toolroll 0.9.63 → 0.9.67

package/dist/operate.js

@@ -1,3 +1,7 @@
+import { ACP_AGENTS, ACP_PROVIDER_IDS, isAcpProvider, isKeyedProvider } from "./acp-agents.js";
+import { inspectAcpAgent } from "./acp-inspect.js";
+import { runAcpChecks } from "./acp-check.js";
+import { verifyLaunch } from "./acp-attest.js";
 import { notificationClaimHeld, claimNotifications, finalizeNotification, notificationDestination } from "./notification-delivery.js";
 import { adapterPolicy } from "./server/route-policy.js";
 import { UNSENT_REPLY_MS } from "./telegram-settings.js";
@@ -95,6 +99,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { releaseStalledUpdate, waitingUpdate } from "./toolroll-update.js";
 import { openStore, openStoreNoMigrate, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, DEFAULT_ACTOR, parseCapabilityKey, verifiedAuthor, isDigestTime, RESULT_SCREENSHOTS, } from "./store.js";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
+import { claimInstance, clearInstance, openInstanceSocket } from "./console-instance.js";
 import { authorizePlanUnderMode } from "./plan-auto.js";
 import { ghDispatchAdapter, mirrorTaskId, syncPass } from "./sync.js";
 import { LIVE_FILE_BOUND, LIVE_RETAIN_MS, sweepLiveLogs } from "./live.js";
@@ -105,6 +110,8 @@ import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync,
 import { BRANCH_PREFIX, envTwins, envValue, existingOrFirst, taskBranches } from "./names.js";
 import { claimActor, currentActor, withActor } from "./actor.js";
 import { parseLeadToken } from "./api-tokens.js";
+import { MAX_NETWORK_HOSTS, normalizeHost } from "./egress.js";
+import { isWritesMode, writesWords } from "./writes-mode.js";
 import { CLI_PASSWORD_SOURCE, withPasswordSource } from "./sign-in-guard.js";
 import { admissionRecorded, admitProject, commandLineActor } from "./project-admission.js";
 import { leadClaim, leadSay, noteLeadWork } from "./lead-voice.js";
@@ -182,7 +189,7 @@ import { register, authenticate, heartbeat as heartbeatRunner, isAlive, recoverD
 import { mintCoordinator, revokeCoordinator, listCoordinators } from "./coordinator.js";
 import { serveMcp } from "./mcp.js";
 import { createInterface } from "node:readline";
-import { propose, approve, addApprover, authenticateAccount, authenticateApprover as passwordApprover, describeScope, approvalOf, hashToken as hashApproverToken, fileAndSealUnderMode, modeFilingCoverage, acceptanceLinesToInput, parseAcceptanceCriteria, splitAcceptanceRubric, rubricIsPlaceholder, isCommitSha } from "./scope.js";
+import { propose, approve, addApprover, authenticateAccount, authenticateApprover as passwordApprover, describeScope, approvalOf, hashToken as hashApproverToken, fileAndSealUnderMode, modeFilingCoverage, acceptanceLinesToInput, parseAcceptanceCriteria, splitAcceptanceRubric, rubricIsPlaceholder, isCommitSha, credentialProof, rememberedLogin } from "./scope.js";
 import { CHAT_APPROVE_ALL, presetTerms, modeTermsJson, modeDigestOf, modeTermsFromJson, modeWords, MODE_MAX_DAYS } from "./modes.js";
 import { WorktreePool } from "./worktree.js";
 import { baseStandingWords, freshBaseFor, taskBaseOf } from "./task-base.js";
@@ -251,6 +258,15 @@ export const OPERATE_HELP = `toolroll — operating the queue
   toolroll project show              show the current project and credential reference
   toolroll project rules --repo <p>  a project's approval rules; an instance operator changes them with
                                         --not-requester on|off, --protect none|project, --protect-paths "a/**,b/**"
+  toolroll project network --repo <p> [--allow h,…] [--remove h,…] [--open|--allowlist] [--local any|none]
+                                        what the project's builds may reach on the network; an approver changes it
+                                        (new scopes seal it; approved ones keep theirs)
+  toolroll project writes --repo <p> [workspace|anywhere]
+                                        where the project's builds may write: only their checkout, caches and temp
+                                        (workspace, the default), or anywhere outside Toolroll's fenced folders;
+                                        an approver changes it (new scopes seal it; approved ones keep theirs)
+  toolroll config unconfined-agents [allow|refuse]
+                                        whether builds run where this machine can't confine them (instance operator)
   toolroll project concurrency [<n>] --repo <p>
                                         how many of a project's tasks build at once (default 2, never past the
                                         worker's capacity); an approver changes it with <n>
@@ -677,6 +693,8 @@ export const OPERATE_BOOLEAN_FLAGS = new Set([
     "no-open", "remove", "no-verify", "no-follow", "end", "report", "off", "tmux",
     "self-heal", "plan-auto", "chat-approve", "full-access", "repair-auto", "review-retry-auto", "no-local",
     "html", "csv", "alerts-only",
+    // project network: what its builds may reach (--open | --allowlist).
+    "open", "allowlist",
     // v105: the full export.
     "zip",
     // Settings → Integrations: the last checks, without checking again.
@@ -698,6 +716,9 @@ export const OPERATE_BOOLEAN_FLAGS = new Set([
     // task steer: pause the running Claude build, then send the note.
     "now",
 ]);
+/** `project network` reads --remove <hosts> and --local any|none as values, where every other verb's --remove and
+ * --local are switches. */
+const PROJECT_NETWORK_VALUE_FLAGS = new Set(["remove", "local"]);
 export function parseOperateArgs(argv, ownValues = new Set()) {
     const positional = [];
     const flags = new Map();
@@ -752,10 +773,11 @@ export function parseOperateArgs(argv, ownValues = new Set()) {
 }
 /** Route a native command and return its exit code. Its password source cannot be selected by an HTTP request. */
 export async function runOperate(command, argv, write, options = {}) {
-    return withPasswordSource(CLI_PASSWORD_SOURCE, () => runOperateLocal(command, argv, write, options));
+    // Each command gets its own remembered-login holder (Passwordless: "cli-login" is this command's, never the next one's).
+    return withPasswordSource(CLI_PASSWORD_SOURCE, () => rememberedLogin.run({ login: null }, () => runOperateLocal(command, argv, write, options)));
 }
 async function runOperateLocal(command, argv, write, options = {}) {
-    const parsed = parseOperateArgs(argv, command === "flows" ? FLOWS_VALUE_FLAGS : undefined);
+    const parsed = parseOperateArgs(argv, ownValueFlags(command, argv));
     // A parse error precedes the flags map, so JSON mode is read from the raw
     // argv — the envelope contract holds even for the earliest refusal.
     if ("error" in parsed)
@@ -967,7 +989,7 @@ export async function runOperateAs(argv, opts) {
     const scope = REMOTE_SCOPES.get(row.invocation);
     if (row.remote !== "yes" || scope === undefined)
         return refuse("not-remote", REMOTE_MESSAGES.no);
-    const parsed = parseOperateArgs(rest, root === "flows" ? FLOWS_VALUE_FLAGS : undefined);
+    const parsed = parseOperateArgs(rest, ownValueFlags(root, rest));
     if ("error" in parsed)
         return refuse("usage", parsed.error);
     // The parser's positionals must spell the same row (a value flag can't hide a subcommand).
@@ -1145,6 +1167,10 @@ async function dispatch(command, positional, flags, context) {
                 return projectDeleteCommand(positional, flags, context);
             if (positional[0] === "concurrency")
                 return projectConcurrencyCommand(positional, flags, context);
+            if (positional[0] === "network")
+                return projectNetworkCommand(positional, flags, context);
+            if (positional[0] === "writes")
+                return projectWritesCommand(positional, flags, context);
             if (positional[0] === "checks")
                 return projectChecksCommand(positional, flags, context);
             if (positional[0] === "demo")
@@ -1223,6 +1249,8 @@ async function dispatch(command, positional, flags, context) {
         case "flows":
             return flowsCommand(positional, flags, context);
         case "config":
+            if (positional[0] === "unconfined-agents")
+                return unconfinedAgentsCommand(positional, flags, context);
             return configCommand(positional, flags, context);
         case "chat":
             return chatCommand(flags, context);
@@ -1243,6 +1271,8 @@ async function dispatch(command, positional, flags, context) {
             });
         case "keys":
             return keysCommand(positional, flags, context);
+        case "agents":
+            return agentsCommand(positional, flags, context);
         case "setup":
             return setupCommand(positional, flags, context);
         case "verify":
@@ -1488,6 +1518,9 @@ function claimCommand(positional, flags, context) {
         if (result.reason === "coordinator-filed") {
             return fail(write, json, "claim", "coordinator-filed", "a coordinator filed this — nothing runs until the operator signs its scope", EXIT.refused);
         }
+        if (result.reason === "sweep-limit") {
+            return fail(write, json, "claim", "sweep-limit", `its sweep already has ${result.limit} running at once — it starts when one finishes`, EXIT.refused, { sweep: result.sweep, limit: result.limit });
+        }
         return fail(write, json, "claim", result.reason, `held by ${result.by} until ${result.until}`, EXIT.refused, { holder: result.by, until: result.until });
     }
     // Taking a task is what makes it running; leaving that to the caller would
@@ -1606,7 +1639,7 @@ async function runnerCommand(positional, flags, context) {
         if (acting === null) {
             return fail(write, json, "runner register", "usage", "`runner register <name> --repo <path> --as <you> --token <t>` — minting runner authority is an operator act", EXIT.usage);
         }
-        const authenticated = authenticateApprover(store, acting.name, acting.token);
+        const authenticated = credentialApprover(store, acting.name, acting.token);
         if (!authenticated.ok) {
             return fail(write, json, "runner register", authenticated.reason, describeApproveFailure(authenticated.reason, name), EXIT.refused);
         }
@@ -1732,7 +1765,7 @@ async function runnerCommand(positional, flags, context) {
         if (acting === null) {
             return fail(write, json, "runner bind", "usage", "`runner bind <name> --repo <path> --as <you> --token <t>` — binding repositories is an operator act", EXIT.usage);
         }
-        const authenticated = authenticateApprover(store, acting.name, acting.token);
+        const authenticated = credentialApprover(store, acting.name, acting.token);
         if (!authenticated.ok) {
             return fail(write, json, "runner bind", authenticated.reason, describeApproveFailure(authenticated.reason, name), EXIT.refused);
         }
@@ -1818,7 +1851,7 @@ async function coordinatorCommand(positional, flags, context) {
         if (acting === null) {
             return fail(write, json, "coordinator mint", "usage", "`coordinator mint <name> --repo <path> --as <you> --token <t>` — minting filing authority is an operator act", EXIT.usage);
         }
-        const authenticated = authenticateApprover(store, acting.name, acting.token);
+        const authenticated = credentialApprover(store, acting.name, acting.token);
         if (!authenticated.ok) {
             return fail(write, json, "coordinator mint", authenticated.reason, describeApproveFailure(authenticated.reason, name), EXIT.refused);
         }
@@ -2292,6 +2325,17 @@ async function tickCommand(flags, context) {
         root: pool,
         ...(context.gitRunner === undefined ? {} : { runner: context.gitRunner }),
     });
+    // ACP agent checks (acp-check.ts) run in a watch's own pass, under its lease, before anything is dispatched — one
+    // at a time per runner. Only a watch's full pass runs them (never a build lane, never a bare tick).
+    const watchOwner = text(flags, "incarnation");
+    if (watchOwner !== undefined && !buildsOnly) {
+        await runAcpChecks({
+            store, runner, token, pool: worktrees, clock,
+            watch: { repo: canonicalProject(repo) ?? resolve(repo), owner: watchOwner },
+            progress: line => { if (!json)
+                write(line); },
+        });
+    }
     // Where a first attempt's branch grows from, resolved once per pass. A
     // detached HEAD refuses the pass rather than guessing: an unattended commit
     // onto "wherever the operator happened to be" is not a default.
@@ -2616,6 +2660,20 @@ async function tickCommand(flags, context) {
             : [store.getScope(id)?.approvedProfile?.provider].filter((one) => one !== null && one !== undefined);
         let unattestedLane = null;
         for (const candidate of new Set(skipProviders)) {
+            // An ACP agent is admitted by its own check on this runner (absence is denial), read here the way the gateway reads it.
+            if (isAcpProvider(candidate)) {
+                const checked = store.acpAttestationFor(candidate, runner);
+                const verified = checked === null ? null : verifyLaunch(checked.launch);
+                if (checked === null) {
+                    unattestedLane = `${ACP_AGENTS[candidate].name} isn't checked on ${runner} — run \`toolroll agents check ${candidate}\` there`;
+                    break;
+                }
+                if (verified !== null && !verified.ok) {
+                    unattestedLane = verified.problem;
+                    break;
+                }
+                continue;
+            }
             if (attestationOf(candidate) === null)
                 continue;
             let verdict = attestedThisPass.get(candidate);
@@ -2646,7 +2704,9 @@ async function tickCommand(flags, context) {
         // budget is raised (the 100% alert went out; the task page and the spend page say why).
         // Budgets are dollars: work that runs only on subscriptions passes (see Store.budgetGate).
         // Each provider as it bills now.
-        const budgeted = budgetHold(ref.id, store.agentsFor([spec.provider, ...skipProviders]));
+        // An ACP agent bills as its declaration for the exact model it would run on this runner.
+        const sealedModel = store.getScope(id)?.approvedProfile?.model ?? null;
+        const budgeted = budgetHold(ref.id, [...new Set([spec.provider, ...skipProviders])].map(provider => isAcpProvider(provider) ? store.agentFor(provider, provider === spec.provider ? spec.model ?? sealedModel : sealedModel, runner) : store.agentsFor([provider])[0]));
         if (budgeted.over !== null) {
             dispatched.push({ id, outcome: "skipped", reason: "budget", detail: budgetWords(budgeted) });
             continue;
@@ -3900,6 +3960,7 @@ async function startConsole(options) {
         ...(options.registryPath === undefined ? {} : { registryPath: options.registryPath }),
         ...(options.upConsole === undefined ? {} : { upConsole: options.upConsole }),
         ...(options.editorLinks === undefined ? {} : { editorLinks: options.editorLinks }),
+        ...(options.instanceSecret === undefined ? {} : { instanceSecret: options.instanceSecret }),
     });
     await new Promise((resolve, reject) => {
         server.once("error", reject);
@@ -4035,6 +4096,8 @@ async function requeueTask(positional, flags, context) {
             claimed: `a runner holds ${id} right now — wait for the attempt to end, or stop it`,
             "accepted-result": `${id}'s last result was accepted; change it through a revision, not a rerun`,
             published: `${id}'s last result is published; revise it through its pull request`,
+            // Only an Approve & build again asks for an exact build; the CLI never does.
+            moved: `${id} changed since its page was read; read it again`,
         };
         return fail(write, json, "task requeue", result.reason, why[result.reason], EXIT.refused);
     }
@@ -4317,6 +4380,13 @@ async function providersCommand(flags, context) {
     // that serializes four of them reads as a hang (Phase 3).
     const probed = await Promise.all(PROVIDER_IDS.map(async (id) => {
         const facts = inspectionOf(id);
+        // An ACP agent is looked at, never run (acp-inspect.ts): its version is its package's, read; whether it may
+        // run is its conformance check.
+        if (isAcpProvider(id)) {
+            const seen = inspectAcpAgent(id);
+            const version = { code: seen.found ? 0 : 127, stdout: seen.found ? (seen.package?.version ?? "") : "", stderr: "", notFound: !seen.found, timedOut: false };
+            return { id, facts, version, installed: seen.found, identity: seen.found ? `not checked on this computer — run \`toolroll agents check ${id}\`` : null };
+        }
         // A version probe carries no key (Codex gemini verify, finding 2).
         const version = await probe(facts.binary, ["--version"], { timeoutMs: 5_000, omitEnv: ALL_CREDENTIAL_ENV });
         const installed = version.code === 0 && !version.notFound;
@@ -4373,7 +4443,7 @@ async function providersCommand(flags, context) {
         if (runnerName === undefined || runnerToken === undefined) {
             return fail(write, json, "providers", "usage", "`toolroll providers --report --runner <name> --token <t>` records readiness under that runner", EXIT.usage);
         }
-        const observed = await observeProviderReadiness((file, args, options) => probe(file, args, { timeoutMs: options?.timeoutMs ?? 5_000, ...(options?.omitEnv === undefined ? {} : { omitEnv: options.omitEnv }) }));
+        const observed = await observeProviderReadiness((file, args, options) => probe(file, args, { timeoutMs: options?.timeoutMs ?? 5_000, ...(options?.omitEnv === undefined ? {} : { omitEnv: options.omitEnv }) }), process.env, PROVIDER_IDS, provider => store.acpAttestationFor(provider, runnerName));
         const reported = reportProviderReadinessAuthed(store, { name: runnerName, token: runnerToken, observations: observed }, context.clock());
         if (!reported.ok) {
             return fail(write, json, "providers", reported.reason, describeAuth(reported.reason, runnerName), EXIT.refused);
@@ -4444,6 +4514,83 @@ async function providersCommand(flags, context) {
  * own — these are 0600 files under the operator's home, and whoever can
  * write them already owns the machine's spend.
  */
+/**
+ * `toolroll agents …` — the coding agents Toolroll runs over ACP (acp-agents.ts): what is installed here, which are
+ * checked on which runner, and how each checked model is billed. An agent runs only once its conformance check passed
+ * on that runner (acp-check.ts); asking for one, or declaring a model billed by the agent's own plan, takes a password.
+ *
+ *   agents                                        each agent: installed, checked, billing
+ *   agents check <agent> --model <m> [--runner r] ask the runner's watch to check it (password)
+ *   agents revoke <agent> [--runner r]            the agent stops running there
+ *   agents billing <agent> <model> plan|metered [--runner r]
+ */
+async function agentsCommand(positional, flags, context) {
+    const { store, write, json, clock } = context;
+    const [action = "list", provider, ...rest] = positional;
+    const runners = store.listRunners().filter(one => one.retiredAt === null).map(one => one.name);
+    const runnerGiven = text(flags, "runner");
+    const runner = runnerGiven ?? (runners.length === 1 ? runners[0] : undefined);
+    if (action === "list") {
+        const rows = ACP_PROVIDER_IDS.map(id => {
+            const seen = inspectAcpAgent(id);
+            const checked = runners.flatMap(name => { const one = store.acpAttestationFor(id, name); return one === null ? [] : [{ runner: name, agent: one.agent, models: one.models, at: one.recordedAt }]; });
+            const latest = store.acpChecksFor(id, 1)[0] ?? null;
+            return { provider: id, name: ACP_AGENTS[id].name, installed: seen.found ? seen.realpath : null, checked, latestCheck: latest === null ? null : { id: latest.id, state: latest.state, model: latest.model, result: latest.result } };
+        });
+        if (json) {
+            write(envelopeJson({ ok: true, command: "agents", agents: rows }));
+            return EXIT.ok;
+        }
+        for (const row of rows) {
+            write(`  ${row.name.padEnd(10)} ${row.installed === null ? "not installed" : row.installed}`);
+            for (const one of row.checked)
+                write(`             checked on ${one.runner}: ${one.agent.name} ${one.agent.version}, ${one.models.length} models (${one.at.slice(0, 10)})`);
+            if (row.latestCheck !== null && row.latestCheck.state !== "passed")
+                write(`             check #${row.latestCheck.id} (${row.latestCheck.model}): ${row.latestCheck.state}${row.latestCheck.result === null ? "" : ` — ${row.latestCheck.result}`}`);
+        }
+        write("  → `agents check <agent> --model <id>` asks this runner's watch to check one; it runs on the watch's next pass");
+        return EXIT.ok;
+    }
+    if (!["check", "revoke", "billing"].includes(action))
+        return fail(write, json, "agents", "usage", "`toolroll agents [check|revoke|billing]`", EXIT.usage);
+    if (provider === undefined || !isAcpProvider(provider))
+        return fail(write, json, `agents ${action}`, "usage", `which agent? ${ACP_PROVIDER_IDS.join(", ")}`, EXIT.usage);
+    if (runner === undefined || !runners.includes(runner))
+        return fail(write, json, `agents ${action}`, "usage", `which runner? --runner ${runners.join(" | ") || "<name>"}`, EXIT.usage);
+    const acting = await askCredentials(flags, context);
+    if (acting === null)
+        return fail(write, json, `agents ${action}`, "usage", "this takes your name and password — `--as <you>` and the hidden prompt", EXIT.usage);
+    const verified = verifyApproverByPassword(store, acting.name, acting.token, store.knownRepos().filter(repo => store.accountCanAccess(acting.name, repo)));
+    if (!verified.ok)
+        return fail(write, json, `agents ${action}`, "unauthenticated", "that is not an approver, or the password does not match", EXIT.refused);
+    // Which agents a runner admits, and how they bill, hold for every project the runner serves: an operator's call.
+    if (!store.isInstanceOperator(verified.who.name))
+        return fail(write, json, `agents ${action}`, "forbidden", "only an installation operator can check, revoke or set billing for a runner's agents", EXIT.refused);
+    const name = ACP_AGENTS[provider].name;
+    const now = clock();
+    if (action === "revoke") {
+        const revoked = store.revokeAcpAttestation(provider, runner, verified.who.name, now);
+        return succeed(write, json, "agents revoke", { provider, runner, revoked }, () => [revoked ? `${name} no longer runs on ${runner}; check it again to bring it back.` : `${name} wasn't checked on ${runner}.`]);
+    }
+    if (action === "billing") {
+        const [model, kind] = rest;
+        if (model === undefined || !validModelId(model) || (kind !== "plan" && kind !== "metered"))
+            return fail(write, json, "agents billing", "usage", "`agents billing <agent> <model> plan|metered`", EXIT.usage);
+        const revision = store.declareAcpBilling({ provider, runner, model, kind, by: verified.who.name }, now);
+        return succeed(write, json, "agents billing", { provider, runner, model, kind, revision }, () => [kind === "plan"
+                ? `${name} on ${model} (${runner}) is billed by ${name}'s own plan: its runs count as $0, unmeasured, and monthly budgets don't hold them. Runs already started keep the terms they started with.`
+                : `${name} on ${model} (${runner}) is metered: its cost is unknown, so capped work and hard budgets hold it.`]);
+    }
+    // check
+    const model = text(flags, "model");
+    if (model === undefined || !validModelId(model))
+        return fail(write, json, "agents check", "usage", "`agents check <agent> --model <id>` — a model the agent offers (its own list shows after the check)", EXIT.usage);
+    const id = store.requestAcpCheck({ provider, runner, model, by: verified.who.name }, now);
+    return succeed(write, json, "agents check", { provider, runner, model, request: id }, () => [
+        `Check #${id} asked for: ${name} on ${model}, on ${runner}. Its watch runs it on its next pass (two short runs, in the fence; the model's own spend).`,
+        "→ `toolroll agents` shows how it went.",
+    ]);
+}
 async function keysCommand(positional, flags, context) {
     const { write, json } = context;
     const [action, provider, ...rest] = positional;
@@ -4451,7 +4598,8 @@ async function keysCommand(positional, flags, context) {
         return fail(write, json, "keys", "usage", `unknown \`keys ${action ?? ""}\` — try ${KEYS_ACTIONS.join(", ")}`, EXIT.usage);
     }
     if (action === "status") {
-        const rows = PROVIDER_IDS.map(one => ({
+        // ACP agents sign in their own way: Toolroll keeps no key for them, so they aren't listed here.
+        const rows = PROVIDER_IDS.filter(isKeyedProvider).map(one => ({
             provider: one,
             envName: PROVIDER_KEY_ENV[one],
             ...keyStatus(one),
@@ -4475,7 +4623,10 @@ async function keysCommand(positional, flags, context) {
         return EXIT.ok;
     }
     if (provider === undefined || !isProviderId(provider)) {
-        return fail(write, json, `keys ${action}`, "usage", `which provider? ${PROVIDER_IDS.join(", ")}`, EXIT.usage);
+        return fail(write, json, `keys ${action}`, "usage", `which provider? ${PROVIDER_IDS.filter(isKeyedProvider).join(", ")}`, EXIT.usage);
+    }
+    if (!isKeyedProvider(provider)) {
+        return fail(write, json, `keys ${action}`, "refused", `${ACP_AGENTS[provider].name} signs in its own way (\`${ACP_AGENTS[provider].signIn}\`) — Toolroll keeps no key for it`, EXIT.refused);
     }
     if (action === "clear") {
         const cleared = clearProviderKey(provider);
@@ -4580,7 +4731,8 @@ async function peopleCommand(positional, flags, context) {
     if (acting === null) {
         return fail(write, json, `people ${action}`, "usage", `\`toolroll people ${action} … --as <you> --token <t>\``, EXIT.usage);
     }
-    const authenticated = authenticateApprover(store, acting.name, acting.token);
+    // Inviting and widening access are credential acts; revoking only narrows.
+    const authenticated = (action === "revoke" ? authenticateApprover(store, acting.name, acting.token) : credentialApprover(store, acting.name, acting.token));
     if (!authenticated.ok) {
         return fail(write, json, `people ${action}`, authenticated.reason, describeApproveFailure(authenticated.reason, acting.name), EXIT.refused);
     }
@@ -4647,7 +4799,8 @@ async function chatApprovalCommand(positional, flags, context) {
     const acting = await askCredentials(flags, context);
     if (acting === null)
         return fail(write, json, command, "unauthenticated", "Approving from chat is your own setting: pass --as <you> --token <your password> (or sign in once with toolroll up).", EXIT.refused);
-    const authed = authenticateApprover(store, acting.name, acting.token);
+    // Turning approving from chat on (or changing its limits) is a credential act; showing or turning it off is not.
+    const authed = (action === "on" ? credentialApprover(store, acting.name, acting.token) : authenticateApprover(store, acting.name, acting.token));
     if (!authed.ok)
         return fail(write, json, command, "unauthenticated", "That name and password aren't an approver's. Nothing was changed.", EXIT.refused);
     const given = text(flags, "repo");
@@ -4710,7 +4863,8 @@ async function modeCommand(positional, flags, context) {
     if (acting === null) {
         return fail(write, json, "mode", "usage", "signing or revoking a mode takes `--as <you> --token <t>`", EXIT.usage);
     }
-    const authed = authenticateApprover(store, acting.name, acting.token);
+    // Signing a mode that lets a chat app approve is a credential act; any other mode signing or revoking is ordinary.
+    const authed = (flag(flags, "chat-approve") ? credentialApprover(store, acting.name, acting.token) : authenticateApprover(store, acting.name, acting.token));
     if (!authed.ok) {
         return fail(write, json, "mode", authed.reason, "that is not an active approver, or the token does not match", EXIT.refused);
     }
@@ -6816,7 +6970,7 @@ async function resolveUpApprover(context, flags, canPrompt) {
     return { approver: selected, approvers: names, verified, passwordFile, mintedPassword: null, notes };
 }
 /** The platform browser opener — detached, silent, never load-bearing. */
-function openBrowser(url) {
+export function openBrowser(url) {
     // TOOLROLL_BROWSER_COMMAND names another program to open it with (it gets the address as its one argument).
     const chosen = envValue(process.env, "BROWSER_COMMAND");
     const command = chosen !== undefined && chosen !== "" ? [chosen, url]
@@ -7182,9 +7336,12 @@ async function upCommand(flags, context) {
     // proved set on each request, so its project rail and unified chat move
     // with the live builder instead of freezing at process start.
     const activeRepos = new Set(repos);
+    // Cockpit B1: this start's instance secret, minted once it is listening; the console answers its challenges with it.
+    let instanceSecret = null;
     let console_;
     try {
         console_ = await startConsole({
+            instanceSecret: () => instanceSecret,
             context,
             host: hostFlag,
             port,
@@ -7442,7 +7599,7 @@ async function upCommand(flags, context) {
     const observeReadiness = () => {
         if (context.agentRunner !== undefined)
             return;
-        void observeProviderReadiness((file, args, options) => run(file, args, { timeoutMs: options?.timeoutMs ?? 5_000, ...(options?.omitEnv === undefined ? {} : { omitEnv: options.omitEnv }) }))
+        void observeProviderReadiness((file, args, options) => run(file, args, { timeoutMs: options?.timeoutMs ?? 5_000, ...(options?.omitEnv === undefined ? {} : { omitEnv: options.omitEnv }) }), process.env, PROVIDER_IDS, provider => store.acpAttestationFor(provider, runnerName))
             .then(observed => {
             if (!stopping)
                 reportProviderReadinessAuthed(store, { name: runnerName, token: runnerToken, observations: observed }, clock());
@@ -7474,6 +7631,21 @@ async function upCommand(flags, context) {
         login: { account: approverPlan2.passwordFile === null ? approverPlan2.approver : loginAccount(approverPlan2.passwordFile) ?? approverPlan2.approver, file: approverPlan2.passwordFile },
     });
     recordUpConsoleUrl(dirname(context.databaseFile), url, clock());
+    // Cockpit B1: who this console is, for bare `toolroll` to prove before it attaches: a fresh secret in the database
+    // (behind the agent fence), and a discovery-only socket beside it. A socket that can't open only means attaching
+    // isn't offered; the console runs either way.
+    // The socket is taken FIRST: only the console that owns it publishes a record. A second console on the same database
+    // (another port) never replaces the first one's record; it runs, but isn't attached to.
+    let mintedSecret = null;
+    const instanceSocket = await openInstanceSocket(context.databaseFile, { pid: process.pid, build: packageVersion(), database: context.databaseFile, port: console_.port }, () => mintedSecret);
+    if (instanceSocket.ok) {
+        mintedSecret = await claimInstance(store, context.databaseFile, { pid: process.pid, port: console_.port, build: packageVersion(), socket: instanceSocket.name }, clock());
+        instanceSecret = mintedSecret;
+        if (mintedSecret === null)
+            progress("attach: another console is running on this database — `toolroll` in a repository opens that one");
+    }
+    else
+        progress(`attach: ${instanceSocket.problem} — \`toolroll\` in a repository won't find this console`);
     if (fatal === null) {
         if (json) {
             write(envelopeJson({
@@ -7541,7 +7713,15 @@ async function upCommand(flags, context) {
     process.removeListener("SIGINT", stop);
     process.removeListener("SIGTERM", stop);
     retireRunnerIfCurrent(store, runnerName, runnerToken, clock());
-    await new Promise(done => console_.server.close(() => done()));
+    if (instanceSocket.ok)
+        instanceSocket.close();
+    if (mintedSecret !== null)
+        clearInstance(store, mintedSecret);
+    let closeProblem = null;
+    await new Promise(done => console_.server.close(error => { closeProblem = error ?? null; done(); }));
+    // A live terminal that couldn't be proved stopped (or any other close failure) is said, never "stopped".
+    if (closeProblem !== null && fatal === null)
+        fatal = closeProblem.message;
     if (fatal !== null) {
         // The startup envelope (when json) already went out; the exit code is
         // the health signal (finding 11/20) — never a second envelope.
@@ -7671,7 +7851,7 @@ async function bridgeCommand(positional, flags, context) {
             return fail(write, json, `bridge ${action}`, "usage", "`--as <you> --token <your password>` — pairing hands your authority to a chat, so it takes your credential", EXIT.usage);
         }
         const { name: asWho, token } = acting;
-        const authenticated = authenticateApprover(store, asWho, token);
+        const authenticated = (action === "pair" ? credentialApprover(store, asWho, token) : authenticateApprover(store, asWho, token));
         if (!authenticated.ok) {
             return fail(write, json, `bridge ${action}`, authenticated.reason, describeApproveFailure(authenticated.reason, asWho), EXIT.refused);
         }
@@ -9451,7 +9631,7 @@ async function leadCommand(positional, flags, context) {
     if (currentActor()?.lead === true)
         return fail(write, json, command, "refused", "A lead cannot mint lead tokens. The person it acts for runs this with their password.", EXIT.refused);
     const acting = await askCredentials(flags, context);
-    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
+    const verified = acting === null ? null : (flags.has("revoke") ? authenticateApprover(store, acting.name, acting.token) : credentialApprover(store, acting.name, acting.token));
     if (acting === null || verified === null || !verified.ok) {
         return fail(write, json, command, "unauthenticated", "A lead token is minted behind your password: pass --as and --token (or use the remembered login).", EXIT.refused);
     }
@@ -10365,6 +10545,10 @@ function credentialsFrom(flags, context) {
         if (remembered !== null && (name === undefined || name === remembered.name)) {
             name = remembered.name;
             token = remembered.password;
+            // This command proves with the remembered login: under Passwordless that reads as "cli-login", never as typed.
+            const holder = rememberedLogin.getStore();
+            if (holder !== undefined)
+                holder.login = { name, token };
         }
     }
     return { name, token };
@@ -10385,6 +10569,12 @@ async function askCredentials(flags, context) {
  * which scope.ts's authenticateAccount takes as that person (a viewer for a read token) and never checks as a
  * password; these add the token's own project limit.
  */
+/** A credential act from the CLI (docs/plans/passwordless.md §5): a password typed for this command; with Passwordless on,
+ * never the remembered login. */
+function credentialApprover(store, by, token, repo) {
+    const proved = authenticateApprover(store, by, token, repo);
+    return !proved.ok || credentialProof(proved.method) ? proved : { ok: false, reason: "not-an-approver" };
+}
 function authenticateApprover(store, by, token, repo) {
     const remote = activeRemote();
     if (remote !== null && repo !== undefined && !remote.allows(repo))
@@ -10734,6 +10924,123 @@ async function projectRulesCommand(positional, flags, context) {
     context.store.setApprovalRules(repo, next, acting.name, context.clock());
     return succeed(context.write, context.json, command, { repo, rules: next }, () => [`${repo}: ${rulesSummary(next)}`]);
 }
+/**
+ * `project network --repo <p> [--allow h,…] [--remove h,…] [--open|--allowlist] [--local any|none]`: what the project's
+ * builds may reach (egress.ts). New scopes are written with it and their approvals seal it; scopes already approved
+ * keep the network they were approved with. Widening or narrowing it is an approver's act with a password typed now,
+ * kept in the ledger as before → after.
+ */
+async function projectNetworkCommand(positional, flags, context) {
+    const command = "project network";
+    const allowed = new Set(["repo", "allow", "remove", "open", "allowlist", "local", "as", "token", "token-file", "token-env", "db", "json"]);
+    for (const name of flags.keys())
+        if (!allowed.has(name))
+            return fail(context.write, context.json, command, "usage", `--${name} is not a project network option.`, EXIT.usage);
+    const repoFlag = text(flags, "repo");
+    const local = flags.get("local");
+    if (positional.length > 1 || repoFlag === undefined || (flags.has("open") && flags.has("allowlist")) || (local !== undefined && local !== "any" && local !== "none")) {
+        return fail(context.write, context.json, command, "usage", "Use project network --repo <project path> [--allow host,…] [--remove host,…] [--open | --allowlist] [--local any|none].", EXIT.usage);
+    }
+    const registered = await loadRepos(registryPathOf(context)).catch(() => ({ error: "unreadable" }));
+    const known = [...new Set([...context.store.knownRepos(), ...context.store.listProjects().map(one => one.path), ...("error" in registered ? [] : registered.repos)])];
+    const repo = known.find(one => one === repoFlag || one === resolve(repoFlag) || one === canonicalProject(repoFlag));
+    if (repo === undefined)
+        return fail(context.write, context.json, command, "not-found", "That isn't a project Toolroll knows.", EXIT.refused);
+    const current = context.store.projectNetwork(repo);
+    const words = (one) => [
+        `${repo}: ${one.mode === "open" ? "builds may reach any host" : `builds reach their agent's provider, the package registries the project uses${one.hosts.length === 0 ? "" : `, and ${one.hosts.join(", ")}`}`}.`,
+        one.loopback === "any" ? "On a Mac, builds may reach this Mac's local services (never Toolroll's own)." : "On a Mac, builds reach no local services but their own proxy and tools.",
+    ];
+    const listOf = (name) => {
+        const given = text(flags, name);
+        if (given === undefined)
+            return [];
+        const hosts = given.split(",").map(one => one.trim()).filter(Boolean).map(normalizeHost);
+        return hosts.some(one => one === null) ? null : hosts;
+    };
+    const add = listOf("allow"), remove = listOf("remove");
+    if (add === null || remove === null)
+        return fail(context.write, context.json, command, "usage", "A host is a name like api.stripe.com or *.stripe.com: no address, port or path.", EXIT.usage);
+    const changing = add.length > 0 || remove.length > 0 || flags.has("open") || flags.has("allowlist") || local !== undefined;
+    if (!changing)
+        return succeed(context.write, context.json, command, { repo, network: current }, () => words(current));
+    const next = {
+        mode: flags.has("open") ? "open" : flags.has("allowlist") ? "allowlist" : current.mode,
+        hosts: [...new Set([...current.hosts.filter(one => !remove.includes(one)), ...add])].sort(),
+        loopback: local === "any" ? "any" : local === "none" ? "proxy-only" : current.loopback,
+    };
+    if (next.hosts.length > MAX_NETWORK_HOSTS)
+        return fail(context.write, context.json, command, "usage", `A project lists at most ${MAX_NETWORK_HOSTS} hosts.`, EXIT.usage);
+    const acting = await askCredentials(flags, context);
+    const verified = acting === null ? null : credentialApprover(context.store, acting.name, acting.token, repo);
+    if (acting === null || verified === null || !verified.ok || !context.store.accountCanAccess(acting.name, repo)) {
+        return fail(context.write, context.json, command, "refused", "An approver for this project changes what its builds may reach, with their password: pass --as and --token.", EXIT.refused);
+    }
+    const changed = context.store.setProjectNetwork(repo, next, acting.name, context.clock());
+    return succeed(context.write, context.json, command, { repo, before: changed.before, network: changed.after }, () => [
+        ...words(changed.after),
+        "Scopes written from now on use this; scopes already approved keep the network they were approved with.",
+    ]);
+}
+/**
+ * `project writes --repo <p> [workspace|anywhere]`: where the project's builds may write (writes-mode.ts). `workspace`:
+ * only their checkout and its Git data, their caches, their temp folder and the provider state their CLI needs;
+ * `anywhere`: anywhere outside Toolroll's fenced folders. New scopes seal it; approved ones keep theirs. Changing it is
+ * an approver's act with a password typed now, kept in the ledger as before → after.
+ */
+async function projectWritesCommand(positional, flags, context) {
+    const command = "project writes";
+    const allowed = new Set(["repo", "as", "token", "token-file", "token-env", "db", "json"]);
+    for (const name of flags.keys())
+        if (!allowed.has(name))
+            return fail(context.write, context.json, command, "usage", `--${name} is not a project writes option.`, EXIT.usage);
+    const repoFlag = text(flags, "repo");
+    const wanted = positional[1];
+    if (positional.length > 2 || repoFlag === undefined || (wanted !== undefined && !isWritesMode(wanted))) {
+        return fail(context.write, context.json, command, "usage", "Use project writes --repo <project path> [workspace | anywhere].", EXIT.usage);
+    }
+    const registered = await loadRepos(registryPathOf(context)).catch(() => ({ error: "unreadable" }));
+    const known = [...new Set([...context.store.knownRepos(), ...context.store.listProjects().map(one => one.path), ...("error" in registered ? [] : registered.repos)])];
+    const repo = known.find(one => one === repoFlag || one === resolve(repoFlag) || one === canonicalProject(repoFlag));
+    if (repo === undefined)
+        return fail(context.write, context.json, command, "not-found", "That isn't a project Toolroll knows.", EXIT.refused);
+    const words = (one) => [`${repo}: builds write ${writesWords(one)}.`];
+    const current = context.store.projectWrites(repo);
+    if (wanted === undefined)
+        return succeed(context.write, context.json, command, { repo, writes: current }, () => words(current));
+    const acting = await askCredentials(flags, context);
+    const verified = acting === null ? null : credentialApprover(context.store, acting.name, acting.token, repo);
+    if (acting === null || verified === null || !verified.ok || !context.store.accountCanAccess(acting.name, repo)) {
+        return fail(context.write, context.json, command, "refused", "An approver for this project changes where its builds may write, with their password: pass --as and --token.", EXIT.refused);
+    }
+    const changed = context.store.setProjectWrites(repo, wanted, acting.name, context.clock());
+    return succeed(context.write, context.json, command, { repo, before: changed.before, writes: changed.after }, () => [
+        ...words(changed.after),
+        "Scopes written from now on use this; scopes already approved keep what they were approved with.",
+    ]);
+}
+/** `config unconfined-agents [allow|refuse]`: whether a build may run on a machine that can't confine it at the OS
+ * (no macOS sandbox, no working bubblewrap). Refused unless an instance operator allows it, with a password. */
+async function unconfinedAgentsCommand(positional, flags, context) {
+    const command = "config unconfined-agents";
+    const { store, write, json } = context;
+    const wanted = positional[1];
+    if (positional.length > 2 || (wanted !== undefined && wanted !== "allow" && wanted !== "refuse")) {
+        return fail(write, json, command, "usage", "Use config unconfined-agents [allow|refuse].", EXIT.usage);
+    }
+    const words = (allowed) => [allowed
+            ? "Builds run even where this machine can't confine them (each such run says \"Not confined\")."
+            : "Builds this machine can't confine at the OS don't start."];
+    if (wanted === undefined)
+        return succeed(write, json, command, { allowed: store.unfencedAgentsAllowed() }, () => words(store.unfencedAgentsAllowed()));
+    const acting = await askCredentials(flags, context);
+    const verified = acting === null ? null : credentialApprover(store, acting.name, acting.token);
+    if (acting === null || verified === null || !verified.ok || !store.isInstanceOperator(acting.name)) {
+        return fail(write, json, command, "refused", "An instance operator changes this, with their password: pass --as and --token.", EXIT.refused);
+    }
+    store.setUnfencedAgentsAllowed(wanted === "allow", acting.name, context.clock());
+    return succeed(write, json, command, { allowed: wanted === "allow" }, () => words(wanted === "allow"));
+}
 /** `project concurrency [<n>] --repo <p>`: how many of a project's tasks build at once. Changing it is an approver's act. */
 async function projectConcurrencyCommand(positional, flags, context) {
     const command = "project concurrency";
@@ -11618,3 +11925,12 @@ function databaseFailure(write, json, command, file, error) {
         return fail(write, json, command, "database", describe(error), EXIT.failed);
     return fail(write, json, command, "database-busy", `The database ${file} stayed busy for ${CONCURRENT_WRITER_WAIT_MS / 1_000} seconds. Wait for the other Toolroll process to finish, then try again.`, EXIT.failed);
 }
+// Last in the file, so the password tripwire's function positions (password-freshness.test.ts) stay as reviewed.
+/** The value flags a verb reads under a global switch's name, for parseOperateArgs. */
+export function ownValueFlags(command, argv) {
+    if (command === "flows")
+        return FLOWS_VALUE_FLAGS;
+    if (command === "project" && argv.find(arg => !arg.startsWith("-")) === "network")
+        return PROJECT_NETWORK_VALUE_FLAGS;
+    return undefined;
+}