toolroll 0.9.62 → 0.9.65

package/dist/agent-fence.js

@@ -24,13 +24,33 @@
  * A build's fence also holds its task boundary (`taskBoundary`): home
  * configuration and the repositories beside its own, so a build works in
  * its task's folders and nowhere else it could do harm.
+ *
+ * Beside what it denies, a fence grants a little back (`FenceGrants`): other
+ * tasks' git metadata is read but never written and their checkouts can be
+ * looked up, so `git gc` and `git worktree prune` see live siblings and keep
+ * them; the shared dependencies this checkout links are read and run, never
+ * written. Every plane checkout pool is denied whole, this build's own checkout given back
+ * (`CheckoutPool`), so another project's worktree is out of reach (Codex covers projects present at launch).
+ * On macOS the agent also can't read another process's arguments
+ * and environment (`kern.procargs`) or inspect a process outside its own
+ * sandbox, so a tool server's or Toolroll's own secrets don't leak through
+ * a process listing, and every other run's launch folder in the system temp
+ * folder is denied, even one made after this launch began. Nor can it get
+ * another process's task port (a debugger's way into its memory), or
+ * rename or remove a folder of the user's above a fenced path or the temp
+ * folder, which would reach the fenced path under a new name.
  */
+import { INSTANCE_DIR } from "./console-instance.js";
+import { ACP_AGENTS, ACP_PROVIDER_IDS } from "./acp-agents.js";
 import { spawnSync } from "node:child_process";
-import { existsSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
-import { homedir } from "node:os";
+import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { readMonitoring } from "./monitoring-settings.js";
 import { existingFolders } from "./names.js";
+import { DEPS_FOLDER, linkedKey, readyCopy, sharedCopies } from "./shared-deps.js";
+/** Beside the database: where Linux builds' network bridges are made (its name reads as secret wherever it is). */
+export const BRIDGE_DIR = "bridge-secrets";
 /** Names that are secrets wherever the database lives (used when its folder is shared with other things). */
 const SENSITIVE_NAME = /(^up-login\.txt$|token|secret|login|password|credential|vapid|keys?\b|\.pem$|\.key$|^backups$|^evidence$|^remote$|^sign-in\.json$|^monitoring\.json$)/i;
 function real(path) {
@@ -45,6 +65,62 @@ function inside(child, parent) {
     const rel = relative(parent, child);
     return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
 }
+export class CheckoutBindingError extends Error {
+}
+export const HARDENED_GIT_ARGS = ["--no-optional-locks", "-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null"];
+const GIT_ENV_NAMES = ["PATH", "HOME", "TMPDIR", "TMP", "TEMP", "SystemRoot", "LANG", "LC_ALL", "CODEX_HOME"];
+export function checkoutGitEnv(base = process.env) {
+    return Object.fromEntries(GIT_ENV_NAMES.flatMap(name => base[name] === undefined ? [] : [[name, base[name]]]));
+}
+export function trustedWorktreeBinding(repository, worktree, poolRoots = []) {
+    const main = real(repository);
+    const checkout = real(worktree);
+    const fail = () => new CheckoutBindingError("The checkout's Git pointer was changed or its trusted binding could not be verified.");
+    const registry = join(main, ".git", "worktrees");
+    try {
+        // The registry may legitimately contain the destination of an attacker link.
+        // Check the recorded name before accepting that destination as this run's checkout.
+        if (realpathSync(worktree) !== join(realpathSync(dirname(worktree)), basename(worktree)))
+            throw fail();
+        for (const root of poolRoots) {
+            if (root === null)
+                continue;
+            const components = [];
+            for (let component = resolve(worktree); component !== dirname(component); component = dirname(component)) {
+                components.push(component);
+                // Permit system aliases above the trusted pool (e.g. /var -> /private/var),
+                // but no redirect at or below it, including older checkout names.
+                if (real(component) !== real(root) && component !== resolve(root))
+                    continue;
+                for (const one of components)
+                    if (lstatSync(one).isSymbolicLink())
+                        throw fail();
+                break;
+            }
+        }
+        if (!lstatSync(join(main, ".git")).isDirectory() || !lstatSync(registry).isDirectory())
+            throw fail();
+        // Query the trusted checkout, never the candidate's configurable Git pointer.
+        const listed = spawnSync("git", [...HARDENED_GIT_ARGS, "worktree", "list", "--porcelain", "-z"], { cwd: main, env: checkoutGitEnv(), encoding: "utf8" });
+        if (listed.status !== 0 || !listed.stdout.split("\0").includes(`worktree ${checkout}`))
+            throw fail();
+        for (const entry of readdirSync(registry)) {
+            const path = join(registry, entry);
+            if (!lstatSync(path).isDirectory() || !inside(real(path), real(registry)))
+                continue;
+            if (real(readFileSync(join(path, "gitdir"), "utf8").trim()) !== join(checkout, ".git"))
+                continue;
+            const gitdir = real(path);
+            if (worktreeGitDir(checkout) !== gitdir || real(join(gitdir, readFileSync(join(gitdir, "commondir"), "utf8").trim())) !== real(join(main, ".git")))
+                throw fail();
+            return { main, gitdir };
+        }
+    }
+    catch {
+        throw fail();
+    }
+    throw fail();
+}
 /**
  * Every path an agent must not reach: the Toolroll state folder
  * beside the database (all of it, except the folder that holds this run's
@@ -55,6 +131,10 @@ function inside(child, parent) {
  */
 export function agentFence(options) {
     const fence = new Set();
+    /** The console's run folder: kept by its own pathname through canonicalization (and its target's too). */
+    let runFolder = null;
+    /** The bridges' folder, likewise. */
+    let bridgeFolder = null;
     const home = real(options.home ?? homedir());
     const worktree = options.worktree === null ? null : real(options.worktree);
     if (options.databaseFile !== null && options.databaseFile !== "" && options.databaseFile !== ":memory:") {
@@ -63,6 +143,45 @@ export function agentFence(options) {
         for (const suffix of ["", "-wal", "-shm", "-journal"])
             if (existsSync(database + suffix))
                 fence.add(database + suffix);
+        // The console's run folder (its discovery sockets, console-instance.ts) beside the database, wherever that is: no
+        // build may add, rename or remove anything in it while a console listens there. It is made (owner-only) before any
+        // build starts if it isn't there yet, so a build can never be the one to create it — and the fence always has a
+        // real folder to cover (a Linux bind needs one).
+        // Whatever is at that path is fenced, always — a folder, a file, a link (the path itself, never only where a link
+        // points), a folder holding anything at all — so no build can replace it; when nothing is there it is made first.
+        // If it can't be made, the path is fenced anyway: a sandbox that can't cover a missing path refuses to launch
+        // rather than run unfenced. The name is Toolroll's own; nothing else belongs there.
+        // The folder Linux builds' network bridges are made in (egress-bridge.ts): made before any build starts and fenced
+        // from every build, so no build — however long it runs — can reach a bridge made for a later one.
+        const bridges = join(state, BRIDGE_DIR);
+        try {
+            lstatSync(bridges);
+        }
+        catch {
+            try {
+                mkdirSync(bridges, { mode: 0o700 });
+            }
+            catch { /* fenced below either way */ }
+        }
+        // Fenced by its own name as well as where it leads: a link planted there is itself out of reach (and the bridge
+        // refuses a root that isn't a private folder: egress-bridge.ts).
+        bridgeFolder = bridges;
+        fence.add(bridges);
+        runFolder = join(state, INSTANCE_DIR);
+        const present = () => { try {
+            lstatSync(runFolder);
+            return true;
+        }
+        catch {
+            return false;
+        } };
+        if (!present()) {
+            try {
+                mkdirSync(runFolder, { mode: 0o700 });
+            }
+            catch { /* fenced below either way */ }
+        }
+        fence.add(runFolder);
         // Only a folder that is Toolroll's own (~/.config/toolroll or an older name,
         // the desktop app's "Toolroll") is fenced whole: a database kept
         // in a shared folder (a projects folder, a test's temp folder) must not
@@ -71,7 +190,7 @@ export function agentFence(options) {
         // The entries this run's worktree needs stay reachable: the one it lives
         // under, and the repository its git metadata belongs to.
         const keep = new Set();
-        for (const needed of [worktree, worktree === null ? null : mainRepositoryOf(worktree)]) {
+        for (const needed of [worktree, options.binding?.main ?? null]) {
             if (needed !== null && inside(needed, state))
                 keep.add(relative(state, needed).split(sep)[0]);
         }
@@ -101,10 +220,23 @@ export function agentFence(options) {
     for (const path of options.extra ?? [])
         if (existsSync(path))
             fence.add(real(path));
+    // Secret, state, database, explicit-extra and home-config denies are never exemptible.
+    if (options.runFolders !== undefined)
+        for (const path of otherRunFolders(options.runFolders))
+            fence.add(path);
+    for (const path of options.boundary?.protectedShell ?? [])
+        fence.add(real(path));
+    const protectedPaths = new Set([...fence].flatMap(path => path === runFolder || path === bridgeFolder ? [path, real(path)] : [real(path)]));
     for (const path of options.boundary?.shell ?? [])
         fence.add(path);
-    // Never fence the run's own worktree or anything above it.
-    return [...fence].filter(path => worktree === null || (path !== worktree && !inside(worktree, path))).sort();
+    const binding = options.binding;
+    const needed = binding === undefined || binding === null ? [] : [binding.gitdir, real(join(binding.main, ".git"))];
+    return [...new Set([...fence].flatMap(path => path === runFolder || path === bridgeFolder ? [path, real(path)] : [real(path)]))].filter(path => {
+        if (protectedPaths.has(path) || !needed.some(target => target === path || inside(target, path)))
+            return true;
+        console.warn(`Dropped build fence entry covering this checkout's own Git data: ${path}`);
+        return false;
+    }).sort();
 }
 /**
  * Credentials and agent configuration in the home folder. A build is the
@@ -112,10 +244,18 @@ export function agentFence(options) {
  * cloud logins or another agent's sign-in, or rewrite their own Claude or
  * Codex setup for the next interactive session.
  */
-const HOME_CONFIGURATION = [".claude", ".claude.json", ".codex", ".gemini", ".ssh", ".aws", ".gnupg", ".netrc", ".git-credentials", ".kube", join(".config", "gh"), join(".docker", "config.json")];
+const HOME_CONFIGURATION = [
+    ".claude", ".claude.json", ".codex", ".gemini", ".ssh", ".aws", ".gnupg", ".netrc", ".git-credentials", ".kube", join(".config", "gh"), join(".docker", "config.json"),
+    // Every ACP agent's own configuration and sign-in (acp-agents.ts): fenced from every build but that agent's own.
+    ...ACP_PROVIDER_IDS.flatMap(id => ACP_AGENTS[id].home),
+];
 /** What a provider's own CLI reads to sign in and keep its sessions. The OS fence around Claude and Gemini holds
  * their whole process, so those stay reachable there; Codex fences only its agent's commands, so it keeps none. */
-const PROVIDER_HOME = { claude: [".claude", ".claude.json"], gemini: [".gemini"], codex: [], openrouter: [] };
+const PROVIDER_HOME = {
+    claude: [".claude", ".claude.json"], gemini: [".gemini"], codex: [], openrouter: [],
+    // Each ACP agent keeps its own configuration and sign-in where its row says (acp-agents.ts).
+    ...Object.fromEntries(ACP_PROVIDER_IDS.map(id => [id, ACP_AGENTS[id].home])),
+};
 /** What Claude's own file tools refuse inside its home: the CLI reads these itself, its model never needs to. */
 const CLAUDE_FILE_TOOL_HOME = [".claude.json", join(".claude", ".credentials.json"), join(".claude", "settings.json"), join(".claude", "settings.local.json"), ".npmrc"];
 /**
@@ -129,10 +269,13 @@ const CLAUDE_FILE_TOOL_HOME = [".claude.json", join(".claude", ".credentials.jso
 export function taskBoundary(options) {
     const home = real(options.home ?? homedir());
     const worktree = real(options.worktree);
-    const main = mainRepositoryOf(worktree);
+    const main = options.binding?.main ?? null;
+    const gitdir = options.binding?.gitdir ?? null;
+    const needed = [worktree, main, gitdir].filter((path) => path !== null);
     const own = new Set(PROVIDER_HOME[options.provider] ?? []);
     const present = (names) => names.map(name => join(home, name)).filter(path => existsSync(path)).map(real);
     const shell = new Set(present(HOME_CONFIGURATION.filter(name => !own.has(name))));
+    const protectedShell = [...shell];
     const repository = (path) => existsSync(join(path, ".git"));
     for (const parent of new Set([dirname(worktree), ...(main === null ? [] : [dirname(main)])])) {
         // Home contains toolchain clones such as .nvm and .oh-my-zsh. The
@@ -149,8 +292,11 @@ export function taskBoundary(options) {
         for (const entry of entries) {
             if (entry.startsWith("."))
                 continue;
-            const path = join(parent, entry);
-            if (path === worktree || path === main || inside(worktree, path) || !repository(path))
+            const candidate = join(parent, entry);
+            if (!repository(candidate))
+                continue;
+            const path = real(candidate);
+            if (needed.some(target => target === path || inside(target, path)))
                 continue;
             shell.add(path);
         }
@@ -170,8 +316,12 @@ export function taskBoundary(options) {
         }
     }
     // Git needs this worktree's metadata and the shared objects/refs, but
-    // must not prune or rewrite the metadata of another task's checkout.
-    const gitdir = worktreeGitDir(worktree);
+    // must not prune or rewrite the metadata of another task's checkout. It
+    // still reads that metadata (gc keeps what a sibling's HEAD and index
+    // reach) and looks up the checkout it names: a checkout it can't see is
+    // one `git worktree prune` deletes the entry of.
+    const readOnly = new Set();
+    const lookup = new Set();
     if (gitdir !== null && main !== null) {
         const siblings = dirname(gitdir);
         let entries = [];
@@ -182,13 +332,160 @@ export function taskBoundary(options) {
             entries = [];
         }
         for (const entry of entries) {
-            const path = real(join(siblings, entry));
-            if (path !== gitdir)
-                shell.add(path);
+            // Only a plain folder, by the name git gave it: a link a build planted here (to ~/.toolroll, say) is never
+            // followed into a grant, which a sandbox that lets the more specific path win would honour over the fence.
+            const path = join(siblings, entry);
+            if (path === gitdir)
+                continue;
+            try {
+                if (!lstatSync(path).isDirectory())
+                    continue;
+            }
+            catch {
+                continue;
+            }
+            readOnly.add(path);
+            let pointer;
+            try {
+                pointer = readFileSync(join(path, "gitdir"), "utf8").trim();
+            }
+            catch {
+                pointer = undefined;
+            }
+            if (pointer === undefined || pointer === "" || !isAbsolute(pointer))
+                continue;
+            const checkout = dirname(real(pointer));
+            // The entry's pointer is build-writable: look up only a checkout whose own .git names this entry back, as git
+            // links a real one, so a planted pointer can't lift a fenced path's metadata.
+            if (worktreeGitDir(checkout) !== path)
+                continue;
+            lookup.add(checkout);
+            lookup.add(join(checkout, ".git"));
         }
     }
     const fileTools = options.provider === "claude" ? present(CLAUDE_FILE_TOOL_HOME).filter(path => !shell.has(path)) : [];
-    return { shell: [...shell].sort(), fileTools: fileTools.sort() };
+    return { protectedShell, shell: [...shell].sort(), fileTools: fileTools.sort(), readOnly: [...readOnly].sort(), lookup: [...lookup].sort() };
+}
+/** The prefixes of every launch's private folders: its tools' config, a Codex build's own home, and a Linux build's
+ * network bridge (egress-bridge.ts). */
+export const RUN_FOLDER_PREFIXES = ["so-tools-", "so-codex-", "so-net-"];
+export function runFolders(own, root = tmpdir()) {
+    return { root: real(root), own: own === null ? null : real(own) };
+}
+/** Every other launch's private folder there now. */
+function otherRunFolders(folders) {
+    let entries = [];
+    try {
+        entries = readdirSync(folders.root);
+    }
+    catch {
+        entries = [];
+    }
+    return entries.filter(entry => RUN_FOLDER_PREFIXES.some(prefix => entry.startsWith(prefix))).map(entry => join(folders.root, entry)).filter(path => path !== folders.own);
+}
+/**
+ * Services a sandboxed process could ask to act outside the sandbox for it (macOS): open a URL in a browser (Launch
+ * Services), script another application (Apple Events), fetch in the background (nsurlsessiond), look a name up
+ * (the DNS service: a lookup is itself a message out), or read and write the clipboard. Denied when the network is
+ * confined; the run's proxy resolves names for it.
+ */
+export const DELEGATION_SERVICES = [
+    "com.apple.coreservices.launchservicesd", "com.apple.coreservices.quarantine-resolver", "com.apple.lsd.mapdb", "com.apple.lsd.modifydb", "com.apple.lsd.open",
+    "com.apple.coreservices.appleevents", "com.apple.nsurlsessiond", "com.apple.nsurlsessiond.NSURLSessionProxyService",
+    "com.apple.dnssd.service", "com.apple.mDNSResponder", "com.apple.pasteboard.1",
+];
+export const NO_GRANTS = { readOnly: [], readable: [], lookup: [] };
+/**
+ * The pool deny for one launch. `roots` come from the plane's own records (the pool beside the database, and the one
+ * the recorded checkout was made in), never from the checkout. A root that holds this checkout's own Git data (the
+ * binding's gitdir or the repository's .git) is never denied whole: it is split around that data instead, entry by
+ * entry, so it is denied as far as it can be (fail closed by denying more, never by refusing). A root inside the
+ * checkout, the home folder, a folder above it or / is left alone: the first is the build's own work, the others the
+ * whole machine.
+ */
+export function checkoutPool(options, list = path => readdirSync(path)) {
+    const own = options.worktree === null ? null : real(options.worktree);
+    const home = real(options.home ?? homedir());
+    const binding = options.binding ?? null;
+    const needed = binding === null ? [] : [realpathSync(binding.gitdir), realpathSync(join(binding.main, ".git"))];
+    const deny = new Set();
+    const visited = new Set();
+    const split = (input) => {
+        const path = realpathSync(input);
+        if (visited.has(path))
+            return;
+        visited.add(path);
+        if (!needed.some(target => target === path || inside(target, path))) {
+            deny.add(path);
+            return;
+        }
+        if (needed.includes(path))
+            return;
+        const entries = list(path); // An unreadable pool must refuse preparation, never silently widen access.
+        for (const entry of entries)
+            split(join(path, entry));
+    };
+    for (const root of options.roots) {
+        if (root === null || !existsSync(root))
+            continue;
+        const path = real(root);
+        if (path === dirname(path) || path === home || inside(home, path) || (own !== null && (path === own || inside(path, own))))
+            continue;
+        split(path);
+    }
+    const holding = own === null ? [] : [...deny].filter(path => inside(own, path));
+    const lookup = new Set([...visited].filter(path => needed.some(target => inside(target, path))));
+    for (const path of holding)
+        for (let folder = dirname(own); folder === path || inside(folder, path); folder = dirname(folder))
+            lookup.add(folder);
+    return { deny: [...deny].sort(), own: holding.length === 0 ? null : own, lookup: [...lookup].sort(), ...(needed.length === 0 ? {} : { gitPaths: needed }) };
+}
+/** The grants for one build: its task boundary's git rules, the shared dependencies its checkout links, and the
+ * checkout pools (`poolRoots`, from the plane's records) denied around its own checkout. */
+export function fenceGrants(options) {
+    const readable = [];
+    const lookup = [...options.boundary?.lookup ?? []];
+    if (options.databaseFile !== null && options.databaseFile !== "" && options.databaseFile !== ":memory:" && options.worktree !== null && options.linked != null) {
+        // The link note names the copy as the plane wrote it; the sandbox sees real paths. The note is in the build's own
+        // checkout, so it is only a hint: the copy must be a ready one the plane made for this run's project under the
+        // setup it stamped on this checkout, or nothing is granted.
+        const written = join(dirname(options.databaseFile), DEPS_FOLDER);
+        const deps = join(dirname(real(options.databaseFile)), DEPS_FOLDER);
+        const key = linkedKey(options.worktree, written) ?? linkedKey(options.worktree, deps);
+        const linked = options.linked;
+        const copy = key === null || !/^[0-9a-f]{24}$/.test(key) ? undefined : sharedCopies(deps).find(one => one.key === key);
+        const ours = copy !== undefined && !copy.retired && copy.repo === linked.repo && linked.setupDigest !== null && readySetup(deps, key) === linked.setupDigest && readyCopy(deps, key) !== null;
+        if (ours && key !== null && existsSync(join(deps, key, "node_modules"))) {
+            lookup.push(deps, join(deps, key));
+            readable.push(join(deps, key, "node_modules"));
+        }
+    }
+    const pool = options.poolRoots === undefined ? undefined : checkoutPool({ roots: options.poolRoots, worktree: options.worktree, binding: options.binding ?? null, ...(options.home === undefined ? {} : { home: options.home }) });
+    return { readOnly: [...options.boundary?.readOnly ?? []], readable, lookup: [...new Set(lookup)].sort(), ...(options.runFolders === undefined ? {} : { runFolders: options.runFolders }),
+        ...(pool === undefined || pool.deny.length === 0 ? {} : { pool }) };
+}
+/** The setup a shared copy was installed by (its ready note), or null. */
+function readySetup(deps, key) {
+    try {
+        const setup = JSON.parse(readFileSync(join(deps, key, "ready.json"), "utf8")).setup;
+        return typeof setup === "string" ? setup : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Git settings every fenced build runs with (GIT_CONFIG_COUNT, after any the
+ * caller already set): `git gc` never expires a reflog, so it never rewrites
+ * another task's reflog, which the fence would refuse mid-collection.
+ */
+export function fencedGitEnv(base = process.env) {
+    const count = Number.parseInt(base["GIT_CONFIG_COUNT"] ?? "0", 10);
+    const start = Number.isInteger(count) && count > 0 ? count : 0;
+    const settings = [["gc.reflogExpire", "never"], ["gc.reflogExpireUnreachable", "never"]];
+    const env = { GIT_CONFIG_COUNT: String(start + settings.length) };
+    settings.forEach(([key, value], index) => { env[`GIT_CONFIG_KEY_${start + index}`] = key; env[`GIT_CONFIG_VALUE_${start + index}`] = value; });
+    return env;
 }
 /** The repository a git worktree belongs to (its `.git` file names the main repository's git folder). */
 function worktreeGitDir(worktree) {
@@ -200,40 +497,248 @@ function worktreeGitDir(worktree) {
         return null;
     }
 }
-function mainRepositoryOf(worktree) {
-    const gitdir = worktreeGitDir(worktree);
-    if (gitdir === null)
-        return null;
-    // <repo>/.git/worktrees/<name> → <repo>
-    const at = gitdir.lastIndexOf(`${sep}.git${sep}worktrees${sep}`);
-    return at < 0 ? null : gitdir.slice(0, at);
-}
 const toml = (value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 /**
  * Codex's own sandbox, fenced. Auto: the `:workspace` profile Codex's
  * `--sandbox workspace-write` already gives (workspace and temp writes, no
  * network). Full access: the same profile widened to write anywhere with
  * network on, instead of no sandbox at all. Either way the fenced paths are
- * denied, which in Codex outranks any write or read grant.
+ * denied, which in Codex outranks any write or read grant. The checkout pools
+ * are never `flattened` (which leaves what is made after launch readable): see
+ * `codexPool`, which denies them around the build's own checkout, written back.
  */
-export function codexFenceArgv(fence, fullAccess) {
-    const filesystem = [...(fullAccess ? ['"/"="write"'] : []), ...fence.map(path => `${toml(path)}="deny"`)];
+export function codexFenceArgv(fence, fullAccess, grants = NO_GRANTS) {
+    const { deny, readOnly } = flattened(fence, grants);
+    // Codex's harness reads its own launch files outside the command sandbox.
+    // Deny the namespace, including folders created after this policy was built.
+    if (grants.runFolders !== undefined) {
+        for (const prefix of RUN_FOLDER_PREFIXES) {
+            deny.push(join(grants.runFolders.root, `${prefix}*`), join(grants.runFolders.root, `${prefix}*`, "**"));
+        }
+    }
+    // Launch folders can already be in the base fence when invoke appends them.
+    // TOML forbids duplicate keys, even with identical values. Normalize aliases
+    // at this boundary and apply stronger access restrictions last.
+    const access = new Map();
+    const pool = grants.pool;
+    // Codex lets the more specific path win: no read grant inside a pool, but the build's own checkout.
+    const pooled = (path) => pool !== undefined && pool.deny.some(one => path === one || inside(path, one))
+        && !(pool.own !== null && (path === pool.own || inside(path, pool.own)));
+    if (fullAccess)
+        access.set("/", "write");
+    for (const path of readOnly)
+        if (!pooled(real(path)))
+            access.set(real(path), "read");
+    if (pool !== undefined) {
+        const held = codexPool(pool);
+        for (const path of held.read)
+            access.set(path, "read");
+        for (const path of held.deny)
+            access.set(path, "deny");
+        for (const path of held.write)
+            access.set(path, "write");
+    }
+    // Denies are keyed where they resolve; the console's run folder is also denied by its own pathname, so a link there
+    // stays unreplaceable, not only its target.
+    for (const path of deny) {
+        access.set(real(path), "deny");
+        if (basename(path) === INSTANCE_DIR)
+            access.set(path, "deny");
+    }
+    const filesystem = [...access].map(([path, mode]) => `${toml(path)}=${toml(mode)}`);
     return [
         "-c", 'default_permissions="standing-orders"',
         "-c", 'permissions.standing-orders.extends=":workspace"',
         "-c", `permissions.standing-orders.filesystem={${filesystem.join(",")}}`,
-        ...(fullAccess ? ["-c", "permissions.standing-orders.network.enabled=true", "-c", 'approval_policy="never"'] : []),
+        // Codex's command sandbox can't route through a proxy: its commands reach the network only when the run's sealed
+        // network is open (and Full access asked for it), and are offline otherwise.
+        ...(fullAccess && (grants.network === undefined || grants.network.mode === "open") ? ["-c", "permissions.standing-orders.network.enabled=true"] : []),
+        ...(fullAccess ? ["-c", 'approval_policy="never"'] : []),
     ];
 }
-/** Claude's own file tools refuse the fenced paths in every mode (its shell is fenced by the macOS sandbox). */
-export function claudeFenceSettings(fence) {
-    const rules = fence.flatMap(path => [`Read(/${path})`, `Read(/${path}/**)`, `Edit(/${path})`, `Edit(/${path}/**)`]);
+/**
+ * Codex cannot deny an ancestor and still traverse it to the own checkout. Deny existing
+ * siblings individually, from the trusted pool roots and a fresh listing, never through
+ * flattened or name patterns. A project added after launch is covered on the next launch;
+ * Seatbelt and bubblewrap retain the stronger whole-pool rule for later-created projects.
+ */
+export function codexPool(pool, list = path => readdirSync(path)) {
+    const deny = new Set();
+    const read = new Set(pool.lookup);
+    const own = pool.own;
+    const needed = [...pool.gitPaths ?? [], ...(own === null ? [] : [own])].map(path => realpathSync(path));
+    const visited = new Set();
+    const split = (input) => {
+        let path;
+        try {
+            path = realpathSync(input);
+        }
+        catch {
+            deny.add(resolve(input));
+            return;
+        }
+        if (visited.has(path))
+            return;
+        visited.add(path);
+        if (needed.some(target => path === target || inside(path, target)))
+            return;
+        if (!needed.some(target => inside(target, path))) {
+            deny.add(path);
+            return;
+        }
+        // Only ancestors needed for traversal stay readable, never writable in Full access.
+        read.add(path);
+        for (const entry of list(path))
+            split(join(path, entry));
+    };
+    for (const root of pool.deny)
+        split(root);
+    return { read: [...read].sort(), deny: [...deny].sort(), write: own === null ? [] : [own] };
+}
+/** Secret-looking names denied by pattern inside a folder `flattened` makes read-only, so one written there after
+ * launch is denied too (the database and its journals, tokens, login and other text files). */
+export const SPLIT_SECRET_PATTERNS = ["orders.db*", "*token*", "up-login*", "*.txt", "*secret*", "*password*", "*credential*", "*.pem", "*.key"];
+/**
+ * A fence as plain denied and read-only paths, for a sandbox that can't
+ * grant inside a denied folder (Codex: a deny outranks any grant): a denied
+ * folder holding something readable becomes read-only, with each of its
+ * entries not on the way to what is readable denied instead. Fails closed: a
+ * folder that can't be listed stays denied whole and its grant is dropped.
+ * Residual: an entry made after launch in a read-only folder is denied only
+ * when its name matches SPLIT_SECRET_PATTERNS; any other new entry there is
+ * readable (never writable) until the next launch. The macOS fence has no
+ * such gap: it denies the folder and grants back only the readable path.
+ */
+export function flattened(fence, grants = NO_GRANTS, list = path => readdirSync(path)) {
+    const deny = [];
+    const readOnly = new Set(grants.readOnly);
+    const split = (path) => {
+        const within = grants.readable.filter(one => inside(one, path));
+        if (within.length === 0) {
+            deny.push(path);
+            return;
+        }
+        let entries;
+        try {
+            entries = list(path);
+        }
+        catch (error) {
+            deny.push(path);
+            process.stderr.write(`toolroll: fence: couldn't list ${path} (${error instanceof Error ? error.message : String(error)}); it stays denied and the shared dependencies inside it aren't granted\n`);
+            return;
+        }
+        readOnly.add(path);
+        for (const pattern of SPLIT_SECRET_PATTERNS)
+            deny.push(join(path, pattern));
+        for (const entry of entries) {
+            const child = join(path, entry);
+            if (grants.readable.includes(child))
+                readOnly.add(child);
+            else
+                split(child);
+        }
+    };
+    for (const path of fence)
+        split(path);
+    // Fail closed: a grant equal to or inside a denied path is dropped, so no read grant can outrank a deny (Codex lets
+    // the more specific path win). Patterns stay as Codex patterns; they can't contain a grant here.
+    const denied = deny.filter(path => !path.includes("*"));
+    return { deny, readOnly: [...readOnly].filter(path => !denied.some(one => path === one || inside(path, one))) };
+}
+/** Claude's own file tools refuse the fenced paths in every mode (its shell is fenced by the macOS sandbox), and
+ * never edit a read-only one. */
+export function claudeFenceSettings(fence, readOnly = []) {
+    const rules = [...fence.flatMap(path => [`Read(/${path})`, `Read(/${path}/**)`, `Edit(/${path})`, `Edit(/${path}/**)`]), ...readOnly.flatMap(path => [`Edit(/${path})`, `Edit(/${path}/**)`])];
     return JSON.stringify({ permissions: { deny: rules } });
 }
 const seatbelt = (path) => `"${path.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
-/** A Seatbelt profile that allows everything except reading or writing the fenced paths. */
-export function macosFenceProfile(fence) {
-    return ["(version 1)", "(allow default)", `(deny file-read* file-write* ${fence.map(path => `(subpath ${seatbelt(path)})`).join(" ")})`].join("\n");
+const seatbeltRegex = (path) => path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/**
+ * The folders the user owns above each path (never `/`, nor the path itself), and each `roots` folder itself when the
+ * user owns it. A Seatbelt path rule follows the name, not the folder: renaming one of these would bring a fenced path
+ * back under a name no rule mentions. A folder the user doesn't own can't be renamed by a build anyway.
+ */
+export function ownedAncestors(paths, roots = [], uid = process.getuid?.()) {
+    const out = new Set();
+    const owned = (path) => { try {
+        return uid !== undefined && statSync(path).uid === uid;
+    }
+    catch {
+        return false;
+    } };
+    const climb = (from) => {
+        for (let folder = from; folder !== dirname(folder); folder = dirname(folder))
+            if (owned(folder))
+                out.add(folder);
+    };
+    for (const path of paths)
+        climb(dirname(path));
+    for (const root of roots)
+        climb(root);
+    return [...out].sort();
+}
+/**
+ * A Seatbelt profile that allows everything except reading or writing the
+ * fenced paths, less what `grants` gives back (a later Seatbelt rule
+ * outranks an earlier one). Whatever the paths, the process can't read
+ * another's arguments and environment (`kern.procargs`, which `ps -E` and
+ * KERN_PROCARGS2 use) or inspect a process outside its own sandbox:
+ * `process-info*` limited by target alone doesn't stop the sysctl. It can't
+ * take another process's task port either (`task_for_pid`, what lldb attaches
+ * with; a task name port too), so a tool server's or Toolroll's own memory
+ * and environment stay out of reach. Last, every folder of the user's above
+ * a fenced or read-only path and above the temp folder (and the temp folder
+ * itself) can't be renamed or removed, though what is inside them stays
+ * writable as before. The checkout pools are denied first, and the build's own
+ * checkout given back right after, so every later deny still holds inside it.
+ */
+export function macosFenceProfile(fence, grants = NO_GRANTS) {
+    const paths = (filter, list) => list.map(path => `(${filter} ${seatbelt(path)})`).join(" ");
+    const folders = grants.runFolders;
+    const pool = grants.pool;
+    const above = ownedAncestors([...fence, ...grants.readOnly, ...pool?.deny ?? []], [folders?.root ?? real(tmpdir())]);
+    return [
+        "(version 1)",
+        "(allow default)",
+        ...(pool === undefined || pool.deny.length === 0 ? [] : [`(deny file-read* file-write* ${paths("subpath", pool.deny)})`]),
+        ...(pool?.own == null ? [] : [
+            `(allow file-read* file-write* ${paths("subpath", [pool.own])})`,
+            `(deny file-write* ${paths("literal", [pool.own])})`,
+        ]),
+        ...(pool === undefined || pool.lookup.length === 0 ? [] : [`(allow file-read-metadata ${paths("literal", pool.lookup)})`]),
+        ...(fence.length === 0 ? [] : [`(deny file-read* file-write* ${paths("subpath", fence)})`]),
+        ...(grants.readOnly.length === 0 ? [] : [`(deny file-write* ${paths("subpath", grants.readOnly)})`]),
+        ...(folders === undefined ? [] : [`(deny file-read* file-write* (regex #"^${seatbeltRegex(folders.root)}/(${RUN_FOLDER_PREFIXES.map(seatbeltRegex).join("|")})"))`]),
+        ...(grants.lookup.length === 0 ? [] : [`(allow file-read-metadata ${paths("literal", grants.lookup)})`]),
+        // Denied whole above, granted back narrowly here (a later rule wins): an entry made after launch beside it stays denied.
+        ...(grants.readable.length === 0 ? [] : [`(allow file-read* file-test-existence ${paths("subpath", grants.readable)})`]),
+        ...(folders?.own == null ? [] : [`(allow file-read* file-write* ${paths("subpath", [folders.own])})`]),
+        '(deny sysctl-read (sysctl-name-prefix "kern.procargs"))',
+        "(deny process-info-pidinfo)",
+        "(allow process-info-pidinfo (target same-sandbox))",
+        "(deny mach-priv-task-port)",
+        "(deny mach-task-name)",
+        ...(above.length === 0 ? [] : [`(deny file-write* ${paths("literal", above)})`]),
+        ...macosNetworkRules(grants.network),
+    ].join("\n");
+}
+/**
+ * The network half of the macOS fence. Every outbound connection is denied, then loopback is given back as the launch
+ * allows: every local port under `loopback: "any"`, else the run's proxy and broker alone. (Seatbelt admits a port an
+ * allow names whatever a deny after it says, so a local port can't be refused once all are admitted: the choice is all
+ * or none, plus the run's own.) Filters name the remote end only: a `local ip` filter would admit any outbound
+ * connection.
+ */
+export function macosNetworkRules(network) {
+    if (network === undefined || network.mode === "open")
+        return [];
+    const local = (port) => `(remote ip "localhost:${port}")`;
+    return [
+        "(deny network-outbound)",
+        `(allow network-outbound ${network.loopback === "any" ? local("*") : [network.proxyPort, ...network.brokerPorts].map(local).join(" ")})`,
+        ...(network.socketRoots.length === 0 ? [] : [`(allow network-outbound ${network.socketRoots.map(root => `(remote unix-socket (subpath ${seatbelt(root)}))`).join(" ")})`]),
+        `(deny mach-lookup ${DELEGATION_SERVICES.map(name => `(global-name ${seatbelt(name)})`).join(" ")})`,
+    ];
 }
 export const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
 /** A process already inside a Seatbelt sandbox (an agent's, or a flow check zone's) can't apply another: sandbox-exec says so. */
@@ -267,8 +772,8 @@ export function macosFenceAvailable(platform = process.platform, probe) {
     return seatbeltWorks;
 }
 /** The spawn that runs `file args` inside the macOS fence (same process: sandbox-exec replaces itself with the agent). */
-export function macosFenced(file, args, fence) {
-    return { file: SANDBOX_EXEC, args: ["-p", macosFenceProfile(fence), file, ...args] };
+export function macosFenced(file, args, fence, grants = NO_GRANTS) {
+    return { file: SANDBOX_EXEC, args: ["-p", macosFenceProfile(fence, grants), file, ...args] };
 }
 /** Whether bubblewrap runs here (checked once): installed, and allowed to make its namespace. */
 let bubblewrapWorks = null;
@@ -285,9 +790,33 @@ export function linuxFenceAvailable(platform = process.platform, probe = () => s
     }
     return bubblewrapWorks;
 }
-/** The spawn that runs `file args` inside the Linux fence: the whole filesystem as it is, except each fenced path masked. */
-export function linuxFenced(file, args, fence) {
-    const masks = fence.flatMap(path => {
+/** A secret-name pattern (SPLIT_SECRET_PATTERNS) as a test of one path segment. */
+const patternTest = (pattern) => new RegExp(`^${pattern.split("*").map(seatbeltRegex).join(".*")}$`);
+const SECRET_SEGMENT = SPLIT_SECRET_PATTERNS.map(patternTest);
+/**
+ * The grants bubblewrap may bind back over its masks: each existing read-only or readable path, never one that is a
+ * fenced path itself, a read-only one inside a fenced path (only the shared install this run links is read inside
+ * one), another launch's private folder, or one with a secret-looking name below its fenced folder. Bubblewrap can't
+ * mask by pattern, so a grant a pattern would deny is dropped instead (fail closed).
+ */
+function linuxGrants(fence, grants) {
+    const folders = grants.runFolders;
+    const launchFolder = (path) => folders !== undefined && inside(path, folders.root) && path !== folders.own && !(folders.own != null && inside(path, folders.own))
+        && RUN_FOLDER_PREFIXES.some(prefix => relative(folders.root, path).split(sep)[0].startsWith(prefix));
+    const secretBelow = (path) => fence.some(one => inside(path, one) && relative(one, path).split(sep).some(segment => SECRET_SEGMENT.some(test => test.test(segment))));
+    const ok = (path, readOnlyGrant) => existsSync(path) && !fence.includes(path) && !launchFolder(path) && !secretBelow(path)
+        && !(readOnlyGrant && fence.some(one => inside(path, one)));
+    return [...new Set([...grants.readOnly.filter(path => ok(path, true)), ...grants.readable.filter(path => ok(path, false))])];
+}
+/** The spawn that runs `file args` inside the Linux fence: the whole filesystem as it is, the checkout pools masked
+ * and the build's own checkout bound back read-write over them, then every fenced path masked whole (an empty
+ * folder, or /dev/null for a file), so what is made there after launch is masked too; then only the explicit grants
+ * bound back read-only (bubblewrap binds from the original root, so a grant inside a mask still reaches its files). */
+export function linuxFenced(file, args, fence, grants = NO_GRANTS) {
+    const network = grants.network?.mode === "allowlist" ? grants.network : null;
+    if (network !== null && network.bridge === undefined)
+        throw new Error("A confined network on Linux needs its bridge");
+    const mask = (path) => {
         let folder = true;
         try {
             folder = statSync(path).isDirectory();
@@ -296,6 +825,59 @@ export function linuxFenced(file, args, fence) {
             folder = true;
         }
         return folder ? ["--tmpfs", path] : ["--ro-bind", "/dev/null", path];
-    });
-    return { file: "bwrap", args: ["--dev-bind", "/", "/", ...masks, "--die-with-parent", "--", file, ...args] };
+    };
+    const pool = grants.pool?.deny ?? [];
+    const own = grants.pool?.own != null && existsSync(grants.pool.own) ? ["--bind", grants.pool.own, grants.pool.own] : [];
+    const kept = linuxGrants([...fence, ...pool], grants).flatMap(path => ["--ro-bind", path, path]);
+    // A confined network: a network and a process view of its own, the host's sockets out of reach (a socket in a
+    // mounted folder is not network, so they are masked), and the run's proxy and broker carried in by the forwarder.
+    const isolated = network === null ? [] : [
+        "--unshare-net", "--unshare-pid", "--proc", "/proc",
+        ...linuxHostSockets().flatMap(mask),
+        "--ro-bind", network.bridge.folder, network.bridge.folder,
+    ];
+    // A confined build gets a /tmp of its own (other programs' sockets, other runs' folders and anything planted there
+    // all out of sight at once), with only its own folders there given back; every mask and grant below still applies.
+    const privateTmp = network === null ? [] : ["--tmpfs", "/tmp", ...(network.keep ?? []).filter(path => inside(path, "/tmp") && existsSync(path)).flatMap(path => ["--bind", path, path])];
+    const command = network === null ? [file, ...args]
+        : [network.bridge.node, network.bridge.forwarder, network.bridge.folder, ...[network.proxyPort, ...network.brokerPorts].map(String), "--", file, ...args];
+    return { file: "bwrap", args: ["--dev-bind", "/", "/", ...privateTmp, ...pool.flatMap(mask), ...own, ...fence.flatMap(mask), ...kept, ...isolated, "--die-with-parent", "--", ...command] };
+}
+/** The host's own sockets a process in a mounted filesystem could still talk to (D-Bus, the display, container
+ * engines), wherever they exist here. */
+export function linuxHostSockets(uid = process.getuid?.(), home = homedir(), tmp = "/tmp") {
+    // The system's own, root-owned: resolved (/var/run is a link to /run) so bubblewrap mounts over the real path, once.
+    const system = [
+        ...(uid === undefined ? [] : [`/run/user/${uid}`]), "/run/dbus", "/var/run/dbus", "/var/run/docker.sock", "/run/docker.sock", "/run/containerd", "/run/podman",
+        "/var/run/podman", "/run/systemd/private", "/run/snapd.socket", "/run/screen",
+    ];
+    const masks = new Set();
+    for (const path of system) {
+        try {
+            masks.add(realpathSync(path));
+        }
+        catch { /* not here */ }
+    }
+    // The user's own, in places a build could plant names: taken only as the real folders or sockets they are, never
+    // through a link (a planted link would turn a mask onto any folder at all). Container engines
+    // run per user (Docker Desktop and the docker CLI's folder whole, so a socket made there later is covered too;
+    // Colima, OrbStack, Lima, Rancher Desktop, rootless containers); a terminal multiplexer takes commands from its
+    // socket; an SSH agent signs as you; editors keep IPC sockets in /tmp (hidden by the build's private /tmp).
+    // Masked whoever owns it (a folder `sudo docker` made is root's): only a link is never followed, since a link turns
+    // a mask onto its target. A link there is a residual until builds can't write the home folder (arc 2).
+    const owned = (path) => {
+        try {
+            const held = lstatSync(path);
+            return !held.isSymbolicLink() && (held.isDirectory() || held.isSocket());
+        }
+        catch {
+            return false;
+        }
+    };
+    for (const path of [".docker", ".colima", ".orbstack", ".lima", ".rd", ".local/share/containers"].map(name => join(home, name)))
+        if (owned(path))
+            masks.add(path);
+    // /tmp's sockets (the display's, an SSH agent's, a multiplexer's, editors') go with the build's private /tmp.
+    void tmp;
+    return [...masks].sort();
 }