toolroll 0.9.61 → 0.9.63

package/dist/provider-home.d.ts

@@ -0,0 +1,22 @@
+/** The operator's own choices a no-model build keeps. */
+export type ProviderDefaults = {
+    model?: string;
+    alwaysThinking?: boolean;
+    effort?: string;
+};
+export declare function claudeConfigDir(env?: Readonly<Record<string, string | undefined>>, home?: string): string;
+export declare function codexHomeDir(env?: Readonly<Record<string, string | undefined>>, home?: string): string;
+/** Claude's user settings: its `model` and `alwaysThinkingEnabled`, when valid. */
+export declare function claudeDefaults(configDir: string): ProviderDefaults;
+/** Codex's config.toml: its top-level `model` and `model_reasoning_effort`, or the selected profile's. */
+export declare function codexDefaults(codexHome: string): ProviderDefaults;
+/**
+ * One Codex launch's CODEX_HOME: a private folder linking the operator's
+ * sign-in and sessions. A missing `auth.json` stays missing (an API-key
+ * build needs none); a missing `sessions/` is made where Codex would make
+ * it, so a resumed build finds the thread its first launch wrote.
+ */
+export declare function isolatedCodexHome(source: string, root?: string): {
+    dir: string;
+    cleanup: () => void;
+};

package/dist/provider-home.js

@@ -0,0 +1,99 @@
+/**
+ * What a build keeps of the provider's own home, and nothing more.
+ *
+ * A build loads none of the operator's Claude settings or Codex config
+ * (provider.ts), so two things from them are carried explicitly:
+ *
+ * - A build routed with no model runs as the operator's own CLI would: the
+ *   model they chose (Claude's settings.json `model`, Codex's config.toml
+ *   `model`), Claude's `alwaysThinkingEnabled` and Codex's reasoning effort.
+ *   Nothing else of either file (hooks, plugins, MCP servers) is read.
+ * - A Codex build gets its own CODEX_HOME for the launch: links to the
+ *   operator's `auth.json` and `sessions/` (so it signs in, and a repair
+ *   resumes the same thread), and no skills, AGENTS.md or anything else from
+ *   theirs. Links, never copies: a refreshed sign-in lands in the real file.
+ *   The folder is fenced from the agent's commands and removed after the run.
+ */
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
+import { validModelId } from "./provider.js";
+const EFFORT = /^[a-z]{1,16}$/;
+export function claudeConfigDir(env = process.env, home = homedir()) {
+    return env["CLAUDE_CONFIG_DIR"] || join(home, ".claude");
+}
+export function codexHomeDir(env = process.env, home = homedir()) {
+    return env["CODEX_HOME"] || join(home, ".codex");
+}
+/** Claude's user settings: its `model` and `alwaysThinkingEnabled`, when valid. */
+export function claudeDefaults(configDir) {
+    let settings;
+    try {
+        settings = JSON.parse(readFileSync(join(configDir, "settings.json"), "utf8"));
+    }
+    catch {
+        return {};
+    }
+    if (settings === null || typeof settings !== "object" || Array.isArray(settings))
+        return {};
+    const { model, alwaysThinkingEnabled } = settings;
+    return {
+        ...(typeof model === "string" && model !== "" && validModelId(model) ? { model } : {}),
+        ...(typeof alwaysThinkingEnabled === "boolean" ? { alwaysThinking: alwaysThinkingEnabled } : {}),
+    };
+}
+/** Codex's config.toml: its top-level `model` and `model_reasoning_effort`, or the selected profile's. */
+export function codexDefaults(codexHome) {
+    let text;
+    try {
+        text = readFileSync(join(codexHome, "config.toml"), "utf8");
+    }
+    catch {
+        return {};
+    }
+    const tables = new Map([["", {}]]);
+    let table = "";
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        const header = /^\[\s*([^\]]+?)\s*\]$/.exec(line);
+        if (header !== null) {
+            table = header[1].replace(/"/g, "");
+            if (!tables.has(table))
+                tables.set(table, {});
+            continue;
+        }
+        const pair = /^([A-Za-z0-9_]+)\s*=\s*"([^"\\]*)"\s*(?:#.*)?$/.exec(line);
+        if (pair !== null)
+            tables.get(table)[pair[1]] = pair[2];
+    }
+    const top = tables.get("");
+    const profile = top["profile"] === undefined ? {} : tables.get(`profiles.${top["profile"]}`) ?? {};
+    const model = profile["model"] ?? top["model"];
+    const effort = profile["model_reasoning_effort"] ?? top["model_reasoning_effort"];
+    return {
+        ...(model !== undefined && model !== "" && validModelId(model) ? { model } : {}),
+        ...(effort !== undefined && EFFORT.test(effort) ? { effort } : {}),
+    };
+}
+/**
+ * One Codex launch's CODEX_HOME: a private folder linking the operator's
+ * sign-in and sessions. A missing `auth.json` stays missing (an API-key
+ * build needs none); a missing `sessions/` is made where Codex would make
+ * it, so a resumed build finds the thread its first launch wrote.
+ */
+export function isolatedCodexHome(source, root = tmpdir()) {
+    const dir = mkdtempSync(join(root, "so-codex-"));
+    try {
+        chmodSync(dir, 0o700);
+        if (existsSync(join(source, "auth.json")))
+            symlinkSync(join(source, "auth.json"), join(dir, "auth.json"));
+        mkdirSync(join(source, "sessions"), { recursive: true, mode: 0o700 });
+        symlinkSync(join(source, "sessions"), join(dir, "sessions"), "dir");
+    }
+    catch (error) {
+        rmSync(dir, { recursive: true, force: true });
+        throw error;
+    }
+    // rm removes the links themselves, never what they point to.
+    return { dir, cleanup: () => rmSync(dir, { recursive: true, force: true }) };
+}

package/dist/provider.d.ts

@@ -18,6 +18,7 @@
  * TOML-quoted deterministically, and the API key excluded from every
  * shell the model itself launches (Codex provider review, Q5).
  */
+import { type FenceGrants } from "./agent-fence.js";
 import { type ExecResult, type RunOptions } from "./exec.js";
 import { MODEL_ID, type AgentSpec, type ProviderId } from "./contracts/provider.js";
 export type { AgentSpec, ProviderId } from "./contracts/provider.js";
@@ -64,6 +65,17 @@ export type Invocation = {
      * Codex renders it as its own sandbox profile; Claude as deny rules for
      * its file tools (its shell is fenced by the macOS sandbox around it). */
     fence?: readonly string[];
+    /** What the fence gives back (agent-fence.ts): Codex renders read-only
+     * paths as "read", Claude's file tools never edit them. */
+    fenceGrants?: FenceGrants;
+    /** The operator's own model choices, for a build routed with no model
+     * (provider-home.ts): the model, Claude's always-on thinking and Codex's
+     * reasoning effort. Never rendered for a review or an explicit model. */
+    inherited?: {
+        model?: string;
+        alwaysThinking?: boolean;
+        effort?: string;
+    };
     /** More paths Claude's own file tools refuse, beside the fence: home
      * configuration its CLI still reads itself (so the sandbox around the
      * whole process can't deny them). */
@@ -199,6 +211,7 @@ export declare const OPENROUTER_ENV_KEY = "OPENROUTER_API_KEY";
  * planted user, project and local hooks and MCP servers: none loaded.
  */
 export declare const CLAUDE_BUILD_ISOLATION_ARGV: readonly string[];
+export declare function claudePluginEnv(env: Readonly<Record<string, string | undefined>>): string[];
 /** Claude's own tools that only make sense with a person to wake them. */
 export declare const HEADLESS_DISALLOWED_TOOLS: readonly string[];
 /**
@@ -221,9 +234,10 @@ export declare function isolationUnsupported(provider: ProviderId, stderr: strin
  * A Codex build's own setup, the equivalent of Claude's: the operator's
  * config.toml (its MCP servers, model choices, profiles) and execpolicy
  * rules ignored, ChatGPT apps and plugins off (plugins carry their own MCP
- * servers), and hooks off. Sign-in still comes from CODEX_HOME, which
- * `--ignore-user-config` leaves alone. The project's named tools follow as
- * `-c mcp_servers.*` (project-tools.ts).
+ * servers), and hooks off. The gateway gives each launch its own CODEX_HOME
+ * linking only the operator's sign-in and sessions (provider-home.ts), so no
+ * skills or AGENTS.md of theirs load either. The project's named tools follow
+ * as `-c mcp_servers.*` (project-tools.ts).
  */
 export declare const CODEX_BUILD_ISOLATION_ARGV: readonly string[];
 /**

package/dist/provider.js

@@ -181,6 +181,16 @@ const CLAUDE_REVIEW_JSON_SCHEMA = {
  * planted user, project and local hooks and MCP servers: none loaded.
  */
 export const CLAUDE_BUILD_ISOLATION_ARGV = ["--setting-sources", "", "--strict-mcp-config"];
+/**
+ * Plugins also ride the environment: a plugin named in CLAUDE_CODE_PLUGIN_DIRS
+ * loads its hooks whatever `--setting-sources` says (Claude Code 2.1.290,
+ * the provider canary's plugin sentinel). A build's launch sheds every
+ * plugin variable of the environment it would inherit.
+ */
+const CLAUDE_PLUGIN_ENV = /^CLAUDE_(CODE_\w*PLUGIN|AI_PLUGINS)\w*$/;
+export function claudePluginEnv(env) {
+    return Object.keys(env).filter(name => CLAUDE_PLUGIN_ENV.test(name));
+}
 const EMPTY_MCP_CONFIG = '{"mcpServers":{}}';
 /** Claude's own tools that only make sense with a person to wake them. */
 export const HEADLESS_DISALLOWED_TOOLS = ["ScheduleWakeup", "CronCreate", "Monitor"];
@@ -203,7 +213,7 @@ const claudeArgv = (invocation) => [
         : invocation.skipPermissions
             ? ["--dangerously-skip-permissions"]
             : ["--permission-mode", invocation.permissionMode]),
-    ...(invocation.model === null ? [] : ["--model", invocation.model]),
+    ...modelArgv("--model", invocation),
     ...(invocation.maxBudgetUsd === undefined ? [] : ["--max-budget-usd", String(invocation.maxBudgetUsd)]),
     ...(invocation.phase === "review"
         ? [...CLAUDE_REVIEW_ISOLATION_ARGV, "--json-schema", JSON.stringify(CLAUDE_REVIEW_JSON_SCHEMA)]
@@ -222,12 +232,22 @@ const claudeArgv = (invocation) => [
             ...(invocation.jsonSchema === undefined ? [] : ["--json-schema", JSON.stringify(invocation.jsonSchema)])
         ]),
 ];
+/** The route's model, or for a build routed with none, the operator's own (never for a review). */
+function modelArgv(flag, invocation) {
+    const model = invocation.model ?? (invocation.phase === "review" ? undefined : invocation.inherited?.model);
+    return model === undefined ? [] : [flag, model];
+}
+/** What else a no-model build keeps of the operator's setup. */
+const inheritedFrom = (invocation) => invocation.model === null && invocation.phase !== "review" ? invocation.inherited ?? {} : {};
 /** The build's one --settings: no personal memory, plus the fence and steering doorbell. */
 function claudeSettingsArgv(invocation) {
     const denied = [...(invocation.fence ?? []), ...(invocation.fileToolFence ?? [])];
+    const readOnly = invocation.fenceGrants?.readOnly ?? [];
+    const thinking = inheritedFrom(invocation).alwaysThinking;
     return ["--settings", JSON.stringify({
             autoMemoryEnabled: false,
-            ...(denied.length > 0 ? JSON.parse(claudeFenceSettings(denied)) : {}),
+            ...(thinking === undefined ? {} : { alwaysThinkingEnabled: thinking }),
+            ...(denied.length > 0 || readOnly.length > 0 ? JSON.parse(claudeFenceSettings(denied, readOnly)) : {}),
             ...(invocation.steerFolder === undefined ? {} : { hooks: claudeSteerHooks(invocation.steerFolder.dir, invocation.steerFolder.name) }),
         })];
 }
@@ -421,9 +441,10 @@ const codexSandboxArgv = (mode, resuming) => resuming ? ["-c", `sandbox_mode="${
  * A Codex build's own setup, the equivalent of Claude's: the operator's
  * config.toml (its MCP servers, model choices, profiles) and execpolicy
  * rules ignored, ChatGPT apps and plugins off (plugins carry their own MCP
- * servers), and hooks off. Sign-in still comes from CODEX_HOME, which
- * `--ignore-user-config` leaves alone. The project's named tools follow as
- * `-c mcp_servers.*` (project-tools.ts).
+ * servers), and hooks off. The gateway gives each launch its own CODEX_HOME
+ * linking only the operator's sign-in and sessions (provider-home.ts), so no
+ * skills or AGENTS.md of theirs load either. The project's named tools follow
+ * as `-c mcp_servers.*` (project-tools.ts).
  */
 export const CODEX_BUILD_ISOLATION_ARGV = [
     "--ignore-user-config",
@@ -469,11 +490,12 @@ const codexArgv = (extra) => (invocation) => {
             // denied. Full access becomes that sandbox widened to write anywhere
             // with network, instead of no sandbox (which fenced nothing).
             : invocation.fence !== undefined && invocation.fence.length > 0
-                ? codexFenceArgv(invocation.fence, invocation.skipPermissions)
+                ? codexFenceArgv(invocation.fence, invocation.skipPermissions, invocation.fenceGrants)
                 : invocation.skipPermissions
                     ? ["--dangerously-bypass-approvals-and-sandbox"]
                     : codexSandboxArgv("workspace-write", resuming)),
-        ...(invocation.model === null ? [] : ["-m", invocation.model]),
+        ...modelArgv("-m", invocation),
+        ...(inheritedFrom(invocation).effort === undefined ? [] : ["-c", `model_reasoning_effort=${toml(inheritedFrom(invocation).effort)}`]),
         ...extra,
         // After `extra`: the tools' shell_environment_policy must be the last word (it keeps OpenRouter's key out too).
         ...(invocation.phase === "review" ? [] : invocation.toolArgv ?? []),
@@ -851,6 +873,7 @@ const AUDITS = {
         isolation: { flag: CLAUDE_BUILD_ISOLATION_ARGV.filter(one => one !== "").join(" "), resumeSafe: true, enforced: true },
         configSurface: [
             "Toolroll's own --settings (the fence and steering hook)",
+            "your model and alwaysThinkingEnabled, when the route names no model",
             "the project's named tools (Settings → Tools)",
             "repository CLAUDE.md",
             "organisation-managed settings",
@@ -863,10 +886,11 @@ const AUDITS = {
         sessionIdentity: "announced",
         terminalContract: "none",
         // Builds ignore config.toml and execpolicy rules, with apps, plugins and
-        // hooks off (CODEX_BUILD_ISOLATION_ARGV); sign-in stays in CODEX_HOME.
+        // hooks off (CODEX_BUILD_ISOLATION_ARGV), in a per-launch CODEX_HOME that
+        // links only the sign-in and sessions (provider-home.ts).
         // Never --ephemeral: repair resumes sessions.
         isolation: { flag: "--ignore-user-config --ignore-rules", resumeSafe: true, enforced: true },
-        configSurface: ["the project's named tools (Settings → Tools)", "~/.codex/AGENTS.md and repository AGENTS.md", "sign-in from CODEX_HOME"],
+        configSurface: ["the project's named tools (Settings → Tools)", "repository AGENTS.md", "sign-in and sessions linked from CODEX_HOME (no skills or AGENTS.md)", "your model and reasoning effort, when the route names no model"],
     },
     openrouter: {
         transport: "streaming-jsonl",
@@ -876,7 +900,7 @@ const AUDITS = {
         terminalContract: "none",
         // Codex's build setup, with the model provider pinned by constant -c overrides.
         isolation: { flag: "--ignore-user-config --ignore-rules", resumeSafe: true, enforced: true },
-        configSurface: ["the project's named tools (Settings → Tools)", "~/.codex/AGENTS.md and repository AGENTS.md", `${OPENROUTER_ENV_KEY}`],
+        configSurface: ["the project's named tools (Settings → Tools)", "repository AGENTS.md", `${OPENROUTER_ENV_KEY}`],
     },
     gemini: {
         transport: "streaming-jsonl",

package/dist/remote-main.d.ts

@@ -0,0 +1,61 @@
+import { type ExecResult } from "./exec.js";
+import type { Store } from "./store.js";
+import type { Runner } from "./worktree.js";
+/** What the private directory's git may see of this process's environment: nothing that names a repository, an
+ * object store or config. The fixed settings below go on top. Teardown git (teardown-git.ts) uses the same. */
+export declare const ENV_ALLOWLIST: string[];
+export declare const ENV: Record<string, string>;
+/** The only credential helper https may use: the system keychain on macOS; elsewhere none, so a private https remote
+ * fails closed instead of asking. */
+export declare const CREDENTIAL_HELPER: string;
+export type RemoteUrl = {
+    kind: "network";
+    url: string;
+};
+/**
+ * A URL Toolroll may fetch remote main from: https or ssh (either form). Local paths, file URLs and loopback hosts
+ * (this machine is where builds run) are always refused. Remote helpers (ext::, fd:: and the like), plain http and
+ * git:// (no authentication), relative paths, embedded passwords and anything odd are refused.
+ */
+export declare function parseRemoteUrl(url: string): RemoteUrl | {
+    why: string;
+};
+/** Why a recorded URL may not be used as the trusted remote; null when it may. */
+export declare function remoteUrlProblem(url: string): string | null;
+export type RemoteGit = (args: readonly string[]) => Promise<ExecResult>;
+export type RemoteMain = {
+    url: string;
+    /** The commit the recorded remote's main is at, as fetched just now. */
+    main: string;
+    /** Git in the private directory, hardened as above. */
+    git: RemoteGit;
+    /** Bring this exact commit (with its history) from the project by fetch, for a content comparison. */
+    bring: (repo: string, head: string) => Promise<boolean>;
+};
+export type RemoteMainRead = {
+    ok: true;
+    remote: RemoteMain;
+} | {
+    ok: false;
+    why: string;
+};
+/**
+ * One pass's reads of recorded remotes. Every `read` fetches again (the pre-teardown re-check is never older than
+ * the teardown); a project's private directory lasts until `close`, so a fetch after the first only brings what
+ * changed. Close removes every directory.
+ */
+export declare class RemoteMains {
+    private readonly store;
+    private readonly runner;
+    private readonly scratch;
+    private readonly helper;
+    private readonly dirs;
+    constructor(store: Store, runner: Runner | undefined, scratch: string, helper?: string);
+    private exec;
+    /** Nothing but fetched objects decides: a private directory that grew alternates, grafts or shallow state is
+     * not trusted. */
+    private clean;
+    private dirFor;
+    read(repo: string): Promise<RemoteMainRead>;
+    close(): void;
+}

package/dist/remote-main.js

@@ -0,0 +1,179 @@
+/**
+ * The project's main as its recorded remote has it, read by Toolroll's own process. Automatic completion of landed
+ * work (landed-cleanup.ts) trusts only this: a build shares the project's .git, so it can move the local main or
+ * repoint origin in .git/config, and neither may complete its own task.
+ *
+ * The remote URL is the one captured on first admission or explicitly supplied by the owner (project-admission.ts), never the repository's
+ * config. Each read fetches that URL's main into a fresh, private Git directory under Toolroll's evidence folder (which
+ * the agent fence denies to builds), with no system or global config, no includes or URL rewriting, no replace
+ * objects, no hooks, no ext or file transport and only an explicit credential helper. The shared repository's objects, refs,
+ * replace refs, grafts and shallow state are never read: commits enter only by fetch. A content comparison brings the
+ * result's exact recorded commit in by fetch too; git checks every object against its hash.
+ *
+ * Every doubt fails closed: no recorded remote, a URL that isn't allowed, a failed fetch or a remote without main all
+ * read as "not proven", and the task stays for a person.
+ */
+import { mkdirSync, mkdtempSync, rmSync, existsSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { run } from "./exec.js";
+/** The ref a fetched remote main is kept under, inside the private directory only. */
+const REMOTE_MAIN = "refs/toolroll/remote-main";
+const SHA = /^[0-9a-f]{40}$/;
+const FETCH_TIMEOUT_MS = 120_000;
+/** What the private directory's git may see of this process's environment: nothing that names a repository, an
+ * object store or config. The fixed settings below go on top. Teardown git (teardown-git.ts) uses the same. */
+export const ENV_ALLOWLIST = ["PATH", "HOME", "TMPDIR", "LANG", "LC_ALL", "SSH_AUTH_SOCK", "HTTPS_PROXY", "https_proxy", "NO_PROXY", "no_proxy"];
+export const ENV = {
+    GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_NO_REPLACE_OBJECTS: "1", GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: "", SSH_ASKPASS: "", GIT_SSH_COMMAND: "ssh -o BatchMode=yes",
+};
+/** The only credential helper https may use: the system keychain on macOS; elsewhere none, so a private https remote
+ * fails closed instead of asking. */
+export const CREDENTIAL_HELPER = process.platform === "darwin" ? "osxkeychain" : "";
+/** Settings for every command in the private directory. The directory's own config is ours and empty. File transport
+ * is off for the recorded remote; only the result fetch from the registered project path turns it on. */
+function hardened(helper, file = "never") {
+    return ["-c", "core.hooksPath=/dev/null", "-c", "protocol.allow=never", "-c", "protocol.https.allow=always", "-c", "protocol.ssh.allow=always",
+        "-c", `protocol.file.allow=${file}`, "-c", "protocol.ext.allow=never", "-c", "credential.helper=", ...(helper === "" ? [] : ["-c", `credential.helper=${helper}`]),
+        "-c", "gc.auto=0", "-c", "maintenance.auto=false", "-c", "fetch.recurseSubmodules=false", "-c", "core.fsmonitor=false"];
+}
+/**
+ * A URL Toolroll may fetch remote main from: https or ssh (either form). Local paths, file URLs and loopback hosts
+ * (this machine is where builds run) are always refused. Remote helpers (ext::, fd:: and the like), plain http and
+ * git:// (no authentication), relative paths, embedded passwords and anything odd are refused.
+ */
+export function parseRemoteUrl(url) {
+    const refused = { why: "its remote URL isn't one Toolroll fetches from" };
+    if (url === "" || url.length > 2048 || /[\x00-\x20\x7f]/.test(url) || url.startsWith("-") || url.includes("\\"))
+        return refused;
+    if (/^[A-Za-z][A-Za-z0-9+.-]*::/.test(url) || /^file:/i.test(url) || /^[A-Za-z]:[\\/]/.test(url))
+        return refused;
+    const scheme = /^([A-Za-z][A-Za-z0-9+.-]*):\/\//.exec(url)?.[1]?.toLowerCase();
+    if (scheme !== undefined) {
+        if (scheme !== "https" && scheme !== "ssh")
+            return refused;
+        try {
+            const parsed = new URL(url);
+            if (parsed.password !== "" || (scheme === "https" && parsed.username !== "") || parsed.search !== "" || parsed.hash !== "" || parsed.hostname === "" || loopback(parsed.hostname))
+                return refused;
+        }
+        catch {
+            return refused;
+        }
+        return { kind: "network", url };
+    }
+    // scp-like ssh: [user@]host:path, with no slash before the first colon.
+    const colon = url.indexOf(":");
+    const host = /^(?:[A-Za-z0-9._-]+@)?([A-Za-z0-9.-]+)$/.exec(url.slice(0, colon))?.[1];
+    if (colon > 0 && colon < url.length - 1 && host !== undefined && !loopback(host))
+        return { kind: "network", url };
+    return refused;
+}
+/** localhost (and its subdomains), any IPv4 spelling of 127.0.0.0/8 or 0.0.0.0 (inet_aton accepts 127.1, 0x7f.1 and
+ * the like), and ::1, :: or an IPv4-mapped loopback. */
+function loopback(hostname) {
+    const host = hostname.toLowerCase().replace(/^\[(.*)\]$/, "$1").replace(/\.+$/, "");
+    if (host === "localhost" || host.endsWith(".localhost"))
+        return true;
+    const parts = host.split(".");
+    if (parts.length <= 4 && parts.every(part => /^(0x[0-9a-f]*|[0-9]+)$/.test(part))) {
+        const values = parts.map(part => part.startsWith("0x") ? parseInt(part.slice(2) || "0", 16) : /^0[0-7]+$/.test(part) ? parseInt(part, 8) : Number(part));
+        const first = values.length === 1 ? Math.floor(values[0] / 2 ** 24) : values[0];
+        return first === 127 || values.every(value => value === 0);
+    }
+    if (!host.includes(":"))
+        return false;
+    try {
+        const v6 = new URL(`http://[${host}]/`).hostname;
+        return v6 === "[::1]" || v6 === "[::]" || /^\[::ffff:(7f[0-9a-f]{2}:|0:)/.test(v6);
+    }
+    catch {
+        return true;
+    }
+}
+/** Why a recorded URL may not be used as the trusted remote; null when it may. */
+export function remoteUrlProblem(url) {
+    const parsed = parseRemoteUrl(url);
+    return "why" in parsed ? parsed.why : null;
+}
+/**
+ * One pass's reads of recorded remotes. Every `read` fetches again (the pre-teardown re-check is never older than
+ * the teardown); a project's private directory lasts until `close`, so a fetch after the first only brings what
+ * changed. Close removes every directory.
+ */
+export class RemoteMains {
+    store;
+    runner;
+    scratch;
+    helper;
+    dirs = new Map();
+    constructor(store, runner = run, scratch, helper = CREDENTIAL_HELPER) {
+        this.store = store;
+        this.runner = runner;
+        this.scratch = scratch;
+        this.helper = helper;
+    }
+    exec(dir, args, file = "never") {
+        return this.runner("git", ["--git-dir", dir, ...hardened(this.helper, file), ...args], { cwd: dir, envAllowlist: ENV_ALLOWLIST, env: ENV, timeoutMs: FETCH_TIMEOUT_MS, maxBuffer: 512 * 1024 * 1024 });
+    }
+    /** Nothing but fetched objects decides: a private directory that grew alternates, grafts or shallow state is
+     * not trusted. */
+    clean(dir) {
+        return !["shallow", join("info", "grafts"), join("objects", "info", "alternates"), join("objects", "info", "http-alternates")].some(name => existsSync(join(dir, name)));
+    }
+    async dirFor(repo) {
+        const known = this.dirs.get(repo);
+        if (known !== undefined && existsSync(known))
+            return known;
+        try {
+            mkdirSync(this.scratch, { recursive: true });
+            const dir = mkdtempSync(join(this.scratch, ".remote-main-"));
+            this.dirs.set(repo, dir);
+            const made = await this.runner("git", ["init", "--quiet", "--bare", "--template=", dir], { cwd: dir, envAllowlist: ENV_ALLOWLIST, env: ENV, timeoutMs: 30_000 });
+            return made.code === 0 ? dir : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async read(repo) {
+        const url = this.store.projectRemote(repo);
+        if (url === null)
+            return { ok: false, why: "the project has no recorded remote" };
+        const problem = remoteUrlProblem(url);
+        if (problem !== null)
+            return { ok: false, why: problem };
+        const dir = await this.dirFor(repo);
+        if (dir === null)
+            return { ok: false, why: "Toolroll couldn't read the project's remote main" };
+        const fetched = await this.exec(dir, ["fetch", "--quiet", "--no-tags", "--no-write-fetch-head", "--", url, `+refs/heads/main:${REMOTE_MAIN}`]);
+        if (fetched.code !== 0 || !this.clean(dir))
+            return { ok: false, why: "Toolroll couldn't read the project's remote main" };
+        const resolved = await this.exec(dir, ["rev-parse", "--verify", "--quiet", `${REMOTE_MAIN}^{commit}`]);
+        const main = resolved.stdout.trim();
+        if (resolved.code !== 0 || !SHA.test(main))
+            return { ok: false, why: "Toolroll couldn't read the project's remote main" };
+        const git = args => this.exec(dir, args);
+        const bring = async (from, head) => {
+            if (!SHA.test(head))
+                return false;
+            if ((await git(["cat-file", "-e", `${head}^{commit}`])).code === 0)
+                return true;
+            // The one local fetch: from the project path Toolroll registered (never a URL), for this exact hash-checked commit.
+            if (!isAbsolute(from))
+                return false;
+            const got = await this.exec(dir, ["fetch", "--quiet", "--no-tags", "--no-write-fetch-head", "--", from, `+${head}:refs/toolroll/results/${head}`], "always");
+            return got.code === 0 && this.clean(dir) && (await git(["cat-file", "-e", `${head}^{commit}`])).code === 0;
+        };
+        return { ok: true, remote: { url, main, git, bring } };
+    }
+    close() {
+        for (const dir of this.dirs.values()) {
+            try {
+                rmSync(dir, { recursive: true, force: true });
+            }
+            catch { /* the next pass makes its own */ }
+        }
+        this.dirs.clear();
+    }
+}

package/dist/scope.d.ts

@@ -258,7 +258,7 @@ export type Scope = SavedScopeTerms & {
      * 'mode' = sealed by the signer's live mode (modeDigest names it);
      * 'chat' = the owner's own two taps in their paired chat, under their chat-approval setting or a signed term
      * (modeDigest names that authority; the yes is the person's and doesn't lapse with it). */
-    approvalBasis?: "password" | "mode" | "chat" | null;
+    approvalBasis?: "password" | "mode" | "chat" | "grant" | null;
     modeDigest?: string | null;
     /** v24 (optional so hand-built scopes in tests stay valid): the working
      * execution profile, its resolution state, and the immutable snapshot

package/dist/serve.js

@@ -14,7 +14,7 @@ import { startMaintenance } from './maintenance.js';
 import { connectionsOf, localConnectOf, oneClickOf } from "./mcp-connect.js";
 import { MOBILE_VIEWPORT_SCRIPT } from "./mobile-viewport.js";
 import { projectAuthority } from "./project-access.js";
-import { discoverTools, projectToolsOf, secretsSetFor, TOOL_CATALOG, toolStanding } from "./project-tools.js";
+import { discoverTools, projectToolsOf, secretsSetFor, TOOL_CATALOG, toolSecretStorage, toolStanding } from "./project-tools.js";
 import { toolRefusal } from "./policy.js";
 import { isEdgeAddress, refuseEdge } from "./server/edge-refusal.js";
 import { announcePasswordBearer, isPasswordBearer, PASSWORD_BEARER_REFUSED, passwordBearerAccepted } from "./password-bearer.js";
@@ -434,17 +434,25 @@ export function createDecisionServer(options) {
         }
     };
     /** One project's Tools page: its tools with which secrets are set (never values), the common tools not yet added, and what this computer already has. */
-    const toolHome = options.toolHome ?? homedir();
+    // A test's own folder for tool secrets and found tools; Toolroll's own (beside its database, and this home) otherwise.
+    const toolHome = options.toolHome;
     const toolsViewOf = (repo, codex, kit = null, wanted = null) => {
         const tools = projectToolsOf(store, repo);
         const names = new Set(tools.map(one => one.name));
         return {
             repo, project: repo.split(/[\\/]/).filter(Boolean).at(-1) ?? repo,
-            tools: tools.map(tool => ({ tool, secretsSet: secretsSetFor(repo, tool.spec, toolHome) })),
+            // Secrets that can't be read (a refused folder, a locked keychain) read as none set: the page says why once (storage).
+            tools: tools.map(tool => { let secretsSet = []; try {
+                secretsSet = secretsSetFor(repo, tool.spec, toolHome);
+            }
+            catch {
+                secretsSet = [];
+            } return { tool, secretsSet }; }),
             // A service that connects by signing in (or an app's own Connect) is offered only that way.
             catalog: TOOL_CATALOG.filter(one => !names.has(one.name) && oneClickOf(one.name) === null && localConnectOf(one.name) === null),
             connections: connectionsOf(store, repo, toolHome), kit, wanted,
             found: discoverTools(repo, codex, toolHome).filter(one => !names.has(one.spec.name)),
+            storage: toolSecretStorage(),
         };
     };
     const codingProjects = () => [...new Set([...managedRepos(), ...store.listProjects().map(project => project.path)])].filter(repo => rowVisible(liveCeiling(), repo));