toolroll 0.9.63 → 0.9.65

package/dist/browser-shell.js

@@ -4,6 +4,9 @@ import { readFileSync } from 'node:fs';
 import {} from './browser-workspace.js';
 import { html, jsonScript, replaceMarkup, scriptElement } from './html.js';
 const assets = new Map();
+/** The fixed public assets: the workspace, Live mode's own small bundle, and the notices. */
+const BROWSER_ASSETS = [['workspace.js', 'text/javascript; charset=utf-8'], ['workspace.css', 'text/css; charset=utf-8'], ['terminal.js', 'text/javascript; charset=utf-8'],
+    ['terminal.css', 'text/css; charset=utf-8'], ['THIRD_PARTY_NOTICES.txt', 'text/plain; charset=utf-8']];
 function readAsset(name) {
     // Compiled installation first; the second location supports source-based
     // development/tests after the browser build. No request supplies a file path.
@@ -16,9 +19,9 @@ function readAsset(name) {
     return null;
 }
 export function browserAssetsAvailable() {
-    if (assets.size === 3)
+    if (assets.size === BROWSER_ASSETS.length)
         return true;
-    for (const [name, type] of [['workspace.js', 'text/javascript; charset=utf-8'], ['workspace.css', 'text/css; charset=utf-8'], ['THIRD_PARTY_NOTICES.txt', 'text/plain; charset=utf-8']]) {
+    for (const [name, type] of BROWSER_ASSETS) {
         const body = readAsset(name);
         if (body === null)
             return false;
@@ -27,7 +30,7 @@ export function browserAssetsAvailable() {
     return true;
 }
 export function serveBrowserAsset(request, response, path) {
-    if (path !== '/assets/workspace.js' && path !== '/assets/workspace.css' && path !== '/assets/THIRD_PARTY_NOTICES.txt')
+    if (!BROWSER_ASSETS.some(([name]) => path === `/assets/${name}`))
         return false;
     if (request.method !== 'GET' && request.method !== 'HEAD') {
         response.writeHead(405, { allow: 'GET, HEAD', 'cache-control': 'no-store' });

package/dist/browser-workspace.d.ts

@@ -1,6 +1,7 @@
 /** The browser consumes this contract with a type-only import. All HTML is
  * produced by the existing trusted server renderers, never by a model-supplied
  * fragment. These projections do not authenticate, mutate or grant authority. */
+import { type DisplayState, type StateCounts } from './agent-state-words.js';
 import type { TeamSnapshot } from './team-contract.js';
 import type { RunActivity } from './activity-line.js';
 import type { BrandIconId } from './brand-icons.js';
@@ -21,6 +22,50 @@ export type BrowserProject = {
     href: string;
     knowledgeHref: string;
 };
+/** A project's state for one person (agent-state.ts): the strongest of its counts, the counts, and its tasks with
+ * something live, asking, failed or unread (strongest first, `more` beyond those shown). `path` null: work with no
+ * project yet. */
+export type BrowserProjectState = {
+    path: string | null;
+    name: string;
+    href: string;
+    state: DisplayState;
+    counts: StateCounts;
+    tasks: BrowserRailTask[];
+    more: number;
+    /** Everything here that needs this person, as opaque keys (one per obligation and version: the chime's subjects),
+     * with the task and agent each is about so a tab already showing one stays quiet. */
+    asks: BrowserAsk[];
+    /** The projects folded together to keep a snapshot inside one live frame: their counts summed, `more` of them. */
+    others?: true;
+};
+/** The most a summary snapshot may take in UTF-8 bytes, as the summary room sends it (JSON inside JSON, plus the
+ * frame's envelope), well inside one live frame (live-bus.ts STREAM_LIMIT_BYTES). */
+export declare const SUMMARY_BUDGET = 24000;
+/** A snapshot's size on the wire: UTF-8 bytes of the JSON string the frame carries, plus its envelope. */
+export declare function summaryFrameBytes(value: unknown): number;
+/**
+ * A summary snapshot that fits one live frame, with every count kept: long words are clipped, then rail tasks become
+ * `more` (from the project listing most), then the quietest projects fold into one `others` entry with their counts
+ * summed. Nothing is dropped silently: whatever is not listed is counted.
+ */
+export declare function boundProjectSummary(rows: readonly BrowserProjectState[], budget?: number): BrowserProjectState[];
+/** One thing that needs this person, as the chime knows it: an opaque key (never words), and what it is about. */
+export type BrowserAsk = {
+    key: string;
+    task: string | null;
+    run: number | null;
+    /** When it last changed (ISO): one older than the chime's memory reaches back is never news. */
+    at: string;
+};
+/** One task on the rail: its state, and its agent's last act when one is at work (else the state's words). */
+export type BrowserRailTask = {
+    id: string;
+    title: string;
+    href: string;
+    state: DisplayState;
+    line: string;
+};
 /** count: tasks waiting on a person, shown beside Tasks when above zero. */
 export type BrowserNavigationItem = {
     label: string;
@@ -185,6 +230,14 @@ export type BrowserLimitTile = {
 export type BrowserLimits = {
     tiles: BrowserLimitTile[];
 };
+/** The sidebar's usage chip (limits-ui.ts usageChipOf): the most-used subscription window, stale when its reading is old. */
+export type BrowserUsageChip = {
+    text: string;
+    tone: BrowserLimitTile['tone'];
+    stale: boolean;
+    href: string;
+    title: string;
+};
 export type BrowserSettingsView = {
     kind: 'settings';
     said: string | null;
@@ -440,6 +493,18 @@ export type BrowserTaskView = {
         action: string;
         run: number;
     } | null;
+    /** The running attempt's composer (steer-controls.ts): what it takes, said plainly, and its note box when it takes
+     * notes. Pause and Stop stay as `pause` and `stop`. */
+    steering?: {
+        controls: BrowserAgentControls;
+        steer: {
+            action: string;
+            run: number;
+        } | null;
+    } | null;
+    /** This task's latest attempts, newest first: a draft this tab wrote for one that has since ended shows with a way
+     * to send it to the next attempt. */
+    steerRecent?: number[];
     /** Pause and Pause and steer, beside Stop: the same exact live Claude build, one request id per form (Pause, the note,
      * Resume), where its latest pause stands (null: running), and until when a paused build can wait before it ends. */
     pause?: {
@@ -486,7 +551,47 @@ export type BrowserTaskView = {
     details?: BrowserTaskDetailGroup[];
     /** Where to message the agent when this page carries no conversation (null: messaging isn't available here). */
     chatHref?: string | null;
+    /** One page per task (docs/plans/one-page-task-and-agent.md): the tab the address names (Activity when none). */
+    tab?: BrowserTaskTab;
+    /** The Result tab: the selected attempt's result exactly as its result page shows it, whether it is the task's
+     * current one (the header then owns its status and ceremonies), and every result attempt to pick from. Null: none yet. */
+    result?: {
+        selected: NonNullable<BrowserResultView["selected"]>;
+        current: boolean;
+        attempts: {
+            label: string;
+            href: string;
+            current: boolean;
+        }[];
+        /** What the result shows, as one stamp (every check, note and control in it; never a form's fresh request token): the
+         * page holds the result it loaded and says when a newer one is ready, so its evidence and decision always agree. */
+        revision: string;
+    } | null;
+    /** Where the approval sits: under the header when it is the thing to do now, else at the top of the Plan tab. */
+    approvalPlacement?: "lead" | "plan";
+    /** ⋯ More actions: the task's secondary acts, the same order on the task and agent pages, destructive last. */
+    more?: BrowserTaskMore[];
 };
+export type BrowserTaskTab = "activity" | "result" | "plan";
+/** One ⋯ item: a plain link, a copy of this page's address, a one-click POST (never a ceremony), or a go-to that switches
+ * to the tab holding the item's own form, opens it and focuses it (`target`: that element's id). */
+export type BrowserTaskMore = {
+    group: "work" | "share" | "danger";
+    label: string;
+} & ({
+    kind: "link";
+    href: string;
+} | {
+    kind: "copy";
+} | {
+    kind: "post";
+    action: string;
+    fields: Record<string, string>;
+} | {
+    kind: "goto";
+    tab: BrowserTaskTab;
+    target: string;
+});
 /** One project on the Projects page; opening it is a POST to /projects/open. */
 export type BrowserProjectRow = {
     name: string;
@@ -689,7 +794,12 @@ export type BrowserResultView = {
             accept?: {
                 note: string | null;
             } | null;
+            returnTo?: string;
         } | null;
+        /** How its run went (docs/plans/run-efficiency.md): recorded numbers only, unknowns null. */
+        efficiency?: import("./run-efficiency.js").RunEfficiency | null;
+        /** What its network was and what its proxy saw (egress.ts): display only. */
+        network?: import("./egress.js").RunNetworkRecord | null;
         /** Words for the result's Accept: Accept and finish when offered, else the Needs you acceptance. */
         decision: BrowserResultDecision | null;
         checks: {
@@ -882,6 +992,14 @@ export type BrowserFlowCard = {
     task: {
         id: string;
         href: string;
+        /** Its running attempt's composer (steer-controls.ts), for an approver: what it takes, its controls, its note box. */
+        composer?: {
+            controls: BrowserAgentControls;
+            steer: {
+                action: string;
+                run: number;
+            } | null;
+        };
     } | null;
     createdBy: string;
     updatedAt: string;
@@ -896,10 +1014,15 @@ export type BrowserFlowCard = {
         at: string;
     }[];
     /** Where a trigger found it: a GitHub or Linear issue, another flow's card, a button, a schedule. */
+    /** `proved` and `host` (v126): how an outside event's delivery was proved ("signed by Sentry", "unsigned") and its
+     * link's host, always shown beside the link. */
     source: {
         kind: string;
         label: string;
         url: string | null;
+        proved?: string;
+        host?: string | null;
+        shown?: string | null;
     } | null;
     /** Who is responsible for it, who follows it, and whether the viewer does. */
     owner: string | null;
@@ -1017,10 +1140,27 @@ export type BrowserFlowTrigger = {
         label: string;
         questions: string[];
     } | null;
-    /** A webhook trigger: whether it can prove deliveries yet (Linear needs its signing secret pasted). */
+    /** A webhook trigger: whether it can prove deliveries yet (Linear, Sentry and Vercel need their signing secret pasted).
+     * v126: a webhook's sender (who signs it; "none" is the address alone), whether Toolroll makes its secret, and a
+     * warning in words when anyone could add cards (unsigned) or any project could (a Sentry or Vercel webhook unscoped). */
     hook: {
         ready: boolean;
         needsSecret: boolean;
+        sender: string | null;
+        makesSecret: boolean;
+        warning: string | null;
+        readerNote: string | null;
+        /** v126: deliveries turned away because too many were already held, until a person clears it, and how to resend them. */
+        dropped: {
+            count: number;
+            since: string;
+            resend: string;
+        } | null;
+        /** v126: the Sentry or Vercel project (and Vercel team) it takes deliveries from; null: any the secret covers. */
+        scope: {
+            project: string | null;
+            team: string | null;
+        } | null;
     } | null;
     checkable: boolean;
     /** A button shared as a public form (its link works). */
@@ -1183,6 +1323,22 @@ export type BrowserAgentQuestion = {
     text: string;
     action: string;
 };
+export type BrowserAgentControls = {
+    send: "live" | "mailbox" | null;
+    words: string;
+    pause: {
+        action: string;
+        run: number;
+        state: "pausing" | "paused" | null;
+        requests: [string, string, string];
+        until: string | null;
+    } | null;
+    stop: {
+        action: string;
+        run: number;
+        label: string;
+    } | null;
+};
 export type BrowserAgentDetail = BrowserAgentRow & {
     live: boolean;
     question: BrowserAgentQuestion | null;
@@ -1201,11 +1357,39 @@ export type BrowserAgentDetail = BrowserAgentRow & {
         action: string;
         run: number;
     } | null;
+    /** What this running attempt takes (steer-capabilities.ts): how a note reaches it (or why none does), Pause and
+     * Stop for the exact run each names. Null when it is not running or this person may not act. */
+    controls?: BrowserAgentControls | null;
+    /** Cockpit E: this running attempt's checkout, proved to be on this machine — the cd command to copy, and where Show
+     * in Finder posts. Absent off this machine, for a viewer, or once it ends. Nothing is ever launched in it. */
+    /** `reveal` is null where Finder can't be asked (not a Mac): the path and the command stand alone. */
+    checkout?: {
+        path: string;
+        cd: string;
+        reveal: string | null;
+    } | null;
     /** Whether this person may reply or steer (an approver, outside the demo); a viewer sees the question but no composer. */
     canAct: boolean;
     /** The task, and once finished the run's own page (its result page when it built one). */
     taskHref: string;
     resultHref: string | null;
+    /** The task this agent works on, as its page heads it: the status words, and its one action as a way to the task page's
+     * tab that holds it (never a form here: the task page's own form is the one that acts). Null when it can't be read. */
+    task?: {
+        headline: string;
+        sentence: string;
+        tone: string;
+        action: {
+            label: string;
+            href: string;
+        };
+    } | null;
+    /** Where this run opens on its task's page: a result → its Result tab at this run, a plan → the Plan tab, anything
+     * else (a review, an attempt that isn't a result) → its own record. Null while it runs. */
+    open?: {
+        label: string;
+        href: string;
+    } | null;
     /** The exact-run live room: updates, and a watch that keeps this person's pings quiet. */
     room: string;
     said: {
@@ -1213,6 +1397,42 @@ export type BrowserAgentDetail = BrowserAgentRow & {
         text: string;
     } | null;
 };
+/** One run on the timeline: its role, and when it started and ended (null: still running). */
+export type BrowserLaneSegment = {
+    runId: number;
+    role: 'planner' | 'builder' | 'reviewer' | 'scout';
+    agent: string;
+    startedAt: string;
+    endedAt: string | null;
+    outcome: string | null;
+    href: string;
+};
+/** One task's row on the timeline: its runs in order, and the board's word for where it stands ('planning' before a build). */
+export type BrowserAgentLane = {
+    taskId: string;
+    title: string;
+    project: string | null;
+    href: string;
+    group: AgentGroupKey | 'planning';
+    segments: BrowserLaneSegment[];
+};
+/** The agent timeline (after the "Agent lanes" pattern): one row per task over a window ending now. */
+export type BrowserAgentLanes = {
+    since: string;
+    now: string;
+    windows: {
+        key: AgentLaneWindow;
+        label: string;
+        href: string;
+        active: boolean;
+    }[];
+    lanes: BrowserAgentLane[];
+    /** Tasks in the window past the rows shown. */
+    more: number;
+    /** Every task in the window with a live run, not just the rows shown. */
+    running: number;
+};
+export type AgentLaneWindow = '30m' | '2h' | '24h';
 export type BrowserAgentsView = {
     kind: 'agents';
     groups: {
@@ -1220,6 +1440,8 @@ export type BrowserAgentsView = {
         label: string;
         rows: BrowserAgentRow[];
     }[];
+    /** The timeline above the board; empty lanes when nothing ran in the window but something did today; null when nothing ran in a day. */
+    lanes?: BrowserAgentLanes | null;
     selected: BrowserAgentDetail | null;
     /** Shown when nothing is on the board. */
     empty: string | null;
@@ -1232,6 +1454,8 @@ export type BrowserWorkspace = {
     user: string;
     csrf: string;
     sensitive: boolean;
+    /** Passwordless is on for this signed-in browser: ceremony password fields are left out (docs/plans/passwordless.md). */
+    passwordless?: boolean;
     /** What this person named their lead (Settings → Lead): the chat header and every lead message say it. */
     leadName?: string;
     refreshUrl: string;
@@ -1242,6 +1466,16 @@ export type BrowserWorkspace = {
     projects: BrowserProject[];
     crew: BrowserCrewItem[];
     crewTruncated: boolean;
+    /** The sidebar's project states; absent on a sensitive page. The summary room keeps them current. */
+    projectStates?: BrowserProjectState[];
+    /** Cockpit B2: this session's remembered password — minutes left, and where Forget posts. Absent unless it is
+     * live on a direct local request; never on a sensitive page. */
+    fresh?: {
+        minutes: number;
+        forget: string;
+    };
+    /** The most-used subscription window, for an operator; absent for everyone else and on a sensitive page. */
+    usage?: BrowserUsageChip;
     conversation: BrowserConversation | null;
     team?: TeamSnapshot;
     focus: {

package/dist/browser-workspace.js

@@ -1,6 +1,66 @@
+/** The browser consumes this contract with a type-only import. All HTML is
+ * produced by the existing trusted server renderers, never by a model-supplied
+ * fragment. These projections do not authenticate, mutate or grant authority. */
+import { DISPLAY_STATES as DISPLAY_ORDER } from './agent-state-words.js';
 import { browserCrewFromIndex } from './browser-crew.js';
 export { browserCrewFromIndex, browserWorkActionHref } from './browser-crew.js';
 import { workIndexPage } from './work-index.js';
+/** The most a summary snapshot may take in UTF-8 bytes, as the summary room sends it (JSON inside JSON, plus the
+ * frame's envelope), well inside one live frame (live-bus.ts STREAM_LIMIT_BYTES). */
+export const SUMMARY_BUDGET = 24_000;
+/** The frame around a snapshot: its event line, room, revision and the JSON around `at`. Generous on purpose. */
+const SUMMARY_ENVELOPE_BYTES = 512;
+const utf8 = new TextEncoder();
+/** A snapshot's size on the wire: UTF-8 bytes of the JSON string the frame carries, plus its envelope. */
+export function summaryFrameBytes(value) {
+    return utf8.encode(JSON.stringify({ at: JSON.stringify(value) })).length + SUMMARY_ENVELOPE_BYTES;
+}
+const clip = (text, max) => text.length <= max ? text : `${text.slice(0, max - 1)}…`;
+/**
+ * A summary snapshot that fits one live frame, with every count kept: long words are clipped, then rail tasks become
+ * `more` (from the project listing most), then the quietest projects fold into one `others` entry with their counts
+ * summed. Nothing is dropped silently: whatever is not listed is counted.
+ */
+export function boundProjectSummary(rows, budget = SUMMARY_BUDGET) {
+    const size = summaryFrameBytes;
+    let out = rows.map(one => ({ ...one, name: clip(one.name, 80), tasks: one.tasks.map(task => ({ ...task, title: clip(task.title, 120), line: clip(task.line, 120) })) }));
+    while (size(out) > budget) {
+        const fullest = out.reduce((best, one, index) => one.tasks.length > (out[best]?.tasks.length ?? -1) ? index : best, -1);
+        if (fullest === -1 || out[fullest].tasks.length === 0)
+            break;
+        const one = out[fullest];
+        out[fullest] = { ...one, tasks: one.tasks.slice(0, -1), more: one.more + 1 };
+    }
+    if (size(out) <= budget)
+        return out;
+    // Fold the quietest projects (weakest state last in the list) into one entry until it fits.
+    const strength = (one) => DISPLAY_ORDER.indexOf(one.state);
+    const order = out.map((one, index) => ({ one, index })).sort((a, b) => strength(b.one) - strength(a.one) || b.index - a.index);
+    const folded = new Set();
+    const othersOf = () => {
+        if (folded.size === 0)
+            return null;
+        const counts = Object.fromEntries(DISPLAY_ORDER.map(key => [key, [...folded].reduce((sum, index) => sum + out[index].counts[key], 0)]));
+        const state = DISPLAY_ORDER.find(key => key !== 'idle' && counts[key] > 0) ?? 'idle';
+        return { path: null, name: `${folded.size} more ${folded.size === 1 ? 'project' : 'projects'}`, href: '/projects', state, counts, tasks: [], more: folded.size, others: true,
+            asks: [...folded].flatMap(index => out[index].asks) };
+    };
+    const assemble = () => { const others = othersOf(); return [...out.filter((_, index) => !folded.has(index)), ...(others === null ? [] : [others])]; };
+    for (const { index } of order) {
+        if (size(assemble()) <= budget)
+            break;
+        folded.add(index);
+    }
+    // Still too large: the oldest asks go last (their counts stay; only their chimes are lost).
+    let assembled = assemble();
+    while (size(assembled) > budget) {
+        const fullest = assembled.reduce((best, one, index) => one.asks.length > (assembled[best]?.asks.length ?? -1) ? index : best, -1);
+        if (fullest === -1 || assembled[fullest].asks.length === 0)
+            break;
+        assembled = assembled.map((one, index) => index === fullest ? { ...one, asks: one.asks.slice(0, -1) } : one);
+    }
+    return assembled;
+}
 /** The Tasks badge's words: the count and the projects it covers
  * ("3 need you in shop", "1 needs you across all your projects"). */
 export function needsYouLabelOf(count, projectName, saturated = false) {

package/dist/builder.d.ts

@@ -1,3 +1,5 @@
+import type { LaunchNetwork } from "./invoke.js";
+import type { ProviderId } from "./contracts/provider.js";
 import { type PreparedEvidence } from "./prepared-evidence.js";
 import { type ExecResult, type RunOptions } from "./exec.js";
 import type { Decision, Store } from "./store.js";
@@ -85,7 +87,7 @@ export type BuildRequest = {
     skipPermissions?: boolean;
     /** The harness this build runs on. Repair ALWAYS inherits it — a session
      * resumed across providers is not a session (Codex provider review, Q3). */
-    provider?: "claude" | "codex" | "openrouter" | "gemini";
+    provider?: ProviderId;
     model?: string;
     /**
      * The model repair turns run on. Repair is a few-k, one-job resumption —
@@ -181,6 +183,9 @@ export declare const SETUP_ENV_DENYLIST: readonly string[];
 export declare function redactSecretText(text: string): string;
 /** The same blanking with no length cap, for a log that keeps its length (a flow script's output). */
 export declare function redactSecretAssignments(text: string): string;
+/** A build's network (egress.ts): the one its approval sealed, or — sealed before network policies existed — the
+ * narrowed legacy one (provider hosts and the repository's registries, nothing added since). */
+export declare function launchNetworkOf(store: Store, taskRef: number, profile: ExecutionProfile): LaunchNetwork;
 export declare function proveApprovedProfile(scope: Scope | null, given: {
     provider: string;
     model: string | undefined;

package/dist/builder.js

@@ -1,3 +1,5 @@
+import { legacyNetwork, repositoryEcosystems } from "./egress.js";
+import { isAcpProvider } from "./acp-agents.js";
 import { OBSERVATION_MAILBOX, observationBrief, parseObservationCases, collectObservations } from "./observations.js";
 import { checkCommandFor, effectiveCheckLevel, recordRunCheckLevel } from "./check-levels.js";
 import { queueBatchCheck } from "./batch-checks.js";
@@ -47,7 +49,7 @@ import { stopRequestedFor, stopWords, underStopWatch } from "./task-control.js";
 import { witnessedRunner } from "./process-custody.js";
 import { runWithIsolatedDatabase } from "./child-database.js";
 import { recordWorktreeProcess, saveWorkPatch } from "./worktree.js";
-import { approvalOf, digestOf, profileDigestOf, routeParityProblem } from "./scope.js";
+import { approvalOf, digestOf, idleClock, isAcpProfile, profileDigestOf, routeParityProblem, watchdogsOf } from "./scope.js";
 import { legOf, routeDigestOf, routeFromJson } from "./phase-routing.js";
 import { execFileSync } from "node:child_process";
 import { currentClaim, heartbeat, SYNC_MAX_AGE_MS, finalize } from "./claim.js";
@@ -59,6 +61,7 @@ import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { invokeAgent } from "./invoke.js";
 import { TELEGRAM_TOKEN_ENVS } from "./names.js";
 import { OPENROUTER_ENV_KEY, auditOf, ALL_CREDENTIAL_ENV } from "./provider.js";
+import { liveLogContext } from "./live-detail.js";
 import { openLiveLog } from "./live.js";
 import { fence } from "./brief-fence.js";
 import { closeSteerMailbox, openSteerMailbox, STEER_HANDLED } from "./steer-mailbox.js";
@@ -199,12 +202,17 @@ function repairModelOf(profile, request) {
 function profileWantsSkip(profile) {
     return ((profile.provider === "claude" && profile.permissionArgv === "bypassPermissions") ||
         ((profile.provider === "codex" || profile.provider === "openrouter") && profile.sandboxMode === "danger-full-access") ||
-        (profile.provider === "gemini" && profile.approvalArgv === "yolo"));
+        (profile.provider === "gemini" && profile.approvalArgv === "yolo") ||
+        // An ACP agent's only posture is full access inside the fence.
+        isAcpProfile(profile));
 }
 const PROVIDER_VERSIONS = new Map();
 /** Provenance only (finding 20): a best-effort `--version` probe, cached
  * per process, null on any failure — never authority, never a refusal. */
 function providerVersionOf(provider) {
+    // An ACP agent is never run outside the gateway, not even for --version: its version is what its check recorded.
+    if (isAcpProvider(provider))
+        return null;
     if (PROVIDER_VERSIONS.has(provider))
         return PROVIDER_VERSIONS.get(provider) ?? null;
     let version = null;
@@ -221,6 +229,14 @@ function providerVersionOf(provider) {
     PROVIDER_VERSIONS.set(provider, version);
     return version;
 }
+/** A build's network (egress.ts): the one its approval sealed, or — sealed before network policies existed — the
+ * narrowed legacy one (provider hosts and the repository's registries, nothing added since). */
+export function launchNetworkOf(store, taskRef, profile) {
+    if (profile.network !== undefined)
+        return { policy: profile.network };
+    const repo = store.refForId(taskRef)?.repo ?? null;
+    return { policy: legacyNetwork(profile.provider, repo === null ? [] : repositoryEcosystems(repo)) };
+}
 export function proveApprovedProfile(scope, given) {
     // The raw terms first (raw authority repair): a scope whose stored terms
     // do not read back exactly proves nothing — not the filtered reading.
@@ -293,7 +309,7 @@ export function proveApprovedProfile(scope, given) {
     if (given.timeoutMs !== undefined && given.timeoutMs !== snapshot.timeoutSeconds * 1000) {
         return {
             ok: false,
-            message: `approved with a ${snapshot.timeoutSeconds}s ${snapshot.timeoutKind === "idle" ? "no-progress window" : "clock"}, asked for ${Math.round(given.timeoutMs / 1000)}s — re-approve to change it (stale-approval)`,
+            message: `approved with a ${snapshot.timeoutSeconds}s ${idleClock(snapshot) ? "no-progress window" : "clock"}, asked for ${Math.round(given.timeoutMs / 1000)}s — re-approve to change it (stale-approval)`,
         };
     }
     return {
@@ -1123,7 +1139,7 @@ export async function build(store, request) {
                 maxTurns: effective.maxTurns ?? maxTurns,
                 finished: () => handoffFiles.some(name => existsSync(join(worktree, name))),
                 // A paused build can wait as long as the idle limit allows (live-input.ts idleLimit); a wall-clock profile has none.
-                onOpen: () => store.markLiveInputOpened(request.runId, clock(), effective.profile.timeoutKind === "idle" ? effective.timeoutMs : null),
+                onOpen: () => store.markLiveInputOpened(request.runId, clock(), idleClock(effective.profile) ? effective.timeoutMs : null),
                 onClose: () => store.markLiveInputClosed(request.runId, clock()),
                 onPaused: () => store.markRunPaused(request.runId, clock()),
             });
@@ -1153,7 +1169,7 @@ export async function build(store, request) {
     // Every streaming transport emits events now (peek); a file that cannot
     // open is a null, and a null never costs a build.
     // What the agent did last rides the same stream into one row (live tasks).
-    const liveLog = withAgentTurns(withRunActivity(openLiveLog(root, request.runId), store, request.runId, clock), (state, at) => { if (attemptKey !== null)
+    const liveLog = withAgentTurns(withRunActivity(openLiveLog(root, request.runId, liveLogContext(store, taskRef, worktree)), store, request.runId, clock), (state, at) => { if (attemptKey !== null)
         recordAgentTurn(store, { run: request.runId, attemptKey, state, at }); }, clock, (open, at) => { if (attemptKey !== null)
         noteOpenTool(store, request.runId, attemptKey, open, at); });
     // The retry base (steering fix for run 1465's proof): the SAME pinned
@@ -1291,10 +1307,9 @@ export async function build(store, request) {
             ...(liveSession === null ? {} : { liveInput: liveSession }),
             // New approvals bind a no-progress watchdog, not a deadline. Legacy
             // snapshots carry no timeoutKind and retain their wall-clock terms.
-            ...(effective.profile.timeoutKind === "idle"
-                ? { idleTimeoutMs: effective.timeoutMs }
-                : { timeoutMs: effective.timeoutMs }),
+            ...watchdogsOf(effective.profile, effective.timeoutMs),
             omitEnv: AGENT_ENV_DENYLIST,
+            network: launchNetworkOf(store, request.taskRef, effective.profile),
             ...(agent === undefined ? {} : { runner: agent }),
             onSpawn: (pid) => { spawned = true; request.onProviderSpawn?.(pid); },
             onStreamEvent: (event) => liveLog.observe(event),
@@ -1490,7 +1505,7 @@ export async function settleProviderOutcome(captured, result) {
         return {
             ok: false,
             reason: "timeout",
-            message: effective.profile.timeoutKind === "idle"
+            message: idleClock(effective.profile)
                 ? `the builder made no observable progress for ${Math.round(timeoutMs / 60_000)} minutes and was stopped — whatever it wrote is still in ${worktree}`
                 : `the builder ran past ${Math.round(timeoutMs / 60_000)} minutes and was stopped — whatever it wrote is still in ${worktree}`,
         };
@@ -2614,7 +2629,8 @@ async function resumeUnhandedWork(captured, sessionId) {
         if (request.leaseId !== undefined && !heartbeat(store, request.leaseId, clock()).ok) {
             return { ok: false, reason: "fenced", message: `${taskId}'s lease did not survive the resumed turn — the work is still in ${worktree}` };
         }
-        if (store.budgetGate(clock())({ ...store.budgetSubject(request.taskRef), agents: [{ provider, billing: store.runBilling(request.runId) ?? store.agentsFor([provider])[0].billing }] }).over !== null)
+        // An ACP agent's turn bills as its own model's declaration on this runner, never as the attempt it continues.
+        if (store.budgetGate(clock())({ ...store.budgetSubject(request.taskRef), agents: [isAcpProvider(provider) ? store.agentFor(provider, model ?? null, request.runner) : { provider, billing: store.runBilling(request.runId) ?? store.agentsFor([provider])[0].billing }] }).over !== null)
             break;
         if (store.agentPolicyRefusal(provider, model ?? null) !== null)
             break;
@@ -2634,8 +2650,9 @@ async function resumeUnhandedWork(captured, sessionId) {
             ...(request.maxBudgetUsd === undefined ? {} : { maxBudgetUsd: request.maxBudgetUsd }),
         }, {
             cwd: worktree,
-            ...(effective.profile.timeoutKind === "idle" ? { idleTimeoutMs: effective.timeoutMs } : { timeoutMs: effective.timeoutMs }),
+            ...watchdogsOf(effective.profile, effective.timeoutMs),
             omitEnv: AGENT_ENV_DENYLIST,
+            network: launchNetworkOf(store, request.taskRef, effective.profile),
             ...(agent === undefined ? {} : { runner: agent }),
             ...(request.onProviderSpawn === undefined ? {} : { onSpawn: request.onProviderSpawn }),
             clock,
@@ -2811,7 +2828,8 @@ async function ingestPark(args) {
         }
         // v105: a repair turn spends too — a budget used up since the build began stops further turns (billed to a key).
         // It bills as the attempt it mends did.
-        if (store.budgetGate(clock())({ ...store.budgetSubject(request.taskRef), agents: [{ provider: repairProvider, billing: store.runBilling(request.runId) ?? store.agentsFor([repairProvider])[0].billing }] }).over !== null)
+        // An ACP repair bills as its own model's declaration on this runner, never as the attempt it mends.
+        if (store.budgetGate(clock())({ ...store.budgetSubject(request.taskRef), agents: [isAcpProvider(repairProvider) ? store.agentFor(repairProvider, repairModel ?? null, request.runner) : { provider: repairProvider, billing: store.runBilling(request.runId) ?? store.agentsFor([repairProvider])[0].billing }] }).over !== null)
             break;
         // Sprint 8: nor does a repair run on a provider or model the organisation policy doesn't allow.
         if (store.agentPolicyRefusal(repairProvider, repairModel ?? null) !== null)
@@ -2845,8 +2863,11 @@ async function ingestPark(args) {
                 : {}),
         }, {
             cwd: worktree,
-            timeoutMs: args.profile !== undefined ? args.profile.repairTimeoutSeconds * 1000 : REPAIR_TIMEOUT_MS,
+            ...(args.profile !== undefined && isAcpProfile(args.profile)
+                ? watchdogsOf(args.profile, args.profile.repairTimeoutSeconds * 1000, true)
+                : { timeoutMs: args.profile !== undefined ? args.profile.repairTimeoutSeconds * 1000 : REPAIR_TIMEOUT_MS }),
             omitEnv: AGENT_ENV_DENYLIST,
+            ...(args.profile === undefined ? {} : { network: launchNetworkOf(store, request.taskRef, args.profile) }),
             ...(agent === undefined ? {} : { runner: agent }),
             ...(request.onProviderSpawn === undefined ? {} : { onSpawn: request.onProviderSpawn }),
             clock,

package/dist/chat-actions.d.ts

@@ -68,6 +68,16 @@ export declare const CHAT_ACTIONS: {
         readonly protected: false;
         readonly password: false;
     };
+    readonly sweep_file: {
+        readonly label: "Start sweep";
+        readonly protected: true;
+        readonly password: true;
+    };
+    readonly sweep_cancel_rest: {
+        readonly label: "Cancel the rest";
+        readonly protected: false;
+        readonly password: false;
+    };
     readonly flow_edit: {
         readonly label: "Save flow";
         readonly protected: false;
@@ -256,7 +266,7 @@ export declare function sharedActionReviewPath(id: number): string;
 export declare function mintSharedActionReview(store: Store, who: VerifiedApprover, id: number, root: string, now: Date): {
     payload: {
         version: 1;
-        operation: "decision_record" | "decision_retire" | "flow_card_add" | "flow_card_approve" | "flow_card_assign" | "flow_card_cancel" | "flow_card_choose" | "flow_card_comment" | "flow_card_move" | "flow_card_send_back" | "flow_card_watch" | "flow_create" | "flow_edit" | "flow_script_save" | "flow_starter" | "flow_trigger_add" | "flow_trigger_pause" | "flow_trigger_remove" | "flow_trigger_resume" | "kit_setup" | "knowledge_instructions" | "knowledge_remove" | "knowledge_restore" | "knowledge_save" | "lead_about_you" | "result_accept" | "scope_approve" | "skill_disable" | "skill_enable" | "skill_import" | "skill_restore" | "skill_test" | "subagent_answer" | "subagent_ask" | "subagent_create" | "subagent_memory" | "subagent_note" | "subagent_routine" | "subagent_soul" | "subagent_state" | "subagent_tools" | "subagent_undo" | "task_cancel" | "task_resume" | "tool_add" | "tool_remove";
+        operation: "decision_record" | "decision_retire" | "flow_card_add" | "flow_card_approve" | "flow_card_assign" | "flow_card_cancel" | "flow_card_choose" | "flow_card_comment" | "flow_card_move" | "flow_card_send_back" | "flow_card_watch" | "flow_create" | "flow_edit" | "flow_script_save" | "flow_starter" | "flow_trigger_add" | "flow_trigger_pause" | "flow_trigger_remove" | "flow_trigger_resume" | "kit_setup" | "knowledge_instructions" | "knowledge_remove" | "knowledge_restore" | "knowledge_save" | "lead_about_you" | "result_accept" | "scope_approve" | "skill_disable" | "skill_enable" | "skill_import" | "skill_restore" | "skill_test" | "subagent_answer" | "subagent_ask" | "subagent_create" | "subagent_memory" | "subagent_note" | "subagent_routine" | "subagent_soul" | "subagent_state" | "subagent_tools" | "subagent_undo" | "sweep_cancel_rest" | "sweep_file" | "task_cancel" | "task_resume" | "tool_add" | "tool_remove";
         request: {
             [x: string]: unknown;
         };
@@ -286,6 +296,8 @@ export declare function executeSharedAction(store: Store, who: VerifiedApprover,
     said: string;
     taskId: string | null;
     href?: string;
+    awaiting?: true;
+    already?: true;
 } | {
     ok: false;
     reason: "needs-confirm" | "stale" | "refused";