toolroll 0.9.62 → 0.9.63

package/dist/toolroll-update.js

@@ -35,7 +35,7 @@ import { processMayBeAlive } from "./process-liveness.js";
 import { assertCodingUpdateStopped, backupCodingCatalog, codingCatalogExists, releaseStaleCodingOwner, removeCodingUpdateGate } from "./coding-update.js";
 import { installLaunchdService, launchdPlist, stopLaunchdService, writeFileDurably } from "./daemon.js";
 import { NAME } from "./names.js";
-import { orphanKey, updateSafeSchema, V117_RENAMED_COLUMNS, V117_RENAMED_TABLES, V118_MERGED_TABLES, V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS } from "./store.js";
+import { orphanKey, updateSafeSchema, V117_RENAMED_COLUMNS, V117_RENAMED_TABLES, V118_MERGED_TABLES, V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS } from "./store.js";
 import { isNewer, REGISTRY } from "./releases.js";
 import { markNeverIndex } from "./never-index.js";
 import { readRuntimeUpdateJournal, RUNTIME_PHASES, RUNTIME_UPDATE_STEPS, stagedStartedAt, updaterStartingOf } from "./contracts/update-journal.js";
@@ -400,7 +400,8 @@ const HISTORY_RULES = {
     // saved before them reads none.
     // v121: live steering's columns and a run's attempt key read none, and no sends, the same way.
     // v122: a project's recorded remote reads none the same way.
-    ...addedColumns(V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS),
+    // v123: a plan authorization's basis reads the operating mode, and a trigger firing reads not on time and no script ran.
+    ...addedColumns(V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS),
 };
 /** The tables a migration may remove whole (v115's removed features). */
 export const RETIRED_TABLES = Object.freeze(Object.keys(HISTORY_RULES).filter(name => HISTORY_RULES[name].retired));

package/dist/tools-ui.d.ts

@@ -2,7 +2,7 @@
  * entered here and nowhere else, and never shown again. */
 import { type Html } from "./html.js";
 import { type FoundTool, type ProjectTool, type ToolSpec } from "./project-tools.js";
-export declare const TOOLS_CSS = ".tools{max-width:780px;min-width:0;overflow-wrap:anywhere}.tools .card{padding:16px 18px;margin:12px 0;min-width:0}.tools .card h2{font-size:1.05rem;margin:0;color:var(--so-ink);font-weight:600}.tools .tool-heading{display:flex;align-items:center;gap:10px}.tools .tool-heading h2{flex:1;min-width:0}.tools .tool-state{font-size:.85rem;flex-shrink:0;color:var(--so-muted)}.tools .tool-state[data-ready=\"false\"]{color:var(--so-warning)}.tools .card>p{margin:6px 0 0}.tools .tool-note{color:var(--so-warning)}.tools code{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word;font-size:.85rem}.tools form{display:grid;gap:10px;margin:0}.tools label{display:grid;gap:6px}.tools input,.tools select{box-sizing:border-box;width:100%;max-width:100%;min-width:0}.tools button{justify-self:start;white-space:nowrap;min-height:44px;max-width:100%;overflow:hidden;text-overflow:ellipsis}.tools details:not(.card){margin:6px 0 0;padding:0;border:0;border-radius:0;background:none;box-shadow:none}.tools details:not(.card)>summary{min-height:36px;display:flex;align-items:center;font-size:.9rem;color:var(--so-muted);cursor:pointer}.tools details:not(.card)[open]>summary{color:var(--so-ink)}.tools details.card>summary{cursor:pointer;min-height:44px;display:flex;align-items:center;font-weight:600}.tools summary{list-style:none;gap:10px}.tools summary::-webkit-details-marker{display:none}.tools summary::before{content:\"\";flex-shrink:0;width:6px;height:6px;margin:0 2px;border-right:1.5px solid currentColor;border-bottom:1.5px solid currentColor;transform:rotate(-45deg);transition:transform .15s}.tools details[open]>summary::before{transform:rotate(45deg)}.tools details:not(.card) form{padding:4px 0 10px}.tools .tool-facts{margin:0 0 8px;display:grid;gap:4px;font-size:.9rem}.tools .tool-facts p{margin:0}.tools .tool-controls{display:flex;gap:12px;flex-wrap:wrap;margin-top:12px}.tools .tool-found{display:flex;gap:10px;align-items:flex-start}.tools .tool-found input{flex:0 0 auto;width:18px;height:18px;margin-top:3px}.tools .tool-found span{min-width:0}.tools .problem{padding:10px 12px;margin:8px 0 0}.tools .tool-connect{scroll-margin-top:72px}.tools .connect-wanted{background:var(--so-accent);color:var(--so-on-accent);border-color:var(--so-accent)}.tools .connect-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(210px,1fr));gap:8px}.tools .connect-tile{display:grid;grid-template-columns:auto 1fr;column-gap:10px;align-items:center;justify-self:stretch;text-align:left;white-space:normal;padding:10px 12px;border:1px solid var(--so-line);border-radius:10px;background:var(--so-paper);color:var(--so-ink);min-height:60px;font:inherit;cursor:pointer;scroll-margin-top:96px}.tools .connect-tile:hover{border-color:var(--so-input-line);background:var(--so-raised)}.tools .connect-tile:target,.tools .connect-tile:focus-visible{outline:2px solid var(--so-accent);outline-offset:2px}.tools .connect-tile .brand-mark{grid-row:span 2}.tools .connect-tile strong{font-weight:600;line-height:1.3}.tools .connect-tile>span:not(.brand-mark){font-size:.8rem;color:var(--so-muted);line-height:1.35;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}.tools .connect-tile[data-state=\"connected\"]>span:not(.brand-mark){color:var(--so-success)}.tools .connect-local{grid-column:1/-1}.tools .connect-local>span:not(.brand-mark){-webkit-line-clamp:unset}.tools .connect-problem{margin:0}.tools .connect-problem:focus{outline:2px solid var(--so-accent);outline-offset:2px}.tools .connect-tile:disabled{cursor:default;opacity:.6}@media(max-width:600px){.tools .connect-grid{grid-template-columns:1fr 1fr}.tools .connect-tile:not(.connect-local)>span:not(.brand-mark){display:none}.tools .connect-local>span:not(.brand-mark){grid-column:2}.tools .connect-tile{min-height:52px;padding:8px 10px}.tools .connect-tile .brand-mark{grid-row:auto}.tools input,.tools select{font-size:16px}.tools .card{padding:14px}}";
+export declare const TOOLS_CSS = ".tools{max-width:780px;min-width:0;overflow-wrap:anywhere}.tools .card{padding:16px 18px;margin:12px 0;min-width:0}.tools .card h2{font-size:1.05rem;margin:0;color:var(--so-ink);font-weight:600}.tools .tool-heading{display:flex;align-items:center;gap:10px}.tools .tool-heading h2{flex:1;min-width:0}.tools .tool-state{font-size:.85rem;flex-shrink:0;color:var(--so-muted)}.tools .tool-state[data-ready=\"false\"]{color:var(--so-warning)}.tools .card>p{margin:6px 0 0}.tools .card>p.tool-credential{margin-top:4px;font-size:.875rem;color:var(--so-muted)}.tools .tool-note{color:var(--so-warning)}.tools code{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word;font-size:.85rem}.tools form{display:grid;gap:10px;margin:0}.tools label{display:grid;gap:6px}.tools input,.tools select{box-sizing:border-box;width:100%;max-width:100%;min-width:0}.tools button{justify-self:start;white-space:nowrap;min-height:44px;max-width:100%;overflow:hidden;text-overflow:ellipsis}.tools details:not(.card){margin:6px 0 0;padding:0;border:0;border-radius:0;background:none;box-shadow:none}.tools details:not(.card)>summary{min-height:36px;display:flex;align-items:center;font-size:.9rem;color:var(--so-muted);cursor:pointer}.tools details:not(.card)[open]>summary{color:var(--so-ink)}.tools details.card>summary{cursor:pointer;min-height:44px;display:flex;align-items:center;font-weight:600}.tools summary{list-style:none;gap:10px}.tools summary::-webkit-details-marker{display:none}.tools summary::before{content:\"\";flex-shrink:0;width:6px;height:6px;margin:0 2px;border-right:1.5px solid currentColor;border-bottom:1.5px solid currentColor;transform:rotate(-45deg);transition:transform .15s}.tools details[open]>summary::before{transform:rotate(45deg)}.tools details:not(.card) form{padding:4px 0 10px}.tools .tool-facts{margin:0 0 8px;display:grid;gap:4px;font-size:.9rem}.tools .tool-facts p{margin:0}.tools .tool-controls{display:flex;gap:12px;flex-wrap:wrap;margin-top:12px}.tools .tool-found{display:flex;gap:10px;align-items:flex-start}.tools .tool-found input{flex:0 0 auto;width:18px;height:18px;margin-top:3px}.tools .tool-found span{min-width:0}.tools .problem{padding:10px 12px;margin:8px 0 0}.tools .tool-connect{scroll-margin-top:72px}.tools .connect-wanted{background:var(--so-accent);color:var(--so-on-accent);border-color:var(--so-accent)}.tools .connect-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(210px,1fr));gap:8px}.tools .connect-tile{display:grid;grid-template-columns:auto 1fr;column-gap:10px;align-items:center;justify-self:stretch;text-align:left;white-space:normal;padding:10px 12px;border:1px solid var(--so-line);border-radius:10px;background:var(--so-paper);color:var(--so-ink);min-height:60px;font:inherit;cursor:pointer;scroll-margin-top:96px}.tools .connect-tile:hover{border-color:var(--so-input-line);background:var(--so-raised)}.tools .connect-tile:target,.tools .connect-tile:focus-visible{outline:2px solid var(--so-accent);outline-offset:2px}.tools .connect-tile .brand-mark{grid-row:span 2}.tools .connect-tile strong{font-weight:600;line-height:1.3}.tools .connect-tile>span:not(.brand-mark){font-size:.8rem;color:var(--so-muted);line-height:1.35;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}.tools .connect-tile[data-state=\"connected\"]>span:not(.brand-mark){color:var(--so-success)}.tools .connect-local{grid-column:1/-1}.tools .connect-local>span:not(.brand-mark){-webkit-line-clamp:unset}.tools .connect-problem{margin:0}.tools .connect-problem:focus{outline:2px solid var(--so-accent);outline-offset:2px}.tools .connect-tile:disabled{cursor:default;opacity:.6}@media(max-width:600px){.tools .connect-grid{grid-template-columns:1fr 1fr}.tools .connect-tile:not(.connect-local)>span:not(.brand-mark){display:none}.tools .connect-local>span:not(.brand-mark){grid-column:2}.tools .connect-tile{min-height:52px;padding:8px 10px}.tools .connect-tile .brand-mark{grid-row:auto}.tools input,.tools select{font-size:16px}.tools .card{padding:14px}}";
 export type ToolsView = {
     repo: string;
     project: string;
@@ -26,6 +26,12 @@ export type ToolsView = {
         label: string;
     })[];
     found: FoundTool[];
+    /** Where this computer keeps tool secrets (project-tools.ts toolSecretStorage): said plainly when it's files only. */
+    storage?: {
+        words: string;
+        filesOnly: boolean;
+        problem?: string;
+    };
     /** The person's other projects and the one-click services still open there: where a connection here can also go. */
     others?: {
         repo: string;

package/dist/tools-ui.js

@@ -2,9 +2,10 @@
  * entered here and nowhere else, and never shown again. */
 import { html, postForm } from "./html.js";
 import { brandMarkHtml, TILE_PHONE } from "./brand-mark.js";
-import { toolCommandLine, toolStanding } from "./project-tools.js";
+import { signedIn } from "./oauth-run-token.js";
+import { credentialModeOf, toolCommandLine, toolStanding } from "./project-tools.js";
 const hidden = (data) => Object.entries(data).map(([k, v]) => html `<input type="hidden" name="${k}" value="${v}">`);
-export const TOOLS_CSS = `.tools{max-width:780px;min-width:0;overflow-wrap:anywhere}.tools .card{padding:16px 18px;margin:12px 0;min-width:0}.tools .card h2{font-size:1.05rem;margin:0;color:var(--so-ink);font-weight:600}.tools .tool-heading{display:flex;align-items:center;gap:10px}.tools .tool-heading h2{flex:1;min-width:0}.tools .tool-state{font-size:.85rem;flex-shrink:0;color:var(--so-muted)}.tools .tool-state[data-ready="false"]{color:var(--so-warning)}.tools .card>p{margin:6px 0 0}.tools .tool-note{color:var(--so-warning)}.tools code{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word;font-size:.85rem}.tools form{display:grid;gap:10px;margin:0}.tools label{display:grid;gap:6px}.tools input,.tools select{box-sizing:border-box;width:100%;max-width:100%;min-width:0}.tools button{justify-self:start;white-space:nowrap;min-height:44px;max-width:100%;overflow:hidden;text-overflow:ellipsis}.tools details:not(.card){margin:6px 0 0;padding:0;border:0;border-radius:0;background:none;box-shadow:none}.tools details:not(.card)>summary{min-height:36px;display:flex;align-items:center;font-size:.9rem;color:var(--so-muted);cursor:pointer}.tools details:not(.card)[open]>summary{color:var(--so-ink)}.tools details.card>summary{cursor:pointer;min-height:44px;display:flex;align-items:center;font-weight:600}.tools summary{list-style:none;gap:10px}.tools summary::-webkit-details-marker{display:none}.tools summary::before{content:"";flex-shrink:0;width:6px;height:6px;margin:0 2px;border-right:1.5px solid currentColor;border-bottom:1.5px solid currentColor;transform:rotate(-45deg);transition:transform .15s}.tools details[open]>summary::before{transform:rotate(45deg)}.tools details:not(.card) form{padding:4px 0 10px}.tools .tool-facts{margin:0 0 8px;display:grid;gap:4px;font-size:.9rem}.tools .tool-facts p{margin:0}.tools .tool-controls{display:flex;gap:12px;flex-wrap:wrap;margin-top:12px}.tools .tool-found{display:flex;gap:10px;align-items:flex-start}.tools .tool-found input{flex:0 0 auto;width:18px;height:18px;margin-top:3px}.tools .tool-found span{min-width:0}.tools .problem{padding:10px 12px;margin:8px 0 0}.tools .tool-connect{scroll-margin-top:72px}.tools .connect-wanted{background:var(--so-accent);color:var(--so-on-accent);border-color:var(--so-accent)}.tools .connect-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(210px,1fr));gap:8px}.tools .connect-tile{display:grid;grid-template-columns:auto 1fr;column-gap:10px;align-items:center;justify-self:stretch;text-align:left;white-space:normal;padding:10px 12px;border:1px solid var(--so-line);border-radius:10px;background:var(--so-paper);color:var(--so-ink);min-height:60px;font:inherit;cursor:pointer;scroll-margin-top:96px}.tools .connect-tile:hover{border-color:var(--so-input-line);background:var(--so-raised)}.tools .connect-tile:target,.tools .connect-tile:focus-visible{outline:2px solid var(--so-accent);outline-offset:2px}.tools .connect-tile .brand-mark{grid-row:span 2}.tools .connect-tile strong{font-weight:600;line-height:1.3}.tools .connect-tile>span:not(.brand-mark){font-size:.8rem;color:var(--so-muted);line-height:1.35;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}.tools .connect-tile[data-state="connected"]>span:not(.brand-mark){color:var(--so-success)}.tools .connect-local{grid-column:1/-1}.tools .connect-local>span:not(.brand-mark){-webkit-line-clamp:unset}.tools .connect-problem{margin:0}.tools .connect-problem:focus{outline:2px solid var(--so-accent);outline-offset:2px}.tools .connect-tile:disabled{cursor:default;opacity:.6}${TILE_PHONE}{.tools .connect-grid{grid-template-columns:1fr 1fr}.tools .connect-tile:not(.connect-local)>span:not(.brand-mark){display:none}.tools .connect-local>span:not(.brand-mark){grid-column:2}.tools .connect-tile{min-height:52px;padding:8px 10px}.tools .connect-tile .brand-mark{grid-row:auto}.tools input,.tools select{font-size:16px}.tools .card{padding:14px}}`;
+export const TOOLS_CSS = `.tools{max-width:780px;min-width:0;overflow-wrap:anywhere}.tools .card{padding:16px 18px;margin:12px 0;min-width:0}.tools .card h2{font-size:1.05rem;margin:0;color:var(--so-ink);font-weight:600}.tools .tool-heading{display:flex;align-items:center;gap:10px}.tools .tool-heading h2{flex:1;min-width:0}.tools .tool-state{font-size:.85rem;flex-shrink:0;color:var(--so-muted)}.tools .tool-state[data-ready="false"]{color:var(--so-warning)}.tools .card>p{margin:6px 0 0}.tools .card>p.tool-credential{margin-top:4px;font-size:.875rem;color:var(--so-muted)}.tools .tool-note{color:var(--so-warning)}.tools code{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word;font-size:.85rem}.tools form{display:grid;gap:10px;margin:0}.tools label{display:grid;gap:6px}.tools input,.tools select{box-sizing:border-box;width:100%;max-width:100%;min-width:0}.tools button{justify-self:start;white-space:nowrap;min-height:44px;max-width:100%;overflow:hidden;text-overflow:ellipsis}.tools details:not(.card){margin:6px 0 0;padding:0;border:0;border-radius:0;background:none;box-shadow:none}.tools details:not(.card)>summary{min-height:36px;display:flex;align-items:center;font-size:.9rem;color:var(--so-muted);cursor:pointer}.tools details:not(.card)[open]>summary{color:var(--so-ink)}.tools details.card>summary{cursor:pointer;min-height:44px;display:flex;align-items:center;font-weight:600}.tools summary{list-style:none;gap:10px}.tools summary::-webkit-details-marker{display:none}.tools summary::before{content:"";flex-shrink:0;width:6px;height:6px;margin:0 2px;border-right:1.5px solid currentColor;border-bottom:1.5px solid currentColor;transform:rotate(-45deg);transition:transform .15s}.tools details[open]>summary::before{transform:rotate(45deg)}.tools details:not(.card) form{padding:4px 0 10px}.tools .tool-facts{margin:0 0 8px;display:grid;gap:4px;font-size:.9rem}.tools .tool-facts p{margin:0}.tools .tool-controls{display:flex;gap:12px;flex-wrap:wrap;margin-top:12px}.tools .tool-found{display:flex;gap:10px;align-items:flex-start}.tools .tool-found input{flex:0 0 auto;width:18px;height:18px;margin-top:3px}.tools .tool-found span{min-width:0}.tools .problem{padding:10px 12px;margin:8px 0 0}.tools .tool-connect{scroll-margin-top:72px}.tools .connect-wanted{background:var(--so-accent);color:var(--so-on-accent);border-color:var(--so-accent)}.tools .connect-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(210px,1fr));gap:8px}.tools .connect-tile{display:grid;grid-template-columns:auto 1fr;column-gap:10px;align-items:center;justify-self:stretch;text-align:left;white-space:normal;padding:10px 12px;border:1px solid var(--so-line);border-radius:10px;background:var(--so-paper);color:var(--so-ink);min-height:60px;font:inherit;cursor:pointer;scroll-margin-top:96px}.tools .connect-tile:hover{border-color:var(--so-input-line);background:var(--so-raised)}.tools .connect-tile:target,.tools .connect-tile:focus-visible{outline:2px solid var(--so-accent);outline-offset:2px}.tools .connect-tile .brand-mark{grid-row:span 2}.tools .connect-tile strong{font-weight:600;line-height:1.3}.tools .connect-tile>span:not(.brand-mark){font-size:.8rem;color:var(--so-muted);line-height:1.35;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}.tools .connect-tile[data-state="connected"]>span:not(.brand-mark){color:var(--so-success)}.tools .connect-local{grid-column:1/-1}.tools .connect-local>span:not(.brand-mark){-webkit-line-clamp:unset}.tools .connect-problem{margin:0}.tools .connect-problem:focus{outline:2px solid var(--so-accent);outline-offset:2px}.tools .connect-tile:disabled{cursor:default;opacity:.6}${TILE_PHONE}{.tools .connect-grid{grid-template-columns:1fr 1fr}.tools .connect-tile:not(.connect-local)>span:not(.brand-mark){display:none}.tools .connect-local>span:not(.brand-mark){grid-column:2}.tools .connect-tile{min-height:52px;padding:8px 10px}.tools .connect-tile .brand-mark{grid-row:auto}.tools input,.tools select{font-size:16px}.tools .card{padding:14px}}`;
 /** The project chooser: it opens the chosen project at once; without scripts, its button does. */
 export function toolsProjectPicker(projects, chosen, keep = {}) {
     if (projects.length < 2)
@@ -18,19 +19,23 @@ const password = html `<label>Your Toolroll password<input type="password" name=
 function toolCard(one, base, manage, project, research = null) {
     const { tool, secretsSet } = one;
     const standing = toolStanding(tool, secretsSet);
-    // One line per secret: the disclosure is both where it stands and where it is set.
-    const secrets = manage ? tool.spec.secrets.map(secret => {
+    // How its runs get credentials, in one line; what that means is in Details.
+    const mode = credentialModeOf(tool.spec, secretsSet);
+    const credential = mode === null ? "" : html `<p class="tool-credential" data-credential="${mode.mode}">${mode.words}</p>`;
+    // One line per secret: the disclosure is both where it stands and where it is set. A service connected by signing
+    // in gets its tokens only by signing in again (its Connect tile): no token of it is ever pasted here.
+    const secrets = manage && !signedIn(tool.spec) ? tool.spec.secrets.map(secret => {
         const set = secretsSet.includes(secret.name);
         return html `<details><summary>${set ? `Replace ${secret.name}` : `Set ${secret.name}${secret.optional ? " (optional)" : ""}`}</summary>${postForm("/settings/tools/change", html `<label>${secret.name}<input type="password" name="value" autocomplete="off" required></label>${password}<button>Save</button>`, { hidden: { ...base, action: "secret", name: tool.name, secret: secret.name } })}</details>`;
     }) : "";
     const tested = tool.lastTest?.ok ? html `<p>Tested ${tool.lastTest.at.slice(0, 16).replace("T", " ")} UTC: ${tool.lastTest.tools.join(", ") || "it lists no tools"}</p>` : "";
-    const details = html `<details><summary>Details</summary><div class="tool-facts"><p>Starts: <code>${toolCommandLine(tool.spec)}</code></p><p>From ${tool.source} · added by ${tool.createdBy}</p>${tested}</div></details>`;
+    const details = html `<details><summary>Details</summary><div class="tool-facts">${mode?.detail == null ? "" : html `<p>${mode.detail}</p>`}<p>Starts: <code>${toolCommandLine(tool.spec)}</code></p><p>From ${tool.source} · added by ${tool.createdBy}</p>${tested}</div></details>`;
     const failed = tool.lastTest !== null && !tool.lastTest.ok ? html `<p class="problem" role="status">${tool.lastTest.problem ?? "The last test failed."}</p>` : "";
     // Connected, but research can't use it (its grant writes): said once, with the one way to fix it.
     const reconnect = research === null || !manage ? "" : html `<details><summary>Reconnect read-only</summary>${postForm("/settings/tools/connect", html `${password}<button>Reconnect read-only</button>`, { hidden: { ...base, service: tool.name, access: "read" } })}</details>`;
     const limited = research === null ? "" : html `<p class="tool-note" role="status">${research}</p>${reconnect}`;
     const controls = manage ? html `<div class="tool-controls">${postForm("/settings/tools/change", html `<button aria-label="Test ${tool.name} in ${project}">Test</button>`, { hidden: { ...base, action: "test", name: tool.name } })}${postForm("/settings/tools/change", html `<button class="secondary">Remove from ${project}</button>`, { hidden: { ...base, action: "remove", name: tool.name } })}</div>` : "";
-    return html `<article class="card" id="tool-${tool.name}"><div class="tool-heading">${brandMarkHtml(tool.source === "custom" ? null : tool.name, tool.name, standing.ready)}<h2>${tool.name}</h2><span class="tool-state" data-ready="${String(standing.ready)}">${standing.words}</span></div><p>${tool.spec.about}</p>${failed}${limited}${secrets}${details}${controls}</article>`;
+    return html `<article class="card" id="tool-${tool.name}"><div class="tool-heading">${brandMarkHtml(tool.source === "custom" ? null : tool.name, tool.name, standing.ready)}<h2>${tool.name}</h2><span class="tool-state" data-ready="${String(standing.ready)}">${standing.words}</span></div><p>${tool.spec.about}</p>${credential}${failed}${limited}${secrets}${details}${controls}</article>`;
 }
 /** A service connected here, offered to the person's other projects: each button signs in again for that project (tokens are never copied). */
 function elsewhere(view, base) {
@@ -44,7 +49,11 @@ export function toolsHtml(view, csrf, canManage, message = {}) {
     // `shown` is the project this page shows; the server refuses a post whose repo differs from it.
     const base = { repo: view.repo, shown: view.repo };
     const to = ` to ${view.project}`;
-    const intro = html `<p>Builds in ${view.project} use exactly these tools. MCP servers set up elsewhere on this computer aren't used.</p><details><summary>How tools work</summary><ul><li>A tool you add reaches work you approve from now on. Approve a task again to give it a new tool.</li><li>Removing a tool takes it away from every build right away.</li><li>Secrets stay on this computer, are never shown again, and go only to the tool that needs them.</li><li>Reviewers and the lead chat never get tools. Gemini builds don't use tools yet.</li></ul></details>`;
+    const keptIn = view.storage === undefined || view.storage.filesOnly ? "Secrets stay on this computer" : view.storage.words.replace(/\.$/, "");
+    // No keychain here: said once, plainly, where it can't be missed.
+    const storage = view.storage?.problem !== undefined ? html `<p class="problem tool-storage" role="alert">${view.storage.problem}</p>`
+        : view.storage?.filesOnly === true ? html `<p class="tool-storage" role="note">${view.storage.words}</p>` : "";
+    const intro = html `<p>Builds in ${view.project} use exactly these tools. MCP servers set up elsewhere on this computer aren't used.</p><details><summary>How tools work</summary><ul><li>A tool you add reaches work you approve from now on. Approve a task again to give it a new tool.</li><li>Removing a tool takes it away from every build right away.</li><li>${keptIn}, are never shown again, and go only to the tool that needs them.</li><li>Reviewers and the lead chat never get tools. Gemini builds don't use tools yet.</li></ul></details>`;
     const cards = view.tools.length === 0 ? html `<p class="meta">No tools yet. Builds in this project get none.</p>` : view.tools.map(one => toolCard(one, base, manage, view.project, view.connections.find(c => c.id === one.tool.name && c.state === "connected")?.research ?? null));
     const fromList = view.catalog.length === 0 ? "" : postForm("/settings/tools/change", html `<label>Common tools<select name="catalog">${view.catalog.map(one => html `<option value="${one.name}">${one.label}: ${one.about}</option>`)}</select></label>${password}<button>Add${to}</button>`, { hidden: { ...base, action: "add-catalog" } });
     const custom = html `<details><summary>Add your own</summary>${postForm("/settings/tools/change", html `<label>Name<input name="name" pattern="[a-z0-9][a-z0-9_\\-]{0,39}" maxlength="40" required placeholder="for example: postgres"></label><label>It runs as<select name="transport"><option value="stdio">A program on this computer</option><option value="http">A web address</option></select></label><label>Command or address<input name="target" required placeholder="npx -y some-mcp-server@1.2.3, or https://…"></label><label>Secrets it needs (names, comma separated)<input name="secrets" placeholder="for example: DATABASE_URL"></label><p class="meta">For a web address, the first secret is sent as its sign-in token. Set each secret's value after adding.</p>${password}<button>Add${to}</button>`, { hidden: { ...base, action: "add-custom" } })}</details>`;
@@ -62,5 +71,5 @@ export function toolsHtml(view, csrf, canManage, message = {}) {
     const add = manage ? html `<details class="card"${view.tools.length === 0 ? html ` open` : ""}><summary>Add a tool</summary>${fromList}${custom}</details>` : "";
     const found = manage && view.found.length > 0 ? html `<details class="card"><summary>Found on this computer (${view.found.length})</summary><p class="meta">MCP servers your other apps use. Adding one copies its settings, and any secrets it has, into this project.</p>${postForm("/settings/tools/change", html `${view.found.map(one => html `<label class="tool-found"><input type="checkbox" name="import" value="${one.spec.name}"><span><strong>${one.spec.name}</strong> · ${one.source}<br><code>${toolCommandLine(one.spec)}</code>${one.spec.secrets.length === 0 ? "" : html `<br><span class="meta">Brings ${one.spec.secrets.map(s => s.name).join(", ")}</span>`}</span></label>`)}${password}<button>Add selected${to}</button>`, { hidden: { ...base, action: "import" } })}</details>` : "";
     const note = atButton ? "" : message.problem ? html `<p class="problem" role="alert">${message.problem}</p>` : message.said ? html `<p role="status">${message.said}</p>` : "";
-    return html `<section class="tools">${note}${intro}${cards}${connect}${add}${found}</section>`;
+    return html `<section class="tools">${note}${intro}${storage}${cards}${connect}${add}${found}</section>`;
 }

package/dist/work-index.js

@@ -5,7 +5,7 @@ import { leadNameOf } from './lead-identity.js';
 import { createHash } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
-import { readProjectAccess } from './project-access.js';
+import { accountReachesSql, readProjectAccess } from './project-access.js';
 import { pauseOnTaskProviders, providerName, signInReason } from './provider-auth.js';
 import { scopeTermsProblem, stopFactOf } from './store.js';
 import { assignmentChecksForRun } from './assignment.js';
@@ -19,6 +19,7 @@ import { withFollowUps } from './result-follow-ups.js';
 import { LANDED_ACTOR, landedReasonOf } from './result-completion.js';
 import { ASKS, NEED_ASK, NEEDS, askChipOf, failedAttemptSentence, processNeedOf, resultHoldUpSentence } from './needs-you.js';
 import { LEAD_CLAIM_SQL, LEAD_IDLE_MS } from './lead-voice.js';
+import { grantStandsSql } from './flow-unattended.js';
 export const WORK_INDEX_PAGE_LIMIT = 40;
 export const WORK_INDEX_MAX_LIMIT = 100;
 const EMPTY = { all: 0, 'needs-you': 0, running: 0, completed: 0 };
@@ -134,9 +135,10 @@ const PROJECTION = `WITH RECURSIVE admitted AS MATERIALIZED (
       UNION ALL SELECT json_extract(leg.value,'$.provider') FROM json_each(CASE WHEN json_valid(sc.approved_route_json) THEN sc.approved_route_json ELSE '{}' END,'$.legs') leg
         WHERE json_extract(leg.value,'$.phase')='build'))) signed_out,
     (sc.approved_at IS NOT NULL AND sc.approved_by IS NOT NULL AND sc.approved_digest=sc.digest) approved,
-    (sc.approval_basis IS NOT 'mode' OR EXISTS(SELECT 1 FROM operating_mode om JOIN approver signer ON signer.name=om.signed_by
+    ((sc.approval_basis IS NOT 'mode' AND sc.approval_basis IS NOT 'grant') OR (sc.approval_basis='mode' AND EXISTS(SELECT 1 FROM operating_mode om JOIN approver signer ON signer.name=om.signed_by
       WHERE om.repo=c.repo AND om.digest=sc.mode_digest AND om.revoked_at IS NULL AND om.absolute_expiry>$now
-      AND signer.role='approver' AND signer.revoked_at IS NULL)) dispatch_approval,
+      AND signer.role='approver' AND signer.revoked_at IS NULL AND ${accountReachesSql("signer", "c.repo")}))
+      OR (sc.approval_basis='grant' AND ${grantStandsSql("sc.mode_digest", "$now", "c.repo")})) dispatch_approval,
     CASE WHEN sc.task_id IS NULL THEN 0 ELSE so_work_scope_valid(json_object(
       'touches',sc.touches,'acceptance_json',sc.acceptance_json,'budget_microusd',sc.budget_microusd,
       'goal',CASE WHEN typeof(sc.goal)='text' THEN '' ELSE sc.goal END,

package/dist/worktree.d.ts

@@ -24,6 +24,7 @@
  */
 import { type ExecResult, type RunOptions } from "./exec.js";
 import type { Store, WorktreeRow } from "./store.js";
+import { type Git } from "./teardown-git.js";
 export type Runner = (file: string, args: readonly string[], options?: RunOptions) => Promise<ExecResult>;
 export type PoolOptions = {
     /** Where worktrees are created. Outside the repo, and outside any sync root. */
@@ -123,6 +124,8 @@ export declare const WORKTREE_TIMEOUT_MS = 60000;
  * the pool root through its own slashes.
  */
 export declare function worktreePath(root: string, repo: string, branch: string): string;
+/** The pool root a checkout at `path` of `repo` was made under (worktreePath's layout), or null for one it didn't make. */
+export declare function poolRootOf(path: string, repo: string): string | null;
 /** Record a potentially writing subprocess against the original checkout lease. */
 export declare function recordWorktreeProcess(store: Store, path: string, runner: string, pid: number, leaseEpoch?: string | null): void;
 /** Read-only occupancy witness shared with stop settlement. */
@@ -281,17 +284,18 @@ export declare class WorktreePool {
     /**
      * Whether a let-go checkout could go without losing anything: clean (build output that .gitignore hides is not
      * work, and neither are the files Toolroll itself wrote in there), and everything its HEAD reaches on a branch, tag
-     * or remote. Reads only.
+     * or remote. Reads only, through `git` when given (teardown's hardened git).
      */
-    inspect(path: string): Promise<"clean" | KeptWhy>;
+    inspect(path: string, git?: Git): Promise<"clean" | KeptWhy>;
     /**
      * Keep storage in check: remove the working copies nobody needs any more. Of `rows`, a checkout goes when it is
      * let go, nothing holds it, `wanted` says it may go (asked again right before it goes, so a task coming back or a
      * lease since keeps it) and `inspect` finds it clean, then clean still right before it goes (git refuses an edit
      * made after that). Only the working copy goes: its branch, and so every commit,
-     * stays, and a later lease of the same branch makes a new one. At most `max` go per pass.
+     * stays, and a later lease of the same branch makes a new one. At most `max` go per pass. Every git command goes
+     * through `git` when given: landed cleanup passes its hardened teardown git (teardown-git.ts).
      */
-    prune(rows: readonly WorktreeRow[], wanted: (row: WorktreeRow, fresh: boolean) => boolean | Promise<boolean>, max?: number): Promise<{
+    prune(rows: readonly WorktreeRow[], wanted: (row: WorktreeRow, fresh: boolean) => boolean | Promise<boolean>, max?: number, git?: Git): Promise<{
         removed: WorktreeRow[];
         kept: {
             path: string;
@@ -342,5 +346,7 @@ export declare class WorktreePool {
      * hides is not work, but a file somebody dropped in and never staged is.
      */
     private isDirty;
+    /** All disposal and inspection paths share the hardened teardown boundary. */
+    private readonly teardown;
     private git;
 }

package/dist/worktree.js

@@ -23,15 +23,16 @@
  * over `.git` internals corrupts both.
  */
 import { createHash, randomBytes } from "node:crypto";
-import { existsSync, readFileSync, writeFileSync, rmSync, realpathSync, mkdirSync, readdirSync, renameSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync, writeFileSync, rmSync, realpathSync, mkdirSync, readdirSync, renameSync } from "node:fs";
 import { hostname } from "node:os";
-import { dirname, join } from "node:path";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { run } from "./exec.js";
 import { currentBootId, provenDeadByBootChange } from "./boot-identity.js";
 import { HANDOFF_PREFIX, MAILBOX_SUFFIX, looksLikeProtocolFile, readMailbox } from "./evidence.js";
 import { parseHandoff } from "./decision.js";
 import { diskBytes } from "./storage.js";
 import { markNeverIndex } from "./never-index.js";
+import { teardownGit } from "./teardown-git.js";
 /**
  * The note a lease leaves in the checkout, naming the process holding it.
  *
@@ -129,6 +130,31 @@ export function worktreePath(root, repo, branch) {
         .slice(0, 8);
     return join(root, safeSegment(basenameOf(repo)), `${safeSegment(branch)}-${digest}`);
 }
+/** The pool root a checkout at `path` of `repo` was made under (worktreePath's layout), or null for one it didn't make. */
+export function poolRootOf(path, repo) {
+    const project = dirname(path);
+    return basename(project) === safeSegment(basenameOf(repo)) && /-[0-9a-f]{8}$/.test(basename(path)) ? dirname(project) : null;
+}
+/** Inspect names, not their destinations, before the plane writes into a pool. */
+function safePoolPath(root, target) {
+    const base = resolve(root);
+    const rel = relative(base, resolve(target));
+    if (rel.startsWith("..") || rel.startsWith(sep))
+        return false;
+    let path = base;
+    for (const component of ["", ...rel.split(sep)]) {
+        path = join(path, component);
+        try {
+            if (!lstatSync(path).isDirectory())
+                return false;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                return false;
+        }
+    }
+    return true;
+}
 function normalisePath(path) {
     return path.replace(/\\/g, "/").replace(/\/+$/, "");
 }
@@ -210,20 +236,21 @@ export function worktreeProcessOccupancy(path) {
  * reset or clean a tree saves this first.
  */
 export async function saveWorkPatch(runner, path, file, header) {
-    const status = await runner(GIT, [...READ_ONLY, "status", "--porcelain", "--untracked-files=all"], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+    const git = teardownGit(runner);
+    const status = await git(path, [...READ_ONLY, "status", "--porcelain", "--untracked-files=all", "--ignore-submodules=all"]);
     if (status.code !== 0)
         return { ok: false, message: `${path} could not be inspected before its work was saved` };
     const untracked = status.stdout
         .split("\n")
         .filter(line => line.startsWith("?? ") && !line.trimEnd().endsWith(MARKER))
         .map(line => line.slice(3).trim());
-    const tracked = await runner(GIT, [...READ_ONLY, "diff", "--binary", "HEAD"], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+    const tracked = await git(path, [...READ_ONLY, "diff", "--binary", "--ignore-submodules=all", "HEAD"]);
     if (tracked.code !== 0)
         return { ok: false, message: `${path}: git diff failed while saving its work (${firstLine(tracked.stderr)})` };
     const parts = [tracked.stdout];
     for (const one of untracked) {
         // --no-index exits 1 when the sides differ; that is the expected answer.
-        const diff = await runner(GIT, [...READ_ONLY, "diff", "--binary", "--no-index", "--", "/dev/null", one], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+        const diff = await git(path, [...READ_ONLY, "diff", "--binary", "--no-index", "--ignore-submodules=all", "--", "/dev/null", one]);
         if (diff.code > 1)
             return { ok: false, message: `${path}: ${one} could not be captured (${firstLine(diff.stderr)})` };
         parts.push(diff.stdout);
@@ -304,6 +331,8 @@ export class WorktreePool {
     }
     async lease(request) {
         const target = worktreePath(this.options.root, request.repo, request.branch);
+        if (!safePoolPath(this.options.root, target))
+            return { ok: false, reason: "git", message: "The checkout pool contains a symlink or an unreadable folder." };
         if (busy.has(target))
             return { ok: false, reason: "in-use", message: `${target} is busy; try again in a moment` };
         const release = reserveCheckout(this.store, target);
@@ -331,6 +360,9 @@ export class WorktreePool {
             };
         }
         const path = worktreePath(this.options.root, request.repo, request.branch);
+        const unsafe = () => ({ ok: false, reason: "git", message: "The checkout pool contains a symlink or an unreadable folder." });
+        if (!safePoolPath(this.options.root, path))
+            return unsafe();
         const existing = this.store.getWorktree(path);
         // The machine outranks the database here. A row can say "released" while a
         // process that never got to write its own ending is still working in the
@@ -408,10 +440,14 @@ export class WorktreePool {
             const fromBase = request.base !== undefined && !branchExists;
             // Spotlight leaves the checkouts alone: the marker sits in the pool and the project's folder, never inside a
             // checkout, where a build's `git add -A` would commit it (never-index.ts).
+            if (!safePoolPath(this.options.root, path))
+                return unsafe();
             try {
                 mkdirSync(dirname(path), { recursive: true });
             }
-            catch { /* git reports it */ }
+            catch {
+                return unsafe();
+            }
             markNeverIndex(this.options.root);
             markNeverIndex(dirname(path));
             // A new branch is created first, on its own, so its reflog's first entry says Toolroll made it and when.
@@ -426,10 +462,12 @@ export class WorktreePool {
                     return { ok: false, reason: "git", message: firstLine(branch.stderr) };
                 made = oid;
             }
+            if (!safePoolPath(this.options.root, path))
+                return unsafe();
             const add = await this.git(request.repo, ["worktree", "add", path, request.branch]);
             if (add.code !== 0) {
                 if (made !== null)
-                    await this.git(request.repo, ["update-ref", "-d", `refs/heads/${request.branch}`, made]);
+                    await this.teardown(request.repo, ["update-ref", "-d", `refs/heads/${request.branch}`, made]);
                 return { ok: false, reason: "git", message: firstLine(add.stderr) };
             }
         }
@@ -592,10 +630,10 @@ export class WorktreePool {
     }
     /** Back to HEAD, untracked gone, our lease note kept; proven clean after. */
     async resetTree(path) {
-        const checkout = await this.runner(GIT, ["checkout", "--", "."], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+        const checkout = await this.teardown(path, ["checkout", "--", "."]);
         if (checkout.code !== 0)
             return { ok: false, message: `${path}: git checkout failed while resetting (${firstLine(checkout.stderr)})` };
-        const clean = await this.runner(GIT, ["clean", "-fd", "-e", MARKER], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+        const clean = await this.teardown(path, ["clean", "-fd", "-e", MARKER]);
         if (clean.code !== 0)
             return { ok: false, message: `${path}: git clean failed while resetting (${firstLine(clean.stderr)})` };
         const dirty = await this.isDirty(path);
@@ -683,17 +721,17 @@ export class WorktreePool {
         const occupied = this.inUse(path);
         if (occupied.held)
             return { ok: false, message: `${path} is being used by process ${occupied.by} — leaving it alone` };
-        const removed = await this.git(existing.repo, ["worktree", "remove", "--force", path]);
+        const removed = await this.teardown(existing.repo, ["worktree", "remove", "--force", path]);
         if (removed.code !== 0)
             return { ok: false, message: `git worktree remove: ${removed.stderr.trim() || `exit ${removed.code}`}` };
         // The branch is disposable too; a failure here is bookkeeping, not custody.
-        await this.git(existing.repo, ["branch", "-D", existing.branch]);
+        await this.teardown(existing.repo, ["branch", "-D", existing.branch]);
         this.store.forgetWorktree(path);
         void now;
         return { ok: true };
     }
     async orphans(repo) {
-        const listed = await this.git(repo, ["worktree", "list", "--porcelain"], READ_ONLY);
+        const listed = await this.teardown(repo, ["worktree", "list", "--porcelain"]);
         // A listing that failed is not a listing that came back empty. Treating
         // it as empty would report every stored row as missing — and anything
         // acting on that answer would erase real bookkeeping over a git hiccup.
@@ -790,14 +828,14 @@ export class WorktreePool {
     /**
      * Whether a let-go checkout could go without losing anything: clean (build output that .gitignore hides is not
      * work, and neither are the files Toolroll itself wrote in there), and everything its HEAD reaches on a branch, tag
-     * or remote. Reads only.
+     * or remote. Reads only, through `git` when given (teardown's hardened git).
      */
-    async inspect(path) {
-        const dirty = await this.isDirty(path, true);
+    async inspect(path, git = this.teardown) {
+        const dirty = await this.isDirty(path, true, git);
         if (dirty !== false)
             return dirty === null ? "unreadable" : "has changes";
         // Commits only this checkout's HEAD reaches (a detached HEAD moved on) exist nowhere else.
-        const own = await this.runner(GIT, [...READ_ONLY, "rev-list", "-1", "HEAD", "--not", "--branches", "--tags", "--remotes"], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+        const own = await git(path, [...READ_ONLY, "rev-list", "-1", "HEAD", "--not", "--branches", "--tags", "--remotes"]);
         if (own.code !== 0)
             return "unreadable";
         return own.stdout.trim() === "" ? "clean" : "has commits";
@@ -807,9 +845,10 @@ export class WorktreePool {
      * let go, nothing holds it, `wanted` says it may go (asked again right before it goes, so a task coming back or a
      * lease since keeps it) and `inspect` finds it clean, then clean still right before it goes (git refuses an edit
      * made after that). Only the working copy goes: its branch, and so every commit,
-     * stays, and a later lease of the same branch makes a new one. At most `max` go per pass.
+     * stays, and a later lease of the same branch makes a new one. At most `max` go per pass. Every git command goes
+     * through `git` when given: landed cleanup passes its hardened teardown git (teardown-git.ts).
      */
-    async prune(rows, wanted, max = Infinity) {
+    async prune(rows, wanted, max = Infinity, git = this.teardown) {
         const removed = [];
         const kept = [];
         const idle = (row, releasedAt) => row !== null && row.runner === null && row.releasedAt === releasedAt && !this.inUse(row.path).held;
@@ -823,7 +862,7 @@ export class WorktreePool {
                 continue;
             if (!existsSync(row.path) || !idle(row, row.releasedAt))
                 continue;
-            const found = await this.inspect(row.path);
+            const found = await this.inspect(row.path, git);
             if (found !== "clean") {
                 kept.push({ path: row.path, why: found });
                 continue;
@@ -843,7 +882,7 @@ export class WorktreePool {
                 const allowed = wanted(now, true);
                 if (!(typeof allowed === "boolean" ? allowed : await allowed))
                     continue;
-                const gone = await this.removeCleanCopy(row);
+                const gone = await this.removeCleanCopy(row, git);
                 if (gone !== "removed") {
                     kept.push({ path: row.path, why: gone });
                     continue;
@@ -867,7 +906,7 @@ export class WorktreePool {
         const idle = (now) => now !== null && now.runner === null && now.releasedAt !== null && now.releasedAt === row.releasedAt && !this.inUse(row.path).held;
         if (busy.has(row.path) || !existsSync(row.path) || !idle(this.store.getWorktree(row.path)))
             return { ok: false, message: `${row.path} is in use` };
-        const listed = await this.runner(GIT, [...READ_ONLY, "ls-files", "--others", "--ignored", "--exclude-standard", "--directory", "-z"], { cwd: row.path, timeoutMs: WORKTREE_TIMEOUT_MS });
+        const listed = await this.teardown(row.path, [...READ_ONLY, "ls-files", "--others", "--ignored", "--exclude-standard", "--directory", "-z"]);
         if (listed.code !== 0)
             return { ok: false, message: `git couldn't list ${row.path}` };
         const drop = listed.stdout.split("\0").filter(one => one.endsWith("/")).map(one => one.slice(0, -1))
@@ -949,7 +988,7 @@ export class WorktreePool {
         catch {
             return false;
         }
-        const gone = await this.git(row.repo, ["worktree", "remove", "--force", row.path]);
+        const gone = await this.teardown(row.repo, ["worktree", "remove", "--force", row.path]);
         if (gone.code !== 0) {
             rmSync(note, { force: true });
             return false;
@@ -963,11 +1002,11 @@ export class WorktreePool {
      * removed without --force, so git itself refuses an edit made since. Only Toolroll's own files go first, because
      * git's check would count them.
      */
-    async removeCleanCopy(row) {
-        const found = await this.inspect(row.path);
+    async removeCleanCopy(row, git) {
+        const found = await this.inspect(row.path, git);
         if (found !== "clean")
             return found;
-        const status = await this.runner(GIT, [...READ_ONLY, "status", "--porcelain", "--untracked-files=all"], { cwd: row.path, timeoutMs: WORKTREE_TIMEOUT_MS });
+        const status = await git(row.path, [...READ_ONLY, "status", "--porcelain", "--untracked-files=all", "--ignore-submodules=all"]);
         if (status.code !== 0)
             return "unreadable";
         for (const line of status.stdout.split("\n")) {
@@ -975,9 +1014,9 @@ export class WorktreePool {
             if (name === MARKER || (name !== "" && looksLikeProtocolFile(name)))
                 rmSync(join(row.path, name), { recursive: true, force: true });
         }
-        const gone = await this.git(row.repo, ["worktree", "remove", row.path]);
+        const gone = await git(row.repo, ["worktree", "remove", row.path]);
         if (gone.code !== 0)
-            return (await this.isDirty(row.path)) === false ? "git refused" : "has changes";
+            return (await this.isDirty(row.path, false, git)) === false ? "git refused" : "has changes";
         this.forgetRemoved(row);
         return "removed";
     }
@@ -995,8 +1034,8 @@ export class WorktreePool {
      * `--untracked-files=all` and no `--ignored`: build output that .gitignore
      * hides is not work, but a file somebody dropped in and never staged is.
      */
-    async isDirty(path, ignoreOwnFiles = false) {
-        const status = await this.runner(GIT, [...READ_ONLY, "status", "--porcelain", "--untracked-files=all"], { cwd: path, timeoutMs: WORKTREE_TIMEOUT_MS });
+    async isDirty(path, ignoreOwnFiles = false, git = this.teardown) {
+        const status = await git(path, [...READ_ONLY, "status", "--porcelain", "--untracked-files=all", "--ignore-submodules=all"]);
         if (status.code !== 0)
             return null;
         // Our own lease note is not the operator's work. Without this the marker
@@ -1010,6 +1049,8 @@ export class WorktreePool {
             .filter(line => line.trim() !== "")
             .some(line => !line.trimEnd().endsWith(MARKER) && !(ignoreOwnFiles && line.startsWith("?? ") && looksLikeProtocolFile(line.slice(3).trim())));
     }
+    /** All disposal and inspection paths share the hardened teardown boundary. */
+    teardown = (cwd, args) => teardownGit(this.runner)(cwd, args);
     git(cwd, args, prefix = []) {
         return this.runner(GIT, [...prefix, ...args], { cwd, timeoutMs: WORKTREE_TIMEOUT_MS });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.62",
+  "version": "0.9.63",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"
@@ -8,6 +8,8 @@
   "scripts": {
     "build": "tsc -p tsconfig.build.json && node scripts/browser-build.mjs && node scripts/postbuild.mjs",
     "test": "vitest run",
+    "test:attacks": "vitest run --config test/attacks/vitest.config.ts",
+    "check:quick": "node scripts/quick-check.mjs",
     "dev": "tsx src/cli.ts",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.browser.json",
     "certify:provider": "npm run build && node scripts/provider-canary.mjs",