toolroll 0.9.63 → 0.9.67

package/dist/builder.js

@@ -1,3 +1,6 @@
+import { legacyNetwork, repositoryEcosystems } from "./egress.js";
+import { checkoutGit } from "./teardown-git.js";
+import { isAcpProvider } from "./acp-agents.js";
 import { OBSERVATION_MAILBOX, observationBrief, parseObservationCases, collectObservations } from "./observations.js";
 import { checkCommandFor, effectiveCheckLevel, recordRunCheckLevel } from "./check-levels.js";
 import { queueBatchCheck } from "./batch-checks.js";
@@ -39,15 +42,15 @@ import { PREPARED_EVIDENCE_FILE, PREPARED_EVIDENCE_GIT, preparedScreenshotMatche
  * watchdog and a high runaway-turn breaker still stop a pathological loop;
  * repair remains narrowly time-bounded because its job is narrowly scoped.
  */
-import { existsSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, realpathSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { run, runClaudeStreamJsonl, runOwnerTag, streamsInput } from "./exec.js";
 import { stopRequestedFor, stopWords, underStopWatch } from "./task-control.js";
 import { witnessedRunner } from "./process-custody.js";
 import { runWithIsolatedDatabase } from "./child-database.js";
 import { recordWorktreeProcess, saveWorkPatch } from "./worktree.js";
-import { approvalOf, digestOf, profileDigestOf, routeParityProblem } from "./scope.js";
+import { approvalOf, digestOf, idleClock, isAcpProfile, profileDigestOf, routeParityProblem, watchdogsOf } from "./scope.js";
 import { legOf, routeDigestOf, routeFromJson } from "./phase-routing.js";
 import { execFileSync } from "node:child_process";
 import { currentClaim, heartbeat, SYNC_MAX_AGE_MS, finalize } from "./claim.js";
@@ -56,9 +59,10 @@ import { heartbeat as runnerHeartbeat } from "./runner.js";
 import { MARKER as LEASE_MARKER } from "./worktree.js";
 import { parseDecision, parseHandoff, repairPrompt, HEADLESS_RULE, HANDOFF_CONCLUSION_CAP, HANDOFF_ITEM_CAP, HANDOFF_LIST_CAP, HANDOFF_PAYLOAD_CAP } from "./decision.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { invokeAgent } from "./invoke.js";
+import { fencedCommands, invokeAgent } from "./invoke.js";
 import { TELEGRAM_TOKEN_ENVS } from "./names.js";
 import { OPENROUTER_ENV_KEY, auditOf, ALL_CREDENTIAL_ENV } from "./provider.js";
+import { liveLogContext } from "./live-detail.js";
 import { openLiveLog } from "./live.js";
 import { fence } from "./brief-fence.js";
 import { closeSteerMailbox, openSteerMailbox, STEER_HANDLED } from "./steer-mailbox.js";
@@ -199,12 +203,17 @@ function repairModelOf(profile, request) {
 function profileWantsSkip(profile) {
     return ((profile.provider === "claude" && profile.permissionArgv === "bypassPermissions") ||
         ((profile.provider === "codex" || profile.provider === "openrouter") && profile.sandboxMode === "danger-full-access") ||
-        (profile.provider === "gemini" && profile.approvalArgv === "yolo"));
+        (profile.provider === "gemini" && profile.approvalArgv === "yolo") ||
+        // An ACP agent's only posture is full access inside the fence.
+        isAcpProfile(profile));
 }
 const PROVIDER_VERSIONS = new Map();
 /** Provenance only (finding 20): a best-effort `--version` probe, cached
  * per process, null on any failure — never authority, never a refusal. */
 function providerVersionOf(provider) {
+    // An ACP agent is never run outside the gateway, not even for --version: its version is what its check recorded.
+    if (isAcpProvider(provider))
+        return null;
     if (PROVIDER_VERSIONS.has(provider))
         return PROVIDER_VERSIONS.get(provider) ?? null;
     let version = null;
@@ -221,6 +230,51 @@ function providerVersionOf(provider) {
     PROVIDER_VERSIONS.set(provider, version);
     return version;
 }
+/** A build's network (egress.ts): the one its approval sealed, or — sealed before network policies existed — the
+ * narrowed legacy one (provider hosts and the repository's registries, nothing added since). */
+export function launchNetworkOf(store, taskRef, profile) {
+    if (profile.network !== undefined)
+        return { policy: profile.network };
+    const repo = store.refForId(taskRef)?.repo ?? null;
+    return { policy: legacyNetwork(profile.provider, repo === null ? [] : repositoryEcosystems(repo)) };
+}
+/** Asking a checkout which branch it is on: reads no file a build wrote and runs nothing. */
+const BRANCH_QUERIES = [
+    ["--no-optional-locks", "rev-parse", "--abbrev-ref", "HEAD"], ["--no-optional-locks", "symbolic-ref", "--short", "-q", "HEAD"],
+];
+/**
+ * The plane's git as a build runs it: hardened (teardown-git.ts checkoutGit) for every call, failing closed, but one —
+ * asking the project's own main checkout which branch it is on (its config is the operator's, and the query runs
+ * nothing). An injected runner (`request.git`: tests only; production always runs git itself) is used as given.
+ */
+function buildCheckoutGit(given, worktree, mainCheckout = null) {
+    if (given !== run)
+        return given;
+    const hardened = checkoutGit(given);
+    const real = (path) => { try {
+        return realpathSync(resolve(path));
+    }
+    catch {
+        return null;
+    } };
+    const trusted = mainCheckout === null ? null : real(mainCheckout);
+    const own = real(worktree);
+    return (file, args, options) => {
+        const at = options?.cwd === undefined ? null : real(options.cwd);
+        const query = BRANCH_QUERIES.some(one => one.length === args.length && one.every((word, index) => args[index] === word));
+        return trusted !== null && at === trusted && at !== own && query ? given(file, args, options) : hardened(file, args, options);
+    };
+}
+/** A run's setup and check commands, in its build's fence, writing where the approval this build runs under sealed
+ * (never the scope as it may since have been rewritten; invoke.ts fencedCommands). */
+function commandRunner(store, runId, profile, inner) {
+    return fencedCommands(store, runId, launchWritesOf(profile), inner);
+}
+/** Where a build may write (writes-mode.ts): what its approval sealed, or — sealed before write allowlists — anywhere
+ * its fence allows, as it was approved. */
+export function launchWritesOf(profile) {
+    return profile.writes ?? "anywhere";
+}
 export function proveApprovedProfile(scope, given) {
     // The raw terms first (raw authority repair): a scope whose stored terms
     // do not read back exactly proves nothing — not the filtered reading.
@@ -293,7 +347,7 @@ export function proveApprovedProfile(scope, given) {
     if (given.timeoutMs !== undefined && given.timeoutMs !== snapshot.timeoutSeconds * 1000) {
         return {
             ok: false,
-            message: `approved with a ${snapshot.timeoutSeconds}s ${snapshot.timeoutKind === "idle" ? "no-progress window" : "clock"}, asked for ${Math.round(given.timeoutMs / 1000)}s — re-approve to change it (stale-approval)`,
+            message: `approved with a ${snapshot.timeoutSeconds}s ${idleClock(snapshot) ? "no-progress window" : "clock"}, asked for ${Math.round(given.timeoutMs / 1000)}s — re-approve to change it (stale-approval)`,
         };
     }
     return {
@@ -315,7 +369,9 @@ export function proveApprovedProfile(scope, given) {
  * that forgot one is exactly the caller this is protecting against.
  */
 export async function build(store, request) {
-    const { taskId, taskRef, runner, worktree, branch, now, permissionMode = "auto", skipPermissions = false, provider = "claude", model, maxTurns = DEFAULT_MAX_TURNS, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS, agent, git = run, } = request;
+    const { taskId, taskRef, runner, worktree, branch, now, permissionMode = "auto", skipPermissions = false, provider = "claude", model, maxTurns = DEFAULT_MAX_TURNS, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS, agent, git: givenGit = run, } = request;
+    // The plane's own git on this build's checkout runs hardened, and never where the checkout's config names a command.
+    const git = buildCheckoutGit(givenGit, worktree, store.getWorktree(worktree)?.repo ?? null);
     const scope = store.getScope(taskId);
     const approval = approvalOf(scope);
     if (!approval.approved) {
@@ -609,7 +665,7 @@ export async function build(store, request) {
             // Setup runs under the stop watch (v52), owned by this run: an
             // operator's stop ends the setup's process group and the attempt
             // settles as interrupted below, never as a setup failure.
-            const made = await underStopWatch(store, request.runId, () => runWithIsolatedDatabase(witnessedRunner(store, request.runId, request.clock ?? (() => now), runSetup), shell.file, shell.args, {
+            const made = await underStopWatch(store, request.runId, () => runWithIsolatedDatabase(witnessedRunner(store, request.runId, request.clock ?? (() => now), commandRunner(store, request.runId, effective.profile, runSetup)), shell.file, shell.args, {
                 cwd: worktree,
                 timeoutMs: setupWanted.timeoutMs,
                 processGroup: true,
@@ -1123,7 +1179,7 @@ export async function build(store, request) {
                 maxTurns: effective.maxTurns ?? maxTurns,
                 finished: () => handoffFiles.some(name => existsSync(join(worktree, name))),
                 // A paused build can wait as long as the idle limit allows (live-input.ts idleLimit); a wall-clock profile has none.
-                onOpen: () => store.markLiveInputOpened(request.runId, clock(), effective.profile.timeoutKind === "idle" ? effective.timeoutMs : null),
+                onOpen: () => store.markLiveInputOpened(request.runId, clock(), idleClock(effective.profile) ? effective.timeoutMs : null),
                 onClose: () => store.markLiveInputClosed(request.runId, clock()),
                 onPaused: () => store.markRunPaused(request.runId, clock()),
             });
@@ -1153,7 +1209,7 @@ export async function build(store, request) {
     // Every streaming transport emits events now (peek); a file that cannot
     // open is a null, and a null never costs a build.
     // What the agent did last rides the same stream into one row (live tasks).
-    const liveLog = withAgentTurns(withRunActivity(openLiveLog(root, request.runId), store, request.runId, clock), (state, at) => { if (attemptKey !== null)
+    const liveLog = withAgentTurns(withRunActivity(openLiveLog(root, request.runId, liveLogContext(store, taskRef, worktree)), store, request.runId, clock), (state, at) => { if (attemptKey !== null)
         recordAgentTurn(store, { run: request.runId, attemptKey, state, at }); }, clock, (open, at) => { if (attemptKey !== null)
         noteOpenTool(store, request.runId, attemptKey, open, at); });
     // The retry base (steering fix for run 1465's proof): the SAME pinned
@@ -1291,10 +1347,10 @@ export async function build(store, request) {
             ...(liveSession === null ? {} : { liveInput: liveSession }),
             // New approvals bind a no-progress watchdog, not a deadline. Legacy
             // snapshots carry no timeoutKind and retain their wall-clock terms.
-            ...(effective.profile.timeoutKind === "idle"
-                ? { idleTimeoutMs: effective.timeoutMs }
-                : { timeoutMs: effective.timeoutMs }),
+            ...watchdogsOf(effective.profile, effective.timeoutMs),
             omitEnv: AGENT_ENV_DENYLIST,
+            network: launchNetworkOf(store, request.taskRef, effective.profile),
+            writes: launchWritesOf(effective.profile),
             ...(agent === undefined ? {} : { runner: agent }),
             onSpawn: (pid) => { spawned = true; request.onProviderSpawn?.(pid); },
             onStreamEvent: (event) => liveLog.observe(event),
@@ -1490,7 +1546,7 @@ export async function settleProviderOutcome(captured, result) {
         return {
             ok: false,
             reason: "timeout",
-            message: effective.profile.timeoutKind === "idle"
+            message: idleClock(effective.profile)
                 ? `the builder made no observable progress for ${Math.round(timeoutMs / 60_000)} minutes and was stopped — whatever it wrote is still in ${worktree}`
                 : `the builder ran past ${Math.round(timeoutMs / 60_000)} minutes and was stopped — whatever it wrote is still in ${worktree}`,
         };
@@ -1759,7 +1815,7 @@ export async function settleProviderOutcome(captured, result) {
                 };
                 if (!eligible())
                     throw Error("The observation source or execution authority changed.");
-                const execute = (file, args, options) => underStopWatch(store, request.runId, () => runWithIsolatedDatabase(witnessedRunner(store, request.runId, clock, request.verify ?? run), file, args, {
+                const execute = (file, args, options) => underStopWatch(store, request.runId, () => runWithIsolatedDatabase(witnessedRunner(store, request.runId, clock, commandRunner(store, request.runId, captured.effective.profile, request.verify ?? run)), file, args, {
                     ...options, processGroup: true, owner: runOwnerTag(store, request.runId), beforeSpawn: eligible,
                     onSpawn: pid => request.onProviderSpawn?.(pid), envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST,
                 }));
@@ -2219,7 +2275,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
         const runVerification = async (label) => {
             const streamed = { stdout: false, stderr: false };
             // The check runs under the stop watch (v52), owned by this run.
-            const result = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, verifyRunner), verifyShell.file, verifyShell.args, {
+            const result = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, commandRunner(store, runId, captured.effective.profile, verifyRunner)), verifyShell.file, verifyShell.args, {
                 cwd: worktree,
                 timeoutMs: configured.timeoutMs,
                 processGroup: true,
@@ -2261,7 +2317,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
             detachShared(worktree, depsRoot);
             const label = "Own install · approved project setup (package.json or lockfile changed)";
             const setupShell = approvedCommandShell(live.command);
-            const installed = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, request.setup ?? run), setupShell.file, setupShell.args, {
+            const installed = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, commandRunner(store, runId, captured.effective.profile, request.setup ?? run)), setupShell.file, setupShell.args, {
                 cwd: worktree,
                 timeoutMs: live.timeoutMs,
                 processGroup: true,
@@ -2280,7 +2336,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
             checkLog.push(attemptLog(label, live.command, installed));
             if (installed.notFound || installed.timedOut || installed.code !== 0)
                 return "own-install-failed";
-            return await sealedTreeState(request.git ?? run) === "clean" ? null : "setup-changed-files";
+            return await sealedTreeState(buildCheckoutGit(request.git ?? run, worktree)) === "clean" ? null : "setup-changed-files";
         };
         const ownInstall = await ownInstallIfChanged();
         const first = ownInstall === null ? await runVerification("Project check · attempt 1") : null;
@@ -2324,7 +2380,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
                 verifyCommand = { configured: true, ran: false, attemptFailed: true, failure: "custody-lost" };
             }
             else {
-                const gitRunner = request.git ?? run;
+                const gitRunner = buildCheckoutGit(request.git ?? run, worktree);
                 const beforeSetup = await sealedTreeState(gitRunner);
                 if (beforeSetup === "head-moved") {
                     verifyCommand = { configured: true, ran: false, attemptFailed: true, failure: "checkout-moved" };
@@ -2351,7 +2407,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
                     else {
                         const setupRunner = request.setup ?? run;
                         const setupShell = approvedCommandShell(liveBeforeSetup.command);
-                        const restored = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, setupRunner), setupShell.file, setupShell.args, {
+                        const restored = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, commandRunner(store, runId, captured.effective.profile, setupRunner)), setupShell.file, setupShell.args, {
                             cwd: worktree,
                             timeoutMs: liveBeforeSetup.timeoutMs,
                             processGroup: true,
@@ -2614,7 +2670,8 @@ async function resumeUnhandedWork(captured, sessionId) {
         if (request.leaseId !== undefined && !heartbeat(store, request.leaseId, clock()).ok) {
             return { ok: false, reason: "fenced", message: `${taskId}'s lease did not survive the resumed turn — the work is still in ${worktree}` };
         }
-        if (store.budgetGate(clock())({ ...store.budgetSubject(request.taskRef), agents: [{ provider, billing: store.runBilling(request.runId) ?? store.agentsFor([provider])[0].billing }] }).over !== null)
+        // An ACP agent's turn bills as its own model's declaration on this runner, never as the attempt it continues.
+        if (store.budgetGate(clock())({ ...store.budgetSubject(request.taskRef), agents: [isAcpProvider(provider) ? store.agentFor(provider, model ?? null, request.runner) : { provider, billing: store.runBilling(request.runId) ?? store.agentsFor([provider])[0].billing }] }).over !== null)
             break;
         if (store.agentPolicyRefusal(provider, model ?? null) !== null)
             break;
@@ -2634,8 +2691,10 @@ async function resumeUnhandedWork(captured, sessionId) {
             ...(request.maxBudgetUsd === undefined ? {} : { maxBudgetUsd: request.maxBudgetUsd }),
         }, {
             cwd: worktree,
-            ...(effective.profile.timeoutKind === "idle" ? { idleTimeoutMs: effective.timeoutMs } : { timeoutMs: effective.timeoutMs }),
+            ...watchdogsOf(effective.profile, effective.timeoutMs),
             omitEnv: AGENT_ENV_DENYLIST,
+            network: launchNetworkOf(store, request.taskRef, effective.profile),
+            writes: launchWritesOf(effective.profile),
             ...(agent === undefined ? {} : { runner: agent }),
             ...(request.onProviderSpawn === undefined ? {} : { onSpawn: request.onProviderSpawn }),
             clock,
@@ -2811,7 +2870,8 @@ async function ingestPark(args) {
         }
         // v105: a repair turn spends too — a budget used up since the build began stops further turns (billed to a key).
         // It bills as the attempt it mends did.
-        if (store.budgetGate(clock())({ ...store.budgetSubject(request.taskRef), agents: [{ provider: repairProvider, billing: store.runBilling(request.runId) ?? store.agentsFor([repairProvider])[0].billing }] }).over !== null)
+        // An ACP repair bills as its own model's declaration on this runner, never as the attempt it mends.
+        if (store.budgetGate(clock())({ ...store.budgetSubject(request.taskRef), agents: [isAcpProvider(repairProvider) ? store.agentFor(repairProvider, repairModel ?? null, request.runner) : { provider: repairProvider, billing: store.runBilling(request.runId) ?? store.agentsFor([repairProvider])[0].billing }] }).over !== null)
             break;
         // Sprint 8: nor does a repair run on a provider or model the organisation policy doesn't allow.
         if (store.agentPolicyRefusal(repairProvider, repairModel ?? null) !== null)
@@ -2845,8 +2905,11 @@ async function ingestPark(args) {
                 : {}),
         }, {
             cwd: worktree,
-            timeoutMs: args.profile !== undefined ? args.profile.repairTimeoutSeconds * 1000 : REPAIR_TIMEOUT_MS,
+            ...(args.profile !== undefined && isAcpProfile(args.profile)
+                ? watchdogsOf(args.profile, args.profile.repairTimeoutSeconds * 1000, true)
+                : { timeoutMs: args.profile !== undefined ? args.profile.repairTimeoutSeconds * 1000 : REPAIR_TIMEOUT_MS }),
             omitEnv: AGENT_ENV_DENYLIST,
+            ...(args.profile === undefined ? {} : { network: launchNetworkOf(store, request.taskRef, args.profile), writes: launchWritesOf(args.profile) }),
             ...(agent === undefined ? {} : { runner: agent }),
             ...(request.onProviderSpawn === undefined ? {} : { onSpawn: request.onProviderSpawn }),
             clock,

package/dist/chat-actions.d.ts

@@ -68,6 +68,16 @@ export declare const CHAT_ACTIONS: {
         readonly protected: false;
         readonly password: false;
     };
+    readonly sweep_file: {
+        readonly label: "Start sweep";
+        readonly protected: true;
+        readonly password: true;
+    };
+    readonly sweep_cancel_rest: {
+        readonly label: "Cancel the rest";
+        readonly protected: false;
+        readonly password: false;
+    };
     readonly flow_edit: {
         readonly label: "Save flow";
         readonly protected: false;
@@ -256,7 +266,7 @@ export declare function sharedActionReviewPath(id: number): string;
 export declare function mintSharedActionReview(store: Store, who: VerifiedApprover, id: number, root: string, now: Date): {
     payload: {
         version: 1;
-        operation: "decision_record" | "decision_retire" | "flow_card_add" | "flow_card_approve" | "flow_card_assign" | "flow_card_cancel" | "flow_card_choose" | "flow_card_comment" | "flow_card_move" | "flow_card_send_back" | "flow_card_watch" | "flow_create" | "flow_edit" | "flow_script_save" | "flow_starter" | "flow_trigger_add" | "flow_trigger_pause" | "flow_trigger_remove" | "flow_trigger_resume" | "kit_setup" | "knowledge_instructions" | "knowledge_remove" | "knowledge_restore" | "knowledge_save" | "lead_about_you" | "result_accept" | "scope_approve" | "skill_disable" | "skill_enable" | "skill_import" | "skill_restore" | "skill_test" | "subagent_answer" | "subagent_ask" | "subagent_create" | "subagent_memory" | "subagent_note" | "subagent_routine" | "subagent_soul" | "subagent_state" | "subagent_tools" | "subagent_undo" | "task_cancel" | "task_resume" | "tool_add" | "tool_remove";
+        operation: "decision_record" | "decision_retire" | "flow_card_add" | "flow_card_approve" | "flow_card_assign" | "flow_card_cancel" | "flow_card_choose" | "flow_card_comment" | "flow_card_move" | "flow_card_send_back" | "flow_card_watch" | "flow_create" | "flow_edit" | "flow_script_save" | "flow_starter" | "flow_trigger_add" | "flow_trigger_pause" | "flow_trigger_remove" | "flow_trigger_resume" | "kit_setup" | "knowledge_instructions" | "knowledge_remove" | "knowledge_restore" | "knowledge_save" | "lead_about_you" | "result_accept" | "scope_approve" | "skill_disable" | "skill_enable" | "skill_import" | "skill_restore" | "skill_test" | "subagent_answer" | "subagent_ask" | "subagent_create" | "subagent_memory" | "subagent_note" | "subagent_routine" | "subagent_soul" | "subagent_state" | "subagent_tools" | "subagent_undo" | "sweep_cancel_rest" | "sweep_file" | "task_cancel" | "task_resume" | "tool_add" | "tool_remove";
         request: {
             [x: string]: unknown;
         };
@@ -286,6 +296,8 @@ export declare function executeSharedAction(store: Store, who: VerifiedApprover,
     said: string;
     taskId: string | null;
     href?: string;
+    awaiting?: true;
+    already?: true;
 } | {
     ok: false;
     reason: "needs-confirm" | "stale" | "refused";