soft);color:var(--so-warning)}.verdict-chip--info{background:var(--so-info-soft);color:var(--so-info)}.verdict-by{margin:.4rem 0 0}details.result-request-open{margin:.5rem 0}details.result-request-open>summary{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;cursor:pointer;list-style:none}details.result-request-open>summary::-webkit-details-marker{display:none}details.result-request-open[open]>summary{margin-bottom:.75rem}.settings-tiles{display:grid;gap:1.25rem;margin:0 0 2rem}.settings-tiles h2{margin:0 0 .5rem;font-size:.875rem;font-weight:600;color:var(--so-muted)}.settings-tiles section>div{display:grid;grid-template-columns:repeat(auto-fill,minmax(8.5rem,1fr));gap:.5rem}.settings-tiles a>span{display:grid;gap:.1rem;min-width:0}.settings-tiles .provider-status{font-weight:400;font-size:.8125rem}.settings-tiles a{display:flex;align-items:center;gap:.6rem;min-height:3rem;padding:.65rem .8rem;border:1px solid var(--so-line);border-radius:.625rem;background:var(--so-paper);color:var(--so-ink);text-decoration:none;font-weight:550;font-size:.875rem}@media(hover:hover) and (pointer:fine){.settings-tiles a:hover{border-color:var(--so-input-line);background:var(--so-raised)}}.settings-tiles a>svg{width:1.1rem;height:1.1rem;flex-shrink:0;color:var(--so-accent-text)}details.settings-more{margin:.25rem 0 1.25rem}details.settings-more>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:550}details.settings-more>summary .meta{font-weight:400;margin-left:.35rem}.settings-changed{margin-top:-.25rem}.appearance{margin:0 0 28px}.appearance h2{margin:0 0 10px}.theme-switch{display:inline-flex;flex-wrap:nowrap;max-width:100%;gap:4px;padding:4px;margin:0;border:1px solid var(--so-line);border-radius:10px;background:var(--so-raised)}.theme-switch .theme-choice,.so-native-region .theme-switch .theme-choice{flex:1 1 0;width:auto;white-space:nowrap;min-height:40px;padding:8px 16px;border:0;border-radius:7px;background:transparent;color:var(--so-muted);font:inherit;font-weight:550;box-shadow:none;cursor:pointer}@media(hover:hover) and (pointer:fine){.theme-switch .theme-choice:hover{color:var(--so-ink)}}.theme-switch .theme-choice[aria-pressed="true"]{background:var(--so-paper);color:var(--so-ink);box-shadow:0 1px 2px rgb(0 0 0 / .1)}.appearance .meta{margin:8px 0 0}@media(max-width:600px){.theme-switch .theme-choice{min-height:44px}}.update-notes{white-space:pre-wrap;overflow-wrap:anywhere;font:inherit;max-height:18rem;overflow:auto}`;
 /** The page CSS this module writes itself (not the imported modules'), for the stylesheet contract tests. */