toolroll 0.9.60 → 0.9.61

package/dist/project-tools.js

@@ -540,7 +540,7 @@ function safeLine(text) {
 }
 const toml = (value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 const tomlList = (values) => `[${values.map(toml).join(",")}]`;
-/** Claude: only these servers (`--strict-mcp-config`), written to a private 0600 file removed after the run. */
+/** Claude: only these servers, written to a private 0600 file removed after the run (the provider adds `--strict-mcp-config`). */
 export function claudeToolArgs(launch) {
     const servers = {};
     for (const tool of launch.tools) {
@@ -563,49 +563,27 @@ export function claudeToolArgs(launch) {
     const file = join(dir, "mcp.json");
     writeFileSync(file, JSON.stringify({ mcpServers: servers }), { mode: 0o600 });
     return {
-        argv: ["--strict-mcp-config", "--mcp-config", file],
+        argv: ["--mcp-config", file],
         // A first `npx` download can take longer than the default start-up wait.
         env: launch.tools.length > 0 ? { MCP_TIMEOUT: "60000" } : {},
         omitEnv: [],
         cleanup: () => rmSync(dir, { recursive: true, force: true }),
     };
 }
-/** The operator's Codex model settings a build keeps when its tools are replaced: how it thinks, never what it can reach. */
-const CARRIED_CODEX_SETTINGS = ["model_reasoning_effort", "model_reasoning_summary", "model_verbosity", "service_tier", "personality"];
-export function carriedCodexSettings(includeModel, codexHome = process.env["CODEX_HOME"] ?? join(homedir(), ".codex")) {
-    let text = "";
-    try {
-        text = readFileSync(join(codexHome, "config.toml"), "utf8");
-    }
-    catch {
-        return [];
-    }
-    const wanted = includeModel ? ["model", ...CARRIED_CODEX_SETTINGS] : CARRIED_CODEX_SETTINGS;
-    const argv = [];
-    for (const line of text.split("\n")) {
-        if (/^\s*\[/.test(line))
-            break;
-        const match = /^\s*([a-z_]+)\s*=\s*("[^"\\\n]{0,80}"|[A-Za-z0-9_.-]{1,40})\s*(?:#.*)?$/.exec(line);
-        if (match !== null && wanted.includes(match[1]))
-            argv.push("-c", `${match[1]}=${match[2]}`);
-    }
-    return argv;
-}
 /** Where the tool launcher lives beside this module, built. */
 export function toolLauncherPath() {
     return fileURLToPath(new URL("./tool-launcher.js", import.meta.url));
 }
 /**
- * Codex: the operator's config.toml is ignored whole (its MCP servers
- * with it), ChatGPT apps and plugins are off, the model settings above
- * are carried, and each tool is named by `-c` and started through the
- * launcher. Codex gives its own environment to the agent's shell whatever
+ * Codex: each tool is named by `-c` and started through the launcher. The
+ * operator's config.toml, rules, apps, plugins and hooks are already off
+ * (the provider's CODEX_BUILD_ISOLATION_ARGV), and nothing of config.toml
+ * is carried. Codex gives its own environment to the agent's shell whatever
  * its policy says, so no secret rides it: each tool's values sit in the
  * run's private 0600 file and reach only that tool's process.
  */
-export function codexToolArgs(launch, options) {
-    // ChatGPT apps, connectors and plugins are the operator's account, not the project's: all off (plugins carry their own MCP servers).
-    const argv = ["--ignore-user-config", ...carriedCodexSettings(options.includeModel, options.codexHome), "-c", "apps._default.enabled=false", "-c", "features.plugins=false"];
+export function codexToolArgs(launch, options = {}) {
+    const argv = [];
     if (launch.tools.length === 0)
         return { argv, env: {}, omitEnv: [], cleanup: () => undefined };
     const dir = mkdtempSync(join(tmpdir(), "so-tools-"));
@@ -701,9 +679,8 @@ export function prepareRunTools(store, runId, provider, options) {
     const launch = limitedTo(toolLaunchFor(store, runId, options.home), options.readOnly, options.withheld);
     const enabledTools = options.readOnly === undefined ? {} : { enabledTools: options.readOnly };
     const prepared = provider === "claude" ? claudeToolArgs(launch)
-        : provider === "codex" ? codexToolArgs(launch, { includeModel: options.includeModel, ...enabledTools })
-            : provider === "openrouter" ? codexToolArgs(launch, { includeModel: false, ...enabledTools })
-                : { argv: [...GEMINI_NO_TOOLS_ARGV], env: {}, omitEnv: [], cleanup: () => undefined };
+        : provider === "codex" || provider === "openrouter" ? codexToolArgs(launch, enabledTools)
+            : { argv: [...GEMINI_NO_TOOLS_ARGV], env: {}, omitEnv: [], cleanup: () => undefined };
     const skipped = provider === "gemini"
         ? [...launch.skipped, ...launch.tools.map(one => ({ name: one.spec.name, reason: "Gemini builds can't use project tools yet" }))]
         : launch.skipped;
@@ -725,13 +702,12 @@ function limitedTo(launch, readOnly, withheld = {}) {
     };
 }
 /** When a launch's tools cannot be prepared, it still gets none of anything else's: the same isolation with an empty list. */
-export function noToolsArgs(provider, includeModel) {
-    const none = { tools: [], skipped: [] };
+export function noToolsArgs(provider) {
     if (provider === "claude")
-        return { argv: ["--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}'], env: {}, omitEnv: [], cleanup: () => undefined };
+        return { argv: ["--mcp-config", '{"mcpServers":{}}'], env: {}, omitEnv: [], cleanup: () => undefined };
     if (provider === "gemini")
         return { argv: [...GEMINI_NO_TOOLS_ARGV], env: {}, omitEnv: [], cleanup: () => undefined };
-    return codexToolArgs(none, { includeModel: provider === "codex" && includeModel });
+    return codexToolArgs({ tools: [], skipped: [] });
 }
 /** Add one tool (and, for an import, the values it brings) to a project's builds. */
 export function addToolTo(store, repo, input, source, by, now, options = {}) {

package/dist/provider.d.ts

@@ -64,6 +64,13 @@ export type Invocation = {
      * Codex renders it as its own sandbox profile; Claude as deny rules for
      * its file tools (its shell is fenced by the macOS sandbox around it). */
     fence?: readonly string[];
+    /** More paths Claude's own file tools refuse, beside the fence: home
+     * configuration its CLI still reads itself (so the sandbox around the
+     * whole process can't deny them). */
+    fileToolFence?: readonly string[];
+    /** The task's own folder (its worktree). A Claude build loads no settings
+     * files, so this is where the repository's CLAUDE.md is read from. */
+    workspace?: string;
     /** A running build's steering folder (steer-mailbox.ts): the absolute path
      * and the worktree-relative name its brief uses. Claude renders a
      * PostToolUse hook that says when a note is waiting; every other provider
@@ -72,6 +79,11 @@ export type Invocation = {
         dir: string;
         name: string;
     };
+    /** Live input (live-input.ts): the brief arrives as the first stdin message
+     * and stdin stays open, so the argv carries `--input-format stream-json`
+     * and never the brief (Claude drops a `-p` prompt once stdin carries
+     * input). Set by the gateway only, for a transport that streams input. */
+    streamInput?: boolean;
     /** Claude's structured-output floor for a non-review phase: the scout's
      * report rides the terminal result event instead of a file plan mode
      * would refuse to write. Ignored by providers without `--json-schema`. */
@@ -115,6 +127,9 @@ export type ParsedEnvelope = {
     tokensIn: number | null;
     tokensOut: number | null;
     costUsd: number | null;
+    /** The run spent but its cost could not be read (Claude's main result was too large to keep): the gateway charges
+     * the run's dollar cap, or records it unmeasured when none applied. Absent = the cost is what costUsd says. */
+    costUnknown?: boolean;
     usageRaw: string | null;
     /**
      * Whether the provider was seen to initialize (codex: thread.started;
@@ -152,6 +167,9 @@ export type ParsedEnvelope = {
 type Adapter = {
     binary: string;
     argv(invocation: Invocation): string[];
+    /** Environment the launch needs beside the argv (Claude: read the
+     * workspace's CLAUDE.md through `--add-dir`). */
+    env?(invocation: Invocation): Record<string, string>;
     /** Prompt input for transports that use stdin instead of a bounded OS argument. */
     stdin?(invocation: Invocation): string | undefined;
     parse(stdout: string): ParsedEnvelope;
@@ -167,8 +185,47 @@ type Adapter = {
     clampTimeout(phase: Phase, requestedMs: number): number;
 };
 export declare const OPENROUTER_ENV_KEY = "OPENROUTER_API_KEY";
+/**
+ * A build's own setup (plan, build and repair; never a review, which keeps
+ * the isolation above). No settings file loads — not the user's, the
+ * repository's or the local one — so none of their hooks, plugins or
+ * permissions reach the run; Toolroll's one `--settings` (the fence and the
+ * steering hook) is all there is. MCP servers come only from `--mcp-config`:
+ * the project's named tools, or an explicit empty list. The repository's
+ * CLAUDE.md still loads, through `--add-dir` on the workspace. Sign-in is
+ * the CLI's own (keychain or ~/.claude), which no setting source governs.
+ * `-p` never shows the workspace trust prompt (Claude Code 2.1.290), so a
+ * fresh worktree can't wedge a headless run. Checked against 2.1.290 with
+ * planted user, project and local hooks and MCP servers: none loaded.
+ */
+export declare const CLAUDE_BUILD_ISOLATION_ARGV: readonly string[];
 /** Claude's own tools that only make sense with a person to wake them. */
 export declare const HEADLESS_DISALLOWED_TOOLS: readonly string[];
+/**
+ * Whether a failed launch was an installed CLI too old for a build's own
+ * setup: it names one of those flags as unknown. Then nothing ran, and the
+ * run says so plainly instead of reading as a failed sign-in or bad work.
+ */
+export declare function isolationUnsupported(provider: ProviderId, stderr: string): string | null;
+/**
+ * Codex's own fail-closed equivalent of `CLAUDE_REVIEW_ISOLATION_ARGV`:
+ * read-only sandbox rather than the ordinary `workspace-write` (a reviewer
+ * dispatched to codex was, until this, handed a write-capable sandbox —
+ * the same class of leak the claude side had), approvals that REFUSE
+ * rather than wait on a prompt a headless turn can never answer, and the
+ * user's own `~/.codex/config.toml` — which can name arbitrary MCP
+ * servers, exactly the surface `--strict-mcp-config` closes for claude —
+ * ignored outright.
+ */
+/**
+ * A Codex build's own setup, the equivalent of Claude's: the operator's
+ * config.toml (its MCP servers, model choices, profiles) and execpolicy
+ * rules ignored, ChatGPT apps and plugins off (plugins carry their own MCP
+ * servers), and hooks off. Sign-in still comes from CODEX_HOME, which
+ * `--ignore-user-config` leaves alone. The project's named tools follow as
+ * `-c mcp_servers.*` (project-tools.ts).
+ */
+export declare const CODEX_BUILD_ISOLATION_ARGV: readonly string[];
 /**
  * The diagnostic discipline (Phase 3 B6/C6): the harness's own words are
  * untrusted bytes headed for refusal screens and notifications — controls
@@ -188,11 +245,10 @@ export declare const ALL_CREDENTIAL_ENV: readonly string[];
 export declare function adapterFor(provider: ProviderId): Adapter;
 /**
  * The provider audit: what each harness supports, what we actually pass,
- * and what user-global configuration can leak into an unattended run.
- * REPORT BEFORE ENFORCEMENT (Codex roadmap review, item 10): none of this
- * changes an invocation — it states facts an operator reads on `providers`,
- * so hermetic mode can later be turned on per provider from evidence
- * instead of hope. `enforced` is a literal false until that day.
+ * and what user-global configuration still reaches an unattended run.
+ * None of this changes an invocation — it states facts an operator reads
+ * on `providers`. Claude and Codex builds now run in their own setup
+ * (`enforced`); Gemini's flag is still only reported.
  */
 export type ProviderAudit = {
     /** How output reaches us — and therefore which signals can exist at all. */
@@ -217,13 +273,14 @@ export type ProviderAudit = {
      */
     terminalContract: "required" | "none";
     isolation: {
-        /** The harness's hermetic flag, if it has one. We do not pass it. */
+        /** The harness's hermetic flag, if it has one. */
         flag: string | null;
         /** Whether that flag preserves resume. false = documented conflict. */
         resumeSafe: boolean | null;
-        enforced: false;
+        /** Whether every build, fresh or resumed, passes it. */
+        enforced: boolean;
     };
-    /** User-global surfaces that can reach an invocation today. */
+    /** What still reaches a build: its own sources and the user surfaces left. */
     configSurface: readonly string[];
 };
 /** Read-only facts about a provider — safe anywhere, spawns nothing. */

package/dist/provider.js

@@ -21,7 +21,7 @@
 import { claudeFenceSettings, codexFenceArgv } from "./agent-fence.js";
 import { claudeSteerHooks } from "./steer-mailbox.js";
 import {} from "./exec.js";
-import { runStreamJsonl, runClaudeStreamJsonl, runGeminiStreamJsonl } from "./exec.js";
+import { runStreamJsonl, runClaudeStreamJsonl, runGeminiStreamJsonl, CLAUDE_COST_UNKNOWN } from "./exec.js";
 import { scanForSecrets } from "./evidence.js";
 import { FINDINGS_MODEL_SCHEMA } from "./contracts/review-findings.js";
 import { REVIEW_OUTPUT_LIMITS } from "./structured-output.js";
@@ -167,11 +167,26 @@ const CLAUDE_REVIEW_JSON_SCHEMA = {
     required: ["version"],
     additionalProperties: false,
 };
+/**
+ * A build's own setup (plan, build and repair; never a review, which keeps
+ * the isolation above). No settings file loads — not the user's, the
+ * repository's or the local one — so none of their hooks, plugins or
+ * permissions reach the run; Toolroll's one `--settings` (the fence and the
+ * steering hook) is all there is. MCP servers come only from `--mcp-config`:
+ * the project's named tools, or an explicit empty list. The repository's
+ * CLAUDE.md still loads, through `--add-dir` on the workspace. Sign-in is
+ * the CLI's own (keychain or ~/.claude), which no setting source governs.
+ * `-p` never shows the workspace trust prompt (Claude Code 2.1.290), so a
+ * fresh worktree can't wedge a headless run. Checked against 2.1.290 with
+ * planted user, project and local hooks and MCP servers: none loaded.
+ */
+export const CLAUDE_BUILD_ISOLATION_ARGV = ["--setting-sources", "", "--strict-mcp-config"];
+const EMPTY_MCP_CONFIG = '{"mcpServers":{}}';
 /** Claude's own tools that only make sense with a person to wake them. */
 export const HEADLESS_DISALLOWED_TOOLS = ["ScheduleWakeup", "CronCreate", "Monitor"];
 const claudeArgv = (invocation) => [
     "-p",
-    invocation.brief,
+    ...(invocation.streamInput === true ? ["--input-format", "stream-json"] : [invocation.brief]),
     ...(invocation.resumeSession === null ? [] : ["--resume", invocation.resumeSession]),
     // stream-json (arc 1): the terminal result event IS the old buffered
     // envelope, now arriving as one line of many — the streaming transport
@@ -197,22 +212,47 @@ const claudeArgv = (invocation) => [
             // turn that a -p process never gets. Denied at the harness too.
             "--disallowedTools", HEADLESS_DISALLOWED_TOOLS.join(","),
             ...(invocation.allowedTools === undefined || invocation.allowedTools.length === 0 ? [] : ["--allowedTools", invocation.allowedTools.join(",")]),
+            ...CLAUDE_BUILD_ISOLATION_ARGV,
+            ...(invocation.workspace === undefined ? [] : ["--add-dir", invocation.workspace]),
             ...(invocation.toolArgv ?? []),
             ...(invocation.extraMcpServers === undefined ? [] : ["--mcp-config", JSON.stringify({ mcpServers: invocation.extraMcpServers })]),
+            // Strict with nothing named still names its empty list.
+            ...((invocation.toolArgv ?? []).includes("--mcp-config") || invocation.extraMcpServers !== undefined ? [] : ["--mcp-config", EMPTY_MCP_CONFIG]),
             ...claudeSettingsArgv(invocation),
             ...(invocation.jsonSchema === undefined ? [] : ["--json-schema", JSON.stringify(invocation.jsonSchema)])
         ]),
 ];
-/** One --settings for a build: the fence's deny rules and the steering doorbell, whichever the run has. */
+/** The build's one --settings: no personal memory, plus the fence and steering doorbell. */
 function claudeSettingsArgv(invocation) {
-    const fenced = invocation.fence !== undefined && invocation.fence.length > 0;
-    if (!fenced && invocation.steerFolder === undefined)
-        return [];
+    const denied = [...(invocation.fence ?? []), ...(invocation.fileToolFence ?? [])];
     return ["--settings", JSON.stringify({
-            ...(fenced ? JSON.parse(claudeFenceSettings(invocation.fence)) : {}),
+            autoMemoryEnabled: false,
+            ...(denied.length > 0 ? JSON.parse(claudeFenceSettings(denied)) : {}),
             ...(invocation.steerFolder === undefined ? {} : { hooks: claudeSteerHooks(invocation.steerFolder.dir, invocation.steerFolder.name) }),
         })];
 }
+/** With no settings sources, only `--add-dir` folders' CLAUDE.md load, and only with this set. */
+const claudeEnv = (invocation) => invocation.phase === "review" || invocation.workspace === undefined ? {} : { CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD: "1" };
+/** The flags a build's own setup depends on, by provider. */
+const ISOLATION_FLAGS = {
+    claude: ["--setting-sources", "--strict-mcp-config", "--settings", "--add-dir", "--mcp-config"],
+    codex: ["--ignore-user-config", "--ignore-rules"],
+    openrouter: ["--ignore-user-config", "--ignore-rules"],
+};
+/**
+ * Whether a failed launch was an installed CLI too old for a build's own
+ * setup: it names one of those flags as unknown. Then nothing ran, and the
+ * run says so plainly instead of reading as a failed sign-in or bad work.
+ */
+export function isolationUnsupported(provider, stderr) {
+    const flags = ISOLATION_FLAGS[provider] ?? [];
+    const said = stderr.slice(0, 8192);
+    const flag = flags.find(one => new RegExp(`(unknown|unexpected|unrecognized) (option|argument)[^\\n]{0,8}${one.replace(/-/g, "\\-")}\\b`, "i").test(said));
+    if (flag === undefined)
+        return null;
+    const name = provider === "claude" ? "Claude Code" : "Codex";
+    return `The installed ${name} doesn't support ${flag}, which builds need to run without your own hooks, plugins and MCP servers. Update ${name} and try again.`;
+}
 /**
  * The turn's own words, preferring the schema-validated structured field
  * (present only under `--json-schema`) over the plain result string — the
@@ -267,6 +307,7 @@ function claudeEnvelopeOf(result, sessionFromInit, initObserved, initSessionConf
         tokensIn: typeof input === "number" && input >= 0 ? input : null,
         tokensOut: typeof output === "number" && output >= 0 ? output : null,
         costUsd: typeof cost === "number" && cost >= 0 ? cost : null,
+        ...(result !== null && result[CLAUDE_COST_UNKNOWN] === true ? { costUnknown: true } : {}),
         usageRaw: result?.usage === undefined ? null : JSON.stringify(result.usage).slice(0, USAGE_JSON_CAP),
         initObserved,
         // Structural, never prose (finding 15): consumed means the primary
@@ -376,6 +417,21 @@ const codexSandboxArgv = (mode, resuming) => resuming ? ["-c", `sandbox_mode="${
  * servers, exactly the surface `--strict-mcp-config` closes for claude —
  * ignored outright.
  */
+/**
+ * A Codex build's own setup, the equivalent of Claude's: the operator's
+ * config.toml (its MCP servers, model choices, profiles) and execpolicy
+ * rules ignored, ChatGPT apps and plugins off (plugins carry their own MCP
+ * servers), and hooks off. Sign-in still comes from CODEX_HOME, which
+ * `--ignore-user-config` leaves alone. The project's named tools follow as
+ * `-c mcp_servers.*` (project-tools.ts).
+ */
+export const CODEX_BUILD_ISOLATION_ARGV = [
+    "--ignore-user-config",
+    "--ignore-rules",
+    "-c", "apps._default.enabled=false",
+    "-c", "features.plugins=false",
+    "-c", "features.hooks=false",
+];
 const CODEX_REVIEW_ISOLATION_ARGV = (resuming) => [
     "--ignore-user-config",
     ...codexSandboxArgv("read-only", resuming),
@@ -406,6 +462,7 @@ const codexArgv = (extra) => (invocation) => {
         ...(invocation.resumeSession === null ? [] : ["resume", invocation.resumeSession]),
         "--json",
         "--skip-git-repo-check",
+        ...(invocation.phase === "review" ? [] : CODEX_BUILD_ISOLATION_ARGV),
         ...(invocation.phase === "review"
             ? CODEX_REVIEW_ISOLATION_ARGV(resuming)
             // The agent fence: Codex's own sandbox with Toolroll's secrets
@@ -725,6 +782,7 @@ const ADAPTERS = {
     claude: {
         binary: "claude",
         argv: claudeArgv,
+        env: claudeEnv,
         parse: claudeParse,
         defaultRunner: runClaudeStreamJsonl,
         extraOmitEnv: foreignCredentialEnv("claude"),
@@ -788,13 +846,14 @@ const AUDITS = {
         initSignal: "system-init",
         sessionIdentity: "announced",
         terminalContract: "none",
-        // Restricted mode is resume-safe and is enforced for sealed reviewer
-        // turns. `enforced` remains false here because this provider-wide audit
-        // also covers ordinary build turns, where the flag is not applied.
-        isolation: { flag: "--restricted", resumeSafe: true, enforced: false },
+        // Builds: no settings sources and strict MCP, fresh and resumed alike
+        // (CLAUDE_BUILD_ISOLATION_ARGV). Reviews keep --restricted --safe-mode.
+        isolation: { flag: CLAUDE_BUILD_ISOLATION_ARGV.filter(one => one !== "").join(" "), resumeSafe: true, enforced: true },
         configSurface: [
-            "~/.claude/CLAUDE.md and settings (hooks, MCP servers, plugins)",
-            "repository CLAUDE.md / .claude directory",
+            "Toolroll's own --settings (the fence and steering hook)",
+            "the project's named tools (Settings → Tools)",
+            "repository CLAUDE.md",
+            "organisation-managed settings",
         ],
     },
     codex: {
@@ -803,10 +862,11 @@ const AUDITS = {
         initSignal: "thread.started",
         sessionIdentity: "announced",
         terminalContract: "none",
-        // --ephemeral exists and is deliberately not passed: repair resumes
-        // sessions, and ephemeral runs have none to resume.
-        isolation: { flag: "--ephemeral", resumeSafe: false, enforced: false },
-        configSurface: ["~/.codex/config.toml", "repository AGENTS.md"],
+        // Builds ignore config.toml and execpolicy rules, with apps, plugins and
+        // hooks off (CODEX_BUILD_ISOLATION_ARGV); sign-in stays in CODEX_HOME.
+        // Never --ephemeral: repair resumes sessions.
+        isolation: { flag: "--ignore-user-config --ignore-rules", resumeSafe: true, enforced: true },
+        configSurface: ["the project's named tools (Settings → Tools)", "~/.codex/AGENTS.md and repository AGENTS.md", "sign-in from CODEX_HOME"],
     },
     openrouter: {
         transport: "streaming-jsonl",
@@ -814,10 +874,9 @@ const AUDITS = {
         initSignal: "thread.started",
         sessionIdentity: "announced",
         terminalContract: "none",
-        isolation: { flag: "--ephemeral", resumeSafe: false, enforced: false },
-        // The constant -c overrides pin the model provider per invocation, so
-        // user config cannot reroute the spend — but the file still loads.
-        configSurface: ["~/.codex/config.toml (model_provider pinned per invocation)", "repository AGENTS.md"],
+        // Codex's build setup, with the model provider pinned by constant -c overrides.
+        isolation: { flag: "--ignore-user-config --ignore-rules", resumeSafe: true, enforced: true },
+        configSurface: ["the project's named tools (Settings → Tools)", "~/.codex/AGENTS.md and repository AGENTS.md", `${OPENROUTER_ENV_KEY}`],
     },
     gemini: {
         transport: "streaming-jsonl",

package/dist/result-completion.d.ts

@@ -6,6 +6,13 @@
 import type { Store } from "./store.js";
 /** The ledger action a person's (or lead's) completion of a result writes. */
 export declare const COMPLETION_ACTION = "assignment handoff checked";
+/** The actor of an automatic completion: the result's work already landed (landed-cleanup.ts). Its ledger detail is
+ * the plain-English reason ("its pull request merged"), the one place every surface reads it from. */
+export declare const LANDED_ACTOR = "system:landed";
+/** Who may complete a result, as a completion's ledger actor: a person, a lead, or Toolroll when the work landed. */
+export declare const COMPLETER_ACTOR: RegExp;
+/** Why Toolroll marked a result complete, from its completion's actor and detail; null for a person's completion. */
+export declare function landedReasonOf(actor: string | null | undefined, detail: string | null | undefined): string | null;
 /** Whether a task's family is marked complete. Completion is recorded on the
  * family's root against its current version's latest result, so the root, a
  * superseded revision and the current version all read Complete together. */

package/dist/result-completion.js

@@ -1,6 +1,15 @@
 import { readVerifiedArtifact } from "./evidence.js";
 /** The ledger action a person's (or lead's) completion of a result writes. */
 export const COMPLETION_ACTION = "assignment handoff checked";
+/** The actor of an automatic completion: the result's work already landed (landed-cleanup.ts). Its ledger detail is
+ * the plain-English reason ("its pull request merged"), the one place every surface reads it from. */
+export const LANDED_ACTOR = "system:landed";
+/** Who may complete a result, as a completion's ledger actor: a person, a lead, or Toolroll when the work landed. */
+export const COMPLETER_ACTOR = /^(?:(?:operator|coordinator|lead):.+|system:landed)$/;
+/** Why Toolroll marked a result complete, from its completion's actor and detail; null for a person's completion. */
+export function landedReasonOf(actor, detail) {
+    return actor === LANDED_ACTOR ? detail?.trim() || "its work is already in main" : null;
+}
 /** Whether a task's family is marked complete. Completion is recorded on the
  * family's root against its current version's latest result, so the root, a
  * superseded revision and the current version all read Complete together. */

package/dist/runner.d.ts

@@ -121,8 +121,10 @@ export declare function removeRunnerRepoAuthed(store: Store, args: {
 export declare const RUNNER_NAME_MAX = 60;
 /** The most tasks one worker may be set to run at once (the console's register form says the same). */
 export declare const RUNNER_CAPACITY_MAX = 64;
-/** A capacity as typed: a whole number from 1 to RUNNER_CAPACITY_MAX, or null. */
-export declare function parseRunnerCapacity(value: string): number | null;
+/** A capacity as typed; changing an existing worker may use zero to drain it. */
+export declare function parseRunnerCapacity(value: string, { allowZero }?: {
+    allowZero?: boolean | undefined;
+}): number | null;
 export declare function validRunnerName(name: string): boolean;
 /** A generated base name: lowercase [a-z0-9-], collapsed, trimmed. The
  * suffix budget (finding 24) is the CALLER's arithmetic — truncate the

package/dist/runner.js

@@ -165,10 +165,10 @@ export function removeRunnerRepoAuthed(store, args, now) {
 export const RUNNER_NAME_MAX = 60;
 /** The most tasks one worker may be set to run at once (the console's register form says the same). */
 export const RUNNER_CAPACITY_MAX = 64;
-/** A capacity as typed: a whole number from 1 to RUNNER_CAPACITY_MAX, or null. */
-export function parseRunnerCapacity(value) {
+/** A capacity as typed; changing an existing worker may use zero to drain it. */
+export function parseRunnerCapacity(value, { allowZero = false } = {}) {
     const capacity = Number(value.trim());
-    return value.trim() !== "" && Number.isInteger(capacity) && capacity >= 1 && capacity <= RUNNER_CAPACITY_MAX ? capacity : null;
+    return value.trim() !== "" && Number.isInteger(capacity) && capacity >= (allowZero ? 0 : 1) && capacity <= RUNNER_CAPACITY_MAX ? capacity : null;
 }
 export function validRunnerName(name) {
     if (name === "" || name.length > RUNNER_NAME_MAX)

package/dist/serve.js

@@ -14,7 +14,8 @@ import { startMaintenance } from './maintenance.js';
 import { connectionsOf, localConnectOf, oneClickOf } from "./mcp-connect.js";
 import { MOBILE_VIEWPORT_SCRIPT } from "./mobile-viewport.js";
 import { projectAuthority } from "./project-access.js";
-import { discoverTools, projectToolsOf, secretsSetFor, TOOL_CATALOG } from "./project-tools.js";
+import { discoverTools, projectToolsOf, secretsSetFor, TOOL_CATALOG, toolStanding } from "./project-tools.js";
+import { toolRefusal } from "./policy.js";
 import { isEdgeAddress, refuseEdge } from "./server/edge-refusal.js";
 import { announcePasswordBearer, isPasswordBearer, PASSWORD_BEARER_REFUSED, passwordBearerAccepted } from "./password-bearer.js";
 import { createSharedGuards } from "./server/guards.js";
@@ -390,7 +391,24 @@ export function createDecisionServer(options) {
         repo, name: projectName(repo), holdings: projectHoldings(store, repo), running: projectRunning(store, repo, clock()),
         canDelete: who.via === "cookie" && store.isInstanceOperator(who.name),
         builds: projectBuildsOf(repo, who),
+        access: projectAccessOf(repo),
     });
+    /** Settings → Project → Build access: the project's named tools and whether each loads for its builds. */
+    const projectAccessOf = (repo) => {
+        try {
+            const policy = store.orgPolicy();
+            return { tools: projectToolsOf(store, repo).map(tool => {
+                    const refused = toolRefusal(policy, tool.name);
+                    const set = secretsSetFor(repo, tool.spec, toolHome);
+                    // As a launch decides (toolLaunchFor): a tool the organisation doesn't allow, or missing a secret, is left out.
+                    return refused !== null ? { name: tool.name, loads: false, words: refused }
+                        : { name: tool.name, loads: tool.spec.secrets.every(one => one.optional || set.includes(one.name)), words: toolStanding(tool, set).words };
+                }) };
+        }
+        catch {
+            return { problem: "Couldn't read this project's tools right now." };
+        }
+    };
     /** Settings → Project → Builds at once: the saved number, its workers' capacity, and what builds now. */
     const projectBuildsOf = (repo, who) => {
         const capacities = store.listRunners().filter(one => one.retiredAt === null && one.repos.includes(repo)).map(one => one.capacity);

package/dist/server/live.d.ts

@@ -20,6 +20,9 @@ export type LiveRoom = {
 } | {
     kind: "team";
     conversation: string | null;
+} | {
+    kind: "agent";
+    run: number;
 };
 /** A room's name, read strictly: anything else is not a room. */
 export declare function parseLiveRoom(name: string): LiveRoom | null;

package/dist/server/live.js

@@ -1,3 +1,6 @@
+import { randomBytes } from "node:crypto";
+import { boardRunOf, holdAgentView, releaseAgentView } from "../agent-board.js";
+import { agentRunFingerprint } from "../agents-board.js";
 import { createLiveRooms, LiveConnection } from "../live-bus.js";
 import { reproveRemote } from "../operate-remote.js";
 import { rowVisible } from "../project.js";
@@ -8,7 +11,7 @@ import { adapterPolicy } from "./route-policy.js";
 import { requestContext } from "./request-context.js";
 /** A page asks for a few rooms at once: its workspace, what it shows, its conversation. */
 export const LIVE_ROOMS_PER_PAGE = 5;
-const ROOM_NAME = /^(workspace|task|flow|chat|team)(?::([^?]{1,400}))?(?:\?([^#]{0,600}))?$/;
+const ROOM_NAME = /^(workspace|task|flow|chat|team|agent)(?::([^?]{1,400}))?(?:\?([^#]{0,600}))?$/;
 /** At most one workspace nudge a second: a burst of writes is one re-read, the first heard at once. */
 const WORKSPACE_SETTLE_MS = 1_000;
 /** A running reply's preview: at most one snapshot every 80 ms; the last one always goes out. */
@@ -45,6 +48,8 @@ export function parseLiveRoom(name) {
             if (key !== null || !only("conversation"))
                 return null;
             return { kind, conversation: params.get("conversation") || null };
+        case "agent":
+            return key !== null && /^[1-9][0-9]{0,9}$/.test(key) && query === undefined ? { kind, run: Number(key) } : null;
     }
     return null;
 }
@@ -61,6 +66,8 @@ export function createLiveHandlers(runtime, live) {
         return cursor === null ? null : String(cursor);
     }, null, { bus: live.bus });
     const chatViewers = new Set();
+    // One agent's open view (Agents board): what it shows, keyed by the exact run.
+    const agentRooms = createLiveRooms(run => agentRunFingerprint(store, run), null, { bus: live.bus });
     /** The same session, still signed in, from the cookie and the account (never this request's context). */
     const readBrowser = (request, who) => {
         const again = identify(request, false);
@@ -177,7 +184,7 @@ export function createLiveHandlers(runtime, live) {
         if ([...url.searchParams.keys()].some(key => key !== "room") || names.length === 0 || names.length > LIVE_ROOMS_PER_PAGE || new Set(names).size !== names.length)
             return json(response, 400, { error: "room" });
         const rooms = names.map(name => ({ name, room: parseLiveRoom(name) }));
-        if (rooms.some(one => one.room === null) || rooms.filter(one => one.room?.kind === "workspace").length > 1 || rooms.filter(one => one.room?.kind === "chat").length > 1 || rooms.filter(one => one.room?.kind === "team").length > 1)
+        if (rooms.some(one => one.room === null) || rooms.filter(one => one.room?.kind === "agent").length > 1 || rooms.filter(one => one.room?.kind === "workspace").length > 1 || rooms.filter(one => one.room?.kind === "chat").length > 1 || rooms.filter(one => one.room?.kind === "team").length > 1)
             return json(response, 400, { error: "room" });
         // Admit every room before the stream opens, with the answers each page's own stream gave.
         const joins = [];
@@ -198,6 +205,31 @@ export function createLiveHandlers(runtime, live) {
                     // A sign-out or a narrowed account stops it.
                     valid: () => signedIn() && rowVisible(liveCeiling(), repo) && store.accountCanAccess(who.name, repo) }));
             }
+            else if (room.kind === "agent") {
+                const browser = who;
+                const run = store.getRun(room.run);
+                const repo = run === null ? null : store.refForId(run.taskRef)?.repo ?? null;
+                if (run === null || repo === null || !visible(repo) || !store.accountCanAccess(who.name, repo))
+                    return json(response, 404, { error: "run" });
+                // A repair is its build's own activity: its room is the build's.
+                const signedIn = sameBrowser(request, browser), runId = boardRunOf(store, run.id), view = randomBytes(12).toString("hex");
+                // The watch is a short lease in the database, renewed on every keep-alive and released when the page goes:
+                // the process that sends chat pings reads it there (agent-board.ts watchingAgent).
+                const watch = () => { try {
+                    holdAgentView(store, view, who.name, runId, clock());
+                }
+                catch { /* a missed renewal only lets a ping through */ } };
+                joins.push(connection => {
+                    watch();
+                    connection.onKeepAlive(watch);
+                    connection.onClose(() => { try {
+                        releaseAgentView(store, view, clock());
+                    }
+                    catch { /* it lapses on its own */ } });
+                    agentRooms.join(runId, { name: who.name, room: name, connection,
+                        valid: () => signedIn() && rowVisible(liveCeiling(), repo) && store.accountCanAccess(who.name, repo) });
+                });
+            }
             else if (room.kind === "flow") {
                 const browser = who;
                 const flow = store.getFlow(room.flow);
@@ -302,6 +334,7 @@ export function createLiveHandlers(runtime, live) {
             detachChat();
             workspaceRooms.close();
             teamRooms.close();
+            agentRooms.close();
             for (const viewer of [...chatViewers])
                 viewer.connection.close();
         },