toolroll 0.9.63 → 0.9.65

package/dist/acp-inspect.d.ts

@@ -0,0 +1,23 @@
+import { type AcpProviderId } from "./acp-agents.js";
+export type AcpInspection = {
+    found: false;
+    binary: string;
+} | {
+    found: true;
+    binary: string;
+    /** The PATH entry that matched, and where it really is. */
+    path: string;
+    realpath: string;
+    /** A native executable (Mach-O/ELF), or a script with a shebang line. */
+    kind: "native" | "script" | "unknown";
+    /** For a script: the nearest package.json's name and version, read, never run. */
+    package: {
+        name: string;
+        version: string;
+    } | null;
+    size: number;
+};
+/** Find an agent's binary on PATH, and describe it without running it. */
+export declare function inspectAcpAgent(provider: AcpProviderId, env?: Readonly<Record<string, string | undefined>>): AcpInspection;
+/** The words a screen says for an inspection: "installed at …, version …" or "not installed". */
+export declare function inspectionWords(inspection: AcpInspection): string;

package/dist/acp-inspect.js

@@ -0,0 +1,109 @@
+/**
+ * What can be known about an ACP agent's binary without running it
+ * (docs/plans/acp-adapter.md § Identity): nothing outside the one spawning
+ * gateway executes an ACP agent — not readiness, not the providers screen,
+ * not a version probe. So readiness and the screens look, and never run:
+ * PATH lookup, realpath, lstat, and for a script launcher a bounded read of
+ * the nearest package.json for its name and version.
+ *
+ * None of this is evidence an agent may run. That is its conformance check
+ * (attestation), which this only helps describe.
+ */
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync, statSync } from "node:fs";
+import { delimiter, dirname, isAbsolute, join } from "node:path";
+import { ACP_AGENTS } from "./acp-agents.js";
+/** The most bytes read from a launcher (its first line) or a package.json. */
+const READ_CAP = 64 * 1024;
+/** How many folders up from the launcher a package.json is looked for. */
+const PACKAGE_DEPTH = 6;
+/** Read at most `cap` bytes from the start of a regular file, without following a final symlink. */
+function readHead(file, cap) {
+    let fd = null;
+    try {
+        fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW | (constants.O_NONBLOCK ?? 0));
+        if (!fstatSync(fd).isFile())
+            return null;
+        const buffer = Buffer.alloc(cap);
+        const read = readSync(fd, buffer, 0, cap, 0);
+        return buffer.subarray(0, read);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== null)
+            closeSync(fd);
+    }
+}
+function kindOf(head) {
+    if (head === null || head.length < 4)
+        return "unknown";
+    if (head[0] === 0x23 && head[1] === 0x21)
+        return "script"; // "#!"
+    const magic = head.readUInt32BE(0);
+    // ELF, Mach-O (both byte orders, 32/64-bit) and fat binaries.
+    if (magic === 0x7f454c46 || [0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe, 0xcafebabe, 0xbebafeca].includes(magic))
+        return "native";
+    return "unknown";
+}
+/** The nearest package.json above a script, by bounded read; its name and plain version, or null. */
+function packageOf(realpath) {
+    let folder = dirname(realpath);
+    for (let depth = 0; depth < PACKAGE_DEPTH; depth += 1) {
+        const head = readHead(join(folder, "package.json"), READ_CAP);
+        if (head !== null) {
+            try {
+                const parsed = JSON.parse(head.toString("utf8"));
+                const name = parsed["name"];
+                const version = parsed["version"];
+                if (typeof name === "string" && typeof version === "string" && name.length <= 214 && /^\d+\.\d+\.\d+$/.test(version))
+                    return { name, version };
+            }
+            catch {
+                // A package.json past the cap or not JSON says nothing.
+            }
+            return null;
+        }
+        const up = dirname(folder);
+        if (up === folder)
+            break;
+        folder = up;
+    }
+    return null;
+}
+/** Find an agent's binary on PATH, and describe it without running it. */
+export function inspectAcpAgent(provider, env = process.env) {
+    const binary = ACP_AGENTS[provider].binary;
+    for (const folder of (env["PATH"] ?? "").split(delimiter)) {
+        if (folder === "" || !isAbsolute(folder))
+            continue;
+        const path = join(folder, binary);
+        try {
+            lstatSync(path);
+        }
+        catch {
+            continue;
+        }
+        let realpath;
+        try {
+            realpath = realpathSync(path);
+            const stat = statSync(realpath);
+            if (!stat.isFile() || (stat.mode & 0o111) === 0)
+                continue;
+            const head = readHead(realpath, 4096);
+            const kind = kindOf(head);
+            return { found: true, binary, path, realpath, kind, package: kind === "script" ? packageOf(realpath) : null, size: stat.size };
+        }
+        catch {
+            continue;
+        }
+    }
+    return { found: false, binary };
+}
+/** The words a screen says for an inspection: "installed at …, version …" or "not installed". */
+export function inspectionWords(inspection) {
+    if (!inspection.found)
+        return `\`${inspection.binary}\` is not installed on this computer's PATH`;
+    const version = inspection.package === null ? "" : ` (${inspection.package.name} ${inspection.package.version})`;
+    return `installed at ${inspection.realpath}${version}`;
+}

package/dist/agent-board.d.ts

@@ -20,8 +20,6 @@ export declare const QUESTIONS_PER_ATTEMPT = 10;
 export declare const QUESTION_PAGE_EVERY_MS: number;
 /** The board's one note on a run whose agent asked past the caps (set once). */
 export declare const QUESTIONS_OVERFLOW_NOTE = "The agent asked more questions than the board takes; see its transcript.";
-/** Notification kinds held while the person watches the run, and re-checked when the watch lapses. */
-export declare const WATCHED_KINDS: ReadonlySet<string>;
 export declare const AGENT_BOARD_SCHEMA = "\nCREATE TABLE IF NOT EXISTS agent_turn (\n  id          INTEGER PRIMARY KEY,\n  run         INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  attempt_key TEXT NOT NULL,\n  state       TEXT NOT NULL CHECK (state IN ('busy','idle','crashed')),\n  at          TEXT NOT NULL\n);\nCREATE INDEX IF NOT EXISTS agent_turn_run ON agent_turn (run, id);\nCREATE TABLE IF NOT EXISTS agent_now (\n  task_ref         INTEGER PRIMARY KEY REFERENCES task_ref(id) ON DELETE CASCADE,\n  run              INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  attempt_key      TEXT NOT NULL,\n  state            TEXT NOT NULL CHECK (state IN ('busy','idle','crashed')),\n  state_at         TEXT NOT NULL,\n  transcript_bytes INTEGER NOT NULL DEFAULT 0,\n  transcript_at    TEXT NOT NULL,\n  stuck_at         TEXT,\n  said             TEXT CHECK (said IN ('working','blocked','done')),\n  said_note        TEXT,\n  said_at          TEXT,\n  status_offset    INTEGER NOT NULL DEFAULT 0,\n  diff_files       INTEGER,\n  diff_at          TEXT\n);\nCREATE TABLE IF NOT EXISTS agent_question (\n  id          INTEGER PRIMARY KEY,\n  run         INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  task_ref    INTEGER NOT NULL REFERENCES task_ref(id) ON DELETE CASCADE,\n  attempt_key TEXT NOT NULL,\n  key         TEXT NOT NULL,\n  question    TEXT NOT NULL,\n  asked_at    TEXT NOT NULL,\n  closed_at   TEXT,\n  closed_how  TEXT CHECK (closed_how IN ('answered','ended')),\n  answer_note INTEGER REFERENCES task_steer(id),\n  answered_by TEXT,\n  UNIQUE (run, key)\n);\nCREATE INDEX IF NOT EXISTS agent_question_open ON agent_question (task_ref) WHERE closed_at IS NULL;\nCREATE TABLE IF NOT EXISTS agent_seen (\n  account TEXT NOT NULL,\n  run     INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  seen_at TEXT NOT NULL,\n  PRIMARY KEY (account, run)\n);\nCREATE TABLE IF NOT EXISTS agent_view (\n  view       TEXT PRIMARY KEY,\n  account    TEXT NOT NULL,\n  run        INTEGER NOT NULL,\n  expires_at TEXT NOT NULL\n);\nCREATE INDEX IF NOT EXISTS agent_view_run ON agent_view (run, account);\nCREATE INDEX IF NOT EXISTS agent_board_open ON run (task_ref, id) WHERE role = 'builder' AND outcome IS NULL;\nCREATE INDEX IF NOT EXISTS agent_board_recent ON run (finished_at, task_ref, id) WHERE role = 'builder' AND outcome IS NOT NULL;\nCREATE INDEX IF NOT EXISTS agent_board_repair ON run (parent_run, id) WHERE role = 'repair';\n";
 /** Added to agent_now after the table first shipped (store.ts addColumn): the oldest open tool call's kind and start. */
 export declare const AGENT_NOW_COLUMNS: readonly [string, string][];
@@ -194,15 +192,30 @@ export declare function releaseAgentView(store: Store, view: string, at: Date):
 export declare function watchingAgentUntil(store: Store, account: string, run: number, at: Date): string | null;
 /** Someone has this exact run open right now. */
 export declare function watchingAgent(store: Store, account: string, run: number, at: Date): boolean;
+export declare const neverHeld: (kind: string) => boolean;
 /**
- * A watched ping, decided when its delivery is claimed (every chat, phone and browser asks here, after the
- * permanent rules in store.pingAllowed): held until the watch lapses while this person has the run open; then
- * skipped when they have already seen the finished run (an answered question is resolved, so never claimed);
- * otherwise sent. Anything that is not a watched kind about a run is sent.
+ * A notification's subject (cockpit §3, R11): the run it is about — its own, or for a ping about a task the task's
+ * live build — so any ping, not only the agent's own kinds, can be held while its person watches that agent. Null:
+ * about nothing a person watches. Its version is the notification's own identity (its dedupe key), so a newer fact
+ * about the same subject is a new ping.
+ */
+export declare function attentionSubjectOf(store: Store, row: {
+    kind: string;
+    run: number | null;
+    taskRef?: number | null;
+}): {
+    run: number;
+} | null;
+/**
+ * A watched ping (cockpit §3, R11), decided when its delivery is claimed AND again at every channel's final send
+ * fence, after the permanent rules in store.pingAllowed: held until the watch lapses while this person has its
+ * subject's agent open; then skipped when it was news about a finished run they have since seen; otherwise sent.
+ * A ping about nothing anyone watches is sent. (A delivery already handed to the network can't be recalled.)
  */
 export declare function watchedPing(store: Store, row: {
     kind: string;
     run: number | null;
+    taskRef?: number | null;
 }, account: string, now: Date): {
     hold: string;
 } | "skip" | "send";

package/dist/agent-board.js

@@ -46,8 +46,6 @@ export const QUESTIONS_PER_ATTEMPT = 10;
 export const QUESTION_PAGE_EVERY_MS = 5 * 60_000;
 /** The board's one note on a run whose agent asked past the caps (set once). */
 export const QUESTIONS_OVERFLOW_NOTE = "The agent asked more questions than the board takes; see its transcript.";
-/** Notification kinds held while the person watches the run, and re-checked when the watch lapses. */
-export const WATCHED_KINDS = new Set(["agent-question", "run-finished", "build-failed"]);
 export const AGENT_BOARD_SCHEMA = `
 CREATE TABLE IF NOT EXISTS agent_turn (
   id          INTEGER PRIMARY KEY,
@@ -435,19 +433,42 @@ export function watchingAgentUntil(store, account, run, at) {
 export function watchingAgent(store, account, run, at) {
     return watchingAgentUntil(store, account, run, at) !== null;
 }
+/** Kinds no watch ever holds: a security alert and the evening digest reach people as they are (store.pingAllowed).
+ * Nothing held may delay them either: a channel's ordering never keeps one behind a held ping (neverHeld). */
+const NEVER_HELD = new Set(["secret-detected", "security-release", "evening-digest"]);
+export const neverHeld = (kind) => NEVER_HELD.has(kind);
+/** Kinds that are news only until the finished run is seen: a ping about one already opened is not sent at all. */
+const SEEN_SETTLES = new Set(["run-finished", "build-failed"]);
 /**
- * A watched ping, decided when its delivery is claimed (every chat, phone and browser asks here, after the
- * permanent rules in store.pingAllowed): held until the watch lapses while this person has the run open; then
- * skipped when they have already seen the finished run (an answered question is resolved, so never claimed);
- * otherwise sent. Anything that is not a watched kind about a run is sent.
+ * A notification's subject (cockpit §3, R11): the run it is about — its own, or for a ping about a task the task's
+ * live build — so any ping, not only the agent's own kinds, can be held while its person watches that agent. Null:
+ * about nothing a person watches. Its version is the notification's own identity (its dedupe key), so a newer fact
+ * about the same subject is a new ping.
+ */
+export function attentionSubjectOf(store, row) {
+    if (NEVER_HELD.has(row.kind))
+        return null;
+    if (row.run !== null)
+        return { run: row.run };
+    if (row.taskRef === undefined || row.taskRef === null)
+        return null;
+    const live = store.handle.prepare("SELECT id FROM run WHERE task_ref = ? AND role = 'builder' AND outcome IS NULL ORDER BY id DESC LIMIT 1").get(row.taskRef);
+    return live === undefined ? null : { run: Number(live["id"]) };
+}
+/**
+ * A watched ping (cockpit §3, R11), decided when its delivery is claimed AND again at every channel's final send
+ * fence, after the permanent rules in store.pingAllowed: held until the watch lapses while this person has its
+ * subject's agent open; then skipped when it was news about a finished run they have since seen; otherwise sent.
+ * A ping about nothing anyone watches is sent. (A delivery already handed to the network can't be recalled.)
  */
 export function watchedPing(store, row, account, now) {
-    if (row.run === null || !WATCHED_KINDS.has(row.kind))
+    const subject = attentionSubjectOf(store, row);
+    if (subject === null)
         return "send";
-    const until = watchingAgentUntil(store, account, row.run, now);
+    const until = watchingAgentUntil(store, account, subject.run, now);
     if (until !== null)
         return { hold: until };
-    if (row.kind === "agent-question")
+    if (!SEEN_SETTLES.has(row.kind) || row.run === null)
         return "send";
     const seen = store.handle.prepare("SELECT 1 AS hit FROM agent_seen WHERE account = ? AND run = ?").get(account, boardRunOf(store, row.run));
     return seen === undefined ? "send" : "skip";

package/dist/agent-fence.d.ts

@@ -1,3 +1,6 @@
+import type { LoopbackMode } from "./egress.js";
+/** Beside the database: where Linux builds' network bridges are made (its name reads as secret wherever it is). */
+export declare const BRIDGE_DIR = "bridge-secrets";
 /** How a launch was fenced, as recorded on the run and said on the task. */
 export type FenceMethod = "codex-profile" | "macos-sandbox" | "linux-bubblewrap" | "claude-rules" | "none";
 /** Only the plane's recorded repository may supply an own-Git exemption. */
@@ -55,8 +58,9 @@ export type RunFolders = {
     root: string;
     own: string | null;
 };
-/** The prefixes of every launch's private folders: its tools' config and a Codex build's own home. */
-export declare const RUN_FOLDER_PREFIXES: readonly ["so-tools-", "so-codex-"];
+/** The prefixes of every launch's private folders: its tools' config, a Codex build's own home, and a Linux build's
+ * network bridge (egress-bridge.ts). */
+export declare const RUN_FOLDER_PREFIXES: readonly ["so-tools-", "so-codex-", "so-net-"];
 export declare function runFolders(own: string | null, root?: string): RunFolders;
 /**
  * What a fence gives back beside its denied paths. Each is narrow and none
@@ -75,7 +79,40 @@ export type FenceGrants = {
     lookup: string[];
     runFolders?: RunFolders;
     pool?: CheckoutPool;
+    network?: NetworkFence;
 };
+/**
+ * A launch's network confinement (egress.ts, docs/plans/agent-baseline-hardening.md arc 1). `open`: the network as it
+ * always was. `allowlist`: nothing leaves the machine but through the run's own proxy (`proxyPort`); the run's tool
+ * broker (`brokerPorts`) stays reachable; on macOS this Mac's other local services are reachable only under
+ * `loopback: "any"` (all of them: Seatbelt can't refuse one local port once it admits the rest); unix sockets only
+ * under `socketRoots` (the run's own temp folder and checkout). On Linux the agent gets a network of its own and
+ * reaches the proxy and broker through `bridge` (a folder of unix sockets the plane serves, and the forwarder that
+ * carries them onto the namespace's own loopback).
+ */
+export type NetworkFence = {
+    mode: "open";
+} | {
+    mode: "allowlist";
+    proxyPort: number;
+    brokerPorts: number[];
+    loopback: LoopbackMode;
+    socketRoots: string[];
+    bridge?: {
+        folder: string;
+        forwarder: string;
+        node: string;
+    };
+    /** Linux: the run's own folders a private /tmp gives back (its checkout, its launch folder), when they are there. */
+    keep?: string[];
+};
+/**
+ * Services a sandboxed process could ask to act outside the sandbox for it (macOS): open a URL in a browser (Launch
+ * Services), script another application (Apple Events), fetch in the background (nsurlsessiond), look a name up
+ * (the DNS service: a lookup is itself a message out), or read and write the clipboard. Denied when the network is
+ * confined; the run's proxy resolves names for it.
+ */
+export declare const DELEGATION_SERVICES: readonly string[];
 export declare const NO_GRANTS: FenceGrants;
 /**
  * The plane's checkout pools, denied whole: every project's worktrees, and any made there after launch. `agentFence`
@@ -187,6 +224,14 @@ export declare function ownedAncestors(paths: readonly string[], roots?: readonl
  * checkout given back right after, so every later deny still holds inside it.
  */
 export declare function macosFenceProfile(fence: readonly string[], grants?: FenceGrants): string;
+/**
+ * The network half of the macOS fence. Every outbound connection is denied, then loopback is given back as the launch
+ * allows: every local port under `loopback: "any"`, else the run's proxy and broker alone. (Seatbelt admits a port an
+ * allow names whatever a deny after it says, so a local port can't be refused once all are admitted: the choice is all
+ * or none, plus the run's own.) Filters name the remote end only: a `local ip` filter would admit any outbound
+ * connection.
+ */
+export declare function macosNetworkRules(network: NetworkFence | undefined): string[];
 export declare const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
 /**
  * Whether this machine can run an agent inside the macOS fence (checked once). Not from inside another
@@ -213,3 +258,6 @@ export declare function linuxFenced(file: string, args: readonly string[], fence
     file: string;
     args: string[];
 };
+/** The host's own sockets a process in a mounted filesystem could still talk to (D-Bus, the display, container
+ * engines), wherever they exist here. */
+export declare function linuxHostSockets(uid?: number | undefined, home?: string, tmp?: string): string[];

package/dist/agent-fence.js

@@ -40,13 +40,17 @@
  * rename or remove a folder of the user's above a fenced path or the temp
  * folder, which would reach the fenced path under a new name.
  */
+import { INSTANCE_DIR } from "./console-instance.js";
+import { ACP_AGENTS, ACP_PROVIDER_IDS } from "./acp-agents.js";
 import { spawnSync } from "node:child_process";
-import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { readMonitoring } from "./monitoring-settings.js";
 import { existingFolders } from "./names.js";
 import { DEPS_FOLDER, linkedKey, readyCopy, sharedCopies } from "./shared-deps.js";
+/** Beside the database: where Linux builds' network bridges are made (its name reads as secret wherever it is). */
+export const BRIDGE_DIR = "bridge-secrets";
 /** Names that are secrets wherever the database lives (used when its folder is shared with other things). */
 const SENSITIVE_NAME = /(^up-login\.txt$|token|secret|login|password|credential|vapid|keys?\b|\.pem$|\.key$|^backups$|^evidence$|^remote$|^sign-in\.json$|^monitoring\.json$)/i;
 function real(path) {
@@ -127,6 +131,10 @@ export function trustedWorktreeBinding(repository, worktree, poolRoots = []) {
  */
 export function agentFence(options) {
     const fence = new Set();
+    /** The console's run folder: kept by its own pathname through canonicalization (and its target's too). */
+    let runFolder = null;
+    /** The bridges' folder, likewise. */
+    let bridgeFolder = null;
     const home = real(options.home ?? homedir());
     const worktree = options.worktree === null ? null : real(options.worktree);
     if (options.databaseFile !== null && options.databaseFile !== "" && options.databaseFile !== ":memory:") {
@@ -135,6 +143,45 @@ export function agentFence(options) {
         for (const suffix of ["", "-wal", "-shm", "-journal"])
             if (existsSync(database + suffix))
                 fence.add(database + suffix);
+        // The console's run folder (its discovery sockets, console-instance.ts) beside the database, wherever that is: no
+        // build may add, rename or remove anything in it while a console listens there. It is made (owner-only) before any
+        // build starts if it isn't there yet, so a build can never be the one to create it — and the fence always has a
+        // real folder to cover (a Linux bind needs one).
+        // Whatever is at that path is fenced, always — a folder, a file, a link (the path itself, never only where a link
+        // points), a folder holding anything at all — so no build can replace it; when nothing is there it is made first.
+        // If it can't be made, the path is fenced anyway: a sandbox that can't cover a missing path refuses to launch
+        // rather than run unfenced. The name is Toolroll's own; nothing else belongs there.
+        // The folder Linux builds' network bridges are made in (egress-bridge.ts): made before any build starts and fenced
+        // from every build, so no build — however long it runs — can reach a bridge made for a later one.
+        const bridges = join(state, BRIDGE_DIR);
+        try {
+            lstatSync(bridges);
+        }
+        catch {
+            try {
+                mkdirSync(bridges, { mode: 0o700 });
+            }
+            catch { /* fenced below either way */ }
+        }
+        // Fenced by its own name as well as where it leads: a link planted there is itself out of reach (and the bridge
+        // refuses a root that isn't a private folder: egress-bridge.ts).
+        bridgeFolder = bridges;
+        fence.add(bridges);
+        runFolder = join(state, INSTANCE_DIR);
+        const present = () => { try {
+            lstatSync(runFolder);
+            return true;
+        }
+        catch {
+            return false;
+        } };
+        if (!present()) {
+            try {
+                mkdirSync(runFolder, { mode: 0o700 });
+            }
+            catch { /* fenced below either way */ }
+        }
+        fence.add(runFolder);
         // Only a folder that is Toolroll's own (~/.config/toolroll or an older name,
         // the desktop app's "Toolroll") is fenced whole: a database kept
         // in a shared folder (a projects folder, a test's temp folder) must not
@@ -179,12 +226,12 @@ export function agentFence(options) {
             fence.add(path);
     for (const path of options.boundary?.protectedShell ?? [])
         fence.add(real(path));
-    const protectedPaths = new Set([...fence].map(real));
+    const protectedPaths = new Set([...fence].flatMap(path => path === runFolder || path === bridgeFolder ? [path, real(path)] : [real(path)]));
     for (const path of options.boundary?.shell ?? [])
         fence.add(path);
     const binding = options.binding;
     const needed = binding === undefined || binding === null ? [] : [binding.gitdir, real(join(binding.main, ".git"))];
-    return [...new Set([...fence].map(real))].filter(path => {
+    return [...new Set([...fence].flatMap(path => path === runFolder || path === bridgeFolder ? [path, real(path)] : [real(path)]))].filter(path => {
         if (protectedPaths.has(path) || !needed.some(target => target === path || inside(target, path)))
             return true;
         console.warn(`Dropped build fence entry covering this checkout's own Git data: ${path}`);
@@ -197,10 +244,18 @@ export function agentFence(options) {
  * cloud logins or another agent's sign-in, or rewrite their own Claude or
  * Codex setup for the next interactive session.
  */
-const HOME_CONFIGURATION = [".claude", ".claude.json", ".codex", ".gemini", ".ssh", ".aws", ".gnupg", ".netrc", ".git-credentials", ".kube", join(".config", "gh"), join(".docker", "config.json")];
+const HOME_CONFIGURATION = [
+    ".claude", ".claude.json", ".codex", ".gemini", ".ssh", ".aws", ".gnupg", ".netrc", ".git-credentials", ".kube", join(".config", "gh"), join(".docker", "config.json"),
+    // Every ACP agent's own configuration and sign-in (acp-agents.ts): fenced from every build but that agent's own.
+    ...ACP_PROVIDER_IDS.flatMap(id => ACP_AGENTS[id].home),
+];
 /** What a provider's own CLI reads to sign in and keep its sessions. The OS fence around Claude and Gemini holds
  * their whole process, so those stay reachable there; Codex fences only its agent's commands, so it keeps none. */
-const PROVIDER_HOME = { claude: [".claude", ".claude.json"], gemini: [".gemini"], codex: [], openrouter: [] };
+const PROVIDER_HOME = {
+    claude: [".claude", ".claude.json"], gemini: [".gemini"], codex: [], openrouter: [],
+    // Each ACP agent keeps its own configuration and sign-in where its row says (acp-agents.ts).
+    ...Object.fromEntries(ACP_PROVIDER_IDS.map(id => [id, ACP_AGENTS[id].home])),
+};
 /** What Claude's own file tools refuse inside its home: the CLI reads these itself, its model never needs to. */
 const CLAUDE_FILE_TOOL_HOME = [".claude.json", join(".claude", ".credentials.json"), join(".claude", "settings.json"), join(".claude", "settings.local.json"), ".npmrc"];
 /**
@@ -311,8 +366,9 @@ export function taskBoundary(options) {
     const fileTools = options.provider === "claude" ? present(CLAUDE_FILE_TOOL_HOME).filter(path => !shell.has(path)) : [];
     return { protectedShell, shell: [...shell].sort(), fileTools: fileTools.sort(), readOnly: [...readOnly].sort(), lookup: [...lookup].sort() };
 }
-/** The prefixes of every launch's private folders: its tools' config and a Codex build's own home. */
-export const RUN_FOLDER_PREFIXES = ["so-tools-", "so-codex-"];
+/** The prefixes of every launch's private folders: its tools' config, a Codex build's own home, and a Linux build's
+ * network bridge (egress-bridge.ts). */
+export const RUN_FOLDER_PREFIXES = ["so-tools-", "so-codex-", "so-net-"];
 export function runFolders(own, root = tmpdir()) {
     return { root: real(root), own: own === null ? null : real(own) };
 }
@@ -327,6 +383,17 @@ function otherRunFolders(folders) {
     }
     return entries.filter(entry => RUN_FOLDER_PREFIXES.some(prefix => entry.startsWith(prefix))).map(entry => join(folders.root, entry)).filter(path => path !== folders.own);
 }
+/**
+ * Services a sandboxed process could ask to act outside the sandbox for it (macOS): open a URL in a browser (Launch
+ * Services), script another application (Apple Events), fetch in the background (nsurlsessiond), look a name up
+ * (the DNS service: a lookup is itself a message out), or read and write the clipboard. Denied when the network is
+ * confined; the run's proxy resolves names for it.
+ */
+export const DELEGATION_SERVICES = [
+    "com.apple.coreservices.launchservicesd", "com.apple.coreservices.quarantine-resolver", "com.apple.lsd.mapdb", "com.apple.lsd.modifydb", "com.apple.lsd.open",
+    "com.apple.coreservices.appleevents", "com.apple.nsurlsessiond", "com.apple.nsurlsessiond.NSURLSessionProxyService",
+    "com.apple.dnssd.service", "com.apple.mDNSResponder", "com.apple.pasteboard.1",
+];
 export const NO_GRANTS = { readOnly: [], readable: [], lookup: [] };
 /**
  * The pool deny for one launch. `roots` come from the plane's own records (the pool beside the database, and the one
@@ -471,14 +538,22 @@ export function codexFenceArgv(fence, fullAccess, grants = NO_GRANTS) {
         for (const path of held.write)
             access.set(path, "write");
     }
-    for (const path of deny)
+    // Denies are keyed where they resolve; the console's run folder is also denied by its own pathname, so a link there
+    // stays unreplaceable, not only its target.
+    for (const path of deny) {
         access.set(real(path), "deny");
+        if (basename(path) === INSTANCE_DIR)
+            access.set(path, "deny");
+    }
     const filesystem = [...access].map(([path, mode]) => `${toml(path)}=${toml(mode)}`);
     return [
         "-c", 'default_permissions="standing-orders"',
         "-c", 'permissions.standing-orders.extends=":workspace"',
         "-c", `permissions.standing-orders.filesystem={${filesystem.join(",")}}`,
-        ...(fullAccess ? ["-c", "permissions.standing-orders.network.enabled=true", "-c", 'approval_policy="never"'] : []),
+        // Codex's command sandbox can't route through a proxy: its commands reach the network only when the run's sealed
+        // network is open (and Full access asked for it), and are offline otherwise.
+        ...(fullAccess && (grants.network === undefined || grants.network.mode === "open") ? ["-c", "permissions.standing-orders.network.enabled=true"] : []),
+        ...(fullAccess ? ["-c", 'approval_policy="never"'] : []),
     ];
 }
 /**
@@ -644,8 +719,27 @@ export function macosFenceProfile(fence, grants = NO_GRANTS) {
         "(deny mach-priv-task-port)",
         "(deny mach-task-name)",
         ...(above.length === 0 ? [] : [`(deny file-write* ${paths("literal", above)})`]),
+        ...macosNetworkRules(grants.network),
     ].join("\n");
 }
+/**
+ * The network half of the macOS fence. Every outbound connection is denied, then loopback is given back as the launch
+ * allows: every local port under `loopback: "any"`, else the run's proxy and broker alone. (Seatbelt admits a port an
+ * allow names whatever a deny after it says, so a local port can't be refused once all are admitted: the choice is all
+ * or none, plus the run's own.) Filters name the remote end only: a `local ip` filter would admit any outbound
+ * connection.
+ */
+export function macosNetworkRules(network) {
+    if (network === undefined || network.mode === "open")
+        return [];
+    const local = (port) => `(remote ip "localhost:${port}")`;
+    return [
+        "(deny network-outbound)",
+        `(allow network-outbound ${network.loopback === "any" ? local("*") : [network.proxyPort, ...network.brokerPorts].map(local).join(" ")})`,
+        ...(network.socketRoots.length === 0 ? [] : [`(allow network-outbound ${network.socketRoots.map(root => `(remote unix-socket (subpath ${seatbelt(root)}))`).join(" ")})`]),
+        `(deny mach-lookup ${DELEGATION_SERVICES.map(name => `(global-name ${seatbelt(name)})`).join(" ")})`,
+    ];
+}
 export const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
 /** A process already inside a Seatbelt sandbox (an agent's, or a flow check zone's) can't apply another: sandbox-exec says so. */
 const NESTED_SANDBOX = /sandbox_apply: Operation not permitted/;
@@ -719,6 +813,9 @@ function linuxGrants(fence, grants) {
  * folder, or /dev/null for a file), so what is made there after launch is masked too; then only the explicit grants
  * bound back read-only (bubblewrap binds from the original root, so a grant inside a mask still reaches its files). */
 export function linuxFenced(file, args, fence, grants = NO_GRANTS) {
+    const network = grants.network?.mode === "allowlist" ? grants.network : null;
+    if (network !== null && network.bridge === undefined)
+        throw new Error("A confined network on Linux needs its bridge");
     const mask = (path) => {
         let folder = true;
         try {
@@ -732,5 +829,55 @@ export function linuxFenced(file, args, fence, grants = NO_GRANTS) {
     const pool = grants.pool?.deny ?? [];
     const own = grants.pool?.own != null && existsSync(grants.pool.own) ? ["--bind", grants.pool.own, grants.pool.own] : [];
     const kept = linuxGrants([...fence, ...pool], grants).flatMap(path => ["--ro-bind", path, path]);
-    return { file: "bwrap", args: ["--dev-bind", "/", "/", ...pool.flatMap(mask), ...own, ...fence.flatMap(mask), ...kept, "--die-with-parent", "--", file, ...args] };
+    // A confined network: a network and a process view of its own, the host's sockets out of reach (a socket in a
+    // mounted folder is not network, so they are masked), and the run's proxy and broker carried in by the forwarder.
+    const isolated = network === null ? [] : [
+        "--unshare-net", "--unshare-pid", "--proc", "/proc",
+        ...linuxHostSockets().flatMap(mask),
+        "--ro-bind", network.bridge.folder, network.bridge.folder,
+    ];
+    // A confined build gets a /tmp of its own (other programs' sockets, other runs' folders and anything planted there
+    // all out of sight at once), with only its own folders there given back; every mask and grant below still applies.
+    const privateTmp = network === null ? [] : ["--tmpfs", "/tmp", ...(network.keep ?? []).filter(path => inside(path, "/tmp") && existsSync(path)).flatMap(path => ["--bind", path, path])];
+    const command = network === null ? [file, ...args]
+        : [network.bridge.node, network.bridge.forwarder, network.bridge.folder, ...[network.proxyPort, ...network.brokerPorts].map(String), "--", file, ...args];
+    return { file: "bwrap", args: ["--dev-bind", "/", "/", ...privateTmp, ...pool.flatMap(mask), ...own, ...fence.flatMap(mask), ...kept, ...isolated, "--die-with-parent", "--", ...command] };
+}
+/** The host's own sockets a process in a mounted filesystem could still talk to (D-Bus, the display, container
+ * engines), wherever they exist here. */
+export function linuxHostSockets(uid = process.getuid?.(), home = homedir(), tmp = "/tmp") {
+    // The system's own, root-owned: resolved (/var/run is a link to /run) so bubblewrap mounts over the real path, once.
+    const system = [
+        ...(uid === undefined ? [] : [`/run/user/${uid}`]), "/run/dbus", "/var/run/dbus", "/var/run/docker.sock", "/run/docker.sock", "/run/containerd", "/run/podman",
+        "/var/run/podman", "/run/systemd/private", "/run/snapd.socket", "/run/screen",
+    ];
+    const masks = new Set();
+    for (const path of system) {
+        try {
+            masks.add(realpathSync(path));
+        }
+        catch { /* not here */ }
+    }
+    // The user's own, in places a build could plant names: taken only as the real folders or sockets they are, never
+    // through a link (a planted link would turn a mask onto any folder at all). Container engines
+    // run per user (Docker Desktop and the docker CLI's folder whole, so a socket made there later is covered too;
+    // Colima, OrbStack, Lima, Rancher Desktop, rootless containers); a terminal multiplexer takes commands from its
+    // socket; an SSH agent signs as you; editors keep IPC sockets in /tmp (hidden by the build's private /tmp).
+    // Masked whoever owns it (a folder `sudo docker` made is root's): only a link is never followed, since a link turns
+    // a mask onto its target. A link there is a residual until builds can't write the home folder (arc 2).
+    const owned = (path) => {
+        try {
+            const held = lstatSync(path);
+            return !held.isSymbolicLink() && (held.isDirectory() || held.isSocket());
+        }
+        catch {
+            return false;
+        }
+    };
+    for (const path of [".docker", ".colima", ".orbstack", ".lima", ".rd", ".local/share/containers"].map(name => join(home, name)))
+        if (owned(path))
+            masks.add(path);
+    // /tmp's sockets (the display's, an SSH agent's, a multiplexer's, editors') go with the build's private /tmp.
+    void tmp;
+    return [...masks].sort();
 }

package/dist/agent-pulse.js

@@ -18,7 +18,7 @@ import { closeSync, constants, fstatSync, openSync, readSync, statSync, unlinkSy
 import { join } from "node:path";
 import { ingestStatus, markStuck, noteDiff, noteTranscript, NOTE_MAX, pageQuestions, QUESTION_KEY, QUESTION_MAX, QUESTIONS_OPEN_MAX, QUESTIONS_PER_ATTEMPT } from "./agent-board.js";
 import { readVerifiedArtifact } from "./evidence.js";
-import { liveLogPath, sanitizeTranscriptLine } from "./live.js";
+import { legacyLiveLogPath, liveLogPath, sanitizeTranscriptLine } from "./live.js";
 import { observeWorktree, parseBaseTreeSnapshot, PEEK_LIMITS } from "./peek.js";
 /** The whole file may grow this far; past it, nothing more is read. */
 export const STATUS_FILE_CAP = 256 * 1024;
@@ -168,7 +168,14 @@ export async function changedFileCount(worktree, base) {
  */
 export function pulseAgentBoard(store, state, now) {
     try {
-        const bytes = statSync(liveLogPath(state.root, state.run)).size;
+        // The records file every run writes now, else a legacy text file.
+        let bytes;
+        try {
+            bytes = statSync(liveLogPath(state.root, state.run)).size;
+        }
+        catch {
+            bytes = statSync(legacyLiveLogPath(state.root, state.run)).size;
+        }
         noteTranscript(store, state.run, state.attemptKey, bytes, now);
     }
     catch { /* no live log: the activity row still counts */ }

package/dist/agent-state-words.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The agent states' words, tones and counts (docs/plans/agents-cockpit.md §1), with nothing the browser can't load:
+ * agent-state.ts derives the states; the console's pages and the sidebar say them with these.
+ */
+/** The display states, strongest first: a roll-up takes the first one any member has. */
+export declare const DISPLAY_STATES: readonly ["needs-you", "failed", "stuck", "paused", "working", "waiting", "done", "idle"];
+export type DisplayState = (typeof DISPLAY_STATES)[number];
+export declare const STATE_WORDS: Record<DisplayState, string>;
+/** For someone who may not act on it: the obligation is still there, and still counts. */
+export declare const NEEDS_SOMEONE = "Needs someone";
+/** Each state's tone, for the console's one palette (attention, problem, live, ready, done, muted). */
+export declare const STATE_TONE: Record<DisplayState, "attention" | "problem" | "live" | "ready" | "done" | "muted">;
+export type StateCounts = Record<DisplayState, number>;
+export declare const NO_COUNTS: StateCounts;
+/** The strongest state among counts, and the counts themselves. Nothing counted is idle. */
+export declare function rollUp(counts: StateCounts): {
+    state: DisplayState;
+    counts: StateCounts;
+};