toolroll 0.9.63 → 0.9.67

package/dist/project-memory.js

@@ -218,38 +218,63 @@ export function reindexProjectMemory(store, repo) {
             insert.run('decision', String(row['id']), repo, 'project', String(row['claim']), String(row['why']));
     });
 }
-/** Index conversation messages incrementally: private threads under their person, team conversations under their id and each project they cover. */
+/** Index conversation messages incrementally: private threads under their person, team conversations under their id and each project they cover.
+ * A message still waiting for a turn is not indexed: it is indexed when a turn takes it (the admitted-turn pass below,
+ * with the words the turn took), so a withdrawn, removed or edited waiting message never reaches search. */
 export function reindexConversations(store) {
-    const key = 'memory-search:messages';
+    const key = 'memory-search:messages', admittedKey = 'memory-search:admitted';
     const cursor = store.serviceCursor(key);
-    const rows = store.handle.prepare('SELECT m.id,m.thread,m.role,m.text,t.approver FROM lead_message m JOIN lead_thread t ON t.id=m.thread WHERE m.id>? ORDER BY m.id LIMIT 500').all(cursor);
-    if (rows.length === 0)
-        return;
+    const rows = store.handle.prepare('SELECT m.id,m.thread,m.role,m.text,m.pending,t.approver FROM lead_message m JOIN lead_thread t ON t.id=m.thread WHERE m.id>? ORDER BY m.id LIMIT 500').all(cursor);
     const insert = store.handle.prepare('INSERT INTO memory_search(kind,ref,repo,scope,title,body) VALUES (?,?,?,?,?,?)');
     const teamOf = store.handle.prepare('SELECT id, projects_json FROM team_conversation WHERE thread=?');
+    const indexOne = (row) => {
+        const id = Number(row['id']);
+        // Indexed exactly as stored (the search proves a hit against the stored words); blank means nothing to index.
+        const text = String(row['text']);
+        if (!text.trim() || text.length > 20_000)
+            return;
+        const team = teamOf.get(Number(row['thread']));
+        if (team) {
+            let projects = [];
+            try {
+                projects = JSON.parse(String(team['projects_json']));
+            }
+            catch {
+                projects = [];
+            }
+            for (const repo of projects.length ? projects : [''])
+                insert.run('conversation', `message:${id}`, repo, `conversation:${String(team['id'])}`, `${row['role']} in a team conversation`, text);
+        }
+        else
+            insert.run('conversation', `message:${id}`, '', `approver:${String(row['approver'])}`, `${row['role']} in a private chat`, text);
+    };
     store.transact(() => {
         let last = cursor;
         for (const row of rows) {
             last = Number(row['id']);
-            const text = String(row['text']).trim();
-            if (!text || text.length > 20_000)
+            if (Number(row['pending']) === 1)
                 continue;
-            const team = teamOf.get(Number(row['thread']));
-            if (team) {
-                let projects = [];
-                try {
-                    projects = JSON.parse(String(team['projects_json']));
-                }
-                catch {
-                    projects = [];
-                }
-                for (const repo of projects.length ? projects : [''])
-                    insert.run('conversation', `message:${last}`, repo, `conversation:${String(team['id'])}`, `${row['role']} in a team conversation`, text);
-            }
-            else
-                insert.run('conversation', `message:${last}`, '', `approver:${String(row['approver'])}`, `${row['role']} in a private chat`, text);
+            indexOne(row);
+        }
+        if (rows.length > 0)
+            store.setServiceCursor(key, last, new Date());
+        // Messages that waited and were then admitted (a personal queue row or a team room message bound to a turn since the
+        // last pass): one the walk passed while it waited (at or below the cursor this pass started from) is indexed now,
+        // with the words its turn took. One past it is left to the walk, so nothing is indexed twice. Found by the turn
+        // indexes on both queues: only queued messages are visited, never every turn. (After an update from before v128, a
+        // team message already indexed when it was saved gains a second copy once; search counts each entry once.)
+        const turnCursor = store.serviceCursor(admittedKey);
+        const admitted = store.handle.prepare(`SELECT message, turn FROM (SELECT message, turn_id AS turn FROM lead_queue WHERE turn_id > ?
+      UNION ALL SELECT message, turn_id AS turn FROM team_message WHERE turn_id > ?) ORDER BY turn LIMIT 500`).all(turnCursor, turnCursor);
+        if (admitted.length === 0)
+            return;
+        const taken = store.handle.prepare("SELECT m.id,m.thread,m.role,m.text,t.approver FROM lead_message m JOIN lead_thread t ON t.id=m.thread WHERE m.id=? AND m.pending=0 AND m.id<=?");
+        for (const one of admitted) {
+            const row = taken.get(Number(one['message']), cursor);
+            if (row !== undefined)
+                indexOne(row);
         }
-        store.setServiceCursor(key, last, new Date());
+        store.setServiceCursor(admittedKey, Number(admitted.at(-1)['turn']), new Date());
     });
 }
 const ftsQuery = (query) => {
@@ -269,11 +294,18 @@ export function searchMemory(store, args) {
         reindexProjectMemory(store, repo);
     const conversations = store.handle.prepare('SELECT conversation FROM team_participant WHERE account=? AND active=1').all(args.actor).map(row => `conversation:${String(row['conversation'])}`);
     const scopes = ['project', `approver:${args.actor}`, ...conversations];
+    const limit = Math.min(50, Math.max(1, args.limit ?? 12));
     const match = ftsQuery(query);
     if (!match)
         return [];
     const rows = store.handle.prepare(`SELECT kind, ref, repo, scope, title, snippet(memory_search, 5, '[', ']', '…', 24) AS snippet FROM memory_search
-    WHERE memory_search MATCH ? AND scope IN (SELECT value FROM json_each(?)) AND (repo='' OR repo IN (SELECT value FROM json_each(?))) ORDER BY bm25(memory_search) LIMIT ?`)
-        .all(match, JSON.stringify(scopes), JSON.stringify(repos), Math.min(50, Math.max(1, args.limit ?? 12)));
-    return rows.map(row => ({ kind: row['kind'], ref: String(row['ref']), repo: String(row['repo']), title: String(row['title']).slice(0, 200), snippet: String(row['snippet']).slice(0, 400) }));
+    WHERE memory_search MATCH ? AND scope IN (SELECT value FROM json_each(?)) AND (repo='' OR repo IN (SELECT value FROM json_each(?)))
+      AND (kind<>'conversation' OR EXISTS (SELECT 1 FROM lead_message m WHERE m.id=CAST(substr(memory_search.ref, 9) AS INTEGER) AND m.pending=0
+        AND (m.text = memory_search.body OR trim(m.text, ' '||char(9)||char(10)||char(13)) = memory_search.body)))
+    ORDER BY bm25(memory_search) LIMIT ?`)
+        .all(match, JSON.stringify(scopes), JSON.stringify(repos), limit * 2);
+    // One hit per entry and place: a message indexed before it waited and again when its turn took it counts once.
+    const seen = new Set();
+    return rows.filter(row => { const key = `${row['kind']}\u0000${row['ref']}\u0000${row['repo']}\u0000${row['scope']}`; return !seen.has(key) && seen.add(key) !== undefined; }).slice(0, limit)
+        .map(row => ({ kind: row['kind'], ref: String(row['ref']), repo: String(row['repo']), title: String(row['title']).slice(0, 200), snippet: String(row['snippet']).slice(0, 400) }));
 }

package/dist/project-tools.d.ts

@@ -1,6 +1,7 @@
 import type { Store, ToolActionInfo } from "./store.js";
 import { type BrokerOptions } from "./tool-broker.js";
 import type { FenceMethod } from "./agent-fence.js";
+import type { ProviderId } from "./contracts/provider.js";
 import { type SecretStoreKind } from "./tool-secret-store.js";
 import { type ToolSecret, type ToolSpec } from "./contracts/integration-metadata.js";
 export type { ToolSecret, ToolSpec };
@@ -169,6 +170,7 @@ export type ToolLaunchArgs = {
     cleanup: () => void;
     privateDir?: string;
     serverPids?: () => number[];
+    brokerPort?: number;
 };
 /** How a launch's tools are offered: research steps' servers only their read-only actions. */
 export type ToolLaunchOptions = {
@@ -222,13 +224,13 @@ export type ToolContainment = {
  * read (OpenRouter uses the same harness); Claude's own file rules and Linux's bubblewrap don't stop it, and on Linux
  * hidepid hides nothing from the same user, so Linux never starts one.
  */
-export declare function secretToolRefusal(provider: "claude" | "codex" | "openrouter" | "gemini", containment: ToolContainment): string | null;
+export declare function secretToolRefusal(provider: ProviderId, containment: ToolContainment): string | null;
 /**
  * One attempt's tools, ready for its provider, and recorded on the run:
  * what it launched with and what was left out and why. The caller spawns
  * with `argv`/`env` and calls `cleanup` when the process is done.
  */
-export declare function prepareRunTools(store: Pick<Store, "projectTools" | "getRun" | "refById" | "getScope" | "toolSealFor" | "recordRunTools" | "orgPolicy">, runId: number, provider: "claude" | "codex" | "openrouter" | "gemini", options: {
+export declare function prepareRunTools(store: Pick<Store, "projectTools" | "getRun" | "refById" | "getScope" | "toolSealFor" | "recordRunTools" | "orgPolicy">, runId: number, provider: ProviderId, options: {
     home?: string;
     now: Date;
     containment: ToolContainment;
@@ -241,7 +243,7 @@ export declare function prepareRunTools(store: Pick<Store, "projectTools" | "get
 export declare class RunSignInError extends Error {
 }
 /** When a launch's tools cannot be prepared, it still gets none of anything else's: the same isolation with an empty list. */
-export declare function noToolsArgs(provider: "claude" | "codex" | "openrouter" | "gemini"): ToolLaunchArgs;
+export declare function noToolsArgs(provider: ProviderId): ToolLaunchArgs;
 type ToolWrites = Pick<Store, "projectTools" | "addProjectTool" | "removeProjectTool" | "recordProjectToolTest">;
 /** Add one tool (and, for an import, the values it brings) to a project's builds. */
 export declare function addToolTo(store: ToolWrites, repo: string, input: ToolSpec, source: string, by: string, now: Date, options?: {

package/dist/project-tools.js

@@ -29,6 +29,7 @@ import { fileURLToPath } from "node:url";
 import { scanForSecrets } from "./evidence.js";
 import { namedPath } from "./names.js";
 import { startToolBroker } from "./tool-broker.js";
+import { isAcpProvider } from "./acp-agents.js";
 import { SecretStoreError, destroyOwnFile, prepareSecretFolder, registerSecretFolder, pathIn, readOwnFile, readSealed, removeValue, secretBackend, secretFolder, secretStorage, serviceOf, withSecretLock, withSecretLockAsync, writeOwnFile, writeSealed } from "./tool-secret-store.js";
 import { ACCESS, GRANTED, REFRESH, mintRunToken, mintsRunTokens, oneAtATime, runScope, scopeList, signedIn } from "./oauth-run-token.js";
 import { HEADER_NAME, SECRET_NAME, TOOL_NAME as NAME, TOOL_SPEC_LIMITS as LIMITS, readToolSpec } from "./contracts/integration-metadata.js";
@@ -710,7 +711,7 @@ export async function claudeToolArgs(launch, options = {}) {
         omitEnv: [],
         cleanup,
         privateDir: dir,
-        ...(broker === null ? {} : { serverPids: broker.pids }),
+        ...(broker === null ? {} : { serverPids: broker.pids, brokerPort: broker.port }),
     };
 }
 /** Where the tool launcher lives beside this module, built. */
@@ -749,7 +750,7 @@ export async function codexToolArgs(launch, options = {}) {
         if (enabled !== undefined)
             argv.push("-c", `${key}.enabled_tools=${tomlList(enabled)}`);
     }
-    return { argv, env: {}, omitEnv: [], cleanup, privateDir: dir, serverPids: broker.pids };
+    return { argv, env: {}, omitEnv: [], cleanup, privateDir: dir, serverPids: broker.pids, brokerPort: broker.port };
 }
 /** Gemini: no way yet to hand it exactly these servers, so it gets none. */
 export const GEMINI_NO_TOOLS_ARGV = ["--allowed-mcp-server-names", "standing-orders-none"];
@@ -846,8 +847,9 @@ export function secretToolRefusal(provider, containment) {
 export async function prepareRunTools(store, runId, provider, options) {
     const launch = limitedTo(toolLaunchFor(store, runId, options.home), options.readOnly, options.withheld);
     // A local server with secrets starts only where the build can't read its environment; the rest are left out,
-    // saying why, before the broker exists. Gemini starts none (below).
-    const refusal = provider === "gemini" ? null : secretToolRefusal(provider, options.containment);
+    // saying why, before the broker exists. Gemini and ACP agents start none (below).
+    const toolless = provider === "gemini" || isAcpProvider(provider);
+    const refusal = toolless ? null : secretToolRefusal(provider, options.containment);
     if (refusal !== null) {
         launch.tools = launch.tools.filter(one => {
             if (one.spec.transport === "http" || Object.keys(one.values).length === 0)
@@ -856,14 +858,15 @@ export async function prepareRunTools(store, runId, provider, options) {
             return false;
         });
     }
-    const revokes = provider === "gemini" ? [] : await signInRun(launch, { readOnly: options.readOnly !== undefined, now: options.now, ...(options.home === undefined ? {} : { home: options.home }), ...(options.fetcher === undefined ? {} : { fetcher: options.fetcher }) });
+    const revokes = toolless ? [] : await signInRun(launch, { readOnly: options.readOnly !== undefined, now: options.now, ...(options.home === undefined ? {} : { home: options.home }), ...(options.fetcher === undefined ? {} : { fetcher: options.fetcher }) });
     const revoke = () => Promise.all(revokes.splice(0).map(one => one())).then(() => undefined);
     const offered = { ...(options.readOnly === undefined ? {} : { enabledTools: options.readOnly }), ...(options.broker === undefined ? {} : { broker: options.broker }) };
     let launched;
     try {
         launched = provider === "claude" ? await claudeToolArgs(launch, offered)
             : provider === "codex" || provider === "openrouter" ? await codexToolArgs(launch, offered)
-                : { argv: [...GEMINI_NO_TOOLS_ARGV], env: {}, omitEnv: [], cleanup: () => undefined };
+                : provider === "gemini" ? { argv: [...GEMINI_NO_TOOLS_ARGV], env: {}, omitEnv: [], cleanup: () => undefined }
+                    : { argv: [], env: {}, omitEnv: [], cleanup: () => undefined };
     }
     catch (error) {
         // Tokens were made for a run that won't start: each is revoked, and the run with them.
@@ -874,13 +877,13 @@ export async function prepareRunTools(store, runId, provider, options) {
     }
     // The run's own sign-ins end with it: the broker closes first, so nothing uses a token as it is revoked.
     const prepared = revokes.length === 0 ? launched : { ...launched, cleanup: () => { launched.cleanup(); void revoke(); } };
-    const skipped = provider === "gemini"
-        ? [...launch.skipped, ...launch.tools.map(one => ({ name: one.spec.name, reason: "Gemini builds can't use project tools yet" }))]
+    const skipped = toolless
+        ? [...launch.skipped, ...launch.tools.map(one => ({ name: one.spec.name, reason: provider === "gemini" ? "Gemini builds can't use project tools yet" : "ACP agents can't use project tools yet" }))]
         : launch.skipped;
     try {
         store.recordRunTools(runId, JSON.stringify({
             provider,
-            tools: provider === "gemini" ? [] : launch.tools.map(one => ({ name: one.spec.name, digest: one.digest })),
+            tools: toolless ? [] : launch.tools.map(one => ({ name: one.spec.name, digest: one.digest })),
             skipped,
         }), options.now);
     }

package/dist/provider-auth.d.ts

@@ -14,16 +14,17 @@
  */
 import type { Store } from "./store.js";
 import { type ProviderId } from "./provider.js";
+import type { AuthMode } from "./keys.js";
 /** Every sign-in message's dedupe key starts here: `signin:<kind>:<provider>:<ordinal>:<person>`.
  * Not a lifecycle (`life:`) key: those are progress chatter, and an undelivered
  * one stays out of the attention list — this one needs a person. */
 export declare const SIGN_IN_KEY_PREFIX = "signin:";
-export declare const PROVIDER_AUTH_SCHEMA = "\nCREATE TABLE IF NOT EXISTS provider_auth_pause (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  provider    TEXT NOT NULL,\n  ordinal     INTEGER NOT NULL,\n  auth_mode   TEXT NOT NULL DEFAULT 'subscription' CHECK (auth_mode IN ('subscription', 'api-key')),\n  opened_at   TEXT NOT NULL,\n  first_run   INTEGER,\n  task_ref    INTEGER,\n  runs        INTEGER NOT NULL DEFAULT 1,\n  -- 1 once a sign-in probe during this pause said the provider is signed out:\n  -- only a probe that then sees it signed in again may lift the pause.\n  probe_saw_out INTEGER NOT NULL DEFAULT 0,\n  lifted_at   TEXT,\n  lifted_by   TEXT,\n  lifted_how  TEXT CHECK (lifted_how IS NULL OR lifted_how IN ('run', 'probe', 'person')),\n  resumed     INTEGER,\n  -- The last task let through as a trial while paused: a sign-in check can\n  -- say \"logged in\" for a session that no longer works, so a real run decides.\n  last_trial_at TEXT,\n  UNIQUE (provider, ordinal)\n);\nCREATE UNIQUE INDEX IF NOT EXISTS provider_auth_pause_open ON provider_auth_pause (provider) WHERE lifted_at IS NULL;\n";
+export declare const PROVIDER_AUTH_SCHEMA = "\nCREATE TABLE IF NOT EXISTS provider_auth_pause (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  provider    TEXT NOT NULL,\n  ordinal     INTEGER NOT NULL,\n  auth_mode   TEXT NOT NULL DEFAULT 'subscription' CHECK (auth_mode IN ('subscription', 'api-key', 'agent-login')),\n  opened_at   TEXT NOT NULL,\n  first_run   INTEGER,\n  task_ref    INTEGER,\n  runs        INTEGER NOT NULL DEFAULT 1,\n  -- 1 once a sign-in probe during this pause said the provider is signed out:\n  -- only a probe that then sees it signed in again may lift the pause.\n  probe_saw_out INTEGER NOT NULL DEFAULT 0,\n  lifted_at   TEXT,\n  lifted_by   TEXT,\n  lifted_how  TEXT CHECK (lifted_how IS NULL OR lifted_how IN ('run', 'probe', 'person')),\n  resumed     INTEGER,\n  -- The last task let through as a trial while paused: a sign-in check can\n  -- say \"logged in\" for a session that no longer works, so a real run decides.\n  last_trial_at TEXT,\n  UNIQUE (provider, ordinal)\n);\nCREATE UNIQUE INDEX IF NOT EXISTS provider_auth_pause_open ON provider_auth_pause (provider) WHERE lifted_at IS NULL;\n";
 export type AuthPause = {
     id: number;
     provider: ProviderId;
     ordinal: number;
-    authMode: "subscription" | "api-key";
+    authMode: AuthMode;
     openedAt: string;
     firstRun: number | null;
     taskRef: number | null;
@@ -63,7 +64,7 @@ export declare function openAuthPauses(store: Store): AuthPause[];
  */
 export declare function pauseForAuth(store: Store, args: {
     provider: string;
-    authMode: "subscription" | "api-key" | null;
+    authMode: AuthMode | null;
     runId: number;
     taskRef: number;
     now: Date;

package/dist/provider-auth.js

@@ -1,4 +1,5 @@
 import { PROVIDER_IDS } from "./provider.js";
+import { withAcp } from "./acp-agents.js";
 /** Every sign-in message's dedupe key starts here: `signin:<kind>:<provider>:<ordinal>:<person>`.
  * Not a lifecycle (`life:`) key: those are progress chatter, and an undelivered
  * one stays out of the attention list — this one needs a person. */
@@ -8,7 +9,7 @@ CREATE TABLE IF NOT EXISTS provider_auth_pause (
   id          INTEGER PRIMARY KEY AUTOINCREMENT,
   provider    TEXT NOT NULL,
   ordinal     INTEGER NOT NULL,
-  auth_mode   TEXT NOT NULL DEFAULT 'subscription' CHECK (auth_mode IN ('subscription', 'api-key')),
+  auth_mode   TEXT NOT NULL DEFAULT 'subscription' CHECK (auth_mode IN ('subscription', 'api-key', 'agent-login')),
   opened_at   TEXT NOT NULL,
   first_run   INTEGER,
   task_ref    INTEGER,
@@ -27,8 +28,8 @@ CREATE TABLE IF NOT EXISTS provider_auth_pause (
 );
 CREATE UNIQUE INDEX IF NOT EXISTS provider_auth_pause_open ON provider_auth_pause (provider) WHERE lifted_at IS NULL;
 `;
-const NAMES = { claude: "Claude", codex: "Codex", openrouter: "OpenRouter", gemini: "Gemini" };
-const SIGN_IN = { claude: "claude /login", codex: "codex login", gemini: "gemini", openrouter: "toolroll keys set openrouter" };
+const NAMES = withAcp({ claude: "Claude", codex: "Codex", openrouter: "OpenRouter", gemini: "Gemini" }, agent => agent.name);
+const SIGN_IN = withAcp({ claude: "claude /login", codex: "codex login", gemini: "gemini", openrouter: "toolroll keys set openrouter" }, agent => agent.signIn);
 export function providerName(provider) {
     return PROVIDER_IDS.includes(provider) ? NAMES[provider] : provider;
 }
@@ -57,7 +58,7 @@ function readPause(row) {
         id: Number(row["id"]),
         provider: String(row["provider"]),
         ordinal: Number(row["ordinal"]),
-        authMode: row["auth_mode"] === "api-key" ? "api-key" : "subscription",
+        authMode: row["auth_mode"] === "api-key" ? "api-key" : row["auth_mode"] === "agent-login" ? "agent-login" : "subscription",
         openedAt: String(row["opened_at"]),
         firstRun: row["first_run"] == null ? null : Number(row["first_run"]),
         taskRef: row["task_ref"] == null ? null : Number(row["task_ref"]),

package/dist/provider-connection.d.ts

@@ -1,5 +1,6 @@
 import { run, type ExecResult } from "./exec.js";
 import { type ProviderId } from "./provider.js";
+import { type KeyedProviderId } from "./acp-agents.js";
 import { type AuthMode, type KeyVerdict } from "./keys.js";
 export type ProviderConnection = {
     state: "connected" | "signed-out" | "not-installed" | "unverified" | "key-present" | "key-works" | "key-refused" | "missing-key";
@@ -18,5 +19,5 @@ export declare function createConnectionChecker(options?: {
     home?: string;
     clock?: () => Date;
     env?: NodeJS.ProcessEnv;
-    verify?: (provider: ProviderId, key: string) => Promise<KeyVerdict>;
+    verify?: (provider: KeyedProviderId, key: string) => Promise<KeyVerdict>;
 }): ConnectionChecker;

package/dist/provider-connection.js

@@ -2,6 +2,7 @@
 import { homedir } from "node:os";
 import { run } from "./exec.js";
 import { ALL_CREDENTIAL_ENV, inspectionOf } from "./provider.js";
+import { isAcpProvider } from "./acp-agents.js";
 import { keyStatus, PROVIDER_KEY_ENV, readAuthMode, readProviderKey, verifyProviderKey } from "./keys.js";
 export function signInFacts(provider, result, now = new Date()) {
     const base = { mode: "subscription", checkedAt: now.toISOString() };
@@ -46,6 +47,10 @@ export function createConnectionChecker(options = {}) {
     const cache = new Map();
     const pending = new Map();
     return async (provider, fresh = false) => {
+        // An ACP agent is never run to ask how it is signed in (nothing executes it outside the gateway): what is known
+        // of it is its conformance check, read elsewhere. Here it is simply unverified.
+        if (isAcpProvider(provider))
+            return { state: "unverified", mode: "agent-login", checkedAt: clock().toISOString() };
         const mode = readAuthMode(provider, home);
         const keyFacts = keyStatus(provider, home);
         const ambient = !!(options.env ?? process.env)[PROVIDER_KEY_ENV[provider]];

package/dist/provider.d.ts

@@ -175,6 +175,29 @@ export type ParsedEnvelope = {
      * failure terminal seen.
      */
     structuralTerminal: import("./exhaustion.js").StructuralTerminal | null;
+    /** What an ACP agent itself reported it used — kept on the run, never priced. Absent for every other dialect. */
+    agentReportedUsage?: string | null;
+    /** An ACP conversation's facts the conformance check reads (acp-client.ts AcpEnvelope): nothing else does. */
+    acp?: {
+        offered: string[];
+        exit: {
+            how: "eof" | "term" | "kill" | "self" | "error";
+            leftover: boolean;
+            timedOut: boolean;
+        } | null;
+        agent: {
+            name: string;
+            version: string;
+        } | null;
+        stop: string | null;
+        /** The conversation broke the protocol (acpParse's protocolError), or null. */
+        protocolError: string | null;
+        /** The plane's isolation probes for a check's first step (invoke.ts), when it ran them. */
+        isolation?: {
+            fileDenied: boolean;
+            envClear: boolean;
+        };
+    };
 };
 type Adapter = {
     binary: string;
@@ -266,13 +289,13 @@ export declare function adapterFor(provider: ProviderId): Adapter;
  */
 export type ProviderAudit = {
     /** How output reaches us — and therefore which signals can exist at all. */
-    transport: "buffered-json" | "streaming-jsonl";
+    transport: "buffered-json" | "streaming-jsonl" | "acp-jsonrpc";
     /** Whether a later invocation can resume this provider's session. */
     resume: "native" | "none";
     /** The event whose absence on a failed run means "never initialized".
      * CAPABILITY metadata, not a per-run observation (arc 1 finding 16):
      * whether a given run actually saw it lives in ParsedEnvelope.initObserved. */
-    initSignal: "thread.started" | "system-init" | "init-event" | "none";
+    initSignal: "thread.started" | "system-init" | "init-event" | "acp-session" | "none";
     /** How session identity is established: "announced" = read back from the
      * harness's own stream; "minted" = the PLANE chooses the id pre-spawn
      * (gemini --session-id) and the envelope must echo it (Phase 3 A5). */

package/dist/provider.js

@@ -18,13 +18,16 @@
  * TOML-quoted deterministically, and the API key excluded from every
  * shell the model itself launches (Codex provider review, Q5).
  */
+import { INTERPRETER_INJECTION_ENV } from "./acp-attest.js";
 import { claudeFenceSettings, codexFenceArgv } from "./agent-fence.js";
 import { claudeSteerHooks } from "./steer-mailbox.js";
 import {} from "./exec.js";
-import { runStreamJsonl, runClaudeStreamJsonl, runGeminiStreamJsonl, CLAUDE_COST_UNKNOWN } from "./exec.js";
+import { runStreamJsonl, runClaudeStreamJsonl, runGeminiStreamJsonl, runAcpSession, CLAUDE_COST_UNKNOWN } from "./exec.js";
 import { scanForSecrets } from "./evidence.js";
 import { FINDINGS_MODEL_SCHEMA } from "./contracts/review-findings.js";
 import { REVIEW_OUTPUT_LIMITS } from "./structured-output.js";
+import { ACP_AGENTS, isAcpProvider, withAcp } from "./acp-agents.js";
+import { acpParse } from "./acp-client.js";
 import { agentSpecSchema, MODEL_ID, modelIdSchema, PROVIDER_ID_VALUES, providerIdSchema } from "./contracts/provider.js";
 export const PROVIDER_IDS = PROVIDER_ID_VALUES;
 export function isProviderId(value) {
@@ -787,12 +790,13 @@ export function safeDiagnostic(text) {
  * provider gets its OWN keys and nobody else's: S4 (live spike) confirmed
  * what inheritance makes true by construction — an agent's shell reads its
  * process env, so a foreign key in that env is a foreign key disclosed. */
-const CREDENTIAL_ENV = {
+const CREDENTIAL_ENV = withAcp({
     claude: ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"],
     codex: ["OPENAI_API_KEY", "CODEX_API_KEY"],
     openrouter: [OPENROUTER_ENV_KEY],
     gemini: ["GEMINI_API_KEY", "GOOGLE_API_KEY"],
-};
+    // An ACP agent signs in its own way; Toolroll holds no key for it, so it sheds every key above.
+}, () => []);
 const foreignCredentialEnv = (own) => Object.entries(CREDENTIAL_ENV)
     .filter(([provider]) => provider !== own)
     .flatMap(([, keys]) => [...keys]);
@@ -800,7 +804,40 @@ const foreignCredentialEnv = (own) => Object.entries(CREDENTIAL_ENV)
  * since a feature check needs no key at all (Codex gemini verify,
  * finding 2). Agent spawns keep their own; probes keep none. */
 export const ALL_CREDENTIAL_ENV = Object.values(CREDENTIAL_ENV).flat();
-const ADAPTERS = {
+/**
+ * An ACP agent's retained record (acp-client.ts) read into the gateway's
+ * envelope. Its own usage report is never priced: tokens and cost stay null.
+ */
+function acpEnvelope(stdout) {
+    const read = acpParse(stdout);
+    return {
+        sessionId: read.sessionId,
+        protocolError: read.protocolError,
+        finalMessage: read.finalMessage,
+        tokensIn: null,
+        tokensOut: null,
+        costUsd: null,
+        usageRaw: null,
+        initObserved: read.initObserved,
+        promptConsumed: read.promptConsumed,
+        diagnostic: read.diagnostic === null ? null : safeDiagnostic(read.diagnostic),
+        structuralTerminal: read.terminal === null ? null : { failed: true, text: read.terminal.text === null ? null : safeDiagnostic(read.terminal.text), code: read.terminal.code.slice(0, 128) },
+        agentReportedUsage: read.reportedUsage,
+        acp: { offered: read.offered, exit: read.exit, agent: read.agent, stop: read.stop, protocolError: read.protocolError },
+    };
+}
+function acpAdapter(provider) {
+    return {
+        binary: ACP_AGENTS[provider].binary,
+        argv: () => [...ACP_AGENTS[provider].argv],
+        parse: acpEnvelope,
+        defaultRunner: runAcpSession,
+        // Every key Toolroll knows, and whatever would make the pinned interpreter load code beside the checked script.
+        extraOmitEnv: [...foreignCredentialEnv(provider), ...INTERPRETER_INJECTION_ENV],
+        clampTimeout: (_phase, requested) => requested,
+    };
+}
+const ADAPTERS = withAcp({
     claude: {
         binary: "claude",
         argv: claudeArgv,
@@ -852,7 +889,7 @@ const ADAPTERS = {
         extraOmitEnv: foreignCredentialEnv("gemini"),
         clampTimeout: (phase, requested) => Math.min(requested, GEMINI_TIMEOUT_CAP_MS[phase]),
     },
-};
+}, (_agent, provider) => acpAdapter(provider));
 /**
  * The spawning surface. Imported by invoke.ts and NOWHERE else — the
  * architecture test reads imports, not string literals, because provider
@@ -861,7 +898,7 @@ const ADAPTERS = {
 export function adapterFor(provider) {
     return ADAPTERS[provider];
 }
-const AUDITS = {
+const AUDITS = withAcp({
     claude: {
         transport: "streaming-jsonl",
         resume: "native",
@@ -923,8 +960,17 @@ const AUDITS = {
             "trusted-folder store (S2, live at 0.57.0: headless REFUSES untrusted directories; the plane grants --skip-trust per-invocation to its own leased worktrees)",
         ],
     },
-};
-export const MONEY_CAPABILITIES = {
+}, agent => ({
+    // One ACP conversation per build: the prompt's answer is the only success (acp-client.ts), so exit 0 alone is never believed.
+    transport: "acp-jsonrpc",
+    resume: "none",
+    initSignal: "acp-session",
+    sessionIdentity: "announced",
+    terminalContract: "required",
+    isolation: { flag: agent.argv.filter(one => one.startsWith("--") && one !== "--acp").join(" ") || null, resumeSafe: null, enforced: agent.argv.some(one => one.startsWith("--") && one !== "--acp") },
+    configSurface: [...agent.configSurface],
+}));
+export const MONEY_CAPABILITIES = withAcp({
     claude: {
         incrementalUsage: true,
         nativeDollarCapFlag: "--max-budget-usd",
@@ -947,7 +993,12 @@ export const MONEY_CAPABILITIES = {
         // numbers cover that invocation only (conformance fixture j).
         usageSemantics: "per-invocation",
     },
-};
+}, () => ({
+    // ACP carries no dollars Toolroll trusts: an agent's own usage report is kept apart, unpriced.
+    incrementalUsage: false,
+    nativeDollarCapFlag: null,
+    usageSemantics: "per-invocation",
+}));
 /**
  * The fail-closed budget-flag probe (finding 24's amendment): resolve
  * the EXACT executable that will spawn, read its version, and prove the
@@ -997,6 +1048,9 @@ export function validateSpec(spec) {
     if (spec.provider === "gemini" && spec.model === null) {
         return { ok: false, problem: "model: gemini needs an explicit model — the harness default drifts with its releases" };
     }
+    if (isAcpProvider(spec.provider) && spec.model === null) {
+        return { ok: false, problem: `model: ${ACP_AGENTS[spec.provider].name} needs an explicit model — one it offered when it was checked` };
+    }
     return { ok: true };
 }
 /**

package/dist/pull-request-ui.js

@@ -1,11 +1,11 @@
 /** Settings → Projects → Pull requests: one project's pull-request setup, in plain words. Off shows what setup
  * found (or what to fix) and one Turn on; on shows where pull requests go and how they merge. Every change takes
  * the password; turning on restates the exact repository and branch that were checked. */
-import { html, postForm } from "./html.js";
+import { html, postForm, reauth } from "./html.js";
 const METHOD_WORDS = { squash: "Squash and merge", merge: "Merge commit", rebase: "Rebase and merge" };
 export function pullRequestSettingsHtml(view) {
     const post = (act, body, hidden = {}) => postForm("/settings/pull-requests", body, { attrs: { class: "card pr-settings" }, hidden: { repo: view.repo, act, ...hidden } });
-    const password = html `<label>Password<input type="password" name="password" autocomplete="current-password" required></label>`;
+    const password = html `${reauth(html `<label>Password<input type="password" name="password" autocomplete="current-password" required></label>`)}`;
     const notes = [
         view.said === null ? "" : html `<p class="notice" role="status">${view.said}</p>`,
         view.problem === null ? "" : html `<p class="problem" role="alert">${view.problem}</p>`,

package/dist/push.js

@@ -259,7 +259,7 @@ export async function pushPass(store, options) {
         // Renew and re-fence immediately before the network (finding 12).
         if (!store.renewPushClaim(pair.id, owner, pair.claimGeneration, PUSH_CLAIM_TTL_MS, clock()))
             continue;
-        const fenced = store.pushSendFence(pair.id, owner, pair.claimGeneration);
+        const fenced = store.pushSendFence(pair.id, owner, pair.claimGeneration, clock());
         if (fenced === null)
             continue; // resolved, retired, rotated, or lost — nothing to send
         const subscription = fenced.subscriptionRow;

package/dist/quick-start.d.ts

@@ -0,0 +1,24 @@
+import { type AttachSeams } from "./console-instance.js";
+export type QuickStartSeams = {
+    databaseFile: string;
+    cwd: string;
+    env: Record<string, string | undefined>;
+    build: string;
+    /** The repository's top folder for a directory, or null outside one. */
+    findRepo: (cwd: string) => Promise<string | null>;
+    /** Whether this installation already admitted the repository. */
+    enrolled: (repo: string) => Promise<boolean>;
+    /** The ordinary admission (`repos add`): its registry lock and ceilings, from this CLI's own database. */
+    admit: (repo: string) => Promise<number>;
+    /** `up`, for this repository. */
+    startUp: () => Promise<number>;
+    openBrowser: (url: string) => void | Promise<void>;
+    terminal: boolean;
+    attach?: AttachSeams;
+    /** Tests: the agent check (default: the environment and the process's ancestors). */
+    underAgent?: boolean;
+};
+/** Whether argv is a bare `toolroll` (nothing, or only --json). */
+export declare const isBareInvocation: (argv: readonly string[]) => boolean;
+/** null: not this command (outside a repository) — the caller scans as before. */
+export declare function runQuickStart(argv: readonly string[], write: (line: string) => void, seams: QuickStartSeams): Promise<number | null>;