toolroll 0.9.60 → 0.9.62

package/dist/exec.js

@@ -420,7 +420,10 @@ export const DEFAULT_MAX_BUFFER = 8 * 1024 * 1024;
  * watchdog with no wall-clock deadline. Both roads share the same kill and
  * settlement semantics.
  */
-function streamWatchdog(options, onTimeout) {
+function streamWatchdog(options, onTimeout, 
+/** The idle limit was reached: true when the caller ended the wait its own way (a paused live session closes
+ * stdin), so the same limit runs again for the process to exit before it is killed. */
+onIdle) {
     const hardMs = options.timeoutMs ?? (options.idleTimeoutMs === undefined ? DEFAULT_TIMEOUT_MS : undefined);
     const idleMs = options.idleTimeoutMs;
     let fired = false;
@@ -432,12 +435,25 @@ function streamWatchdog(options, onTimeout) {
         fired = true;
         onTimeout();
     };
+    const idle = () => {
+        let handled = false;
+        try {
+            handled = onIdle?.() === true;
+        }
+        catch {
+            handled = false;
+        }
+        if (handled)
+            armIdle();
+        else
+            fire();
+    };
     const armIdle = () => {
         if (idleMs === undefined)
             return;
         if (idleTimer !== undefined)
             clearTimeout(idleTimer);
-        idleTimer = setTimeout(fire, idleMs);
+        idleTimer = setTimeout(idle, idleMs);
         idleTimer.unref?.();
     };
     if (hardMs !== undefined) {
@@ -725,14 +741,36 @@ const JSONL_OVERFLOW_PREFIX_CAP = 4 * 1024;
  * storage can be reused for the next record. Counting the original bytes
  * (rather than JavaScript characters) makes the overflow receipt exact.
  */
-function boundedJsonlFramer(cap, onLine, inspectDiscriminants = false) {
+function boundedJsonlFramer(cap, onLine, inspectDiscriminants = false, tailCap = 0) {
     const retained = Buffer.allocUnsafe(cap);
     let retainedBytes = 0;
     let originalBytes = 0;
     let nonWhitespace = false;
     let discriminants = inspectDiscriminants ? jsonlDiscriminants() : null;
+    // An oversized line's last tailCap bytes, kept only once the line passes the cap (Claude's result carries its cost
+    // after the words that made it too large). Seeded from the retained prefix's end, so it is always the line's true end.
+    const tailSize = Math.max(0, Math.min(tailCap, cap));
+    const tail = tailSize === 0 ? null : Buffer.allocUnsafe(tailSize);
+    let tailBytes = 0;
+    let tailSeeded = false;
+    const keepTail = (part) => {
+        if (tail === null)
+            return;
+        if (!tailSeeded) {
+            tailSeeded = true;
+            tailBytes = retained.copy(tail, 0, retainedBytes - tailSize, retainedBytes);
+        }
+        if (part.length >= tailSize) {
+            tailBytes = part.copy(tail, 0, part.length - tailSize);
+            return;
+        }
+        const keepOld = Math.min(tailBytes, tailSize - part.length);
+        tail.copyWithin(0, tailBytes - keepOld, tailBytes);
+        tailBytes = keepOld + part.copy(tail, keepOld);
+    };
     const append = (part) => {
         discriminants?.push(part);
+        const before = originalBytes;
         originalBytes += part.length;
         if (!nonWhitespace) {
             for (const byte of part) {
@@ -745,6 +783,9 @@ function boundedJsonlFramer(cap, onLine, inspectDiscriminants = false) {
         if (retainedBytes < cap) {
             retainedBytes += part.copy(retained, retainedBytes, 0, cap - retainedBytes);
         }
+        // The bytes up to the cap are in the prefix; only what runs past it moves the tail.
+        if (tail !== null && originalBytes > cap)
+            keepTail(before >= cap ? part : part.subarray(cap - before));
     };
     const emit = () => {
         onLine({
@@ -752,7 +793,10 @@ function boundedJsonlFramer(cap, onLine, inspectDiscriminants = false) {
             bytesOriginal: originalBytes,
             overflowed: originalBytes > cap,
             ...(discriminants === null ? {} : { discriminants: discriminants.finish() }),
+            ...(tail !== null && originalBytes > cap ? { tail: tail.subarray(0, tailBytes) } : {}),
         });
+        tailBytes = 0;
+        tailSeeded = false;
         retainedBytes = 0;
         originalBytes = 0;
         nonWhitespace = false;
@@ -866,6 +910,85 @@ function leadingClaudeSystemSubtype(prefix) {
     const match = /^\s*\{\s*"type"\s*:\s*"system"\s*,\s*"subtype"\s*:\s*"([A-Za-z0-9._-]+)"/.exec(prefix.toString("utf8", 0, Math.min(prefix.length, 512)));
     return match?.[1] ?? null;
 }
+/** How much of an oversized Claude result's end is kept to read its cost and usage (they follow the words). */
+const CLAUDE_RESULT_TAIL_CAP = 64 * 1024;
+/**
+ * Where a key's value starts in a fragment of JSON text, once and only once. `"key":` never occurs inside a JSON
+ * string (every quote there is escaped, so `y":` cannot appear), so each match is a real key, though possibly of a
+ * nested object. A key seen more than once is ambiguous and reads as absent.
+ */
+function soleKeyValueAt(texts, key) {
+    const pattern = new RegExp(`"${key}"\\s*:\\s*`, "g");
+    let found = null;
+    for (const text of texts) {
+        for (const match of text.matchAll(pattern)) {
+            if (found !== null)
+                return null;
+            found = { text, at: match.index + match[0].length };
+        }
+    }
+    return found;
+}
+/** The JSON object starting at `at`, read to its matching brace (strings and escapes respected), or null. */
+function jsonObjectAt(text, at) {
+    if (text[at] !== "{")
+        return null;
+    let depth = 0, inString = false;
+    for (let i = at; i < text.length && i - at < CLAUDE_RESULT_TAIL_CAP; i += 1) {
+        const c = text[i];
+        if (inString) {
+            if (c === "\\")
+                i += 1;
+            else if (c === '"')
+                inString = false;
+        }
+        else if (c === '"')
+            inString = true;
+        else if (c === "{")
+            depth += 1;
+        else if (c === "}" && --depth === 0) {
+            try {
+                const value = JSON.parse(text.slice(at, i + 1));
+                return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+            }
+            catch {
+                return null;
+            }
+        }
+    }
+    return null;
+}
+/**
+ * The accounting an oversized Claude result still carries, read by a bounded scan of its kept prefix and tail: the
+ * session's running `total_cost_usd`, its `usage` and `num_turns`, and whether it is a main result at all (an
+ * `origin` naming anything but a person makes it a background task's). Anything unreadable or seen twice is absent.
+ */
+export function scanOversizedClaudeResult(prefix, tail) {
+    const texts = [prefix.toString("utf8"), ...(tail === undefined ? [] : [tail.toString("utf8")])];
+    const origin = soleKeyValueAt(texts, "origin");
+    const originObject = origin === null ? null : jsonObjectAt(origin.text, origin.at);
+    const primary = originObject === null || String(originObject["kind"] ?? "") === "human";
+    const account = {};
+    const number = (key) => {
+        const at = soleKeyValueAt(texts, key);
+        const match = at === null ? null : /^-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?/.exec(at.text.slice(at.at, at.at + 64));
+        const value = match === null ? NaN : Number(match[0]);
+        return Number.isFinite(value) && value >= 0 ? value : null;
+    };
+    const cost = number("total_cost_usd");
+    if (cost !== null)
+        account["total_cost_usd"] = cost;
+    const turns = number("num_turns");
+    if (turns !== null)
+        account["num_turns"] = turns;
+    const usageAt = soleKeyValueAt(texts, "usage");
+    const usage = usageAt === null ? null : jsonObjectAt(usageAt.text, usageAt.at);
+    if (usage !== null)
+        account["usage"] = usage;
+    return { primary, account };
+}
+/** Marks a Claude result whose session cost could not be read: the gateway charges the run's dollar cap instead. */
+export const CLAUDE_COST_UNKNOWN = "standing_orders_cost_unknown";
 function malformedCodexEventIsLoadBearing(prefix) {
     const type = leadingJsonObjectType(prefix);
     if (type === "thread.started" || type === "turn.completed" || type === "turn.failed")
@@ -1331,15 +1454,45 @@ function primaryResultOrigin(event) {
         return true;
     return false; // task-notification, channel, peer, coordinator, unknown: never the envelope
 }
+/** The usage fields Claude reports per message (not per session): a live session's account adds them up. */
+const LIVE_SUMMED_USAGE = ["input_tokens", "output_tokens", "cache_creation_input_tokens", "cache_read_input_tokens"];
+/**
+ * A live session's account so far (one main result per turn, checked on Claude Code 2.1.290): the latest result's
+ * session, ending, words and cost — `total_cost_usd` is already the session's running total — with the usage token
+ * fields and `num_turns`, which count only their own message, added up across every main result. A field that is not
+ * a non-negative number adds nothing.
+ */
+export function cumulativeLiveResult(previous, latest) {
+    const count = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : null;
+    const usageOf = (event) => event["usage"] !== null && typeof event["usage"] === "object" && !Array.isArray(event["usage"]) ? event["usage"] : null;
+    const before = usageOf(previous), now = usageOf(latest);
+    const usage = { ...(now ?? {}) };
+    for (const key of LIVE_SUMMED_USAGE) {
+        const a = before === null ? null : count(before[key]), b = now === null ? null : count(now[key]);
+        if (a !== null || b !== null)
+            usage[key] = (a ?? 0) + (b ?? 0);
+    }
+    const turnsBefore = count(previous["num_turns"]), turnsNow = count(latest["num_turns"]);
+    return {
+        ...latest,
+        ...(before === null && now === null ? {} : { usage }),
+        ...(turnsBefore === null && turnsNow === null ? {} : { num_turns: (turnsBefore ?? 0) + (turnsNow ?? 0) }),
+    };
+}
+/** This transport can keep stdin open for a live session (RunOptions.liveInput). */
+export const STREAM_INPUT = Symbol.for("toolroll.streamInput");
+/** Whether a runner declares it keeps stdin open for a live session; an injected runner opts in by carrying the mark. */
+export const streamsInput = (runner) => typeof runner === "function" && runner[STREAM_INPUT] === true;
 export function runClaudeStreamJsonl(file, args, options = {}) {
     const { cwd } = options;
     const childEnv = resolveChildEnv(options);
+    const live = options.liveInput ?? null;
     return new Promise(resolve => {
         let child;
         let container = null;
         let attachFailure = null;
         try {
-            const spawned = spawnStream(file, args, options, ["ignore", "pipe", "pipe"], childEnv);
+            const spawned = spawnStream(file, args, options, [live === null ? "ignore" : "pipe", "pipe", "pipe"], childEnv);
             child = spawned.child;
             container = spawned.container;
             void spawned.attached.then(outcome => { if (!outcome.ok)
@@ -1359,6 +1512,12 @@ export function runClaudeStreamJsonl(file, args, options = {}) {
         let conflictingInitLine = null;
         let initSessionId = null;
         let resultLine = null;
+        let resultOverflowed = false;
+        // The run's account: the first main result, or for a live session every main result added up (each oversized
+        // one's scanned cost and usage too). Its cost is the highest running total seen; costUnknown when the latest main
+        // result's cost could not be read (an oversized one), which only a later readable result can clear.
+        let account = null;
+        let costUnknown = false;
         let overflowLine = null;
         let receiptFired = false;
         let stderr = "";
@@ -1380,6 +1539,26 @@ export function runClaudeStreamJsonl(file, args, options = {}) {
                 // note stays honestly unreceipted and re-attaches later.
             }
         };
+        const tally = (event, line) => {
+            const before = account;
+            account = account === null || live === null ? event : { ...(line === null ? account : {}), ...cumulativeLiveResult(account, event) };
+            const cost = event["total_cost_usd"];
+            const readable = typeof cost === "number" && Number.isFinite(cost) && cost >= 0;
+            // The running total only grows: an earlier, higher total stands (a session's cost is never given back).
+            const prior = before?.["total_cost_usd"];
+            if (readable && typeof prior === "number" && prior > cost)
+                account = { ...account, total_cost_usd: prior };
+            if (line === null)
+                costUnknown = !readable;
+            else if (readable)
+                costUnknown = false;
+            if (resultOverflowed)
+                return;
+            if (line !== null && account === event)
+                resultLine = line;
+            else if (line !== null || resultLine !== null)
+                resultLine = JSON.stringify(account);
+        };
         const keep = (framed) => {
             if (framed.overflowed) {
                 // An oversized result is the first primary candidate and therefore
@@ -1404,10 +1583,22 @@ export function runClaudeStreamJsonl(file, args, options = {}) {
                         overflowLine = claudeOverflowLine(framed);
                     return;
                 }
-                if (resultLine === null)
+                // Nothing inside an oversized result is trusted: the agent shapes its bytes (tool inputs in permission_denials
+                // are real JSON objects), so a planted total_cost_usd or origin could read as genuine. It counts as the main
+                // result with an unknown cost, charged at the run's cap, and a live session's input closes.
+                const scanned = { primary: true, account: {} };
+                if (live !== null || resultLine === null)
+                    tally(scanned.account, null);
+                if (resultLine === null) {
                     resultLine = claudeOverflowLine(framed);
+                    resultOverflowed = true;
+                }
                 else if (overflowLine === null)
                     overflowLine = claudeOverflowLine(framed);
+                // A live session whose main result was too large to read cannot be steered safely: close its input, so the
+                // process ends instead of running further turns nobody can account for.
+                if (live !== null && scanned.primary)
+                    live.close("settled");
                 return;
             }
             const line = framed.prefix.toString("utf8");
@@ -1458,8 +1649,11 @@ export function runClaudeStreamJsonl(file, args, options = {}) {
                 // v105: the plan's usage windows, as Claude says them each turn (the Tasks page's limits).
                 noteLimits(claudeLimitsOf(event));
             }
-            else if (type === "result" && resultLine === null && primaryResultOrigin(event)) {
-                resultLine = line;
+            else if (type === "result" && (resultLine === null || live !== null) && primaryResultOrigin(event)) {
+                // A live session ends a turn with a result each time: the run's account is the last one, with every main
+                // result's usage and turns added up (account). After an oversized main result the retained result stays the
+                // fail-closed overflow, but later results still count toward its cost.
+                tally(event, line);
                 // Fallback receipt (finding 11): a SUCCESSFUL main-query completion
                 // entails the prompt ran even if the stream elided assistant
                 // events. Error results never fire — startup death is not delivery.
@@ -1474,15 +1668,32 @@ export function runClaudeStreamJsonl(file, args, options = {}) {
                     // Observational only: a broken listener never touches the run.
                 }
             }
+            // After the run's own bookkeeping: the session may close stdin on this event.
+            if (live !== null)
+                live.observe(event);
         };
-        const framing = boundedJsonlFramer(JSONL_EVENT_HARD_CAP, keep);
+        // The retained main result as the run's account: an oversized one stays the fail-closed overflow but carries the
+        // cost and usage read from it and from later results; a cost that could not be read says so (CLAUDE_COST_UNKNOWN).
+        const accountedResultLine = () => {
+            if (resultLine === null || (!resultOverflowed && !costUnknown))
+                return resultLine;
+            const kept = JSON.parse(resultLine);
+            const counted = {};
+            if (resultOverflowed && account !== null) {
+                for (const key of ["total_cost_usd", "usage", "num_turns"])
+                    if (account[key] !== undefined)
+                        counted[key] = account[key];
+            }
+            return JSON.stringify({ ...kept, ...counted, ...(costUnknown ? { [CLAUDE_COST_UNKNOWN]: true } : {}) });
+        };
+        const framing = boundedJsonlFramer(JSONL_EVENT_HARD_CAP, keep, false, CLAUDE_RESULT_TAIL_CAP);
         const watchdog = streamWatchdog(options, () => {
             timedOut = true;
             if (options.processGroup === true)
                 killGroup(child);
             else
                 child.kill("SIGKILL");
-        });
+        }, live === null ? undefined : () => live.idleLimit());
         child.stdout?.on("data", (chunk) => {
             watchdog.touch();
             framing.push(chunk);
@@ -1501,7 +1712,8 @@ export function runClaudeStreamJsonl(file, args, options = {}) {
             watchdog.stop();
             liveProviders.delete(child);
             framing.finish();
-            const lines = [initLine, initIdentityLine, conflictingInitLine, resultLine, overflowLine]
+            live?.detach();
+            const lines = [initLine, initIdentityLine, conflictingInitLine, accountedResultLine(), overflowLine]
                 .filter((one) => one !== null)
                 .filter((line, index, all) => all.indexOf(line) === index);
             const settlement = container === null ? Promise.resolve(null) : settleContainer(container, options);
@@ -1521,5 +1733,12 @@ export function runClaudeStreamJsonl(file, args, options = {}) {
             finish(null);
         });
         child.on("close", code => finish(code));
+        if (live !== null && child.stdin !== null) {
+            const input = child.stdin;
+            // A pipe the child closed (it exited) ends live input; the run settles on the process, as always.
+            input.on("error", () => live.detach("input-failed"));
+            live.attach({ write: line => { input.write(line, "utf8"); }, end: () => { input.end(); } });
+        }
     });
 }
+runClaudeStreamJsonl[STREAM_INPUT] = true;

package/dist/invoke.js

@@ -16,19 +16,21 @@
  * (`adapterFor`), and only builder, planner, reviewer, and scout import
  * `invokeAgent`.
  */
-import { adapterFor, auditOf } from "./provider.js";
+import { adapterFor, auditOf, isolationUnsupported } from "./provider.js";
 import { readProviderKey, readAuthModeStrict, PROVIDER_KEY_ENV, OWN_KEY_ENV } from "./keys.js";
 import { classifyTerminal } from "./exhaustion.js";
 import { liftAuthPause } from "./provider-auth.js";
 import { attestProvider } from "./attest.js";
-import { run as runCommand, runOwnerTag } from "./exec.js";
+import { run as runCommand, runOwnerTag, streamsInput } from "./exec.js";
 import { currentContainment } from "./containment.js";
 import { witnessedRunner } from "./process-custody.js";
 import { underStopWatch } from "./task-control.js";
 import { childDatabaseEnv, isolatedChildDatabase, removeChildDatabase as removeAgentDatabase } from "./child-database.js";
 import { noToolsArgs, prepareRunTools } from "./project-tools.js";
-import { realpathSync } from "node:fs";
-import { agentFence, linuxFenceAvailable, macosFenceAvailable } from "./agent-fence.js";
+import { readFileSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { agentFence, linuxFenceAvailable, macosFenceAvailable, taskBoundary } from "./agent-fence.js";
 import { billingOf, claudeBillingFrom, seenBilling } from "./spend.js";
 /** The claude binary name — kept for the legacy quota rows and tests that
  * describe history; new code carries a resolved AgentSpec instead. */
@@ -36,6 +38,46 @@ export const PROVIDER_BINARY = "claude";
 /** "Within seconds": how soon a silent failed run must end for its stderr to
  * be read for the sign-in signal. */
 const AUTH_EARLY_EXIT_MS = 30_000;
+// Fixed names only: neither setting values nor arbitrary JSON keys belong in
+// diagnostics. The CLI's existing login stays where it is; no config is copied.
+const CLAUDE_AUTH_ENV = [
+    "ANTHROPIC_API_KEY", "ANTHROPIC_BASE_URL", "ANTHROPIC_AUTH_TOKEN",
+    "CLAUDE_CODE_USE_BEDROCK", "CLAUDE_CODE_SKIP_BEDROCK_AUTH", "ANTHROPIC_BEDROCK_BASE_URL",
+    "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_PROFILE",
+    "AWS_REGION", "AWS_DEFAULT_REGION", "AWS_BEARER_TOKEN_BEDROCK", "ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION",
+    "CLAUDE_CODE_USE_VERTEX", "CLAUDE_CODE_SKIP_VERTEX_AUTH", "ANTHROPIC_VERTEX_BASE_URL",
+    "ANTHROPIC_VERTEX_PROJECT_ID", "CLOUD_ML_REGION", "GOOGLE_APPLICATION_CREDENTIALS", "GOOGLE_CLOUD_PROJECT",
+];
+/** A value-only preflight: a settings-dependent login cannot survive empty setting sources. */
+function claudeSettingsAuthProblem(configDir) {
+    let text;
+    try {
+        text = readFileSync(join(configDir, "settings.json"), "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        return "Can't read your Claude settings.json to check sign-in. Restore access to that file and try again. Isolated builds do not load it.";
+    }
+    let settings;
+    try {
+        settings = JSON.parse(text);
+    }
+    catch {
+        return "Your Claude settings.json is not valid JSON. Fix that file and try again. Isolated builds do not load it, so Toolroll must check whether sign-in depends on it first.";
+    }
+    if (settings === null || typeof settings !== "object" || Array.isArray(settings)) {
+        return "Your Claude settings.json must contain an object. Fix that file and try again. Isolated builds do not load it.";
+    }
+    const value = settings;
+    const keys = ["apiKeyHelper", "forceLoginMethod"].filter(key => Object.hasOwn(value, key));
+    const env = value["env"];
+    if (env !== null && typeof env === "object" && !Array.isArray(env)) {
+        keys.push(...CLAUDE_AUTH_ENV.filter(key => Object.hasOwn(env, key)).map(key => `env.${key}`));
+    }
+    return keys.length === 0 ? null
+        : `Your Claude settings.json defines sign-in settings: ${keys.join(", ")}. Isolated builds do not load that file. Use a Claude login that works without these settings, or select another build provider in Settings. Toolroll has not changed your login or copied these values.`;
+}
 /**
  * A provider can run the repository's own CLI. In a self-hosting build that
  * must never mean "open the database that launched me": a migration from the
@@ -104,9 +146,15 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         throw new Error(`run ${runId} already records session ${recordedSessionId} but this invocation neither resumes nor starts under it`);
     }
     const adapter = adapterFor(spec.provider);
-    const { startSessionId: _untrustedStartSessionId, ...invocationWithoutStart } = invocation;
+    const { startSessionId: _untrustedStartSessionId, streamInput: _untrustedStreamInput, ...invocationWithoutStart } = invocation;
+    // Live input (live-input.ts): only Claude's builds, only through a transport that keeps stdin open. The brief is
+    // the session's first stdin message and never rides the argv; every other road keeps its prompt where it was.
+    const liveInput = spec.provider === "claude" && invocation.phase === "build" && options.liveInput !== undefined && streamsInput(options.runner ?? adapter.defaultRunner)
+        ? options.liveInput
+        : null;
     const resolvedInvocation = {
         ...invocationWithoutStart,
+        ...(liveInput === null ? {} : { streamInput: true }),
         model: spec.model,
         resumeSession: requestedResumeSessionId,
         ...(startSessionId === undefined ? {} : { startSessionId }),
@@ -142,7 +190,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // re-supply survives resolveChildEnv's chat-key strip); in
     // "subscription" mode the key is STRIPPED from the child so the CLI's
     // own login is used — its key is retained, just not handed over.
-    const { runner, clock: _clock, versionProbe: _probe, keyHome, timeoutMs: _hardTimeout, idleTimeoutMs: _idleTimeout, stdin: _callerStdin, accumulateUsage: _accumulateUsage, ...runOptions } = options;
+    const { runner, clock: _clock, versionProbe: _probe, keyHome, timeoutMs: _hardTimeout, idleTimeoutMs: _idleTimeout, stdin: _callerStdin, accumulateUsage: _accumulateUsage, liveInput: _liveInput, ...runOptions } = options;
     // The live setting is read STRICTLY (atomic authority closure): a
     // present mode file that says neither word is a value-shaped refusal
     // before any stamp or process — never the subscription default a
@@ -158,6 +206,11 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         };
     }
     const authMode = strict.mode;
+    if (spec.provider === "claude" && invocation.phase !== "review") {
+        const problem = claudeSettingsAuthProblem(options.env?.["CLAUDE_CONFIG_DIR"] ?? process.env["CLAUDE_CONFIG_DIR"] ?? join(keyHome ?? homedir(), ".claude"));
+        if (problem !== null)
+            return { kind: "refused", reason: "auth-mode", providerVersion: attested?.version ?? null, diagnostic: problem };
+    }
     const ownKeyEnv = OWN_KEY_ENV[spec.provider];
     const managedKey = authMode === "api-key"
         ? readProviderKey(spec.provider, keyHome) ?? (process.env[PROVIDER_KEY_ENV[spec.provider]] || null)
@@ -239,6 +292,8 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         store.stampProviderStart(runId, clock(), attested.version);
     else
         store.stampProviderStart(runId, clock());
+    // The brief is the live session's first message, queued before the spawn writes it.
+    liveInput?.begin(invocation.brief);
     const spawn = witnessedRunner(store, runId, clock, runner ?? adapter.defaultRunner);
     let transportAnnouncedSessionId = null;
     let transportSessionConflict = false;
@@ -255,10 +310,16 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // The agent fence: Toolroll's own secrets, database and other runs'
     // evidence stay out of reach, whatever the permission mode. A review is
     // already confined to its sealed files.
-    const baseFence = invocation.phase === "review" ? [] : runFence(store, runId, options.keyHome);
+    // A build's fence also holds its task boundary: home configuration and
+    // the repositories beside its own, fresh and resumed alike.
+    const fenceOf = invocation.phase === "review" ? { fence: [], fileTools: [] } : runFence(store, runId, spec.provider, options.keyHome);
+    const baseFence = fenceOf.fence;
     const toolsDir = (spec.provider === "codex" || spec.provider === "openrouter") && baseFence.length > 0 ? tools?.privateDir : undefined;
     const fence = toolsDir === undefined ? baseFence : [...baseFence, realpathSync(toolsDir)];
-    const launchArgv = tools === null ? argv : adapter.argv({ ...resolvedInvocation, toolArgv: tools.argv, fence });
+    // Where the build runs: Claude reads the repository's CLAUDE.md from here.
+    const workspace = invocation.phase === "review" ? null : runOptions.cwd ?? run.worktree ?? null;
+    const buildInvocation = { ...resolvedInvocation, ...(tools === null ? {} : { toolArgv: tools.argv, fence, fileToolFence: fenceOf.fileTools }), ...(workspace === null ? {} : { workspace }) };
+    const launchArgv = tools === null ? argv : adapter.argv(buildInvocation);
     const fenced = fenceLaunch(spec.provider, fence);
     if (invocation.phase !== "review")
         store.recordRunFence(runId, { method: fenced.method, paths: fence.length }, clock());
@@ -302,11 +363,13 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
                     throw new Error("the attempt was stopped before spawn custody completed");
             },
             ...(stdin === undefined ? {} : { stdin }),
+            ...(liveInput === null ? {} : { liveInput }),
             ...(hardTimeoutMs === undefined ? {} : { timeoutMs: hardTimeoutMs }),
             ...(idleTimeoutMs === undefined ? {} : { idleTimeoutMs }),
             ...(defaultTimeoutMs === undefined ? {} : { timeoutMs: defaultTimeoutMs }),
             env: {
                 ...(runOptions.env ?? {}),
+                ...(adapter.env?.(buildInvocation) ?? {}),
                 ...(tools?.env ?? {}),
                 ...(managedKey === null ? {} : { [PROVIDER_KEY_ENV[spec.provider]]: managedKey }),
                 // This key is deliberately last: no caller may point an agent back at
@@ -360,6 +423,12 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     }
     store.fixRunBilling(runId, authMode === "api-key" ? "api-key" : evidence ?? billingOf(spec.provider, store.handle), new Date());
     const envelope = adapter.parse(result.stdout);
+    // An installed CLI too old for a build's own setup refuses its flags
+    // before it starts: nothing ran, and the run says what to update.
+    const unsupported = result.code !== 0 && envelope.initObserved !== true && invocation.phase !== "review" ? isolationUnsupported(spec.provider, result.stderr) : null;
+    if (unsupported !== null) {
+        return { kind: "refused", reason: "provider-unattested", providerVersion: attested === null ? null : attested.version, diagnostic: unsupported };
+    }
     // The callback is the crash-safe early stamp; the parsed envelope is the
     // authoritative completed-stream account. Stamp it as a fallback for an
     // alternate transport. On fresh runs COALESCE makes callback/parser
@@ -384,11 +453,19 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
                         ? "the provider returned a session id different from the exact identity recorded for resume"
                         : "the provider session id was different from the identity durably recorded when the stream initialized"
                 : null;
+    // A run whose cost could not be read may still have spent up to its cap: it is charged the cap, never nothing, so
+    // the next run's remaining budget stays honest. With no cap it is unmeasured, as a Codex run is, and says so.
+    const unknownCost = envelope.costUnknown === true;
+    const cap = typeof invocation.maxBudgetUsd === "number" && Number.isFinite(invocation.maxBudgetUsd) && invocation.maxBudgetUsd > 0 ? invocation.maxBudgetUsd : null;
+    const costUsd = unknownCost ? cap : envelope.costUsd;
+    const usageJson = unknownCost
+        ? JSON.stringify({ cost_note: cap === null ? "cost unknown, no dollar cap applied: unmeasured" : "cost unknown, charged at the cap", ...usageOf(envelope.usageRaw) })
+        : envelope.usageRaw;
     store.recordUsage(runId, {
         ...(envelope.tokensIn === null ? {} : { tokensIn: envelope.tokensIn + (options.accumulateUsage ? run.tokensIn ?? 0 : 0) }),
         ...(envelope.tokensOut === null ? {} : { tokensOut: envelope.tokensOut + (options.accumulateUsage ? run.tokensOut ?? 0 : 0) }),
-        ...(envelope.costUsd === null ? {} : { costUsd: envelope.costUsd + (options.accumulateUsage ? run.costUsd ?? 0 : 0) }),
-        ...(envelope.usageRaw === null ? {} : { usageJson: envelope.usageRaw }),
+        ...(costUsd === null ? {} : { costUsd: costUsd + (options.accumulateUsage ? run.costUsd ?? 0 : 0) }),
+        ...(usageJson === null ? {} : { usageJson }),
     });
     // How the attempt ended, classified HERE where the structural terminal
     // still exists; a sign-in that no longer works pauses its provider.
@@ -501,7 +578,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
             usage: {
                 tokensIn: envelope.tokensIn,
                 tokensOut: envelope.tokensOut,
-                costUsd: envelope.costUsd,
+                costUsd,
             },
             // Gated on the run having NOTHING to show (Codex M5-M8 audit, C-8),
             // where "nothing to show" is STRUCTURAL when the transport can say so
@@ -520,17 +597,32 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         },
     };
 }
-/** The paths this run's agent may not reach: the state folder around the live database (but not its own worktree) and ~/.toolroll (or its older name). */
-function runFence(store, runId, keyHome) {
+/** The reported usage, when its kept text is whole JSON, to sit beside a cost note. */
+function usageOf(raw) {
+    if (raw === null)
+        return {};
+    try {
+        return { usage: JSON.parse(raw) };
+    }
+    catch {
+        return {};
+    }
+}
+/** The paths this run's agent may not reach: the state folder around the live database (but not its own worktree),
+ * ~/.toolroll (or its older name), and its task boundary; plus what only Claude's file tools refuse. */
+function runFence(store, runId, provider, keyHome) {
     try {
         // A plane always has a database file; an in-memory store (a test) has nothing to fence.
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
-            return [];
-        return agentFence({ databaseFile, worktree: store.getRun(runId)?.worktree ?? null, ...(keyHome === undefined ? {} : { home: keyHome }) });
+            return { fence: [], fileTools: [] };
+        const worktree = store.getRun(runId)?.worktree ?? null;
+        const home = keyHome === undefined ? {} : { home: keyHome };
+        const boundary = worktree === null ? null : taskBoundary({ worktree, provider, ...home });
+        return { fence: agentFence({ databaseFile, worktree, ...home, boundary }), fileTools: boundary?.fileTools ?? [] };
     }
     catch {
-        return [];
+        return { fence: [], fileTools: [] };
     }
 }
 /** How the fence reaches a provider: Codex through its own sandbox profile
@@ -551,10 +643,10 @@ function fenceLaunch(provider, fence) {
 /** One launch's tools, or — when they cannot be prepared — the same isolation with none, never the operator's global servers. */
 function runTools(store, runId, spec, keyHome, clock, readOnly, withheld) {
     try {
-        return prepareRunTools(store, runId, spec.provider, { ...(keyHome === undefined ? {} : { home: keyHome }), now: clock(), includeModel: spec.model === null, ...(readOnly === undefined ? {} : { readOnly }), ...(withheld === undefined ? {} : { withheld }) });
+        return prepareRunTools(store, runId, spec.provider, { ...(keyHome === undefined ? {} : { home: keyHome }), now: clock(), ...(readOnly === undefined ? {} : { readOnly }), ...(withheld === undefined ? {} : { withheld }) });
     }
     catch {
-        return noToolsArgs(spec.provider, spec.model === null);
+        return noToolsArgs(spec.provider);
     }
 }
 /** How Codex says it's signed in (`codex login status`): a ChatGPT sign-in is its plan; a key or Bedrock is a key;