toolroll 0.9.63 → 0.9.65

package/dist/project-tools.js

@@ -29,6 +29,7 @@ import { fileURLToPath } from "node:url";
 import { scanForSecrets } from "./evidence.js";
 import { namedPath } from "./names.js";
 import { startToolBroker } from "./tool-broker.js";
+import { isAcpProvider } from "./acp-agents.js";
 import { SecretStoreError, destroyOwnFile, prepareSecretFolder, registerSecretFolder, pathIn, readOwnFile, readSealed, removeValue, secretBackend, secretFolder, secretStorage, serviceOf, withSecretLock, withSecretLockAsync, writeOwnFile, writeSealed } from "./tool-secret-store.js";
 import { ACCESS, GRANTED, REFRESH, mintRunToken, mintsRunTokens, oneAtATime, runScope, scopeList, signedIn } from "./oauth-run-token.js";
 import { HEADER_NAME, SECRET_NAME, TOOL_NAME as NAME, TOOL_SPEC_LIMITS as LIMITS, readToolSpec } from "./contracts/integration-metadata.js";
@@ -710,7 +711,7 @@ export async function claudeToolArgs(launch, options = {}) {
         omitEnv: [],
         cleanup,
         privateDir: dir,
-        ...(broker === null ? {} : { serverPids: broker.pids }),
+        ...(broker === null ? {} : { serverPids: broker.pids, brokerPort: broker.port }),
     };
 }
 /** Where the tool launcher lives beside this module, built. */
@@ -749,7 +750,7 @@ export async function codexToolArgs(launch, options = {}) {
         if (enabled !== undefined)
             argv.push("-c", `${key}.enabled_tools=${tomlList(enabled)}`);
     }
-    return { argv, env: {}, omitEnv: [], cleanup, privateDir: dir, serverPids: broker.pids };
+    return { argv, env: {}, omitEnv: [], cleanup, privateDir: dir, serverPids: broker.pids, brokerPort: broker.port };
 }
 /** Gemini: no way yet to hand it exactly these servers, so it gets none. */
 export const GEMINI_NO_TOOLS_ARGV = ["--allowed-mcp-server-names", "standing-orders-none"];
@@ -846,8 +847,9 @@ export function secretToolRefusal(provider, containment) {
 export async function prepareRunTools(store, runId, provider, options) {
     const launch = limitedTo(toolLaunchFor(store, runId, options.home), options.readOnly, options.withheld);
     // A local server with secrets starts only where the build can't read its environment; the rest are left out,
-    // saying why, before the broker exists. Gemini starts none (below).
-    const refusal = provider === "gemini" ? null : secretToolRefusal(provider, options.containment);
+    // saying why, before the broker exists. Gemini and ACP agents start none (below).
+    const toolless = provider === "gemini" || isAcpProvider(provider);
+    const refusal = toolless ? null : secretToolRefusal(provider, options.containment);
     if (refusal !== null) {
         launch.tools = launch.tools.filter(one => {
             if (one.spec.transport === "http" || Object.keys(one.values).length === 0)
@@ -856,14 +858,15 @@ export async function prepareRunTools(store, runId, provider, options) {
             return false;
         });
     }
-    const revokes = provider === "gemini" ? [] : await signInRun(launch, { readOnly: options.readOnly !== undefined, now: options.now, ...(options.home === undefined ? {} : { home: options.home }), ...(options.fetcher === undefined ? {} : { fetcher: options.fetcher }) });
+    const revokes = toolless ? [] : await signInRun(launch, { readOnly: options.readOnly !== undefined, now: options.now, ...(options.home === undefined ? {} : { home: options.home }), ...(options.fetcher === undefined ? {} : { fetcher: options.fetcher }) });
     const revoke = () => Promise.all(revokes.splice(0).map(one => one())).then(() => undefined);
     const offered = { ...(options.readOnly === undefined ? {} : { enabledTools: options.readOnly }), ...(options.broker === undefined ? {} : { broker: options.broker }) };
     let launched;
     try {
         launched = provider === "claude" ? await claudeToolArgs(launch, offered)
             : provider === "codex" || provider === "openrouter" ? await codexToolArgs(launch, offered)
-                : { argv: [...GEMINI_NO_TOOLS_ARGV], env: {}, omitEnv: [], cleanup: () => undefined };
+                : provider === "gemini" ? { argv: [...GEMINI_NO_TOOLS_ARGV], env: {}, omitEnv: [], cleanup: () => undefined }
+                    : { argv: [], env: {}, omitEnv: [], cleanup: () => undefined };
     }
     catch (error) {
         // Tokens were made for a run that won't start: each is revoked, and the run with them.
@@ -874,13 +877,13 @@ export async function prepareRunTools(store, runId, provider, options) {
     }
     // The run's own sign-ins end with it: the broker closes first, so nothing uses a token as it is revoked.
     const prepared = revokes.length === 0 ? launched : { ...launched, cleanup: () => { launched.cleanup(); void revoke(); } };
-    const skipped = provider === "gemini"
-        ? [...launch.skipped, ...launch.tools.map(one => ({ name: one.spec.name, reason: "Gemini builds can't use project tools yet" }))]
+    const skipped = toolless
+        ? [...launch.skipped, ...launch.tools.map(one => ({ name: one.spec.name, reason: provider === "gemini" ? "Gemini builds can't use project tools yet" : "ACP agents can't use project tools yet" }))]
         : launch.skipped;
     try {
         store.recordRunTools(runId, JSON.stringify({
             provider,
-            tools: provider === "gemini" ? [] : launch.tools.map(one => ({ name: one.spec.name, digest: one.digest })),
+            tools: toolless ? [] : launch.tools.map(one => ({ name: one.spec.name, digest: one.digest })),
             skipped,
         }), options.now);
     }

package/dist/provider-auth.d.ts

@@ -14,16 +14,17 @@
  */
 import type { Store } from "./store.js";
 import { type ProviderId } from "./provider.js";
+import type { AuthMode } from "./keys.js";
 /** Every sign-in message's dedupe key starts here: `signin:<kind>:<provider>:<ordinal>:<person>`.
  * Not a lifecycle (`life:`) key: those are progress chatter, and an undelivered
  * one stays out of the attention list — this one needs a person. */
 export declare const SIGN_IN_KEY_PREFIX = "signin:";
-export declare const PROVIDER_AUTH_SCHEMA = "\nCREATE TABLE IF NOT EXISTS provider_auth_pause (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  provider    TEXT NOT NULL,\n  ordinal     INTEGER NOT NULL,\n  auth_mode   TEXT NOT NULL DEFAULT 'subscription' CHECK (auth_mode IN ('subscription', 'api-key')),\n  opened_at   TEXT NOT NULL,\n  first_run   INTEGER,\n  task_ref    INTEGER,\n  runs        INTEGER NOT NULL DEFAULT 1,\n  -- 1 once a sign-in probe during this pause said the provider is signed out:\n  -- only a probe that then sees it signed in again may lift the pause.\n  probe_saw_out INTEGER NOT NULL DEFAULT 0,\n  lifted_at   TEXT,\n  lifted_by   TEXT,\n  lifted_how  TEXT CHECK (lifted_how IS NULL OR lifted_how IN ('run', 'probe', 'person')),\n  resumed     INTEGER,\n  -- The last task let through as a trial while paused: a sign-in check can\n  -- say \"logged in\" for a session that no longer works, so a real run decides.\n  last_trial_at TEXT,\n  UNIQUE (provider, ordinal)\n);\nCREATE UNIQUE INDEX IF NOT EXISTS provider_auth_pause_open ON provider_auth_pause (provider) WHERE lifted_at IS NULL;\n";
+export declare const PROVIDER_AUTH_SCHEMA = "\nCREATE TABLE IF NOT EXISTS provider_auth_pause (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  provider    TEXT NOT NULL,\n  ordinal     INTEGER NOT NULL,\n  auth_mode   TEXT NOT NULL DEFAULT 'subscription' CHECK (auth_mode IN ('subscription', 'api-key', 'agent-login')),\n  opened_at   TEXT NOT NULL,\n  first_run   INTEGER,\n  task_ref    INTEGER,\n  runs        INTEGER NOT NULL DEFAULT 1,\n  -- 1 once a sign-in probe during this pause said the provider is signed out:\n  -- only a probe that then sees it signed in again may lift the pause.\n  probe_saw_out INTEGER NOT NULL DEFAULT 0,\n  lifted_at   TEXT,\n  lifted_by   TEXT,\n  lifted_how  TEXT CHECK (lifted_how IS NULL OR lifted_how IN ('run', 'probe', 'person')),\n  resumed     INTEGER,\n  -- The last task let through as a trial while paused: a sign-in check can\n  -- say \"logged in\" for a session that no longer works, so a real run decides.\n  last_trial_at TEXT,\n  UNIQUE (provider, ordinal)\n);\nCREATE UNIQUE INDEX IF NOT EXISTS provider_auth_pause_open ON provider_auth_pause (provider) WHERE lifted_at IS NULL;\n";
 export type AuthPause = {
     id: number;
     provider: ProviderId;
     ordinal: number;
-    authMode: "subscription" | "api-key";
+    authMode: AuthMode;
     openedAt: string;
     firstRun: number | null;
     taskRef: number | null;
@@ -63,7 +64,7 @@ export declare function openAuthPauses(store: Store): AuthPause[];
  */
 export declare function pauseForAuth(store: Store, args: {
     provider: string;
-    authMode: "subscription" | "api-key" | null;
+    authMode: AuthMode | null;
     runId: number;
     taskRef: number;
     now: Date;

package/dist/provider-auth.js

@@ -1,4 +1,5 @@
 import { PROVIDER_IDS } from "./provider.js";
+import { withAcp } from "./acp-agents.js";
 /** Every sign-in message's dedupe key starts here: `signin:<kind>:<provider>:<ordinal>:<person>`.
  * Not a lifecycle (`life:`) key: those are progress chatter, and an undelivered
  * one stays out of the attention list — this one needs a person. */
@@ -8,7 +9,7 @@ CREATE TABLE IF NOT EXISTS provider_auth_pause (
   id          INTEGER PRIMARY KEY AUTOINCREMENT,
   provider    TEXT NOT NULL,
   ordinal     INTEGER NOT NULL,
-  auth_mode   TEXT NOT NULL DEFAULT 'subscription' CHECK (auth_mode IN ('subscription', 'api-key')),
+  auth_mode   TEXT NOT NULL DEFAULT 'subscription' CHECK (auth_mode IN ('subscription', 'api-key', 'agent-login')),
   opened_at   TEXT NOT NULL,
   first_run   INTEGER,
   task_ref    INTEGER,
@@ -27,8 +28,8 @@ CREATE TABLE IF NOT EXISTS provider_auth_pause (
 );
 CREATE UNIQUE INDEX IF NOT EXISTS provider_auth_pause_open ON provider_auth_pause (provider) WHERE lifted_at IS NULL;
 `;
-const NAMES = { claude: "Claude", codex: "Codex", openrouter: "OpenRouter", gemini: "Gemini" };
-const SIGN_IN = { claude: "claude /login", codex: "codex login", gemini: "gemini", openrouter: "toolroll keys set openrouter" };
+const NAMES = withAcp({ claude: "Claude", codex: "Codex", openrouter: "OpenRouter", gemini: "Gemini" }, agent => agent.name);
+const SIGN_IN = withAcp({ claude: "claude /login", codex: "codex login", gemini: "gemini", openrouter: "toolroll keys set openrouter" }, agent => agent.signIn);
 export function providerName(provider) {
     return PROVIDER_IDS.includes(provider) ? NAMES[provider] : provider;
 }
@@ -57,7 +58,7 @@ function readPause(row) {
         id: Number(row["id"]),
         provider: String(row["provider"]),
         ordinal: Number(row["ordinal"]),
-        authMode: row["auth_mode"] === "api-key" ? "api-key" : "subscription",
+        authMode: row["auth_mode"] === "api-key" ? "api-key" : row["auth_mode"] === "agent-login" ? "agent-login" : "subscription",
         openedAt: String(row["opened_at"]),
         firstRun: row["first_run"] == null ? null : Number(row["first_run"]),
         taskRef: row["task_ref"] == null ? null : Number(row["task_ref"]),

package/dist/provider-connection.d.ts

@@ -1,5 +1,6 @@
 import { run, type ExecResult } from "./exec.js";
 import { type ProviderId } from "./provider.js";
+import { type KeyedProviderId } from "./acp-agents.js";
 import { type AuthMode, type KeyVerdict } from "./keys.js";
 export type ProviderConnection = {
     state: "connected" | "signed-out" | "not-installed" | "unverified" | "key-present" | "key-works" | "key-refused" | "missing-key";
@@ -18,5 +19,5 @@ export declare function createConnectionChecker(options?: {
     home?: string;
     clock?: () => Date;
     env?: NodeJS.ProcessEnv;
-    verify?: (provider: ProviderId, key: string) => Promise<KeyVerdict>;
+    verify?: (provider: KeyedProviderId, key: string) => Promise<KeyVerdict>;
 }): ConnectionChecker;

package/dist/provider-connection.js

@@ -2,6 +2,7 @@
 import { homedir } from "node:os";
 import { run } from "./exec.js";
 import { ALL_CREDENTIAL_ENV, inspectionOf } from "./provider.js";
+import { isAcpProvider } from "./acp-agents.js";
 import { keyStatus, PROVIDER_KEY_ENV, readAuthMode, readProviderKey, verifyProviderKey } from "./keys.js";
 export function signInFacts(provider, result, now = new Date()) {
     const base = { mode: "subscription", checkedAt: now.toISOString() };
@@ -46,6 +47,10 @@ export function createConnectionChecker(options = {}) {
     const cache = new Map();
     const pending = new Map();
     return async (provider, fresh = false) => {
+        // An ACP agent is never run to ask how it is signed in (nothing executes it outside the gateway): what is known
+        // of it is its conformance check, read elsewhere. Here it is simply unverified.
+        if (isAcpProvider(provider))
+            return { state: "unverified", mode: "agent-login", checkedAt: clock().toISOString() };
         const mode = readAuthMode(provider, home);
         const keyFacts = keyStatus(provider, home);
         const ambient = !!(options.env ?? process.env)[PROVIDER_KEY_ENV[provider]];

package/dist/provider.d.ts

@@ -175,6 +175,29 @@ export type ParsedEnvelope = {
      * failure terminal seen.
      */
     structuralTerminal: import("./exhaustion.js").StructuralTerminal | null;
+    /** What an ACP agent itself reported it used — kept on the run, never priced. Absent for every other dialect. */
+    agentReportedUsage?: string | null;
+    /** An ACP conversation's facts the conformance check reads (acp-client.ts AcpEnvelope): nothing else does. */
+    acp?: {
+        offered: string[];
+        exit: {
+            how: "eof" | "term" | "kill" | "self" | "error";
+            leftover: boolean;
+            timedOut: boolean;
+        } | null;
+        agent: {
+            name: string;
+            version: string;
+        } | null;
+        stop: string | null;
+        /** The conversation broke the protocol (acpParse's protocolError), or null. */
+        protocolError: string | null;
+        /** The plane's isolation probes for a check's first step (invoke.ts), when it ran them. */
+        isolation?: {
+            fileDenied: boolean;
+            envClear: boolean;
+        };
+    };
 };
 type Adapter = {
     binary: string;
@@ -266,13 +289,13 @@ export declare function adapterFor(provider: ProviderId): Adapter;
  */
 export type ProviderAudit = {
     /** How output reaches us — and therefore which signals can exist at all. */
-    transport: "buffered-json" | "streaming-jsonl";
+    transport: "buffered-json" | "streaming-jsonl" | "acp-jsonrpc";
     /** Whether a later invocation can resume this provider's session. */
     resume: "native" | "none";
     /** The event whose absence on a failed run means "never initialized".
      * CAPABILITY metadata, not a per-run observation (arc 1 finding 16):
      * whether a given run actually saw it lives in ParsedEnvelope.initObserved. */
-    initSignal: "thread.started" | "system-init" | "init-event" | "none";
+    initSignal: "thread.started" | "system-init" | "init-event" | "acp-session" | "none";
     /** How session identity is established: "announced" = read back from the
      * harness's own stream; "minted" = the PLANE chooses the id pre-spawn
      * (gemini --session-id) and the envelope must echo it (Phase 3 A5). */

package/dist/provider.js

@@ -18,13 +18,16 @@
  * TOML-quoted deterministically, and the API key excluded from every
  * shell the model itself launches (Codex provider review, Q5).
  */
+import { INTERPRETER_INJECTION_ENV } from "./acp-attest.js";
 import { claudeFenceSettings, codexFenceArgv } from "./agent-fence.js";
 import { claudeSteerHooks } from "./steer-mailbox.js";
 import {} from "./exec.js";
-import { runStreamJsonl, runClaudeStreamJsonl, runGeminiStreamJsonl, CLAUDE_COST_UNKNOWN } from "./exec.js";
+import { runStreamJsonl, runClaudeStreamJsonl, runGeminiStreamJsonl, runAcpSession, CLAUDE_COST_UNKNOWN } from "./exec.js";
 import { scanForSecrets } from "./evidence.js";
 import { FINDINGS_MODEL_SCHEMA } from "./contracts/review-findings.js";
 import { REVIEW_OUTPUT_LIMITS } from "./structured-output.js";
+import { ACP_AGENTS, isAcpProvider, withAcp } from "./acp-agents.js";
+import { acpParse } from "./acp-client.js";
 import { agentSpecSchema, MODEL_ID, modelIdSchema, PROVIDER_ID_VALUES, providerIdSchema } from "./contracts/provider.js";
 export const PROVIDER_IDS = PROVIDER_ID_VALUES;
 export function isProviderId(value) {
@@ -787,12 +790,13 @@ export function safeDiagnostic(text) {
  * provider gets its OWN keys and nobody else's: S4 (live spike) confirmed
  * what inheritance makes true by construction — an agent's shell reads its
  * process env, so a foreign key in that env is a foreign key disclosed. */
-const CREDENTIAL_ENV = {
+const CREDENTIAL_ENV = withAcp({
     claude: ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"],
     codex: ["OPENAI_API_KEY", "CODEX_API_KEY"],
     openrouter: [OPENROUTER_ENV_KEY],
     gemini: ["GEMINI_API_KEY", "GOOGLE_API_KEY"],
-};
+    // An ACP agent signs in its own way; Toolroll holds no key for it, so it sheds every key above.
+}, () => []);
 const foreignCredentialEnv = (own) => Object.entries(CREDENTIAL_ENV)
     .filter(([provider]) => provider !== own)
     .flatMap(([, keys]) => [...keys]);
@@ -800,7 +804,40 @@ const foreignCredentialEnv = (own) => Object.entries(CREDENTIAL_ENV)
  * since a feature check needs no key at all (Codex gemini verify,
  * finding 2). Agent spawns keep their own; probes keep none. */
 export const ALL_CREDENTIAL_ENV = Object.values(CREDENTIAL_ENV).flat();
-const ADAPTERS = {
+/**
+ * An ACP agent's retained record (acp-client.ts) read into the gateway's
+ * envelope. Its own usage report is never priced: tokens and cost stay null.
+ */
+function acpEnvelope(stdout) {
+    const read = acpParse(stdout);
+    return {
+        sessionId: read.sessionId,
+        protocolError: read.protocolError,
+        finalMessage: read.finalMessage,
+        tokensIn: null,
+        tokensOut: null,
+        costUsd: null,
+        usageRaw: null,
+        initObserved: read.initObserved,
+        promptConsumed: read.promptConsumed,
+        diagnostic: read.diagnostic === null ? null : safeDiagnostic(read.diagnostic),
+        structuralTerminal: read.terminal === null ? null : { failed: true, text: read.terminal.text === null ? null : safeDiagnostic(read.terminal.text), code: read.terminal.code.slice(0, 128) },
+        agentReportedUsage: read.reportedUsage,
+        acp: { offered: read.offered, exit: read.exit, agent: read.agent, stop: read.stop, protocolError: read.protocolError },
+    };
+}
+function acpAdapter(provider) {
+    return {
+        binary: ACP_AGENTS[provider].binary,
+        argv: () => [...ACP_AGENTS[provider].argv],
+        parse: acpEnvelope,
+        defaultRunner: runAcpSession,
+        // Every key Toolroll knows, and whatever would make the pinned interpreter load code beside the checked script.
+        extraOmitEnv: [...foreignCredentialEnv(provider), ...INTERPRETER_INJECTION_ENV],
+        clampTimeout: (_phase, requested) => requested,
+    };
+}
+const ADAPTERS = withAcp({
     claude: {
         binary: "claude",
         argv: claudeArgv,
@@ -852,7 +889,7 @@ const ADAPTERS = {
         extraOmitEnv: foreignCredentialEnv("gemini"),
         clampTimeout: (phase, requested) => Math.min(requested, GEMINI_TIMEOUT_CAP_MS[phase]),
     },
-};
+}, (_agent, provider) => acpAdapter(provider));
 /**
  * The spawning surface. Imported by invoke.ts and NOWHERE else — the
  * architecture test reads imports, not string literals, because provider
@@ -861,7 +898,7 @@ const ADAPTERS = {
 export function adapterFor(provider) {
     return ADAPTERS[provider];
 }
-const AUDITS = {
+const AUDITS = withAcp({
     claude: {
         transport: "streaming-jsonl",
         resume: "native",
@@ -923,8 +960,17 @@ const AUDITS = {
             "trusted-folder store (S2, live at 0.57.0: headless REFUSES untrusted directories; the plane grants --skip-trust per-invocation to its own leased worktrees)",
         ],
     },
-};
-export const MONEY_CAPABILITIES = {
+}, agent => ({
+    // One ACP conversation per build: the prompt's answer is the only success (acp-client.ts), so exit 0 alone is never believed.
+    transport: "acp-jsonrpc",
+    resume: "none",
+    initSignal: "acp-session",
+    sessionIdentity: "announced",
+    terminalContract: "required",
+    isolation: { flag: agent.argv.filter(one => one.startsWith("--") && one !== "--acp").join(" ") || null, resumeSafe: null, enforced: agent.argv.some(one => one.startsWith("--") && one !== "--acp") },
+    configSurface: [...agent.configSurface],
+}));
+export const MONEY_CAPABILITIES = withAcp({
     claude: {
         incrementalUsage: true,
         nativeDollarCapFlag: "--max-budget-usd",
@@ -947,7 +993,12 @@ export const MONEY_CAPABILITIES = {
         // numbers cover that invocation only (conformance fixture j).
         usageSemantics: "per-invocation",
     },
-};
+}, () => ({
+    // ACP carries no dollars Toolroll trusts: an agent's own usage report is kept apart, unpriced.
+    incrementalUsage: false,
+    nativeDollarCapFlag: null,
+    usageSemantics: "per-invocation",
+}));
 /**
  * The fail-closed budget-flag probe (finding 24's amendment): resolve
  * the EXACT executable that will spawn, read its version, and prove the
@@ -997,6 +1048,9 @@ export function validateSpec(spec) {
     if (spec.provider === "gemini" && spec.model === null) {
         return { ok: false, problem: "model: gemini needs an explicit model — the harness default drifts with its releases" };
     }
+    if (isAcpProvider(spec.provider) && spec.model === null) {
+        return { ok: false, problem: `model: ${ACP_AGENTS[spec.provider].name} needs an explicit model — one it offered when it was checked` };
+    }
     return { ok: true };
 }
 /**

package/dist/pull-request-ui.js

@@ -1,11 +1,11 @@
 /** Settings → Projects → Pull requests: one project's pull-request setup, in plain words. Off shows what setup
  * found (or what to fix) and one Turn on; on shows where pull requests go and how they merge. Every change takes
  * the password; turning on restates the exact repository and branch that were checked. */
-import { html, postForm } from "./html.js";
+import { html, postForm, reauth } from "./html.js";
 const METHOD_WORDS = { squash: "Squash and merge", merge: "Merge commit", rebase: "Rebase and merge" };
 export function pullRequestSettingsHtml(view) {
     const post = (act, body, hidden = {}) => postForm("/settings/pull-requests", body, { attrs: { class: "card pr-settings" }, hidden: { repo: view.repo, act, ...hidden } });
-    const password = html `<label>Password<input type="password" name="password" autocomplete="current-password" required></label>`;
+    const password = html `${reauth(html `<label>Password<input type="password" name="password" autocomplete="current-password" required></label>`)}`;
     const notes = [
         view.said === null ? "" : html `<p class="notice" role="status">${view.said}</p>`,
         view.problem === null ? "" : html `<p class="problem" role="alert">${view.problem}</p>`,

package/dist/push.js

@@ -259,7 +259,7 @@ export async function pushPass(store, options) {
         // Renew and re-fence immediately before the network (finding 12).
         if (!store.renewPushClaim(pair.id, owner, pair.claimGeneration, PUSH_CLAIM_TTL_MS, clock()))
             continue;
-        const fenced = store.pushSendFence(pair.id, owner, pair.claimGeneration);
+        const fenced = store.pushSendFence(pair.id, owner, pair.claimGeneration, clock());
         if (fenced === null)
             continue; // resolved, retired, rotated, or lost — nothing to send
         const subscription = fenced.subscriptionRow;

package/dist/quick-start.d.ts

@@ -0,0 +1,24 @@
+import { type AttachSeams } from "./console-instance.js";
+export type QuickStartSeams = {
+    databaseFile: string;
+    cwd: string;
+    env: Record<string, string | undefined>;
+    build: string;
+    /** The repository's top folder for a directory, or null outside one. */
+    findRepo: (cwd: string) => Promise<string | null>;
+    /** Whether this installation already admitted the repository. */
+    enrolled: (repo: string) => Promise<boolean>;
+    /** The ordinary admission (`repos add`): its registry lock and ceilings, from this CLI's own database. */
+    admit: (repo: string) => Promise<number>;
+    /** `up`, for this repository. */
+    startUp: () => Promise<number>;
+    openBrowser: (url: string) => void | Promise<void>;
+    terminal: boolean;
+    attach?: AttachSeams;
+    /** Tests: the agent check (default: the environment and the process's ancestors). */
+    underAgent?: boolean;
+};
+/** Whether argv is a bare `toolroll` (nothing, or only --json). */
+export declare const isBareInvocation: (argv: readonly string[]) => boolean;
+/** null: not this command (outside a repository) — the caller scans as before. */
+export declare function runQuickStart(argv: readonly string[], write: (line: string) => void, seams: QuickStartSeams): Promise<number | null>;

package/dist/quick-start.js

@@ -0,0 +1,127 @@
+/**
+ * BARE `toolroll` IN A REPOSITORY (docs/plans/agents-cockpit.md B1): the two-action start.
+ *
+ * Inside a git repository, `toolroll` with nothing else (or only --json) either starts the console for it (`up`), or —
+ * when this installation's console is already running and PROVES it is (console-instance.ts: a fresh challenge on the
+ * discovery socket and on its HTTP listener, answered with the secret in the database this CLI opened itself) —
+ * adds the repository through the ordinary project admission and opens that proved console. Under an agent, or with
+ * --json, it starts nothing and changes nothing: it says what it would do. Outside a repository, it scans as before
+ * (the scan is also `toolroll scan`).
+ */
+import { lstatSync, realpathSync } from "node:fs";
+import { proveLiveConsole } from "./console-instance.js";
+import { underAgent } from "./prompt.js";
+import { envelopeJson } from "./envelope.js";
+import { createRequire } from "node:module";
+import { openStoreReadOnly, readSchemaVersion, SCHEMA_VERSION } from "./store.js";
+const EXIT = { ok: 0, refused: 3 };
+/** Whether argv is a bare `toolroll` (nothing, or only --json). */
+export const isBareInvocation = (argv) => argv.every(one => one === "--json");
+/** The database's schema version by the store's own strict reader, read without changing anything. */
+function schemaOf(file) {
+    try {
+        // Loaded only here, as the store loads it: the CLI's other commands never pay for (or warn about) it.
+        const { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
+        const db = new DatabaseSync(file, { readOnly: true });
+        try {
+            const read = readSchemaVersion(db);
+            return read.ok ? read : { ok: false };
+        }
+        finally {
+            db.close();
+        }
+    }
+    catch {
+        return { ok: false };
+    }
+}
+/** Whether the database file is there: "absent" only when the system says so (ENOENT), never for a path it won't show. */
+function databasePresence(file) {
+    try {
+        lstatSync(file);
+        return "present";
+    }
+    catch (error) {
+        return error.code === "ENOENT" ? "absent" : "unknown";
+    }
+}
+async function prove(seams) {
+    // Read only, never created or migrated, never cleaned up: proving changes nothing. "None" only when nothing of this
+    // build can be running on it (no database yet, or one older than this build, which `up` brings up to date); a
+    // database that can't be read, is mid-upgrade or is newer than this build can't be checked, so it is refused.
+    const none = { ok: false, state: "none", message: "no console is running" };
+    const unverifiable = (why) => ({ ok: false, state: "refused", message: `${why}, so a running console can't be checked — run \`toolroll up\` to see what's wrong` });
+    const presence = databasePresence(seams.databaseFile);
+    if (presence === "absent")
+        return none;
+    if (presence === "unknown")
+        return unverifiable("Toolroll's database can't be reached");
+    const schema = schemaOf(seams.databaseFile);
+    if (!schema.ok)
+        return unverifiable("Toolroll's database can't be read");
+    if (schema.version === null || (schema.version > 0 && schema.version < SCHEMA_VERSION))
+        return none;
+    if (schema.version !== SCHEMA_VERSION)
+        return unverifiable("Toolroll's database is being upgraded");
+    const store = openStoreReadOnly(seams.databaseFile);
+    if (store === null)
+        return unverifiable("Toolroll's database can't be read");
+    try {
+        return await proveLiveConsole(seams.databaseFile, store, seams.build, seams.attach ?? {});
+    }
+    catch {
+        return unverifiable("the running console couldn't be checked");
+    }
+    finally {
+        store.close();
+    }
+}
+/** null: not this command (outside a repository) — the caller scans as before. */
+export async function runQuickStart(argv, write, seams) {
+    const found = await seams.findRepo(seams.cwd);
+    if (found === null)
+        return null;
+    let repo = found;
+    try {
+        repo = realpathSync(found);
+    }
+    catch { /* as found */ }
+    const json = argv.includes("--json");
+    const dry = json || (seams.underAgent ?? underAgent(seams.env));
+    const proof = await prove(seams);
+    const enrolled = await seams.enrolled(repo);
+    const would = proof.ok ? (enrolled ? "open" : "add-and-open") : proof.state === "none" ? "start" : "refuse";
+    if (dry) {
+        // Nothing starts, nothing is added, nothing opens: what a person would get, in words or one envelope.
+        const words = would === "start" ? `Would start Toolroll for ${repo} (toolroll up).`
+            : would === "refuse" ? `Would refuse: ${proof.message}.`
+                : `Would ${would === "add-and-open" ? `add ${repo} and ` : ""}open the running console at ${proof.url}.`;
+        if (json)
+            write(envelopeJson({ ok: would !== "refuse", command: "toolroll", repo, would, ...(proof.ok ? { url: proof.url } : { console: proof.state, message: proof.message }), dryRun: true }));
+        else
+            write(words);
+        return would === "refuse" ? EXIT.refused : EXIT.ok;
+    }
+    if (!proof.ok && proof.state === "refused") {
+        write(`Toolroll can't attach: ${proof.message}.`);
+        return EXIT.refused;
+    }
+    if (!proof.ok)
+        return seams.startUp();
+    if (!enrolled) {
+        const admitted = await seams.admit(repo);
+        if (admitted !== 0)
+            return admitted;
+    }
+    // Whatever happened since the first proof (reading the registry, adding the project), the console is proved again,
+    // on both channels, right before its address is shown or opened — never a listener that took the port meanwhile.
+    const again = await prove(seams);
+    if (!again.ok || again.url !== proof.url || again.pid !== proof.pid) {
+        write(`Toolroll can't attach: ${again.ok ? "the console changed while the project was being added" : again.message} — run \`toolroll up\`.`);
+        return EXIT.refused;
+    }
+    write(`Toolroll is on ${proof.url}`);
+    if (seams.terminal)
+        await seams.openBrowser(proof.url);
+    return EXIT.ok;
+}

package/dist/release.d.ts

@@ -226,10 +226,13 @@ export type ReleaseJournal = {
         by: string;
         at: string;
     } | null;
+    /** The passing result: its run, receipt and checkout, and the commit it built (`head`), which a prepared candidate
+     * records as a commit of its own with exactly the candidate's tree (absent in a journal from before that was known). */
     check: {
         run: number;
         receipt: string;
         worktree: string;
+        head?: string;
     } | null;
     completion: {
         actor: string;

package/dist/release.js

@@ -213,9 +213,11 @@ export async function runRelease(options, adapters) {
             if (gate.result.check !== "passed")
                 throw new Stop("check-failed", `The Full release check of ${j.candidate.sha.slice(0, 7)} did not pass (run ${gate.result.run}: ${gate.result.check}). It stays as it is: fix the branch and release the new commit with --new.`);
         };
+        /** The commit the passing build recorded: what the deployed runtime is stamped with. */
+        const builtHead = () => j.check?.head ?? j.candidate.sha;
         const checked = (gate) => {
             approved(gate);
-            if (gate.result?.head !== j.candidate.sha || gate.result?.receipt !== j.check?.receipt)
+            if (gate.result?.head !== builtHead() || gate.result?.receipt !== j.check?.receipt)
                 throw new Stop("drift", `Task ${j.task.id}'s result changed since its check passed.`);
             fullCheck(gate);
         };
@@ -268,12 +270,16 @@ export async function runRelease(options, adapters) {
                             throw new Stop("check-failed", `The release build of ${j.task.id} failed: ${gate.failed}. Fix it and release the new commit with --new.`);
                         if (gate.result === null || gate.result.check === "running" || gate.result.check === "pending")
                             return null;
-                        if (gate.result.head !== j.candidate.sha)
-                            throw new Stop("drift", `The release result is for ${gate.result.head?.slice(0, 7) ?? "no commit"}, not ${j.candidate.sha.slice(0, 7)}.`);
+                        // The build records a prepared candidate as a commit of its own (its message names the task): it must hold
+                        // exactly the candidate's tree, or it isn't the release.
+                        const head = gate.result.head;
+                        if (head === null || (head !== j.candidate.sha && await adapters.repo.tree(head) !== await adapters.repo.tree(j.candidate.sha))) {
+                            throw new Stop("drift", `The release result is for ${head?.slice(0, 7) ?? "no commit"}, which doesn't hold exactly ${j.candidate.sha.slice(0, 7)}'s files.`);
+                        }
                         fullCheck(gate);
                         if (gate.result.worktree === null)
                             throw new Stop("worktree", `Run ${gate.result.run} names no checkout to deploy from.`);
-                        return { run: gate.result.run, receipt: gate.result.receipt, worktree: gate.result.worktree };
+                        return { run: gate.result.run, receipt: gate.result.receipt, worktree: gate.result.worktree, head };
                     });
                     j.check = result;
                     say(`  run ${result.run} passed on ${j.candidate.sha.slice(0, 7)}`);
@@ -310,7 +316,7 @@ export async function runRelease(options, adapters) {
                     await recoverDeploy();
                     checked(await adapters.toolroll.gate(j.task.id));
                     // A deployment that finished but whose answer was lost: the services already run a runtime of this commit.
-                    let runtime = await served(adapters, j.candidate.sha);
+                    let runtime = await served(adapters, builtHead());
                     if (runtime === null) {
                         await pinned();
                         j.deployAttempt = { stage: join(options.stateDir, "staged-upgrades", `browser-${j.candidate.sha.slice(0, 7)}-${randomUUID()}`) };
@@ -326,7 +332,7 @@ export async function runRelease(options, adapters) {
                         save();
                     }
                     const want = runtime;
-                    await waitFor("deploy", `the console and worker to run the gated commit from ${want}`, async () => (await served(adapters, j.candidate.sha)) === want ? true : null);
+                    await waitFor("deploy", `the console and worker to run the gated commit from ${want}`, async () => (await served(adapters, builtHead())) === want ? true : null);
                     j.deploy = { runtime: want, at: j.deploy?.runtime === want ? j.deploy.at : adapters.now().toISOString() };
                     j.deployAttempt = null;
                     delete j.intents.deploy;
@@ -336,7 +342,7 @@ export async function runRelease(options, adapters) {
                 }
                 case "link": {
                     const runtime = j.deploy.runtime;
-                    if (await served(adapters, j.candidate.sha) !== runtime)
+                    if (await served(adapters, builtHead()) !== runtime)
                         throw new Stop("drift", `The console and worker no longer run ${runtime}; the CLI names were not moved.`);
                     if (j.links === undefined || j.links === null) {
                         j.links = await adapters.toolroll.cliLinks();
@@ -348,7 +354,7 @@ export async function runRelease(options, adapters) {
                     catch (error) {
                         throw new Stop("link", `The CLI names were not moved to ${runtime} (they point where they did): ${error.message}. The service already runs the new build; rerun to try again.`);
                     }
-                    const everywhere = await deployed(adapters, j.candidate.sha);
+                    const everywhere = await deployed(adapters, builtHead());
                     if (everywhere !== runtime)
                         throw new Stop("mixed-runtime", `After relinking, the console, worker and both CLI names don't all run ${runtime} at ${j.candidate.sha.slice(0, 7)}.`);
                     say(`  toolroll and standing-orders run ${join(runtime, "bin.js")}`);

package/dist/request-budget-ui.js

@@ -1,4 +1,4 @@
-import { html, postForm } from "./html.js";
+import { html, postForm, reauth } from "./html.js";
 import { effectiveLimits, limitOverrides, PER_DAY_MAX, PER_MINUTE_MAX, REQUEST_BUDGET_DEFAULTS } from "./request-budget.js";
 const n = (value) => value.toLocaleString("en-US");
 export const REQUEST_LIMITS_CSS = `.credentials .limits{display:grid;gap:14px}.credentials .limits form{display:grid;gap:10px}.credentials .limits label{display:grid;gap:6px}` +
@@ -14,7 +14,7 @@ export function requestLimitsHtml(db, tokens, now) {
     const overrides = limitOverrides(db);
     const everyone = overrides.get("*") ?? { readPerMinute: null, actPerMinute: null, perDay: null };
     const field = (name, label, value, placeholder, max) => html `<label>${label}<input type="number" name="${name}" min="1" max="${max}" step="1" inputmode="numeric" value="${value === null ? "" : value}" placeholder="${placeholder}"></label>`;
-    const password = html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label>`;
+    const password = html `${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password"></label>`)}`;
     const buttons = html `<div class="actions"><button name="action" value="save">Save limits</button><button class="secondary" name="action" value="clear">Use defaults</button></div>`;
     const live = tokens.filter(one => one.revokedAt === null && Date.parse(one.expiresAt) > now);
     const installation = postForm("/settings/request-limits", html `\