toolroll 0.9.62 → 0.9.65

package/dist/provider-auth.d.ts

@@ -14,16 +14,17 @@
  */
 import type { Store } from "./store.js";
 import { type ProviderId } from "./provider.js";
+import type { AuthMode } from "./keys.js";
 /** Every sign-in message's dedupe key starts here: `signin:<kind>:<provider>:<ordinal>:<person>`.
  * Not a lifecycle (`life:`) key: those are progress chatter, and an undelivered
  * one stays out of the attention list — this one needs a person. */
 export declare const SIGN_IN_KEY_PREFIX = "signin:";
-export declare const PROVIDER_AUTH_SCHEMA = "\nCREATE TABLE IF NOT EXISTS provider_auth_pause (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  provider    TEXT NOT NULL,\n  ordinal     INTEGER NOT NULL,\n  auth_mode   TEXT NOT NULL DEFAULT 'subscription' CHECK (auth_mode IN ('subscription', 'api-key')),\n  opened_at   TEXT NOT NULL,\n  first_run   INTEGER,\n  task_ref    INTEGER,\n  runs        INTEGER NOT NULL DEFAULT 1,\n  -- 1 once a sign-in probe during this pause said the provider is signed out:\n  -- only a probe that then sees it signed in again may lift the pause.\n  probe_saw_out INTEGER NOT NULL DEFAULT 0,\n  lifted_at   TEXT,\n  lifted_by   TEXT,\n  lifted_how  TEXT CHECK (lifted_how IS NULL OR lifted_how IN ('run', 'probe', 'person')),\n  resumed     INTEGER,\n  -- The last task let through as a trial while paused: a sign-in check can\n  -- say \"logged in\" for a session that no longer works, so a real run decides.\n  last_trial_at TEXT,\n  UNIQUE (provider, ordinal)\n);\nCREATE UNIQUE INDEX IF NOT EXISTS provider_auth_pause_open ON provider_auth_pause (provider) WHERE lifted_at IS NULL;\n";
+export declare const PROVIDER_AUTH_SCHEMA = "\nCREATE TABLE IF NOT EXISTS provider_auth_pause (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  provider    TEXT NOT NULL,\n  ordinal     INTEGER NOT NULL,\n  auth_mode   TEXT NOT NULL DEFAULT 'subscription' CHECK (auth_mode IN ('subscription', 'api-key', 'agent-login')),\n  opened_at   TEXT NOT NULL,\n  first_run   INTEGER,\n  task_ref    INTEGER,\n  runs        INTEGER NOT NULL DEFAULT 1,\n  -- 1 once a sign-in probe during this pause said the provider is signed out:\n  -- only a probe that then sees it signed in again may lift the pause.\n  probe_saw_out INTEGER NOT NULL DEFAULT 0,\n  lifted_at   TEXT,\n  lifted_by   TEXT,\n  lifted_how  TEXT CHECK (lifted_how IS NULL OR lifted_how IN ('run', 'probe', 'person')),\n  resumed     INTEGER,\n  -- The last task let through as a trial while paused: a sign-in check can\n  -- say \"logged in\" for a session that no longer works, so a real run decides.\n  last_trial_at TEXT,\n  UNIQUE (provider, ordinal)\n);\nCREATE UNIQUE INDEX IF NOT EXISTS provider_auth_pause_open ON provider_auth_pause (provider) WHERE lifted_at IS NULL;\n";
 export type AuthPause = {
     id: number;
     provider: ProviderId;
     ordinal: number;
-    authMode: "subscription" | "api-key";
+    authMode: AuthMode;
     openedAt: string;
     firstRun: number | null;
     taskRef: number | null;
@@ -63,7 +64,7 @@ export declare function openAuthPauses(store: Store): AuthPause[];
  */
 export declare function pauseForAuth(store: Store, args: {
     provider: string;
-    authMode: "subscription" | "api-key" | null;
+    authMode: AuthMode | null;
     runId: number;
     taskRef: number;
     now: Date;

package/dist/provider-auth.js

@@ -1,4 +1,5 @@
 import { PROVIDER_IDS } from "./provider.js";
+import { withAcp } from "./acp-agents.js";
 /** Every sign-in message's dedupe key starts here: `signin:<kind>:<provider>:<ordinal>:<person>`.
  * Not a lifecycle (`life:`) key: those are progress chatter, and an undelivered
  * one stays out of the attention list — this one needs a person. */
@@ -8,7 +9,7 @@ CREATE TABLE IF NOT EXISTS provider_auth_pause (
   id          INTEGER PRIMARY KEY AUTOINCREMENT,
   provider    TEXT NOT NULL,
   ordinal     INTEGER NOT NULL,
-  auth_mode   TEXT NOT NULL DEFAULT 'subscription' CHECK (auth_mode IN ('subscription', 'api-key')),
+  auth_mode   TEXT NOT NULL DEFAULT 'subscription' CHECK (auth_mode IN ('subscription', 'api-key', 'agent-login')),
   opened_at   TEXT NOT NULL,
   first_run   INTEGER,
   task_ref    INTEGER,
@@ -27,8 +28,8 @@ CREATE TABLE IF NOT EXISTS provider_auth_pause (
 );
 CREATE UNIQUE INDEX IF NOT EXISTS provider_auth_pause_open ON provider_auth_pause (provider) WHERE lifted_at IS NULL;
 `;
-const NAMES = { claude: "Claude", codex: "Codex", openrouter: "OpenRouter", gemini: "Gemini" };
-const SIGN_IN = { claude: "claude /login", codex: "codex login", gemini: "gemini", openrouter: "toolroll keys set openrouter" };
+const NAMES = withAcp({ claude: "Claude", codex: "Codex", openrouter: "OpenRouter", gemini: "Gemini" }, agent => agent.name);
+const SIGN_IN = withAcp({ claude: "claude /login", codex: "codex login", gemini: "gemini", openrouter: "toolroll keys set openrouter" }, agent => agent.signIn);
 export function providerName(provider) {
     return PROVIDER_IDS.includes(provider) ? NAMES[provider] : provider;
 }
@@ -57,7 +58,7 @@ function readPause(row) {
         id: Number(row["id"]),
         provider: String(row["provider"]),
         ordinal: Number(row["ordinal"]),
-        authMode: row["auth_mode"] === "api-key" ? "api-key" : "subscription",
+        authMode: row["auth_mode"] === "api-key" ? "api-key" : row["auth_mode"] === "agent-login" ? "agent-login" : "subscription",
         openedAt: String(row["opened_at"]),
         firstRun: row["first_run"] == null ? null : Number(row["first_run"]),
         taskRef: row["task_ref"] == null ? null : Number(row["task_ref"]),

package/dist/provider-connection.d.ts

@@ -1,5 +1,6 @@
 import { run, type ExecResult } from "./exec.js";
 import { type ProviderId } from "./provider.js";
+import { type KeyedProviderId } from "./acp-agents.js";
 import { type AuthMode, type KeyVerdict } from "./keys.js";
 export type ProviderConnection = {
     state: "connected" | "signed-out" | "not-installed" | "unverified" | "key-present" | "key-works" | "key-refused" | "missing-key";
@@ -18,5 +19,5 @@ export declare function createConnectionChecker(options?: {
     home?: string;
     clock?: () => Date;
     env?: NodeJS.ProcessEnv;
-    verify?: (provider: ProviderId, key: string) => Promise<KeyVerdict>;
+    verify?: (provider: KeyedProviderId, key: string) => Promise<KeyVerdict>;
 }): ConnectionChecker;

package/dist/provider-connection.js

@@ -2,6 +2,7 @@
 import { homedir } from "node:os";
 import { run } from "./exec.js";
 import { ALL_CREDENTIAL_ENV, inspectionOf } from "./provider.js";
+import { isAcpProvider } from "./acp-agents.js";
 import { keyStatus, PROVIDER_KEY_ENV, readAuthMode, readProviderKey, verifyProviderKey } from "./keys.js";
 export function signInFacts(provider, result, now = new Date()) {
     const base = { mode: "subscription", checkedAt: now.toISOString() };
@@ -46,6 +47,10 @@ export function createConnectionChecker(options = {}) {
     const cache = new Map();
     const pending = new Map();
     return async (provider, fresh = false) => {
+        // An ACP agent is never run to ask how it is signed in (nothing executes it outside the gateway): what is known
+        // of it is its conformance check, read elsewhere. Here it is simply unverified.
+        if (isAcpProvider(provider))
+            return { state: "unverified", mode: "agent-login", checkedAt: clock().toISOString() };
         const mode = readAuthMode(provider, home);
         const keyFacts = keyStatus(provider, home);
         const ambient = !!(options.env ?? process.env)[PROVIDER_KEY_ENV[provider]];

package/dist/provider-home.d.ts

@@ -0,0 +1,22 @@
+/** The operator's own choices a no-model build keeps. */
+export type ProviderDefaults = {
+    model?: string;
+    alwaysThinking?: boolean;
+    effort?: string;
+};
+export declare function claudeConfigDir(env?: Readonly<Record<string, string | undefined>>, home?: string): string;
+export declare function codexHomeDir(env?: Readonly<Record<string, string | undefined>>, home?: string): string;
+/** Claude's user settings: its `model` and `alwaysThinkingEnabled`, when valid. */
+export declare function claudeDefaults(configDir: string): ProviderDefaults;
+/** Codex's config.toml: its top-level `model` and `model_reasoning_effort`, or the selected profile's. */
+export declare function codexDefaults(codexHome: string): ProviderDefaults;
+/**
+ * One Codex launch's CODEX_HOME: a private folder linking the operator's
+ * sign-in and sessions. A missing `auth.json` stays missing (an API-key
+ * build needs none); a missing `sessions/` is made where Codex would make
+ * it, so a resumed build finds the thread its first launch wrote.
+ */
+export declare function isolatedCodexHome(source: string, root?: string): {
+    dir: string;
+    cleanup: () => void;
+};

package/dist/provider-home.js

@@ -0,0 +1,99 @@
+/**
+ * What a build keeps of the provider's own home, and nothing more.
+ *
+ * A build loads none of the operator's Claude settings or Codex config
+ * (provider.ts), so two things from them are carried explicitly:
+ *
+ * - A build routed with no model runs as the operator's own CLI would: the
+ *   model they chose (Claude's settings.json `model`, Codex's config.toml
+ *   `model`), Claude's `alwaysThinkingEnabled` and Codex's reasoning effort.
+ *   Nothing else of either file (hooks, plugins, MCP servers) is read.
+ * - A Codex build gets its own CODEX_HOME for the launch: links to the
+ *   operator's `auth.json` and `sessions/` (so it signs in, and a repair
+ *   resumes the same thread), and no skills, AGENTS.md or anything else from
+ *   theirs. Links, never copies: a refreshed sign-in lands in the real file.
+ *   The folder is fenced from the agent's commands and removed after the run.
+ */
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
+import { validModelId } from "./provider.js";
+const EFFORT = /^[a-z]{1,16}$/;
+export function claudeConfigDir(env = process.env, home = homedir()) {
+    return env["CLAUDE_CONFIG_DIR"] || join(home, ".claude");
+}
+export function codexHomeDir(env = process.env, home = homedir()) {
+    return env["CODEX_HOME"] || join(home, ".codex");
+}
+/** Claude's user settings: its `model` and `alwaysThinkingEnabled`, when valid. */
+export function claudeDefaults(configDir) {
+    let settings;
+    try {
+        settings = JSON.parse(readFileSync(join(configDir, "settings.json"), "utf8"));
+    }
+    catch {
+        return {};
+    }
+    if (settings === null || typeof settings !== "object" || Array.isArray(settings))
+        return {};
+    const { model, alwaysThinkingEnabled } = settings;
+    return {
+        ...(typeof model === "string" && model !== "" && validModelId(model) ? { model } : {}),
+        ...(typeof alwaysThinkingEnabled === "boolean" ? { alwaysThinking: alwaysThinkingEnabled } : {}),
+    };
+}
+/** Codex's config.toml: its top-level `model` and `model_reasoning_effort`, or the selected profile's. */
+export function codexDefaults(codexHome) {
+    let text;
+    try {
+        text = readFileSync(join(codexHome, "config.toml"), "utf8");
+    }
+    catch {
+        return {};
+    }
+    const tables = new Map([["", {}]]);
+    let table = "";
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        const header = /^\[\s*([^\]]+?)\s*\]$/.exec(line);
+        if (header !== null) {
+            table = header[1].replace(/"/g, "");
+            if (!tables.has(table))
+                tables.set(table, {});
+            continue;
+        }
+        const pair = /^([A-Za-z0-9_]+)\s*=\s*"([^"\\]*)"\s*(?:#.*)?$/.exec(line);
+        if (pair !== null)
+            tables.get(table)[pair[1]] = pair[2];
+    }
+    const top = tables.get("");
+    const profile = top["profile"] === undefined ? {} : tables.get(`profiles.${top["profile"]}`) ?? {};
+    const model = profile["model"] ?? top["model"];
+    const effort = profile["model_reasoning_effort"] ?? top["model_reasoning_effort"];
+    return {
+        ...(model !== undefined && model !== "" && validModelId(model) ? { model } : {}),
+        ...(effort !== undefined && EFFORT.test(effort) ? { effort } : {}),
+    };
+}
+/**
+ * One Codex launch's CODEX_HOME: a private folder linking the operator's
+ * sign-in and sessions. A missing `auth.json` stays missing (an API-key
+ * build needs none); a missing `sessions/` is made where Codex would make
+ * it, so a resumed build finds the thread its first launch wrote.
+ */
+export function isolatedCodexHome(source, root = tmpdir()) {
+    const dir = mkdtempSync(join(root, "so-codex-"));
+    try {
+        chmodSync(dir, 0o700);
+        if (existsSync(join(source, "auth.json")))
+            symlinkSync(join(source, "auth.json"), join(dir, "auth.json"));
+        mkdirSync(join(source, "sessions"), { recursive: true, mode: 0o700 });
+        symlinkSync(join(source, "sessions"), join(dir, "sessions"), "dir");
+    }
+    catch (error) {
+        rmSync(dir, { recursive: true, force: true });
+        throw error;
+    }
+    // rm removes the links themselves, never what they point to.
+    return { dir, cleanup: () => rmSync(dir, { recursive: true, force: true }) };
+}

package/dist/provider.d.ts

@@ -18,6 +18,7 @@
  * TOML-quoted deterministically, and the API key excluded from every
  * shell the model itself launches (Codex provider review, Q5).
  */
+import { type FenceGrants } from "./agent-fence.js";
 import { type ExecResult, type RunOptions } from "./exec.js";
 import { MODEL_ID, type AgentSpec, type ProviderId } from "./contracts/provider.js";
 export type { AgentSpec, ProviderId } from "./contracts/provider.js";
@@ -64,6 +65,17 @@ export type Invocation = {
      * Codex renders it as its own sandbox profile; Claude as deny rules for
      * its file tools (its shell is fenced by the macOS sandbox around it). */
     fence?: readonly string[];
+    /** What the fence gives back (agent-fence.ts): Codex renders read-only
+     * paths as "read", Claude's file tools never edit them. */
+    fenceGrants?: FenceGrants;
+    /** The operator's own model choices, for a build routed with no model
+     * (provider-home.ts): the model, Claude's always-on thinking and Codex's
+     * reasoning effort. Never rendered for a review or an explicit model. */
+    inherited?: {
+        model?: string;
+        alwaysThinking?: boolean;
+        effort?: string;
+    };
     /** More paths Claude's own file tools refuse, beside the fence: home
      * configuration its CLI still reads itself (so the sandbox around the
      * whole process can't deny them). */
@@ -163,6 +175,29 @@ export type ParsedEnvelope = {
      * failure terminal seen.
      */
     structuralTerminal: import("./exhaustion.js").StructuralTerminal | null;
+    /** What an ACP agent itself reported it used — kept on the run, never priced. Absent for every other dialect. */
+    agentReportedUsage?: string | null;
+    /** An ACP conversation's facts the conformance check reads (acp-client.ts AcpEnvelope): nothing else does. */
+    acp?: {
+        offered: string[];
+        exit: {
+            how: "eof" | "term" | "kill" | "self" | "error";
+            leftover: boolean;
+            timedOut: boolean;
+        } | null;
+        agent: {
+            name: string;
+            version: string;
+        } | null;
+        stop: string | null;
+        /** The conversation broke the protocol (acpParse's protocolError), or null. */
+        protocolError: string | null;
+        /** The plane's isolation probes for a check's first step (invoke.ts), when it ran them. */
+        isolation?: {
+            fileDenied: boolean;
+            envClear: boolean;
+        };
+    };
 };
 type Adapter = {
     binary: string;
@@ -199,6 +234,7 @@ export declare const OPENROUTER_ENV_KEY = "OPENROUTER_API_KEY";
  * planted user, project and local hooks and MCP servers: none loaded.
  */
 export declare const CLAUDE_BUILD_ISOLATION_ARGV: readonly string[];
+export declare function claudePluginEnv(env: Readonly<Record<string, string | undefined>>): string[];
 /** Claude's own tools that only make sense with a person to wake them. */
 export declare const HEADLESS_DISALLOWED_TOOLS: readonly string[];
 /**
@@ -221,9 +257,10 @@ export declare function isolationUnsupported(provider: ProviderId, stderr: strin
  * A Codex build's own setup, the equivalent of Claude's: the operator's
  * config.toml (its MCP servers, model choices, profiles) and execpolicy
  * rules ignored, ChatGPT apps and plugins off (plugins carry their own MCP
- * servers), and hooks off. Sign-in still comes from CODEX_HOME, which
- * `--ignore-user-config` leaves alone. The project's named tools follow as
- * `-c mcp_servers.*` (project-tools.ts).
+ * servers), and hooks off. The gateway gives each launch its own CODEX_HOME
+ * linking only the operator's sign-in and sessions (provider-home.ts), so no
+ * skills or AGENTS.md of theirs load either. The project's named tools follow
+ * as `-c mcp_servers.*` (project-tools.ts).
  */
 export declare const CODEX_BUILD_ISOLATION_ARGV: readonly string[];
 /**
@@ -252,13 +289,13 @@ export declare function adapterFor(provider: ProviderId): Adapter;
  */
 export type ProviderAudit = {
     /** How output reaches us — and therefore which signals can exist at all. */
-    transport: "buffered-json" | "streaming-jsonl";
+    transport: "buffered-json" | "streaming-jsonl" | "acp-jsonrpc";
     /** Whether a later invocation can resume this provider's session. */
     resume: "native" | "none";
     /** The event whose absence on a failed run means "never initialized".
      * CAPABILITY metadata, not a per-run observation (arc 1 finding 16):
      * whether a given run actually saw it lives in ParsedEnvelope.initObserved. */
-    initSignal: "thread.started" | "system-init" | "init-event" | "none";
+    initSignal: "thread.started" | "system-init" | "init-event" | "acp-session" | "none";
     /** How session identity is established: "announced" = read back from the
      * harness's own stream; "minted" = the PLANE chooses the id pre-spawn
      * (gemini --session-id) and the envelope must echo it (Phase 3 A5). */

package/dist/provider.js

@@ -18,13 +18,16 @@
  * TOML-quoted deterministically, and the API key excluded from every
  * shell the model itself launches (Codex provider review, Q5).
  */
+import { INTERPRETER_INJECTION_ENV } from "./acp-attest.js";
 import { claudeFenceSettings, codexFenceArgv } from "./agent-fence.js";
 import { claudeSteerHooks } from "./steer-mailbox.js";
 import {} from "./exec.js";
-import { runStreamJsonl, runClaudeStreamJsonl, runGeminiStreamJsonl, CLAUDE_COST_UNKNOWN } from "./exec.js";
+import { runStreamJsonl, runClaudeStreamJsonl, runGeminiStreamJsonl, runAcpSession, CLAUDE_COST_UNKNOWN } from "./exec.js";
 import { scanForSecrets } from "./evidence.js";
 import { FINDINGS_MODEL_SCHEMA } from "./contracts/review-findings.js";
 import { REVIEW_OUTPUT_LIMITS } from "./structured-output.js";
+import { ACP_AGENTS, isAcpProvider, withAcp } from "./acp-agents.js";
+import { acpParse } from "./acp-client.js";
 import { agentSpecSchema, MODEL_ID, modelIdSchema, PROVIDER_ID_VALUES, providerIdSchema } from "./contracts/provider.js";
 export const PROVIDER_IDS = PROVIDER_ID_VALUES;
 export function isProviderId(value) {
@@ -181,6 +184,16 @@ const CLAUDE_REVIEW_JSON_SCHEMA = {
  * planted user, project and local hooks and MCP servers: none loaded.
  */
 export const CLAUDE_BUILD_ISOLATION_ARGV = ["--setting-sources", "", "--strict-mcp-config"];
+/**
+ * Plugins also ride the environment: a plugin named in CLAUDE_CODE_PLUGIN_DIRS
+ * loads its hooks whatever `--setting-sources` says (Claude Code 2.1.290,
+ * the provider canary's plugin sentinel). A build's launch sheds every
+ * plugin variable of the environment it would inherit.
+ */
+const CLAUDE_PLUGIN_ENV = /^CLAUDE_(CODE_\w*PLUGIN|AI_PLUGINS)\w*$/;
+export function claudePluginEnv(env) {
+    return Object.keys(env).filter(name => CLAUDE_PLUGIN_ENV.test(name));
+}
 const EMPTY_MCP_CONFIG = '{"mcpServers":{}}';
 /** Claude's own tools that only make sense with a person to wake them. */
 export const HEADLESS_DISALLOWED_TOOLS = ["ScheduleWakeup", "CronCreate", "Monitor"];
@@ -203,7 +216,7 @@ const claudeArgv = (invocation) => [
         : invocation.skipPermissions
             ? ["--dangerously-skip-permissions"]
             : ["--permission-mode", invocation.permissionMode]),
-    ...(invocation.model === null ? [] : ["--model", invocation.model]),
+    ...modelArgv("--model", invocation),
     ...(invocation.maxBudgetUsd === undefined ? [] : ["--max-budget-usd", String(invocation.maxBudgetUsd)]),
     ...(invocation.phase === "review"
         ? [...CLAUDE_REVIEW_ISOLATION_ARGV, "--json-schema", JSON.stringify(CLAUDE_REVIEW_JSON_SCHEMA)]
@@ -222,12 +235,22 @@ const claudeArgv = (invocation) => [
             ...(invocation.jsonSchema === undefined ? [] : ["--json-schema", JSON.stringify(invocation.jsonSchema)])
         ]),
 ];
+/** The route's model, or for a build routed with none, the operator's own (never for a review). */
+function modelArgv(flag, invocation) {
+    const model = invocation.model ?? (invocation.phase === "review" ? undefined : invocation.inherited?.model);
+    return model === undefined ? [] : [flag, model];
+}
+/** What else a no-model build keeps of the operator's setup. */
+const inheritedFrom = (invocation) => invocation.model === null && invocation.phase !== "review" ? invocation.inherited ?? {} : {};
 /** The build's one --settings: no personal memory, plus the fence and steering doorbell. */
 function claudeSettingsArgv(invocation) {
     const denied = [...(invocation.fence ?? []), ...(invocation.fileToolFence ?? [])];
+    const readOnly = invocation.fenceGrants?.readOnly ?? [];
+    const thinking = inheritedFrom(invocation).alwaysThinking;
     return ["--settings", JSON.stringify({
             autoMemoryEnabled: false,
-            ...(denied.length > 0 ? JSON.parse(claudeFenceSettings(denied)) : {}),
+            ...(thinking === undefined ? {} : { alwaysThinkingEnabled: thinking }),
+            ...(denied.length > 0 || readOnly.length > 0 ? JSON.parse(claudeFenceSettings(denied, readOnly)) : {}),
             ...(invocation.steerFolder === undefined ? {} : { hooks: claudeSteerHooks(invocation.steerFolder.dir, invocation.steerFolder.name) }),
         })];
 }
@@ -421,9 +444,10 @@ const codexSandboxArgv = (mode, resuming) => resuming ? ["-c", `sandbox_mode="${
  * A Codex build's own setup, the equivalent of Claude's: the operator's
  * config.toml (its MCP servers, model choices, profiles) and execpolicy
  * rules ignored, ChatGPT apps and plugins off (plugins carry their own MCP
- * servers), and hooks off. Sign-in still comes from CODEX_HOME, which
- * `--ignore-user-config` leaves alone. The project's named tools follow as
- * `-c mcp_servers.*` (project-tools.ts).
+ * servers), and hooks off. The gateway gives each launch its own CODEX_HOME
+ * linking only the operator's sign-in and sessions (provider-home.ts), so no
+ * skills or AGENTS.md of theirs load either. The project's named tools follow
+ * as `-c mcp_servers.*` (project-tools.ts).
  */
 export const CODEX_BUILD_ISOLATION_ARGV = [
     "--ignore-user-config",
@@ -469,11 +493,12 @@ const codexArgv = (extra) => (invocation) => {
             // denied. Full access becomes that sandbox widened to write anywhere
             // with network, instead of no sandbox (which fenced nothing).
             : invocation.fence !== undefined && invocation.fence.length > 0
-                ? codexFenceArgv(invocation.fence, invocation.skipPermissions)
+                ? codexFenceArgv(invocation.fence, invocation.skipPermissions, invocation.fenceGrants)
                 : invocation.skipPermissions
                     ? ["--dangerously-bypass-approvals-and-sandbox"]
                     : codexSandboxArgv("workspace-write", resuming)),
-        ...(invocation.model === null ? [] : ["-m", invocation.model]),
+        ...modelArgv("-m", invocation),
+        ...(inheritedFrom(invocation).effort === undefined ? [] : ["-c", `model_reasoning_effort=${toml(inheritedFrom(invocation).effort)}`]),
         ...extra,
         // After `extra`: the tools' shell_environment_policy must be the last word (it keeps OpenRouter's key out too).
         ...(invocation.phase === "review" ? [] : invocation.toolArgv ?? []),
@@ -765,12 +790,13 @@ export function safeDiagnostic(text) {
  * provider gets its OWN keys and nobody else's: S4 (live spike) confirmed
  * what inheritance makes true by construction — an agent's shell reads its
  * process env, so a foreign key in that env is a foreign key disclosed. */
-const CREDENTIAL_ENV = {
+const CREDENTIAL_ENV = withAcp({
     claude: ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"],
     codex: ["OPENAI_API_KEY", "CODEX_API_KEY"],
     openrouter: [OPENROUTER_ENV_KEY],
     gemini: ["GEMINI_API_KEY", "GOOGLE_API_KEY"],
-};
+    // An ACP agent signs in its own way; Toolroll holds no key for it, so it sheds every key above.
+}, () => []);
 const foreignCredentialEnv = (own) => Object.entries(CREDENTIAL_ENV)
     .filter(([provider]) => provider !== own)
     .flatMap(([, keys]) => [...keys]);
@@ -778,7 +804,40 @@ const foreignCredentialEnv = (own) => Object.entries(CREDENTIAL_ENV)
  * since a feature check needs no key at all (Codex gemini verify,
  * finding 2). Agent spawns keep their own; probes keep none. */
 export const ALL_CREDENTIAL_ENV = Object.values(CREDENTIAL_ENV).flat();
-const ADAPTERS = {
+/**
+ * An ACP agent's retained record (acp-client.ts) read into the gateway's
+ * envelope. Its own usage report is never priced: tokens and cost stay null.
+ */
+function acpEnvelope(stdout) {
+    const read = acpParse(stdout);
+    return {
+        sessionId: read.sessionId,
+        protocolError: read.protocolError,
+        finalMessage: read.finalMessage,
+        tokensIn: null,
+        tokensOut: null,
+        costUsd: null,
+        usageRaw: null,
+        initObserved: read.initObserved,
+        promptConsumed: read.promptConsumed,
+        diagnostic: read.diagnostic === null ? null : safeDiagnostic(read.diagnostic),
+        structuralTerminal: read.terminal === null ? null : { failed: true, text: read.terminal.text === null ? null : safeDiagnostic(read.terminal.text), code: read.terminal.code.slice(0, 128) },
+        agentReportedUsage: read.reportedUsage,
+        acp: { offered: read.offered, exit: read.exit, agent: read.agent, stop: read.stop, protocolError: read.protocolError },
+    };
+}
+function acpAdapter(provider) {
+    return {
+        binary: ACP_AGENTS[provider].binary,
+        argv: () => [...ACP_AGENTS[provider].argv],
+        parse: acpEnvelope,
+        defaultRunner: runAcpSession,
+        // Every key Toolroll knows, and whatever would make the pinned interpreter load code beside the checked script.
+        extraOmitEnv: [...foreignCredentialEnv(provider), ...INTERPRETER_INJECTION_ENV],
+        clampTimeout: (_phase, requested) => requested,
+    };
+}
+const ADAPTERS = withAcp({
     claude: {
         binary: "claude",
         argv: claudeArgv,
@@ -830,7 +889,7 @@ const ADAPTERS = {
         extraOmitEnv: foreignCredentialEnv("gemini"),
         clampTimeout: (phase, requested) => Math.min(requested, GEMINI_TIMEOUT_CAP_MS[phase]),
     },
-};
+}, (_agent, provider) => acpAdapter(provider));
 /**
  * The spawning surface. Imported by invoke.ts and NOWHERE else — the
  * architecture test reads imports, not string literals, because provider
@@ -839,7 +898,7 @@ const ADAPTERS = {
 export function adapterFor(provider) {
     return ADAPTERS[provider];
 }
-const AUDITS = {
+const AUDITS = withAcp({
     claude: {
         transport: "streaming-jsonl",
         resume: "native",
@@ -851,6 +910,7 @@ const AUDITS = {
         isolation: { flag: CLAUDE_BUILD_ISOLATION_ARGV.filter(one => one !== "").join(" "), resumeSafe: true, enforced: true },
         configSurface: [
             "Toolroll's own --settings (the fence and steering hook)",
+            "your model and alwaysThinkingEnabled, when the route names no model",
             "the project's named tools (Settings → Tools)",
             "repository CLAUDE.md",
             "organisation-managed settings",
@@ -863,10 +923,11 @@ const AUDITS = {
         sessionIdentity: "announced",
         terminalContract: "none",
         // Builds ignore config.toml and execpolicy rules, with apps, plugins and
-        // hooks off (CODEX_BUILD_ISOLATION_ARGV); sign-in stays in CODEX_HOME.
+        // hooks off (CODEX_BUILD_ISOLATION_ARGV), in a per-launch CODEX_HOME that
+        // links only the sign-in and sessions (provider-home.ts).
         // Never --ephemeral: repair resumes sessions.
         isolation: { flag: "--ignore-user-config --ignore-rules", resumeSafe: true, enforced: true },
-        configSurface: ["the project's named tools (Settings → Tools)", "~/.codex/AGENTS.md and repository AGENTS.md", "sign-in from CODEX_HOME"],
+        configSurface: ["the project's named tools (Settings → Tools)", "repository AGENTS.md", "sign-in and sessions linked from CODEX_HOME (no skills or AGENTS.md)", "your model and reasoning effort, when the route names no model"],
     },
     openrouter: {
         transport: "streaming-jsonl",
@@ -876,7 +937,7 @@ const AUDITS = {
         terminalContract: "none",
         // Codex's build setup, with the model provider pinned by constant -c overrides.
         isolation: { flag: "--ignore-user-config --ignore-rules", resumeSafe: true, enforced: true },
-        configSurface: ["the project's named tools (Settings → Tools)", "~/.codex/AGENTS.md and repository AGENTS.md", `${OPENROUTER_ENV_KEY}`],
+        configSurface: ["the project's named tools (Settings → Tools)", "repository AGENTS.md", `${OPENROUTER_ENV_KEY}`],
     },
     gemini: {
         transport: "streaming-jsonl",
@@ -899,8 +960,17 @@ const AUDITS = {
             "trusted-folder store (S2, live at 0.57.0: headless REFUSES untrusted directories; the plane grants --skip-trust per-invocation to its own leased worktrees)",
         ],
     },
-};
-export const MONEY_CAPABILITIES = {
+}, agent => ({
+    // One ACP conversation per build: the prompt's answer is the only success (acp-client.ts), so exit 0 alone is never believed.
+    transport: "acp-jsonrpc",
+    resume: "none",
+    initSignal: "acp-session",
+    sessionIdentity: "announced",
+    terminalContract: "required",
+    isolation: { flag: agent.argv.filter(one => one.startsWith("--") && one !== "--acp").join(" ") || null, resumeSafe: null, enforced: agent.argv.some(one => one.startsWith("--") && one !== "--acp") },
+    configSurface: [...agent.configSurface],
+}));
+export const MONEY_CAPABILITIES = withAcp({
     claude: {
         incrementalUsage: true,
         nativeDollarCapFlag: "--max-budget-usd",
@@ -923,7 +993,12 @@ export const MONEY_CAPABILITIES = {
         // numbers cover that invocation only (conformance fixture j).
         usageSemantics: "per-invocation",
     },
-};
+}, () => ({
+    // ACP carries no dollars Toolroll trusts: an agent's own usage report is kept apart, unpriced.
+    incrementalUsage: false,
+    nativeDollarCapFlag: null,
+    usageSemantics: "per-invocation",
+}));
 /**
  * The fail-closed budget-flag probe (finding 24's amendment): resolve
  * the EXACT executable that will spawn, read its version, and prove the
@@ -973,6 +1048,9 @@ export function validateSpec(spec) {
     if (spec.provider === "gemini" && spec.model === null) {
         return { ok: false, problem: "model: gemini needs an explicit model — the harness default drifts with its releases" };
     }
+    if (isAcpProvider(spec.provider) && spec.model === null) {
+        return { ok: false, problem: `model: ${ACP_AGENTS[spec.provider].name} needs an explicit model — one it offered when it was checked` };
+    }
     return { ok: true };
 }
 /**

package/dist/pull-request-ui.js

@@ -1,11 +1,11 @@
 /** Settings → Projects → Pull requests: one project's pull-request setup, in plain words. Off shows what setup
  * found (or what to fix) and one Turn on; on shows where pull requests go and how they merge. Every change takes
  * the password; turning on restates the exact repository and branch that were checked. */
-import { html, postForm } from "./html.js";
+import { html, postForm, reauth } from "./html.js";
 const METHOD_WORDS = { squash: "Squash and merge", merge: "Merge commit", rebase: "Rebase and merge" };
 export function pullRequestSettingsHtml(view) {
     const post = (act, body, hidden = {}) => postForm("/settings/pull-requests", body, { attrs: { class: "card pr-settings" }, hidden: { repo: view.repo, act, ...hidden } });
-    const password = html `<label>Password<input type="password" name="password" autocomplete="current-password" required></label>`;
+    const password = html `${reauth(html `<label>Password<input type="password" name="password" autocomplete="current-password" required></label>`)}`;
     const notes = [
         view.said === null ? "" : html `<p class="notice" role="status">${view.said}</p>`,
         view.problem === null ? "" : html `<p class="problem" role="alert">${view.problem}</p>`,

package/dist/push.js

@@ -259,7 +259,7 @@ export async function pushPass(store, options) {
         // Renew and re-fence immediately before the network (finding 12).
         if (!store.renewPushClaim(pair.id, owner, pair.claimGeneration, PUSH_CLAIM_TTL_MS, clock()))
             continue;
-        const fenced = store.pushSendFence(pair.id, owner, pair.claimGeneration);
+        const fenced = store.pushSendFence(pair.id, owner, pair.claimGeneration, clock());
         if (fenced === null)
             continue; // resolved, retired, rotated, or lost — nothing to send
         const subscription = fenced.subscriptionRow;

package/dist/quick-start.d.ts

@@ -0,0 +1,24 @@
+import { type AttachSeams } from "./console-instance.js";
+export type QuickStartSeams = {
+    databaseFile: string;
+    cwd: string;
+    env: Record<string, string | undefined>;
+    build: string;
+    /** The repository's top folder for a directory, or null outside one. */
+    findRepo: (cwd: string) => Promise<string | null>;
+    /** Whether this installation already admitted the repository. */
+    enrolled: (repo: string) => Promise<boolean>;
+    /** The ordinary admission (`repos add`): its registry lock and ceilings, from this CLI's own database. */
+    admit: (repo: string) => Promise<number>;
+    /** `up`, for this repository. */
+    startUp: () => Promise<number>;
+    openBrowser: (url: string) => void | Promise<void>;
+    terminal: boolean;
+    attach?: AttachSeams;
+    /** Tests: the agent check (default: the environment and the process's ancestors). */
+    underAgent?: boolean;
+};
+/** Whether argv is a bare `toolroll` (nothing, or only --json). */
+export declare const isBareInvocation: (argv: readonly string[]) => boolean;
+/** null: not this command (outside a repository) — the caller scans as before. */
+export declare function runQuickStart(argv: readonly string[], write: (line: string) => void, seams: QuickStartSeams): Promise<number | null>;