toolroll 0.9.60 → 0.9.62

package/dist/orphan-sweep.js

@@ -180,7 +180,8 @@ export async function sweepOrphans(store, now, options = {}) {
     catch {
         return { stopped: [], failed: ["the process list couldn't be read"] };
     }
-    const roots = sweepRoots(store, options.pool ?? null, census, options.tempRoots ?? [], now());
+    const rootsNow = (rows) => sweepRoots(store, options.pool ?? null, rows, options.tempRoots ?? [], now()).filter(root => options.spare?.(root.path) !== true);
+    const roots = rootsNow(census);
     if (roots.length === 0)
         return { stopped: [], failed };
     const guard = protectedProcesses(census, options.self);
@@ -195,14 +196,15 @@ export async function sweepOrphans(store, now, options = {}) {
     const first = orphanTargets(census, located, roots, guard);
     if (first.length === 0)
         return { stopped: [], failed };
-    // Right before the signal, everything again: the same process, still an orphan (or under one), still inside.
+    // Right before the signal, everything again: the same process, still an orphan (or under one), still inside a root
+    // that is still one (no run or lease took its checkout since, nothing live uses it).
     let again;
     try {
         const fresh = read();
         const freshGuard = protectedProcesses(fresh, options.self);
         const freshLocated = locate(fresh.filter(row => row.ppid === 1).map(row => row.pid));
         const before = new Map(first.map(one => [one.row.pid, one]));
-        again = orphanTargets(fresh, freshLocated, roots, freshGuard).filter(one => {
+        again = orphanTargets(fresh, freshLocated, rootsNow(fresh), freshGuard).filter(one => {
             const was = before.get(one.row.pid);
             return was !== undefined && Math.abs(was.row.bornAt - one.row.bornAt) <= BIRTH_SLACK_MS && was.root.path === one.root.path;
         });

package/dist/project-admission.d.ts

@@ -24,11 +24,16 @@ export type AdmissionFailure = {
     reason: "unavailable" | "not-git" | "locked" | "registry" | "abandoned" | "failed";
     message: string;
 };
+/** `remote`: the origin URL this add recorded as the project's trusted remote (null: none), and why one wasn't. */
 export type Admitted = {
     ok: true;
     repo: string;
     name: string;
     added: boolean;
+    remote: {
+        url: string | null;
+        why: string | null;
+    };
 };
 export type Released = {
     ok: true;
@@ -43,12 +48,7 @@ export declare function proveProjectRoot(path: string, exec?: ProjectExec): Prom
     ok: true;
     repo: string;
 } | AdmissionFailure>;
-/**
- * Admit one project. Idempotent: adding a saved project again changes
- * nothing and writes no ledger row. The registry is written first, under
- * its lock; the project row and its ledger row then commit together, so a
- * retry after a failure finishes the job and records it exactly once.
- */
+/** Registry first, then the project and its audit records in one transaction. Re-adds preserve trust. */
 export declare function admitProject(store: Store, input: {
     /** null: a console with no machine registry (a bare `serve`) keeps only the project list. */
     registryFile: string | null;
@@ -56,6 +56,10 @@ export declare function admitProject(store: Store, input: {
     actor: AdmissionActor;
     now: Date;
     exec?: ProjectExec;
+    /** Only the authorized CLI add opts in; console/open/onboarding never discover a remote. */
+    captureOrigin?: boolean;
+    /** Explicit value from the owner/instance-operator CLI boundary. */
+    remoteUrl?: string;
 }): Promise<Admitted | AdmissionFailure>;
 /**
  * Remove one project from the lists and the builder. Its tasks, results and

package/dist/project-admission.js

@@ -15,7 +15,12 @@ import { userInfo } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { run } from "./exec.js";
 import { canonicalProject, projectName, sameRepo } from "./project.js";
+import { remoteUrlProblem } from "./remote-main.js";
 import { addRepos, loadProjectRegistry, removeRepos, updateRepos } from "./repos.js";
+const ADMISSION_GIT = {
+    envAllowlist: ["PATH", "HOME", "TMPDIR", "LANG", "LC_ALL"],
+    env: { GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_NO_REPLACE_OBJECTS: "1" },
+};
 export const PROJECT_ADDED = "project added";
 export const PROJECT_REMOVED = "project removed";
 /** The checkout root a folder belongs to, canonical; never a shell. */
@@ -26,40 +31,57 @@ export async function proveProjectRoot(path, exec = run) {
     const canonical = canonicalProject(path);
     if (canonical === null)
         return { ok: false, reason: "unavailable", message: `${path} isn't a folder on this computer.` };
-    const top = await exec("git", ["rev-parse", "--show-toplevel"], { cwd: canonical, timeoutMs: 5_000 });
+    const top = await exec("git", ["rev-parse", "--show-toplevel"], { cwd: canonical, timeoutMs: 5_000, ...ADMISSION_GIT });
     const repo = top.code === 0 ? canonicalProject(top.stdout.trim()) : null;
     if (repo === null)
         return { ok: false, reason: "not-git", message: `${path} isn't a Git repository. Run git init there first, or choose a folder inside one.` };
     return { ok: true, repo };
 }
-/**
- * Admit one project. Idempotent: adding a saved project again changes
- * nothing and writes no ledger row. The registry is written first, under
- * its lock; the project row and its ledger row then commit together, so a
- * retry after a failure finishes the job and records it exactly once.
- */
+/** Read only on first CLI admission; never rediscover trust from an existing project's config. */
+async function originOf(repo, exec) {
+    const read = await exec("git", ["config", "--local", "--no-includes", "--get", "remote.origin.url"], { cwd: repo, timeoutMs: 5_000, ...ADMISSION_GIT });
+    const url = read.code === 0 ? read.stdout.trim() : "";
+    if (url === "")
+        return { url: null, why: "it has no origin remote" };
+    const problem = remoteUrlProblem(url);
+    return problem === null ? { url, why: null } : { url: null, why: problem };
+}
+/** Registry first, then the project and its audit records in one transaction. Re-adds preserve trust. */
 export async function admitProject(store, input) {
     const proved = await proveProjectRoot(input.path, input.exec);
     if (!proved.ok)
         return proved;
     const { repo } = proved;
+    if (input.remoteUrl !== undefined && (input.actor.origin === "console" || remoteUrlProblem(input.remoteUrl) !== null)) {
+        return { ok: false, reason: "failed", message: "Only an owner or instance operator can record a network remote with repos add --remote <url>. Use an HTTPS or SSH URL without credentials." };
+    }
+    const before = input.registryFile === null ? null : await loadProjectRegistry(input.registryFile);
+    const known = store.projectAdmissionKnown(repo) || (before !== null && !("error" in before) && before.repos.includes(repo));
+    const discovered = !known && input.captureOrigin === true && input.actor.origin !== "console"
+        ? await originOf(repo, input.exec ?? run) : null;
+    let remote = { url: store.projectRemote(repo), why: null };
     let registryHad = true;
     if (input.registryFile !== null) {
-        const before = await loadProjectRegistry(input.registryFile);
         const enrolled = await updateRepos(input.registryFile, repos => addRepos(repos, [repo]));
         if (!enrolled.ok)
             return { ok: false, reason: enrolled.reason, message: `${projectName(repo)} wasn't added: ${enrolled.message}` };
-        registryHad = !("error" in before) && before.repos.includes(repo);
+        registryHad = before !== null && !("error" in before) && before.repos.includes(repo);
     }
     const added = store.transact(() => {
         const rowHad = store.listProjects().some(one => one.path === repo);
-        store.upsertProject(repo, projectName(repo), input.now);
+        const previous = store.projectRemote(repo);
+        const first = !known && !store.projectAdmissionKnown(repo);
+        remote = input.remoteUrl !== undefined ? { url: input.remoteUrl, why: null }
+            : first && discovered !== null ? discovered : { url: previous, why: previous === null ? "no remote recorded; use repos add --remote <url>" : null };
+        store.upsertProject(repo, projectName(repo), input.now, { remoteUrl: remote.url });
+        if (input.remoteUrl !== undefined)
+            store.recordProjectRemote(input.actor.label, repo, previous, input.remoteUrl, input.now);
         if (rowHad && registryHad)
             return false;
         store.recordAction({ at: input.now.toISOString(), actor: input.actor.label, repo, taskId: null, runId: null, action: PROJECT_ADDED, outcome: "added", source: "access", detail: `from ${input.actor.origin}` });
         return true;
     });
-    return { ok: true, repo, name: projectName(repo), added };
+    return { ok: true, repo, name: projectName(repo), added, remote };
 }
 /**
  * Remove one project from the lists and the builder. Its tasks, results and

package/dist/project-delete-ui.d.ts

@@ -8,6 +8,7 @@ import { type Html } from "./html.js";
 import { type ProjectHoldings } from "./project-delete.js";
 export declare const PROJECT_DELETE_CSS: string;
 export type ProjectSettingsView = {
+    remoteUrl?: string | null;
     repo: string;
     name: string;
     holdings: ProjectHoldings;
@@ -20,6 +21,17 @@ export type ProjectSettingsView = {
         building: number;
         canChange: boolean;
     };
+    /** What its builds can reach: the project's named tools and whether each loads (names and words only, never a
+     * secret), or why they couldn't be read. */
+    access?: {
+        tools: {
+            name: string;
+            loads: boolean;
+            words: string;
+        }[];
+    } | {
+        problem: string;
+    };
 };
 /** The project's page: its path, what Toolroll holds for it, and (for an instance operator) Delete project. */
 export declare function projectSettingsHtml(view: ProjectSettingsView, notice: {

package/dist/project-delete-ui.js

@@ -14,7 +14,34 @@ export const PROJECT_DELETE_CSS = `.project-settings,.project-delete{max-width:7
     `.project-settings button,.project-delete button{justify-self:start;min-height:36px;white-space:nowrap}.project-delete .actions a{min-height:36px;display:inline-flex;align-items:center}` +
     `.project-settings .builds-at-once{margin-top:20px}.project-settings .builds-at-once h2{font-size:1rem;margin:0 0 4px}.project-settings .builds-at-once form{margin-top:4px;gap:4px}` +
     `.project-settings .builds-at-once .builds-row{display:flex;gap:8px;align-items:stretch}.project-settings .builds-at-once input{width:5.5rem;min-height:44px;margin:0;box-sizing:border-box}.project-settings .builds-at-once button{min-height:44px;margin:0}` +
-    `.project-settings .builds-at-once .meta{margin:0}.project-settings form.remove-project{margin-top:20px;gap:4px}.project-settings form.remove-project button{min-height:44px}.project-settings form.remove-project .meta{margin:0}`;
+    `.project-settings .builds-at-once .meta{margin:0}.project-settings form.remove-project{margin-top:20px;gap:4px}.project-settings form.remove-project button{min-height:44px}.project-settings form.remove-project .meta{margin:0}` +
+    `.project-settings .build-access{margin-top:20px;min-width:0;overflow-wrap:anywhere}.project-settings .build-access h2{font:var(--so-typography-title-sm);margin:0 0 4px}.project-settings .build-access p{margin:0}` +
+    `.project-settings .build-access .tool-name{font:var(--so-typography-mono)}.project-settings .build-access details{margin:4px 0 0}.project-settings .build-access summary{min-height:44px;display:inline-flex;align-items:center;cursor:pointer;color:var(--so-muted);font:var(--so-typography-label)}` +
+    `.project-settings .build-access ul{margin:0 0 4px;padding-left:20px;font:var(--so-typography-body);color:var(--so-ink)}.project-settings .build-access li{margin:2px 0}.project-settings .build-access li .meta{color:var(--so-muted)}` +
+    `.project-settings .build-access a.manage-tools{display:inline-flex;align-items:center;justify-content:center;min-height:44px;margin-top:4px;padding:0 14px;white-space:nowrap;background:var(--so-paper);color:var(--so-ink);border:1px solid var(--so-input-line);border-radius:var(--so-radius-md);font:var(--so-typography-label);text-decoration:none}` +
+    `.project-settings .build-access a.manage-tools:hover{background:var(--so-raised)}.project-settings .build-access a.manage-tools:focus-visible,.project-settings .build-access summary:focus-visible{outline:2px solid var(--so-ink);outline-offset:2px}`;
+/** Build access: one sentence for what a build gets, the detail on demand, and the way to change it. */
+function accessHtml(view) {
+    const access = view.access;
+    if (access === undefined)
+        return "";
+    const manage = html `<a class="manage-tools" href="/settings/tools?repo=${encodeURIComponent(view.repo)}">Manage tools</a>`;
+    const always = [
+        "Your other projects, keys and sign-in files are out of reach.",
+        "Your own Claude and Codex hooks, plugins and MCP servers don't load.",
+        "Builds sign in with your existing Claude or Codex login.",
+    ];
+    if ("problem" in access) {
+        return html `<section class="build-access" aria-labelledby="build-access-title"><h2 id="build-access-title">Build access</h2><p class="problem" role="alert">${access.problem}</p><details><summary>Details</summary><ul>${always.map(one => html `<li>${one}</li>`)}</ul></details>${manage}</section>`;
+    }
+    const loading = access.tools.filter(one => one.loads);
+    const names = loading.map((one, at) => html `${at === 0 ? "" : ", "}<span class="tool-name">${one.name}</span>`);
+    const outcome = loading.length === 0
+        ? html `<p>Builds work in their task's folder, with no extra tools.</p>`
+        : html `<p>Builds work in their task's folder, with ${loading.length === 1 ? "one tool" : `${loading.length} tools`}: ${names}.</p>`;
+    const tools = access.tools.map(one => html `<li><span class="tool-name">${one.name}</span> <span class="meta">· ${one.words}</span></li>`);
+    return html `<section class="build-access" aria-labelledby="build-access-title"><h2 id="build-access-title">Build access</h2>${outcome}<details><summary>Details</summary><ul>${always.map(one => html `<li>${one}</li>`)}${tools}</ul></details>${manage}</section>`;
+}
 /** Builds at once: one number, one Save. The worker's cap is said only when it lowers the number. */
 function buildsHtml(view) {
     const b = view.builds;
@@ -30,7 +57,10 @@ const note = (notice) => notice.problem ? html `<p class="problem" role="alert">
 /** The project's page: its path, what Toolroll holds for it, and (for an instance operator) Delete project. */
 export function projectSettingsHtml(view, notice) {
     const held = html `<p>Toolroll holds ${holdingsWords(view.holdings)} for <strong>${view.name}</strong>.</p>`;
-    const head = html `${note(notice)}<p class="path">${view.repo}</p>${held}${buildsHtml(view)}`;
+    const remote = html `<section class="build-access recorded-remote" aria-labelledby="recorded-remote-title"><h2 id="recorded-remote-title">Recorded remote</h2>${view.remoteUrl
+        ? html `<p class="path">${view.remoteUrl}</p>`
+        : html `<p>No remote recorded. Landed work waits for your review.</p>`}<details><summary>Change remote</summary><p>An owner or instance operator can run:</p><p class="path">toolroll repos add &lt;project&gt; --remote &lt;url&gt;</p></details></section>`;
+    const head = html `${note(notice)}<p class="path">${view.repo}</p>${held}${remote}${buildsHtml(view)}${accessHtml(view)}`;
     if (!view.canDelete)
         return html `<section class="project-settings">${head}<p class="meta">An instance operator can delete a project.</p></section>`;
     const body = view.running.length > 0

package/dist/project-tools.d.ts

@@ -142,22 +142,19 @@ export type ToolLaunchArgs = {
     cleanup: () => void;
     privateDir?: string;
 };
-/** Claude: only these servers (`--strict-mcp-config`), written to a private 0600 file removed after the run. */
+/** Claude: only these servers, written to a private 0600 file removed after the run (the provider adds `--strict-mcp-config`). */
 export declare function claudeToolArgs(launch: ToolLaunch): ToolLaunchArgs;
-export declare function carriedCodexSettings(includeModel: boolean, codexHome?: string): string[];
 /** Where the tool launcher lives beside this module, built. */
 export declare function toolLauncherPath(): string;
 /**
- * Codex: the operator's config.toml is ignored whole (its MCP servers
- * with it), ChatGPT apps and plugins are off, the model settings above
- * are carried, and each tool is named by `-c` and started through the
- * launcher. Codex gives its own environment to the agent's shell whatever
+ * Codex: each tool is named by `-c` and started through the launcher. The
+ * operator's config.toml, rules, apps, plugins and hooks are already off
+ * (the provider's CODEX_BUILD_ISOLATION_ARGV), and nothing of config.toml
+ * is carried. Codex gives its own environment to the agent's shell whatever
  * its policy says, so no secret rides it: each tool's values sit in the
  * run's private 0600 file and reach only that tool's process.
  */
-export declare function codexToolArgs(launch: ToolLaunch, options: {
-    includeModel: boolean;
-    codexHome?: string;
+export declare function codexToolArgs(launch: ToolLaunch, options?: {
     launcher?: string;
     node?: string;
     enabledTools?: Readonly<Record<string, readonly string[]>>;
@@ -182,12 +179,11 @@ export declare function toolLaunchFor(store: Pick<Store, "projectTools" | "getRu
 export declare function prepareRunTools(store: Pick<Store, "projectTools" | "getRun" | "refById" | "getScope" | "toolSealFor" | "recordRunTools" | "orgPolicy">, runId: number, provider: "claude" | "codex" | "openrouter" | "gemini", options: {
     home?: string;
     now: Date;
-    includeModel: boolean;
     readOnly?: Readonly<Record<string, readonly string[]>>;
     withheld?: Readonly<Record<string, string>>;
 }): ToolLaunchArgs;
 /** When a launch's tools cannot be prepared, it still gets none of anything else's: the same isolation with an empty list. */
-export declare function noToolsArgs(provider: "claude" | "codex" | "openrouter" | "gemini", includeModel: boolean): ToolLaunchArgs;
+export declare function noToolsArgs(provider: "claude" | "codex" | "openrouter" | "gemini"): ToolLaunchArgs;
 type ToolWrites = Pick<Store, "projectTools" | "addProjectTool" | "removeProjectTool" | "recordProjectToolTest">;
 /** Add one tool (and, for an import, the values it brings) to a project's builds. */
 export declare function addToolTo(store: ToolWrites, repo: string, input: ToolSpec, source: string, by: string, now: Date, options?: {

package/dist/project-tools.js

@@ -540,7 +540,7 @@ function safeLine(text) {
 }
 const toml = (value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 const tomlList = (values) => `[${values.map(toml).join(",")}]`;
-/** Claude: only these servers (`--strict-mcp-config`), written to a private 0600 file removed after the run. */
+/** Claude: only these servers, written to a private 0600 file removed after the run (the provider adds `--strict-mcp-config`). */
 export function claudeToolArgs(launch) {
     const servers = {};
     for (const tool of launch.tools) {
@@ -563,49 +563,27 @@ export function claudeToolArgs(launch) {
     const file = join(dir, "mcp.json");
     writeFileSync(file, JSON.stringify({ mcpServers: servers }), { mode: 0o600 });
     return {
-        argv: ["--strict-mcp-config", "--mcp-config", file],
+        argv: ["--mcp-config", file],
         // A first `npx` download can take longer than the default start-up wait.
         env: launch.tools.length > 0 ? { MCP_TIMEOUT: "60000" } : {},
         omitEnv: [],
         cleanup: () => rmSync(dir, { recursive: true, force: true }),
     };
 }
-/** The operator's Codex model settings a build keeps when its tools are replaced: how it thinks, never what it can reach. */
-const CARRIED_CODEX_SETTINGS = ["model_reasoning_effort", "model_reasoning_summary", "model_verbosity", "service_tier", "personality"];
-export function carriedCodexSettings(includeModel, codexHome = process.env["CODEX_HOME"] ?? join(homedir(), ".codex")) {
-    let text = "";
-    try {
-        text = readFileSync(join(codexHome, "config.toml"), "utf8");
-    }
-    catch {
-        return [];
-    }
-    const wanted = includeModel ? ["model", ...CARRIED_CODEX_SETTINGS] : CARRIED_CODEX_SETTINGS;
-    const argv = [];
-    for (const line of text.split("\n")) {
-        if (/^\s*\[/.test(line))
-            break;
-        const match = /^\s*([a-z_]+)\s*=\s*("[^"\\\n]{0,80}"|[A-Za-z0-9_.-]{1,40})\s*(?:#.*)?$/.exec(line);
-        if (match !== null && wanted.includes(match[1]))
-            argv.push("-c", `${match[1]}=${match[2]}`);
-    }
-    return argv;
-}
 /** Where the tool launcher lives beside this module, built. */
 export function toolLauncherPath() {
     return fileURLToPath(new URL("./tool-launcher.js", import.meta.url));
 }
 /**
- * Codex: the operator's config.toml is ignored whole (its MCP servers
- * with it), ChatGPT apps and plugins are off, the model settings above
- * are carried, and each tool is named by `-c` and started through the
- * launcher. Codex gives its own environment to the agent's shell whatever
+ * Codex: each tool is named by `-c` and started through the launcher. The
+ * operator's config.toml, rules, apps, plugins and hooks are already off
+ * (the provider's CODEX_BUILD_ISOLATION_ARGV), and nothing of config.toml
+ * is carried. Codex gives its own environment to the agent's shell whatever
  * its policy says, so no secret rides it: each tool's values sit in the
  * run's private 0600 file and reach only that tool's process.
  */
-export function codexToolArgs(launch, options) {
-    // ChatGPT apps, connectors and plugins are the operator's account, not the project's: all off (plugins carry their own MCP servers).
-    const argv = ["--ignore-user-config", ...carriedCodexSettings(options.includeModel, options.codexHome), "-c", "apps._default.enabled=false", "-c", "features.plugins=false"];
+export function codexToolArgs(launch, options = {}) {
+    const argv = [];
     if (launch.tools.length === 0)
         return { argv, env: {}, omitEnv: [], cleanup: () => undefined };
     const dir = mkdtempSync(join(tmpdir(), "so-tools-"));
@@ -701,9 +679,8 @@ export function prepareRunTools(store, runId, provider, options) {
     const launch = limitedTo(toolLaunchFor(store, runId, options.home), options.readOnly, options.withheld);
     const enabledTools = options.readOnly === undefined ? {} : { enabledTools: options.readOnly };
     const prepared = provider === "claude" ? claudeToolArgs(launch)
-        : provider === "codex" ? codexToolArgs(launch, { includeModel: options.includeModel, ...enabledTools })
-            : provider === "openrouter" ? codexToolArgs(launch, { includeModel: false, ...enabledTools })
-                : { argv: [...GEMINI_NO_TOOLS_ARGV], env: {}, omitEnv: [], cleanup: () => undefined };
+        : provider === "codex" || provider === "openrouter" ? codexToolArgs(launch, enabledTools)
+            : { argv: [...GEMINI_NO_TOOLS_ARGV], env: {}, omitEnv: [], cleanup: () => undefined };
     const skipped = provider === "gemini"
         ? [...launch.skipped, ...launch.tools.map(one => ({ name: one.spec.name, reason: "Gemini builds can't use project tools yet" }))]
         : launch.skipped;
@@ -725,13 +702,12 @@ function limitedTo(launch, readOnly, withheld = {}) {
     };
 }
 /** When a launch's tools cannot be prepared, it still gets none of anything else's: the same isolation with an empty list. */
-export function noToolsArgs(provider, includeModel) {
-    const none = { tools: [], skipped: [] };
+export function noToolsArgs(provider) {
     if (provider === "claude")
-        return { argv: ["--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}'], env: {}, omitEnv: [], cleanup: () => undefined };
+        return { argv: ["--mcp-config", '{"mcpServers":{}}'], env: {}, omitEnv: [], cleanup: () => undefined };
     if (provider === "gemini")
         return { argv: [...GEMINI_NO_TOOLS_ARGV], env: {}, omitEnv: [], cleanup: () => undefined };
-    return codexToolArgs(none, { includeModel: provider === "codex" && includeModel });
+    return codexToolArgs({ tools: [], skipped: [] });
 }
 /** Add one tool (and, for an import, the values it brings) to a project's builds. */
 export function addToolTo(store, repo, input, source, by, now, options = {}) {

package/dist/provider.d.ts

@@ -64,6 +64,13 @@ export type Invocation = {
      * Codex renders it as its own sandbox profile; Claude as deny rules for
      * its file tools (its shell is fenced by the macOS sandbox around it). */
     fence?: readonly string[];
+    /** More paths Claude's own file tools refuse, beside the fence: home
+     * configuration its CLI still reads itself (so the sandbox around the
+     * whole process can't deny them). */
+    fileToolFence?: readonly string[];
+    /** The task's own folder (its worktree). A Claude build loads no settings
+     * files, so this is where the repository's CLAUDE.md is read from. */
+    workspace?: string;
     /** A running build's steering folder (steer-mailbox.ts): the absolute path
      * and the worktree-relative name its brief uses. Claude renders a
      * PostToolUse hook that says when a note is waiting; every other provider
@@ -72,6 +79,11 @@ export type Invocation = {
         dir: string;
         name: string;
     };
+    /** Live input (live-input.ts): the brief arrives as the first stdin message
+     * and stdin stays open, so the argv carries `--input-format stream-json`
+     * and never the brief (Claude drops a `-p` prompt once stdin carries
+     * input). Set by the gateway only, for a transport that streams input. */
+    streamInput?: boolean;
     /** Claude's structured-output floor for a non-review phase: the scout's
      * report rides the terminal result event instead of a file plan mode
      * would refuse to write. Ignored by providers without `--json-schema`. */
@@ -115,6 +127,9 @@ export type ParsedEnvelope = {
     tokensIn: number | null;
     tokensOut: number | null;
     costUsd: number | null;
+    /** The run spent but its cost could not be read (Claude's main result was too large to keep): the gateway charges
+     * the run's dollar cap, or records it unmeasured when none applied. Absent = the cost is what costUsd says. */
+    costUnknown?: boolean;
     usageRaw: string | null;
     /**
      * Whether the provider was seen to initialize (codex: thread.started;
@@ -152,6 +167,9 @@ export type ParsedEnvelope = {
 type Adapter = {
     binary: string;
     argv(invocation: Invocation): string[];
+    /** Environment the launch needs beside the argv (Claude: read the
+     * workspace's CLAUDE.md through `--add-dir`). */
+    env?(invocation: Invocation): Record<string, string>;
     /** Prompt input for transports that use stdin instead of a bounded OS argument. */
     stdin?(invocation: Invocation): string | undefined;
     parse(stdout: string): ParsedEnvelope;
@@ -167,8 +185,47 @@ type Adapter = {
     clampTimeout(phase: Phase, requestedMs: number): number;
 };
 export declare const OPENROUTER_ENV_KEY = "OPENROUTER_API_KEY";
+/**
+ * A build's own setup (plan, build and repair; never a review, which keeps
+ * the isolation above). No settings file loads — not the user's, the
+ * repository's or the local one — so none of their hooks, plugins or
+ * permissions reach the run; Toolroll's one `--settings` (the fence and the
+ * steering hook) is all there is. MCP servers come only from `--mcp-config`:
+ * the project's named tools, or an explicit empty list. The repository's
+ * CLAUDE.md still loads, through `--add-dir` on the workspace. Sign-in is
+ * the CLI's own (keychain or ~/.claude), which no setting source governs.
+ * `-p` never shows the workspace trust prompt (Claude Code 2.1.290), so a
+ * fresh worktree can't wedge a headless run. Checked against 2.1.290 with
+ * planted user, project and local hooks and MCP servers: none loaded.
+ */
+export declare const CLAUDE_BUILD_ISOLATION_ARGV: readonly string[];
 /** Claude's own tools that only make sense with a person to wake them. */
 export declare const HEADLESS_DISALLOWED_TOOLS: readonly string[];
+/**
+ * Whether a failed launch was an installed CLI too old for a build's own
+ * setup: it names one of those flags as unknown. Then nothing ran, and the
+ * run says so plainly instead of reading as a failed sign-in or bad work.
+ */
+export declare function isolationUnsupported(provider: ProviderId, stderr: string): string | null;
+/**
+ * Codex's own fail-closed equivalent of `CLAUDE_REVIEW_ISOLATION_ARGV`:
+ * read-only sandbox rather than the ordinary `workspace-write` (a reviewer
+ * dispatched to codex was, until this, handed a write-capable sandbox —
+ * the same class of leak the claude side had), approvals that REFUSE
+ * rather than wait on a prompt a headless turn can never answer, and the
+ * user's own `~/.codex/config.toml` — which can name arbitrary MCP
+ * servers, exactly the surface `--strict-mcp-config` closes for claude —
+ * ignored outright.
+ */
+/**
+ * A Codex build's own setup, the equivalent of Claude's: the operator's
+ * config.toml (its MCP servers, model choices, profiles) and execpolicy
+ * rules ignored, ChatGPT apps and plugins off (plugins carry their own MCP
+ * servers), and hooks off. Sign-in still comes from CODEX_HOME, which
+ * `--ignore-user-config` leaves alone. The project's named tools follow as
+ * `-c mcp_servers.*` (project-tools.ts).
+ */
+export declare const CODEX_BUILD_ISOLATION_ARGV: readonly string[];
 /**
  * The diagnostic discipline (Phase 3 B6/C6): the harness's own words are
  * untrusted bytes headed for refusal screens and notifications — controls
@@ -188,11 +245,10 @@ export declare const ALL_CREDENTIAL_ENV: readonly string[];
 export declare function adapterFor(provider: ProviderId): Adapter;
 /**
  * The provider audit: what each harness supports, what we actually pass,
- * and what user-global configuration can leak into an unattended run.
- * REPORT BEFORE ENFORCEMENT (Codex roadmap review, item 10): none of this
- * changes an invocation — it states facts an operator reads on `providers`,
- * so hermetic mode can later be turned on per provider from evidence
- * instead of hope. `enforced` is a literal false until that day.
+ * and what user-global configuration still reaches an unattended run.
+ * None of this changes an invocation — it states facts an operator reads
+ * on `providers`. Claude and Codex builds now run in their own setup
+ * (`enforced`); Gemini's flag is still only reported.
  */
 export type ProviderAudit = {
     /** How output reaches us — and therefore which signals can exist at all. */
@@ -217,13 +273,14 @@ export type ProviderAudit = {
      */
     terminalContract: "required" | "none";
     isolation: {
-        /** The harness's hermetic flag, if it has one. We do not pass it. */
+        /** The harness's hermetic flag, if it has one. */
         flag: string | null;
         /** Whether that flag preserves resume. false = documented conflict. */
         resumeSafe: boolean | null;
-        enforced: false;
+        /** Whether every build, fresh or resumed, passes it. */
+        enforced: boolean;
     };
-    /** User-global surfaces that can reach an invocation today. */
+    /** What still reaches a build: its own sources and the user surfaces left. */
     configSurface: readonly string[];
 };
 /** Read-only facts about a provider — safe anywhere, spawns nothing. */