toolroll 0.9.61 → 0.9.63

package/dist/invoke.js

@@ -16,7 +16,7 @@
  * (`adapterFor`), and only builder, planner, reviewer, and scout import
  * `invokeAgent`.
  */
-import { adapterFor, auditOf, isolationUnsupported } from "./provider.js";
+import { adapterFor, auditOf, claudePluginEnv, isolationUnsupported, ALL_CREDENTIAL_ENV } from "./provider.js";
 import { readProviderKey, readAuthModeStrict, PROVIDER_KEY_ENV, OWN_KEY_ENV } from "./keys.js";
 import { classifyTerminal } from "./exhaustion.js";
 import { liftAuthPause } from "./provider-auth.js";
@@ -26,11 +26,13 @@ import { currentContainment } from "./containment.js";
 import { witnessedRunner } from "./process-custody.js";
 import { underStopWatch } from "./task-control.js";
 import { childDatabaseEnv, isolatedChildDatabase, removeChildDatabase as removeAgentDatabase } from "./child-database.js";
-import { noToolsArgs, prepareRunTools } from "./project-tools.js";
+import { RunSignInError, noToolsArgs, prepareRunTools } from "./project-tools.js";
 import { readFileSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
-import { agentFence, linuxFenceAvailable, macosFenceAvailable, taskBoundary } from "./agent-fence.js";
+import { dirname, join } from "node:path";
+import { poolRootOf } from "./worktree.js";
+import { agentFence, CheckoutBindingError, trustedWorktreeBinding, checkoutGitEnv, HARDENED_GIT_ARGS, codexFenceArgv, fenceGrants, fencedGitEnv, linuxFenceAvailable, linuxFenced, macosFenceAvailable, macosFenced, NO_GRANTS, runFolders, taskBoundary } from "./agent-fence.js";
+import { claudeConfigDir, claudeDefaults, codexDefaults, codexHomeDir, isolatedCodexHome } from "./provider-home.js";
 import { billingOf, claudeBillingFrom, seenBilling } from "./spend.js";
 /** The claude binary name — kept for the legacy quota rows and tests that
  * describe history; new code carries a resolved AgentSpec instead. */
@@ -227,73 +229,6 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     if (startSessionId !== undefined) {
         store.stampRun(runId, { sessionId: startSessionId });
     }
-    // The stamp precedes the spawn, so a crash between the two leaves a run
-    // that claims spend which never happened — the honest direction. A spawn
-    // before the stamp would leave spend no record claims, which is the lie
-    // the invariant exists to rule out. For attested providers the probed
-    // version rides the SAME durable write (B2).
-    // The spawn leg of the runner gate (MCP spec v6, review finding 4):
-    // the tuple re-proven against LIVE rows AFTER every awaited step, in
-    // the same breath as the stamp — a takeover during the attestation
-    // await can no longer slip a stale process through.
-    // THE PLANNER'S ROUTE, RE-PROVED AT THE SPAWN (final authority closure):
-    // the provenance the planner was admitted under is held to the authority
-    // its task holds RIGHT NOW — the strict working projection of a filed
-    // scope (exact terms, resolved profile, route parity, digest,
-    // live auth mode), or the bare word `legacy` on a task with no scope. A
-    // scope rewritten, corrupted, or unresolved between the claim and this
-    // instant invokes no provider: a value-shaped refusal, no spend.
-    if (run.role === "planner") {
-        const proved = store.proveRouteForSpawn(runId, clock());
-        if (!proved.ok) {
-            return {
-                kind: "refused",
-                reason: "route-authority",
-                providerVersion: attested === null ? null : attested.version,
-                diagnostic: `the planner's route authority lapsed before spawn — ${proved.problem}`,
-            };
-        }
-    }
-    if (!store.proveRunnerCustodyForSpawn(runId, clock())) {
-        return {
-            kind: "refused",
-            reason: "runner-custody",
-            providerVersion: attested === null ? null : attested.version,
-            diagnostic: "the run's runner custody lapsed before spawn — the lease, the runner, or its repo binding no longer stands",
-        };
-    }
-    // THE STOP FENCE at the spawn (v52): a stop recorded against this run
-    // — or the attempt it runs under — before this instant spawns nothing.
-    // A value-shaped refusal, no stamp, no process, no spend; the road's
-    // settlement seals the attempt as interrupted.
-    const stopBeforeSpawn = store.applicableStopFor(runId);
-    if (stopBeforeSpawn !== null) {
-        return {
-            kind: "refused",
-            reason: "stopped",
-            providerVersion: attested === null ? null : attested.version,
-            diagnostic: `stopped by ${stopBeforeSpawn.requestedBy} (run #${stopBeforeSpawn.run}) before the provider spawned — nothing was spent`,
-        };
-    }
-    // THE CONTAINMENT FENCE at the spawn (OS containment plan): a required
-    // native policy this runner cannot meet — macOS, an undelegated cgroup,
-    // a missing helper — spawns nothing. A value-shaped refusal in the
-    // policy's own words, no stamp, no process, no spend.
-    const containment = currentContainment();
-    if (containment.refusal !== null) {
-        return {
-            kind: "refused",
-            reason: "containment",
-            providerVersion: attested === null ? null : attested.version,
-            diagnostic: containment.refusal,
-        };
-    }
-    if (attested !== null)
-        store.stampProviderStart(runId, clock(), attested.version);
-    else
-        store.stampProviderStart(runId, clock());
-    // The brief is the live session's first message, queued before the spawn writes it.
-    liveInput?.begin(invocation.brief);
     const spawn = witnessedRunner(store, runId, clock, runner ?? adapter.defaultRunner);
     let transportAnnouncedSessionId = null;
     let transportSessionConflict = false;
@@ -304,23 +239,79 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // already ambient in the environment keeps working; the managed file,
     // being deliberate, wins.
     const isolatedDb = isolatedAgentDatabase(runId);
+    // Where the build runs: Claude reads the repository's CLAUDE.md from here.
+    const workspace = invocation.phase === "review" ? null : runOptions.cwd ?? run.worktree ?? null;
+    // How a tool server the broker starts is fenced: as its agent is, once that fence is fixed below.
+    let serverFence = null;
+    // The run's containment, fixed before any tool is prepared: this platform and the OS fence its run gets (a build
+    // has one wherever the plane has a database to fence). It decides which tools may hold secrets in a process the
+    // build could otherwise read; nothing the launch or the checkout writes feeds it.
+    const containment = { platform: process.platform, fence: invocation.phase === "review" ? "none" : fenceMethod(spec.provider, store.databaseFile() !== null) };
     // The project's tools (v80): exactly its MCP servers, and none of the
-    // operator's global or a repository's own. A review keeps its isolation.
-    const tools = invocation.phase === "review" ? null : runTools(store, runId, spec, options.keyHome, clock, invocation.readOnlyTools, invocation.researchWithheld);
+    // operator's global or a repository's own, served by this launch's broker
+    // (tool-broker.ts), which alone holds their secrets. A review keeps its isolation.
+    const launchTools = invocation.phase === "review" ? null : await runTools(store, runId, spec, options.keyHome, clock, invocation.readOnlyTools, invocation.researchWithheld, containment, {
+        env: { ...process.env, ...(runOptions.env ?? {}) },
+        omitEnv: [...(runOptions.omitEnv ?? []), ...ALL_CREDENTIAL_ENV],
+        pass: childDatabaseEnv(isolatedDb.file),
+        ...(workspace === null ? {} : { cwd: workspace }),
+        wrap: () => serverFence,
+    });
+    if (launchTools !== null && "refused" in launchTools) {
+        removeAgentDatabase(isolatedDb.dir);
+        return { kind: "refused", reason: "containment", providerVersion: attested?.version ?? null, diagnostic: launchTools.refused };
+    }
+    const tools = launchTools;
+    const codexHarness = spec.provider === "codex" || spec.provider === "openrouter";
+    // A Codex build's own CODEX_HOME (provider-home.ts): the operator's sign-in and sessions, linked, and nothing else.
+    let codexHome = null;
+    if (codexHarness && invocation.phase !== "review") {
+        try {
+            codexHome = isolatedCodexHome(codexHomeDir({ ...process.env, ...(runOptions.env ?? {}) }, keyHome ?? homedir()));
+        }
+        catch {
+            tools?.cleanup();
+            removeAgentDatabase(isolatedDb.dir);
+            return { kind: "refused", reason: "containment", providerVersion: attested?.version ?? null, diagnostic: "The build's private Codex home could not be created; check access to its sign-in and sessions folders, then retry." };
+        }
+    }
     // The agent fence: Toolroll's own secrets, database and other runs'
     // evidence stay out of reach, whatever the permission mode. A review is
     // already confined to its sealed files.
     // A build's fence also holds its task boundary: home configuration and
-    // the repositories beside its own, fresh and resumed alike.
-    const fenceOf = invocation.phase === "review" ? { fence: [], fileTools: [] } : runFence(store, runId, spec.provider, options.keyHome);
-    const baseFence = fenceOf.fence;
-    const toolsDir = (spec.provider === "codex" || spec.provider === "openrouter") && baseFence.length > 0 ? tools?.privateDir : undefined;
-    const fence = toolsDir === undefined ? baseFence : [...baseFence, realpathSync(toolsDir)];
-    // Where the build runs: Claude reads the repository's CLAUDE.md from here.
-    const workspace = invocation.phase === "review" ? null : runOptions.cwd ?? run.worktree ?? null;
-    const buildInvocation = { ...resolvedInvocation, ...(tools === null ? {} : { toolArgv: tools.argv, fence, fileToolFence: fenceOf.fileTools }), ...(workspace === null ? {} : { workspace }) };
+    // the repositories beside its own, fresh and resumed alike. Codex starts
+    // tool servers outside its command sandbox, so its own launch folder is
+    // fenced too; Claude reads its config from there, inside the sandbox.
+    const ownTools = tools?.privateDir === undefined ? null : realpathSync(tools.privateDir);
+    const fenceOf = invocation.phase === "review" ? { fence: [], fileTools: [], grants: NO_GRANTS, problem: undefined } : runFence(store, runId, spec.provider, options.keyHome, codexHarness ? null : ownTools);
+    if (fenceOf.problem !== undefined) {
+        tools?.cleanup();
+        codexHome?.cleanup();
+        removeAgentDatabase(isolatedDb.dir);
+        return { kind: "refused", reason: "containment", providerVersion: attested?.version ?? null, diagnostic: fenceOf.problem };
+    }
+    const fence = [...fenceOf.fence, ...(fenceOf.fence.length > 0 && codexHarness ? [ownTools, codexHome === null ? null : realpathSync(codexHome.dir)].filter((path) => path !== null) : [])];
+    const grants = fenceOf.grants;
+    const inherited = spec.model === null && invocation.phase !== "review" ? inheritedDefaults(spec.provider, { ...process.env, ...(runOptions.env ?? {}) }, keyHome ?? homedir()) : undefined;
+    const buildInvocation = { ...resolvedInvocation, ...(tools === null ? {} : { toolArgv: tools.argv, fence, fenceGrants: grants, fileToolFence: fenceOf.fileTools }), ...(workspace === null ? {} : { workspace }), ...(inherited === undefined ? {} : { inherited }) };
     const launchArgv = tools === null ? argv : adapter.argv(buildInvocation);
     const fenced = fenceLaunch(spec.provider, fence);
+    // The tools were chosen for the fence decided above: a launch that got any other starts nothing.
+    // Only a prepared project-tool broker depends on the earlier decision. Empty Claude configs also have a privateDir.
+    if (tools?.serverPids !== undefined && fenced.method !== containment.fence) {
+        tools.cleanup();
+        codexHome?.cleanup();
+        removeAgentDatabase(isolatedDb.dir);
+        return { kind: "refused", reason: "containment", providerVersion: attested?.version ?? null, diagnostic: "The build's fence changed while its tools were prepared. Nothing was started; retry the task." };
+    }
+    // A tool server the broker starts is fenced by what this platform supports, whatever the provider: Codex's own
+    // profile fences only its agent's commands, and the broker starts servers outside it.
+    if (fence.length > 0) {
+        if (macosFenceAvailable())
+            serverFence = (file, args) => macosFenced(file, args, fence, grants);
+        else if (linuxFenceAvailable())
+            serverFence = (file, args) => linuxFenced(file, args, fence, grants);
+    }
     if (invocation.phase !== "review")
         store.recordRunFence(runId, { method: fenced.method, paths: fence.length }, clock());
     const billingSeen = { keySource: null, model: null, planWindows: false, answered: false };
@@ -329,87 +320,190 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     const codexLogin = spec.provider === "codex" && authMode === "subscription" && runner === undefined
         ? await codexLoginBilling(attested !== null ? attested.executable : adapter.binary, [...(runOptions.omitEnv ?? []), ...adapter.extraOmitEnv, ...ownKeyEnv])
         : null;
+    const childEnv = {
+        ...(runOptions.env ?? {}),
+        ...(adapter.env?.(buildInvocation) ?? {}),
+        ...(tools?.env ?? {}),
+        // A fenced build's git never expires a reflog, so gc never rewrites another task's (agent-fence.ts).
+        ...(fence.length > 0 ? fencedGitEnv({ ...process.env, ...(runOptions.env ?? {}) }) : {}),
+        ...(codexHome === null ? {} : { CODEX_HOME: codexHome.dir }),
+        ...(managedKey === null ? {} : { [PROVIDER_KEY_ENV[spec.provider]]: managedKey }),
+        // This key is deliberately last: no caller may point an agent back at
+        // the live control database through a generic RunOptions override.
+        ...childDatabaseEnv(isolatedDb.file),
+    };
+    const childOmitEnv = [
+        ...(runOptions.omitEnv ?? []),
+        ...adapter.extraOmitEnv,
+        // A Claude build loads no plugin, from settings or the environment (a review's safe mode already loads none).
+        ...(spec.provider === "claude" && invocation.phase !== "review" ? claudePluginEnv({ ...process.env, ...(runOptions.env ?? {}) }) : []),
+        // Subscription mode: shed this provider's OWN key too, so an ambient
+        // one cannot force API billing over the login the operator prefers.
+        // Api-key mode: shed every OTHER own-key alias (finding 1) — gemini
+        // reads GOOGLE_API_KEY as well as GEMINI_API_KEY, and a stray alias
+        // must not override the ONE canonical key this mode injected.
+        ...(authMode === "subscription"
+            ? ownKeyEnv
+            : ownKeyEnv.filter(name => name !== PROVIDER_KEY_ENV[spec.provider])),
+    ];
+    const launchOptions = {
+        ...(fenced.wrap.length === 0 ? {} : { fence: fenced.wrap, fenceGrants: grants }),
+        ...runOptions,
+        ...(workspace === null ? {} : { cwd: workspace }),
+        // v105: how the CLI really billed this turn (its key source, its plan's windows), read off its own stream.
+        onStreamEvent: event => {
+            if (event["type"] === "system" && event["subtype"] === "init") {
+                if (typeof event["apiKeySource"] === "string")
+                    billingSeen.keySource = event["apiKeySource"].slice(0, 80);
+                if (typeof event["model"] === "string")
+                    billingSeen.model = event["model"].slice(0, 200);
+            }
+            else if (event["type"] === "rate_limit_event") {
+                billingSeen.planWindows = true;
+            }
+            else if (event["type"] === "result" && event["is_error"] !== true && event["subtype"] === "success") {
+                billingSeen.answered = true;
+            }
+            runOptions.onStreamEvent?.(event);
+        },
+        owner: runOwnerTag(store, runId),
+        beforeSpawn: () => store.applicableStopFor(runId) === null && store.getRun(runId)?.outcome === null,
+        onSpawn: pid => {
+            runOptions.onSpawn?.(pid);
+            if (store.applicableStopFor(runId) !== null)
+                throw new Error("the attempt was stopped before spawn custody completed");
+        },
+        ...(stdin === undefined ? {} : { stdin }),
+        ...(liveInput === null ? {} : { liveInput }),
+        ...(hardTimeoutMs === undefined ? {} : { timeoutMs: hardTimeoutMs }),
+        ...(idleTimeoutMs === undefined ? {} : { idleTimeoutMs }),
+        ...(defaultTimeoutMs === undefined ? {} : { timeoutMs: defaultTimeoutMs }),
+        env: childEnv,
+        omitEnv: childOmitEnv,
+        // Providers run in their own process group (M6.12): the harness spawns
+        // shells and tools of its own, and both the timeout and the watch's
+        // hard stop must end the whole tree, not orphan the grandchildren.
+        processGroup: true,
+        // The session registry's crash guarantee (M6.9): the id is stamped the
+        // moment the stream announces it, first write wins — a daemon that
+        // dies mid-turn still knows which session to offer the successor.
+        onSessionId: id => {
+            const normalized = transportSessionId(id);
+            if (normalized === null)
+                return;
+            if (transportAnnouncedSessionId === null)
+                transportAnnouncedSessionId = normalized;
+            else if (transportAnnouncedSessionId !== normalized)
+                transportSessionConflict = true;
+            store.stampRun(runId, { sessionId: normalized });
+        },
+    };
     let result;
-    const spawnedAt = Date.now();
+    let spawnedAt;
     try {
+        if (fence.length > 0 && workspace !== null && (codexHarness || launchOptions.fence !== undefined)) {
+            const inheritedEnv = launchOptions.envAllowlist === undefined ? process.env
+                : Object.fromEntries(launchOptions.envAllowlist.map(name => [name, process.env[name]]));
+            const probeOptions = {
+                cwd: workspace, env: checkoutGitEnv({ ...inheritedEnv, ...childEnv }), omitEnv: childOmitEnv, envAllowlist: [],
+            };
+            // A broken checkout is not evidence of a broken fence. No provider is invoked by either check.
+            const gitArgs = [...HARDENED_GIT_ARGS, "rev-parse", "HEAD"];
+            const control = await runCommand("git", gitArgs, probeOptions);
+            if (control.code === 0) {
+                const executable = attested !== null ? attested.executable : adapter.binary;
+                const insideFence = (file, args) => codexHarness
+                    ? runCommand(executable, ["sandbox", ...codexFenceArgv(fence, invocation.skipPermissions, grants),
+                        "-P", "standing-orders", "--", file, ...args], probeOptions)
+                    : runCommand(file, args, { ...probeOptions, fence: launchOptions.fence,
+                        ...(launchOptions.fenceGrants === undefined ? {} : { fenceGrants: launchOptions.fenceGrants }) });
+                const check = await insideFence("git", gitArgs);
+                if (check.code !== 0) {
+                    const trivial = await insideFence("true", []);
+                    if (trivial.code === 0)
+                        return { kind: "refused", reason: "containment", providerVersion: attested?.version ?? null,
+                            diagnostic: "The build fence blocks this checkout's own Git data.\n\nDetails:\n" + check.stderr.slice(0, 2000) + "\nDenied paths:\n" + fence.join("\n").slice(0, 12000) };
+                }
+            }
+        }
+        // The stamp precedes the spawn, so a crash between the two leaves a run
+        // that claims spend which never happened — the honest direction. A spawn
+        // before the stamp would leave spend no record claims, which is the lie
+        // the invariant exists to rule out. For attested providers the probed
+        // version rides the SAME durable write (B2).
+        // The spawn leg of the runner gate (MCP spec v6, review finding 4):
+        // the tuple re-proven against LIVE rows AFTER every awaited step, in
+        // the same breath as the stamp — a takeover during the attestation
+        // await can no longer slip a stale process through.
+        // THE PLANNER'S ROUTE, RE-PROVED AT THE SPAWN (final authority closure):
+        // the provenance the planner was admitted under is held to the authority
+        // its task holds RIGHT NOW — the strict working projection of a filed
+        // scope (exact terms, resolved profile, route parity, digest,
+        // live auth mode), or the bare word `legacy` on a task with no scope. A
+        // scope rewritten, corrupted, or unresolved between the claim and this
+        // instant invokes no provider: a value-shaped refusal, no spend.
+        if (run.role === "planner") {
+            const proved = store.proveRouteForSpawn(runId, clock());
+            if (!proved.ok) {
+                return {
+                    kind: "refused",
+                    reason: "route-authority",
+                    providerVersion: attested === null ? null : attested.version,
+                    diagnostic: `the planner's route authority lapsed before spawn — ${proved.problem}`,
+                };
+            }
+        }
+        if (!store.proveRunnerCustodyForSpawn(runId, clock())) {
+            return {
+                kind: "refused",
+                reason: "runner-custody",
+                providerVersion: attested === null ? null : attested.version,
+                diagnostic: "the run's runner custody lapsed before spawn — the lease, the runner, or its repo binding no longer stands",
+            };
+        }
+        // THE STOP FENCE at the spawn (v52): a stop recorded against this run
+        // — or the attempt it runs under — before this instant spawns nothing.
+        // A value-shaped refusal, no stamp, no process, no spend; the road's
+        // settlement seals the attempt as interrupted.
+        const stopBeforeSpawn = store.applicableStopFor(runId);
+        if (stopBeforeSpawn !== null) {
+            return {
+                kind: "refused",
+                reason: "stopped",
+                providerVersion: attested === null ? null : attested.version,
+                diagnostic: `stopped by ${stopBeforeSpawn.requestedBy} (run #${stopBeforeSpawn.run}) before the provider spawned — nothing was spent`,
+            };
+        }
+        // THE CONTAINMENT FENCE at the spawn (OS containment plan): a required
+        // native policy this runner cannot meet — macOS, an undelegated cgroup,
+        // a missing helper — spawns nothing. A value-shaped refusal in the
+        // policy's own words, no stamp, no process, no spend.
+        const containment = currentContainment();
+        if (containment.refusal !== null) {
+            return {
+                kind: "refused",
+                reason: "containment",
+                providerVersion: attested === null ? null : attested.version,
+                diagnostic: containment.refusal,
+            };
+        }
+        if (attested !== null)
+            store.stampProviderStart(runId, clock(), attested.version);
+        else
+            store.stampProviderStart(runId, clock());
+        // The brief is queued only once the checkout has passed the fence check.
+        liveInput?.begin(invocation.brief);
+        spawnedAt = Date.now();
         // Under the stop watch (v52): the run's stop row is re-read while the
         // provider runs, and a stop kills THIS run's process group through the
         // handle registered under its owner tag — the exact-attempt road,
         // never the global sweep. Settlement then reads the same row.
-        result = await underStopWatch(store, runId, () => spawn(attested !== null ? attested.executable : adapter.binary, launchArgv, {
-            ...(fenced.wrap.length === 0 ? {} : { fence: fenced.wrap }),
-            ...runOptions,
-            // v105: how the CLI really billed this turn (its key source, its plan's windows), read off its own stream.
-            onStreamEvent: event => {
-                if (event["type"] === "system" && event["subtype"] === "init") {
-                    if (typeof event["apiKeySource"] === "string")
-                        billingSeen.keySource = event["apiKeySource"].slice(0, 80);
-                    if (typeof event["model"] === "string")
-                        billingSeen.model = event["model"].slice(0, 200);
-                }
-                else if (event["type"] === "rate_limit_event") {
-                    billingSeen.planWindows = true;
-                }
-                else if (event["type"] === "result" && event["is_error"] !== true && event["subtype"] === "success") {
-                    billingSeen.answered = true;
-                }
-                runOptions.onStreamEvent?.(event);
-            },
-            owner: runOwnerTag(store, runId),
-            beforeSpawn: () => store.applicableStopFor(runId) === null && store.getRun(runId)?.outcome === null,
-            onSpawn: pid => {
-                runOptions.onSpawn?.(pid);
-                if (store.applicableStopFor(runId) !== null)
-                    throw new Error("the attempt was stopped before spawn custody completed");
-            },
-            ...(stdin === undefined ? {} : { stdin }),
-            ...(liveInput === null ? {} : { liveInput }),
-            ...(hardTimeoutMs === undefined ? {} : { timeoutMs: hardTimeoutMs }),
-            ...(idleTimeoutMs === undefined ? {} : { idleTimeoutMs }),
-            ...(defaultTimeoutMs === undefined ? {} : { timeoutMs: defaultTimeoutMs }),
-            env: {
-                ...(runOptions.env ?? {}),
-                ...(adapter.env?.(buildInvocation) ?? {}),
-                ...(tools?.env ?? {}),
-                ...(managedKey === null ? {} : { [PROVIDER_KEY_ENV[spec.provider]]: managedKey }),
-                // This key is deliberately last: no caller may point an agent back at
-                // the live control database through a generic RunOptions override.
-                ...childDatabaseEnv(isolatedDb.file),
-            },
-            omitEnv: [
-                ...(runOptions.omitEnv ?? []),
-                ...adapter.extraOmitEnv,
-                // Subscription mode: shed this provider's OWN key too, so an ambient
-                // one cannot force API billing over the login the operator prefers.
-                // Api-key mode: shed every OTHER own-key alias (finding 1) — gemini
-                // reads GOOGLE_API_KEY as well as GEMINI_API_KEY, and a stray alias
-                // must not override the ONE canonical key this mode injected.
-                ...(authMode === "subscription"
-                    ? ownKeyEnv
-                    : ownKeyEnv.filter(name => name !== PROVIDER_KEY_ENV[spec.provider])),
-            ],
-            // Providers run in their own process group (M6.12): the harness spawns
-            // shells and tools of its own, and both the timeout and the watch's
-            // hard stop must end the whole tree, not orphan the grandchildren.
-            processGroup: true,
-            // The session registry's crash guarantee (M6.9): the id is stamped the
-            // moment the stream announces it, first write wins — a daemon that
-            // dies mid-turn still knows which session to offer the successor.
-            onSessionId: id => {
-                const normalized = transportSessionId(id);
-                if (normalized === null)
-                    return;
-                if (transportAnnouncedSessionId === null)
-                    transportAnnouncedSessionId = normalized;
-                else if (transportAnnouncedSessionId !== normalized)
-                    transportSessionConflict = true;
-                store.stampRun(runId, { sessionId: normalized });
-            },
-        }));
+        result = await underStopWatch(store, runId, () => spawn(attested !== null ? attested.executable : adapter.binary, launchArgv, launchOptions));
     }
     finally {
         removeAgentDatabase(isolatedDb.dir);
         tools?.cleanup();
+        codexHome?.cleanup();
     }
     // v105: the run's billing, fixed from evidence before its usage is priced: a key it was given is a key; otherwise
     // what the CLI said (Claude's stream) or was last seen doing (Codex's account), and the setting only when neither.
@@ -427,6 +521,8 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // before it starts: nothing ran, and the run says what to update.
     const unsupported = result.code !== 0 && envelope.initObserved !== true && invocation.phase !== "review" ? isolationUnsupported(spec.provider, result.stderr) : null;
     if (unsupported !== null) {
+        // The CLI refused its flags before any model turn: the run never started, whatever the stamp said.
+        store.withdrawProviderStart(runId);
         return { kind: "refused", reason: "provider-unattested", providerVersion: attested === null ? null : attested.version, diagnostic: unsupported };
     }
     // The callback is the crash-safe early stamp; the parsed envelope is the
@@ -608,44 +704,80 @@ function usageOf(raw) {
         return {};
     }
 }
+/** What the plane recorded of a checkout's setup: its project and the setup stamped on it (null: none recorded). */
+function linkedFor(store, worktree) {
+    const row = worktree === null ? null : store.getWorktree(worktree);
+    return row === null ? null : { repo: row.repo, setupDigest: row.setupDigest ?? null };
+}
 /** The paths this run's agent may not reach: the state folder around the live database (but not its own worktree),
- * ~/.toolroll (or its older name), and its task boundary; plus what only Claude's file tools refuse. */
-function runFence(store, runId, provider, keyHome) {
+ * ~/.toolroll (or its older name), its task boundary and other launches' private folders; what the fence gives back
+ * (FenceGrants); and what only Claude's file tools refuse. */
+function runFence(store, runId, provider, keyHome, ownTools) {
     try {
         // A plane always has a database file; an in-memory store (a test) has nothing to fence.
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
-            return { fence: [], fileTools: [] };
+            return { fence: [], fileTools: [], grants: NO_GRANTS };
         const worktree = store.getRun(runId)?.worktree ?? null;
         const home = keyHome === undefined ? {} : { home: keyHome };
-        const boundary = worktree === null ? null : taskBoundary({ worktree, provider, ...home });
-        return { fence: agentFence({ databaseFile, worktree, ...home, boundary }), fileTools: boundary?.fileTools ?? [] };
+        const row = worktree === null ? null : store.getWorktree(worktree);
+        if (worktree !== null && row === null)
+            throw new CheckoutBindingError("The checkout's Git pointer was changed or its trusted binding could not be verified.");
+        const poolRoots = [join(dirname(databaseFile), "worktrees"), ...store.listWorktrees().map(record => poolRootOf(record.path, record.repo))];
+        const binding = worktree === null || row === null ? null : trustedWorktreeBinding(row.repo, worktree, poolRoots);
+        const boundary = worktree === null ? null : taskBoundary({ worktree, provider, ...home, binding });
+        const folders = runFolders(ownTools);
+        return {
+            fence: agentFence({ databaseFile, worktree, ...home, boundary, binding, runFolders: folders }),
+            fileTools: boundary?.fileTools ?? [],
+            // The shared install is granted only as the plane linked it: this checkout's project and stamped setup.
+            // Every plane checkout pool is denied around this one: the plane's own beside the database, and the one this
+            // checkout was recorded in (a --pool elsewhere), so another project's worktree, present at launch, is out of reach. Native wrappers also cover later creations.
+            grants: fenceGrants({ databaseFile, worktree, boundary, runFolders: folders, linked: linkedFor(store, worktree), binding, ...home,
+                poolRoots }),
+        };
     }
-    catch {
-        return { fence: [], fileTools: [] };
+    catch (error) {
+        return { fence: [], fileTools: [], grants: NO_GRANTS, problem: error instanceof CheckoutBindingError ? error.message : "The build fence could not be prepared." };
     }
 }
+/** The operator's own model choices a build routed with no model keeps (provider-home.ts). */
+function inheritedDefaults(provider, env, home) {
+    if (provider === "claude")
+        return claudeDefaults(claudeConfigDir(env, home));
+    if (provider === "codex")
+        return codexDefaults(codexHomeDir(env, home));
+    return undefined;
+}
 /** How the fence reaches a provider: Codex through its own sandbox profile
  * (already in its argv; wrapping it would nest sandboxes), Claude and
  * Gemini inside the macOS sandbox the spawn road applies (`wrap`), Claude
  * elsewhere through its own file-tool rules only. */
 function fenceLaunch(provider, fence) {
-    if (fence.length === 0)
-        return { wrap: [], method: "none" };
+    const method = fenceMethod(provider, fence.length > 0);
+    return { wrap: method === "macos-sandbox" || method === "linux-bubblewrap" ? fence : [], method };
+}
+/** The fence a launch gets, from its provider, whether it has anything to fence, and what this platform supports. */
+function fenceMethod(provider, fenced) {
+    if (!fenced)
+        return "none";
     if (provider === "codex" || provider === "openrouter")
-        return { wrap: [], method: "codex-profile" };
+        return "codex-profile";
     if (macosFenceAvailable())
-        return { wrap: fence, method: "macos-sandbox" };
+        return "macos-sandbox";
     if (linuxFenceAvailable())
-        return { wrap: fence, method: "linux-bubblewrap" };
-    return { wrap: [], method: provider === "claude" ? "claude-rules" : "none" };
+        return "linux-bubblewrap";
+    return provider === "claude" ? "claude-rules" : "none";
 }
 /** One launch's tools, or — when they cannot be prepared — the same isolation with none, never the operator's global servers. */
-function runTools(store, runId, spec, keyHome, clock, readOnly, withheld) {
+async function runTools(store, runId, spec, keyHome, clock, readOnly, withheld, containment, broker) {
     try {
-        return prepareRunTools(store, runId, spec.provider, { ...(keyHome === undefined ? {} : { home: keyHome }), now: clock(), ...(readOnly === undefined ? {} : { readOnly }), ...(withheld === undefined ? {} : { withheld }) });
+        return await prepareRunTools(store, runId, spec.provider, { ...(keyHome === undefined ? {} : { home: keyHome }), now: clock(), containment, ...(readOnly === undefined ? {} : { readOnly }), ...(withheld === undefined ? {} : { withheld }), broker });
     }
-    catch {
+    catch (error) {
+        // Sign-ins made for this run couldn't all be kept (and were revoked): it doesn't start.
+        if (error instanceof RunSignInError)
+            return { refused: error.message };
         return noToolsArgs(spec.provider);
     }
 }