toolroll 0.9.63 → 0.9.67

package/dist/telegram.js

@@ -46,6 +46,10 @@ import { LEAD_MESSAGE_MAX_CHARS } from "./lead.js";
 import { envValue } from "./names.js";
 import { applyProposalTap, processTelegramConversations, phoneLinkButton, replyContextFor, telegramConversationRepos, telegramRequestId, tooLongText, whichTaskText, } from "./telegram-lead.js";
 import { askOf, parseTelegramUpdate, pickOf, readTelegramButtonData, readTelegramUpdate, telegramButton } from "./contracts/telegram-callback.js";
+/** Read the enrolled project list on demand. No callback means no task data,
+ * never an implicit all-database ceiling. Shared by pass and embedded follower. */
+/** A delivery its person began watching after it was claimed: held or settled at the final fence (cockpit §3). */
+const WATCHED_SINCE_CLAIM = "Held: its person is watching this agent now";
 /** The environment name — and therefore the name the builder strips from agents (both names; see names.ts). */
 export { TELEGRAM_TOKEN_ENV as TOKEN_ENV, TELEGRAM_TOKEN_ENVS as TOKEN_ENVS } from "./names.js";
 /** BotFather's shape: numeric bot id, colon, secret. */
@@ -732,6 +736,9 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
         const blocked = [];
         const preflight = (await readAccess()) ?? channelProblem();
         for (const row of group) {
+            // Watched since the claim (cockpit §3): held for later or settled quietly, never sent now, never a failure.
+            if (preflight === null && store.telegramWatchFence(row, binding, owner, clock()) !== "send")
+                continue;
             const problem = preflight ?? store.telegramDeliveryProblem(row, binding, owner, projects, clock(), [...rows.map(one => one.id), row.id]);
             if (problem === null)
                 rows.push(row);
@@ -747,7 +754,18 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
         if (rows.length === 0)
             continue;
         const ids = rows.map(row => row.id);
-        const fence = () => {
+        // Once any part of this delivery has reached Telegram it is committed: a watch opening between its parts never
+        // releases it (that would send the parts already accepted again). Every transport call below goes through `wire`.
+        let sentAny = false;
+        const wire = async (...args) => {
+            const answer = await transport(...args);
+            if (answer.ok === true)
+                sentAny = true;
+            return answer;
+        };
+        // `beforeSend`: the fence before a transport call also asks the watch — until something of this delivery went out;
+        // the one after a confirmed send never does, so a message Telegram accepted is recorded as delivered.
+        const fence = (beforeSend = !sentAny) => {
             const channel = channelProblem();
             if (channel !== null)
                 return channel;
@@ -755,6 +773,10 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
                 const problem = store.telegramDeliveryProblem(row, binding, owner, projects, clock(), ids);
                 if (problem !== null)
                     return problem;
+                // The watch, at the last moment before the network: a held row's claim is released (its finalize is then a
+                // no-op), so nothing is spent on it.
+                if (beforeSend && store.telegramWatchFence(row, binding, owner, clock()) !== "send")
+                    return WATCHED_SINCE_CLAIM;
             }
             return null;
         };
@@ -763,7 +785,7 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
             const problem = (await readAccess()) ?? fence();
             if (problem !== null)
                 return { ok: false, error: problem };
-            const sent = await send(transport, binding.chatId, text, keyboard, entities, silent);
+            const sent = await send(wire, binding.chatId, text, keyboard, entities, silent);
             if (!sent.ok) {
                 if (sent.retryAfter !== undefined)
                     store.deferTelegram(botId, new Date(clock().getTime() + sent.retryAfter * 1_000).toISOString());
@@ -774,7 +796,7 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
             for (const row of messageRows)
                 store.recordTelegramMessage(row, binding, sent.messageId, clock());
             // Keep the old message's history but never acknowledge a replaced pairing.
-            const after = (await readAccess()) ?? fence();
+            const after = (await readAccess()) ?? fence(false);
             return after === null ? sent : { ok: false, error: after };
         };
         const imageSender = async (row) => {
@@ -803,7 +825,7 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
             // No await between the access fence, file validation and upload.
             let answer;
             try {
-                answer = await transport("sendDocument", { chat_id: binding.chatId, caption: `${resultTaskLabel(row.taskId)} · result #${row.run} · screenshot for acceptance` }, undefined, {
+                answer = await wire("sendDocument", { chat_id: binding.chatId, caption: `${resultTaskLabel(row.taskId)} · result #${row.run} · screenshot for acceptance` }, undefined, {
                     field: "document", bytes: verified.bytes, contentType: verified.format === "png" ? "image/png" : "image/jpeg", fileName: resultImageFileName(row.taskId, row.run, artifact, verified.format),
                 });
             }
@@ -819,7 +841,7 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
                 return { ok: false, error: answer.uncertain || (answer.ok && messageId == null) ? "Screenshot delivery is unconfirmed; retry may duplicate it" : "Telegram did not accept the screenshot" };
             }
             store.recordTelegramMessage(row, binding, String(messageId), clock());
-            const after = (await readAccess()) ?? fence();
+            const after = (await readAccess()) ?? fence(false);
             return after === null ? { ok: true, receipt: receiptFor(botId, binding.chatId, String(messageId)) } : { ok: false, error: after };
         };
         /** Screenshots with a result (result-shots.ts): photos, several as one album, re-proved before every call. Each is
@@ -846,10 +868,10 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
                 let answer;
                 try {
                     answer = batch.length > 1
-                        ? await transport("sendMediaGroup", { chat_id: binding.chatId, media: batch.map((one, index) => ({ type: "photo", media: `attach://shot${index}`, ...(index === 0 || one.numbered === true ? { caption: one.caption } : {}) })) }, undefined, upload(batch[0], "shot0"), batch.slice(1).map((one, index) => upload(one, `shot${index + 1}`)))
+                        ? await wire("sendMediaGroup", { chat_id: binding.chatId, media: batch.map((one, index) => ({ type: "photo", media: `attach://shot${index}`, ...(index === 0 || one.numbered === true ? { caption: one.caption } : {}) })) }, undefined, upload(batch[0], "shot0"), batch.slice(1).map((one, index) => upload(one, `shot${index + 1}`)))
                         : batch[0].photo
-                            ? await transport("sendPhoto", { chat_id: binding.chatId, caption: batch[0].caption }, undefined, upload(batch[0], "photo"))
-                            : await transport("sendDocument", { chat_id: binding.chatId, caption: batch[0].caption }, undefined, upload(batch[0], "document"));
+                            ? await wire("sendPhoto", { chat_id: binding.chatId, caption: batch[0].caption }, undefined, upload(batch[0], "photo"))
+                            : await wire("sendDocument", { chat_id: binding.chatId, caption: batch[0].caption }, undefined, upload(batch[0], "document"));
                 }
                 catch {
                     answer = { ok: false, uncertain: true };
@@ -893,7 +915,7 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
             const keyboard = button === null ? [] : [button];
             if (messageId === null)
                 return sender(card.text, keyboard, rows, card.entities);
-            const edited = await editProgress(transport, binding.chatId, messageId, card.text, keyboard, card.entities);
+            const edited = await editProgress(wire, binding.chatId, messageId, card.text, keyboard, card.entities);
             if (!edited.ok) {
                 if (edited.retryAfter !== undefined)
                     store.deferTelegram(botId, new Date(clock().getTime() + edited.retryAfter * 1000).toISOString());
@@ -905,7 +927,7 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
             }
             if (!onlyExisting)
                 store.recordTelegramMessage(row, binding, messageId, clock());
-            const after = (await readAccess()) ?? fence();
+            const after = (await readAccess()) ?? fence(false);
             return after === null ? edited : { ok: false, error: after };
         };
         /** Quiet mode: the task's one card (or its group's), created silently and then only ever edited. */
@@ -929,11 +951,11 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
                 return { ok: true, messageId: card.message };
             }
             if (card.message !== null) {
-                const edited = await editProgress(transport, binding.chatId, card.message, view.text, keyboard, view.entities);
+                const edited = await editProgress(wire, binding.chatId, card.message, view.text, keyboard, view.entities);
                 if (edited.ok) {
                     store.setChatCardMessage(card.id, card.message, shown);
                     store.recordTelegramMessage(fact, binding, card.message, clock());
-                    const after = (await readAccess()) ?? fence();
+                    const after = (await readAccess()) ?? fence(false);
                     return after === null ? edited : { ok: false, error: after };
                 }
                 if (edited.retryAfter !== undefined)
@@ -1003,14 +1025,14 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
                     if (problem !== null)
                         return { ok: false, error: problem };
                     mintFor();
-                    const edited = await editProgress(transport, binding.chatId, batch.message, text, keyboard);
+                    const edited = await editProgress(wire, binding.chatId, batch.message, text, keyboard);
                     if (edited.ok) {
                         // The repaint landed: the old words' buttons retire and the new ones ride the message.
                         retireDecideTokens(store, "telegram", binding.chatId, batch.message, clock());
                         placeDecideTokens(store, tokens, batch.message);
                         store.setChatBatchMessage(batch.id, batch.message, shown);
                         store.recordTelegramMessage(fact, binding, batch.message, clock());
-                        const after = (await readAccess()) ?? fence();
+                        const after = (await readAccess()) ?? fence(false);
                         return after === null ? { ok: true, receipt: receiptFor(botId, binding.chatId, batch.message) } : { ok: false, error: after };
                     }
                     // A failed edit: the buttons it carried never act, and the card's old ones keep working.
@@ -1049,10 +1071,10 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
                 const problem = (await readAccess()) ?? fence();
                 if (problem !== null)
                     return { ok: false, error: problem };
-                const edited = await editProgress(transport, binding.chatId, earlier, words, keyboard);
+                const edited = await editProgress(wire, binding.chatId, earlier, words, keyboard);
                 if (edited.ok) {
                     store.recordTelegramMessage(fact, binding, earlier, clock());
-                    const after = (await readAccess()) ?? fence();
+                    const after = (await readAccess()) ?? fence(false);
                     return after === null ? { ok: true, receipt: receiptFor(botId, binding.chatId, earlier) } : { ok: false, error: after };
                 }
                 if (edited.retryAfter !== undefined)
@@ -1082,7 +1104,7 @@ async function deliverOutboxTo(store, botId, binding, transport, owner, clock, r
                     ? await deliverDigest(botId, binding, sender, rows, digest.lastSentAt, clock, taskId => chatTitle(store, taskId))
                     : await deliverOne(store, botId, binding, sender, rows[0], clock, phoneOrigin, evidenceRoot, projects);
         }
-        const finalProblem = outcome.ok ? (await readAccess()) ?? fence() : null;
+        const finalProblem = outcome.ok ? (await readAccess()) ?? fence(false) : null;
         const settled = finalProblem === null ? outcome : { ok: false, error: finalProblem };
         // A skipped screenshot settles its row but nothing reached the phone.
         const skipped = settled.ok && settled.receipt !== null && settled.receipt.startsWith("skipped:");
@@ -1748,6 +1770,8 @@ function applyMessage(context, update, effects) {
  * message that carried several tasks (never guessed). Everything hostile is
  * silence, as for every other inbound shape.
  */
+/** At most this many of a chat's messages wait for the lead at once (the personal lead queue's bound). */
+export const TELEGRAM_MAX_WAITING = 10;
 function applyConversation(context, update, effects) {
     const { store, botId, transport, clock, report } = context;
     const message = update.message;
@@ -1812,6 +1836,12 @@ function applyConversation(context, update, effects) {
             context_ = focusContextFor(focused);
         }
     }
+    // The lead queue's bound, per chat: ten messages wait at most; the next is answered at once instead of queued.
+    if (store.telegramMessagesWaiting(binding.id) >= TELEGRAM_MAX_WAITING) {
+        say(`${TELEGRAM_MAX_WAITING} messages are already waiting for the lead. Wait for a reply, then send this again.`);
+        report.ignored++;
+        return;
+    }
     store.enqueueTelegramConversation({
         binding, updateId: update.update_id, messageId: String(message.message_id), replyTo,
         request: telegramRequestId(botId, binding.id, update.update_id), text, context: context_, taskId, sourceRun,
@@ -2248,6 +2278,10 @@ function applyCallback(context, update, effects) {
             return;
         }
         const focused = store.chatFocus("telegram", binding.id);
+        if (store.telegramMessagesWaiting(binding.id) >= TELEGRAM_MAX_WAITING) {
+            ack(`${TELEGRAM_MAX_WAITING} messages are already waiting. Wait for a reply.`);
+            return;
+        }
         store.enqueueTelegramConversation({
             binding, updateId: update.update_id, messageId: String(message.message_id), replyTo: null,
             request: telegramRequestId(botId, binding.id, update.update_id), text: option,

package/dist/terminal-catalog.d.ts

@@ -0,0 +1,11 @@
+import type { Database } from "./store.js";
+import type { TerminalLedger } from "./live-terminal.js";
+export declare function terminalCatalogPath(orders: Database): string | null;
+/** The console's ledger: creates the catalog, drops rows of consoles that are gone, and writes its own. */
+export declare function openTerminalLedger(orders: Database, alive?: (pid: number) => boolean): TerminalLedger | null;
+export declare function installTerminalUpdateGate(orders: Database, id: string): void;
+export declare function removeTerminalUpdateGate(orders: Database, id: string): void;
+/** Terminals starting or running in a console that is still alive: active work an update waits for. */
+export declare function activeTerminalUpdateWork(orders: Database, alive?: (pid: number) => boolean): {
+    terminals: number;
+};

package/dist/terminal-catalog.js

@@ -0,0 +1,129 @@
+/**
+ * Live terminals, written down for the updater (docs/plans/live-terminal.md, review round 2 finding 7). Terminals live
+ * in the console's memory, but an update is decided by another process, so each one is a row in a small catalog
+ * beside the database (`<db>.terminals.sqlite`), as the coding workspace keeps its own:
+ *
+ * - a start inserts its row before any work, and an update's gate (a trigger) refuses that insert while the update
+ *   owns admission: no terminal starts during a drain;
+ * - a row is `starting` or `running` until the terminal's sweep ends, then deleted — or kept as `uncertain` when the
+ *   sweep couldn't prove its processes gone, until the terminal is removed; the updater counts rows whose console is
+ *   still alive as active work, so "update when idle" waits for running and unproved terminals;
+ * - rows of a console that is gone are stale (its programs went with it, or are swept at its next start).
+ */
+import { chmodSync, lstatSync } from "node:fs";
+import { processMayBeAlive } from "./process-liveness.js";
+import { sqliteRuntime } from "./sqlite-runtime.js";
+const gatePrefix = "so_terminal_update_";
+const PAUSED = "Toolroll is updating. Running terminals keep going; new ones can start after the update.";
+const SCHEMA = "CREATE TABLE IF NOT EXISTS live_terminal (id TEXT PRIMARY KEY, console_pid INTEGER NOT NULL, state TEXT NOT NULL CHECK (state IN ('starting','running','uncertain')), at TEXT NOT NULL)";
+export function terminalCatalogPath(orders) {
+    const main = orders.prepare("PRAGMA database_list").all().find(row => row["name"] === "main")?.["file"];
+    return typeof main === "string" && main !== "" ? `${main}.terminals.sqlite` : null;
+}
+function exists(file) {
+    try {
+        return lstatSync(file).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function open(file, readOnly) {
+    if (exists(file) && lstatSync(file).isSymbolicLink())
+        throw Error("The terminal catalog is linked, not a regular database.");
+    const db = new (sqliteRuntime().DatabaseSync)(file, { readOnly });
+    db.exec("PRAGMA busy_timeout=1000");
+    return db;
+}
+/** The updater's read: never creates the catalog. */
+function withCatalog(orders, absent, readOnly, action) {
+    const file = terminalCatalogPath(orders);
+    if (file === null || !exists(file))
+        return absent;
+    const db = open(file, readOnly);
+    try {
+        return action(db);
+    }
+    finally {
+        db.close();
+    }
+}
+/** The console's ledger: creates the catalog, drops rows of consoles that are gone, and writes its own. */
+export function openTerminalLedger(orders, alive = pid => processMayBeAlive(pid, false)) {
+    const file = terminalCatalogPath(orders);
+    if (file === null)
+        return null;
+    const db = open(file, false);
+    chmodSync(file, 0o600);
+    db.exec(SCHEMA);
+    for (const row of db.prepare("SELECT DISTINCT console_pid FROM live_terminal").all()) {
+        const pid = Number(row["console_pid"]);
+        if (pid !== process.pid && !alive(pid))
+            db.prepare("DELETE FROM live_terminal WHERE console_pid=?").run(pid);
+    }
+    return {
+        reserve(id) {
+            // Fail closed even where this catalog had no gate to install (it didn't exist yet when the update began): the main
+            // database's own admission pause refuses too.
+            if (orders.prepare("SELECT 1 FROM sqlite_master WHERE type='trigger' AND name GLOB 'so_desktop_update_*' LIMIT 1").get() !== undefined)
+                throw new Error(PAUSED);
+            try {
+                db.prepare("INSERT INTO live_terminal (id, console_pid, state, at) VALUES (?, ?, 'starting', ?)").run(id, process.pid, new Date().toISOString());
+            }
+            catch (error) {
+                throw new Error(error instanceof Error && error.message.includes(PAUSED) ? PAUSED : "No terminal can start right now (its record couldn't be written).");
+            }
+        },
+        running(id) { db.prepare("UPDATE live_terminal SET state='running', at=? WHERE id=?").run(new Date().toISOString(), id); },
+        // A sweep that couldn't prove its processes gone stays written down: the updater counts it while this console lives.
+        release(id, cleanup) {
+            try {
+                if (cleanup === "uncertain")
+                    db.prepare("UPDATE live_terminal SET state='uncertain', at=? WHERE id=?").run(new Date().toISOString(), id);
+                else
+                    db.prepare("DELETE FROM live_terminal WHERE id=?").run(id);
+            }
+            catch { /* the next start drops it as stale */ }
+        },
+        forget(id) { try {
+            db.prepare("DELETE FROM live_terminal WHERE id=?").run(id);
+        }
+        catch { /* stale later */ } },
+    };
+}
+function gateStatement(id) {
+    if (!/^[a-f0-9-]{36}$/.test(id))
+        throw Error("Invalid update identity.");
+    return `CREATE TRIGGER ${gatePrefix}start BEFORE INSERT ON live_terminal BEGIN SELECT RAISE(ABORT, '${PAUSED} [${id}]'); END`;
+}
+function changeGate(db, id, install) {
+    const wanted = gateStatement(id);
+    db.exec("BEGIN IMMEDIATE");
+    try {
+        db.exec(SCHEMA);
+        const rows = db.prepare("SELECT name, sql FROM sqlite_master WHERE type='trigger' AND name GLOB 'so_terminal_update_*'").all();
+        if (rows.some(row => String(row["sql"]) !== wanted))
+            throw Error("Another or unrecognized update owns terminal admission. Its gate was preserved.");
+        if (install && rows.length === 0)
+            db.exec(wanted);
+        if (!install)
+            for (const row of rows)
+                db.exec(`DROP TRIGGER "${String(row["name"])}"`);
+        db.exec("COMMIT");
+    }
+    catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+    }
+}
+export function installTerminalUpdateGate(orders, id) { withCatalog(orders, undefined, false, db => changeGate(db, id, true)); }
+export function removeTerminalUpdateGate(orders, id) { withCatalog(orders, undefined, false, db => changeGate(db, id, false)); }
+/** Terminals starting or running in a console that is still alive: active work an update waits for. */
+export function activeTerminalUpdateWork(orders, alive = pid => processMayBeAlive(pid, false)) {
+    return withCatalog(orders, { terminals: 0 }, true, db => {
+        if (!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='live_terminal'").get())
+            return { terminals: 0 };
+        const rows = db.prepare("SELECT console_pid FROM live_terminal").all();
+        return { terminals: rows.filter(row => alive(Number(row["console_pid"]))).length };
+    });
+}

package/dist/text-limits.d.ts

@@ -68,6 +68,8 @@ export declare const TEXT_LIMITS: {
     readonly triggerState: 40;
     readonly triggerWebhookTitle: 120;
     readonly triggerWebhookField: 80;
+    /** v126: a Sentry or Vercel project (or Vercel team) a signed webhook is scoped to. */
+    readonly triggerWebhookScope: 120;
     readonly triggerFolder: 100;
     readonly triggerSender: 300;
     readonly triggerSubject: 100;

package/dist/text-limits.js

@@ -68,6 +68,8 @@ export const TEXT_LIMITS = {
     triggerState: 40,
     triggerWebhookTitle: 120,
     triggerWebhookField: 80,
+    /** v126: a Sentry or Vercel project (or Vercel team) a signed webhook is scoped to. */
+    triggerWebhookScope: 120,
     triggerFolder: 100,
     triggerSender: 300,
     triggerSubject: 100,

package/dist/tool-broker.d.ts

@@ -11,7 +11,13 @@ export type BrokerOptions = {
     omitEnv?: readonly string[];
     /** Toolroll's own settings for a local server (the run's isolated database), passed as they are. */
     pass?: Readonly<Record<string, string>>;
+    /** Where a local server starts: a folder the build can't write (never its checkout). */
     cwd?: string;
+    /** Folders the build writes (its checkout, its caches): a server whose command, or a path it's given, resolves inside
+     * one is never started, since it would run the build's own bytes outside the build's limits. */
+    untrusted?: readonly string[];
+    /** Why a local server may not start unwrapped (no fence for it here), read when it would; null when it may. */
+    unwrapped?: () => string | null;
     /** How a local server is started inside its run's fence, read when it starts (the fence is fixed after the tools). */
     wrap?: () => ((file: string, args: readonly string[]) => {
         file: string;
@@ -22,6 +28,8 @@ export type ToolBroker = {
     /** The launch's token: the agent's only key to its tools. */
     token: string;
     url: (name: string) => string;
+    /** Its loopback port: the one a confined network leaves reachable for its agent (agent-fence.ts NetworkFence). */
+    port: number;
     /** The local servers running now (the fence tests read them). */
     pids: () => number[];
     /** Revoke the token, stop every server, close the port. */
@@ -33,5 +41,11 @@ export declare const SERVER_ENV: readonly string[];
 /** A local server's environment: the allowlisted names from `base` (and its LC_* locale), less `omit`, then `pass`,
  * then the tool's own values. */
 export declare function serverEnv(base: NodeJS.ProcessEnv, omit: readonly string[], pass: Readonly<Record<string, string>>, values: Readonly<Record<string, string>>): NodeJS.ProcessEnv;
+/**
+ * The first of a server's command and path-like arguments that resolves inside an untrusted folder (a build's checkout
+ * or caches), or null. The command is resolved as spawn would: a path against `cwd`, a bare name through PATH; an
+ * argument counts when it names an existing path (relative to `cwd`) or is written as one (`./x`, `../x`, `/x`).
+ */
+export declare function workspaceBytes(command: string, args: readonly string[], cwd: string | undefined, path: string | undefined, untrusted: readonly string[]): string | null;
 /** Start one launch's broker on a loopback port. */
 export declare function startToolBroker(tools: readonly BrokeredTool[], options?: BrokerOptions): Promise<ToolBroker>;

package/dist/tool-broker.js

@@ -20,6 +20,8 @@
 import { spawn } from "node:child_process";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
+import { accessSync, constants, existsSync, realpathSync } from "node:fs";
+import { delimiter, isAbsolute, resolve, sep } from "node:path";
 const BODY_LIMIT = 4 * 1024 * 1024;
 const ANSWER_LIMIT = 32 * 1024 * 1024;
 const STOP_GRACE_MS = 2_000;
@@ -59,6 +61,54 @@ export function serverEnv(base, omit, pass, values) {
         delete env[name];
     return Object.assign(env, pass, values);
 }
+/**
+ * The first of a server's command and path-like arguments that resolves inside an untrusted folder (a build's checkout
+ * or caches), or null. The command is resolved as spawn would: a path against `cwd`, a bare name through PATH; an
+ * argument counts when it names an existing path (relative to `cwd`) or is written as one (`./x`, `../x`, `/x`).
+ */
+export function workspaceBytes(command, args, cwd, path, untrusted) {
+    if (untrusted.length === 0)
+        return null;
+    const base = cwd ?? process.cwd();
+    // Canonical on-disk names, folded where the filesystem ignores case (macOS, Windows), so `/Users/a/CHECKOUT` is the checkout.
+    const fold = process.platform === "darwin" || process.platform === "win32" ? (one) => one.toLowerCase() : (one) => one;
+    const real = (one) => { try {
+        return fold(realpathSync.native(one));
+    }
+    catch {
+        return fold(resolve(one));
+    } };
+    const roots = untrusted.map(real);
+    const within = (one) => { const at = real(one); return roots.some(root => at === root || at.startsWith(`${root}${sep}`)); };
+    // A root's name anywhere in an argument (inline code, a list of paths) counts, however it's spelled.
+    const mentions = (arg) => { const text = fold(arg); return roots.some(root => text.includes(root)) || untrusted.some(root => text.includes(fold(root))); };
+    const located = command.includes("/") || command.includes(sep) ? resolve(base, command)
+        : (path ?? "").split(delimiter).filter(Boolean).map(dir => resolve(base, dir, command)).find(one => { try {
+            accessSync(one, constants.X_OK);
+            return true;
+        }
+        catch {
+            return false;
+        } }) ?? null;
+    if (located !== null && within(located))
+        return located;
+    // A relative path once meant "in the checkout" (servers started there): it is refused rather than read elsewhere.
+    if (!isAbsolute(command) && (command.includes("/") || command.includes(sep)))
+        return `${command} (a relative path)`;
+    for (const arg of args) {
+        if (mentions(arg))
+            return `${arg} (names what this build writes)`;
+        // A flag's value (`--config=x`, `-c=x`) is checked as its own argument.
+        for (const piece of [arg, ...(arg.startsWith("-") && arg.includes("=") ? [arg.slice(arg.indexOf("=") + 1)] : [])]) {
+            if (piece.startsWith("./") || piece.startsWith("../"))
+                return `${piece} (a relative path)`;
+            const candidate = resolve(base, piece);
+            if ((isAbsolute(piece) || existsSync(candidate)) && within(candidate))
+                return candidate;
+        }
+    }
+    return null;
+}
 /** A local server, started on first use and spoken to over its stdin and stdout. */
 class LocalServer {
     tool;
@@ -68,6 +118,7 @@ class LocalServer {
     buffer = "";
     next = 1;
     pending = new Map();
+    refusal = null;
     constructor(tool, options) {
         this.tool = tool;
         this.options = options;
@@ -75,7 +126,19 @@ class LocalServer {
     pid() { return this.child?.pid ?? null; }
     start() {
         const env = serverEnv(this.options.env ?? process.env, this.options.omitEnv ?? [], this.options.pass ?? {}, this.tool.values);
+        const planted = workspaceBytes(this.tool.spec.command, this.tool.spec.args, this.options.cwd, env["PATH"], this.options.untrusted ?? []);
+        if (planted !== null) {
+            this.refusal = `The tool's server would run ${planted}, inside what this build can write, so it was not started.`;
+            return null;
+        }
         const wrap = this.options.wrap?.() ?? null;
+        if (wrap === null) {
+            const why = this.options.unwrapped?.() ?? null;
+            if (why !== null) {
+                this.refusal = why;
+                return null;
+            }
+        }
         const { file, args } = wrap === null ? { file: this.tool.spec.command, args: [...this.tool.spec.args] } : wrap(this.tool.spec.command, this.tool.spec.args);
         const child = spawn(file, args, { env, ...(this.options.cwd === undefined ? {} : { cwd: this.options.cwd }), stdio: ["pipe", "pipe", "ignore"], detached: process.platform !== "win32" });
         this.child = child;
@@ -131,8 +194,9 @@ class LocalServer {
         // A new session (a reconnect) starts a fresh server: a server answers initialize once.
         if (message.method === "initialize" && this.initialized)
             this.stop();
-        if (this.child === null)
-            this.start();
+        if (this.child === null && this.start() === null) {
+            return Promise.resolve(isRequest(message) ? rpcError(message.id, this.refusal ?? "The tool could not start.") : null);
+        }
         if (message.method === "initialize")
             this.initialized = true;
         if (!isRequest(message)) {
@@ -357,6 +421,7 @@ export async function startToolBroker(tools, options = {}) {
     return {
         token,
         url: name => `http://127.0.0.1:${port}/mcp/${name}`,
+        port,
         pids: () => [...local.values()].map(one => one.pid()).filter((pid) => pid !== null),
         close: () => {
             revoked = true;

package/dist/toolroll-update-ui.js

@@ -4,7 +4,7 @@
  * and a one-time "What's new" card afterwards. The work itself is the
  * `toolroll update` command (toolroll-update.ts), started as its own job.
  */
-import { html, postForm, replaceMarkup } from "./html.js";
+import { html, postForm, replaceMarkup, reauth } from "./html.js";
 import { STEP_WORDS, UPDATE_STEPS, runtimeUpdateTerminal } from "./toolroll-update.js";
 const clock = (iso) => { const d = new Date(iso); return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`; };
 export const UPDATES_CSS = `.updates{max-width:640px;min-width:0;overflow-wrap:anywhere}.updates .card{margin:0 0 16px}.updates h2{margin:0;font-size:1.0625rem}.updates .card>p{margin:4px 0 0}` +
@@ -69,7 +69,7 @@ export function updatesHtml(view, notice) {
                         : latest === null ? html `<h2>Toolroll ${view.current}</h2><p class="meta">Couldn’t check for a newer release: ${"problem" in view.latest ? view.latest.problem : ""}</p>`
                             : html `<h2>Toolroll ${view.current} is up to date</h2>`;
     const form = newer && !["npx", "source", "desktop"].includes(view.method.kind)
-        ? postForm("/settings/updates", html `<label class="step-up">Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label><div class="update-actions"><button type="submit" name="when" value="now" class="primary">Update now</button><button type="submit" name="when" value="when-idle">When idle</button><button type="submit" name="when" value="tonight">Tonight (03:00)</button></div>`, { hidden: { version: latest } })
+        ? postForm("/settings/updates", html `${reauth(html `<label class="step-up">Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}<div class="update-actions"><button type="submit" name="when" value="now" class="primary">Update now</button><button type="submit" name="when" value="when-idle">When idle</button><button type="submit" name="when" value="tonight">Tonight (03:00)</button></div>`, { hidden: { version: latest } })
         : "";
     const rollback = view.rollbackTo !== null ? html `<p class="meta">To go back to ${view.rollbackTo}: <code>toolroll update --rollback</code></p>` : "";
     return html `<section class="updates">${note}${whatsNew}${j ? outcomeHtml(j) : ""}<div class="card" data-update-state="${newer ? "available" : "current"}">${state}${form}${rollback}</div></section>`;

package/dist/toolroll-update.js

@@ -32,10 +32,11 @@ import { createRequire } from "node:module";
 import { clearWords, durableJson, LINGERING_LIMIT_MS, lingeringRun, lingeringWords, settleLeftoverRecords, sqliteLock, desktopUpdateWaitingOf, stoppedWaitingWords, updateWaitingWords, verifiedDatabaseBackup } from "./desktop-update.js";
 import { activeUpdateWork, freezeUpdateGate, installUpdateGate, removeUpdateGate, updateAdmissionPaused, updateGateOwned } from "./desktop-update-gate.js";
 import { processMayBeAlive } from "./process-liveness.js";
+import { removeTerminalUpdateGate } from "./terminal-catalog.js";
 import { assertCodingUpdateStopped, backupCodingCatalog, codingCatalogExists, releaseStaleCodingOwner, removeCodingUpdateGate } from "./coding-update.js";
 import { installLaunchdService, launchdPlist, stopLaunchdService, writeFileDurably } from "./daemon.js";
 import { NAME } from "./names.js";
-import { orphanKey, updateSafeSchema, V117_RENAMED_COLUMNS, V117_RENAMED_TABLES, V118_MERGED_TABLES, V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS } from "./store.js";
+import { orphanKey, updateSafeSchema, V117_RENAMED_COLUMNS, V117_RENAMED_TABLES, V118_MERGED_TABLES, V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS, V125_ADDED_COLUMNS, V126_ADDED_COLUMNS, V128_ADDED_COLUMNS, V129_ADDED_COLUMNS } from "./store.js";
 import { isNewer, REGISTRY } from "./releases.js";
 import { markNeverIndex } from "./never-index.js";
 import { readRuntimeUpdateJournal, RUNTIME_PHASES, RUNTIME_UPDATE_STEPS, stagedStartedAt, updaterStartingOf } from "./contracts/update-journal.js";
@@ -373,6 +374,8 @@ function addedColumns(...versions) {
     }
     return rules;
 }
+/** Rules on tables that later gained declared columns (addedColumns merges into these instead of replacing them). */
+const EARLIER_RULES = { flow_trigger: { fromRoutines: "trigger" } };
 const HISTORY_RULES = {
     ...Object.fromEntries(Object.entries(CHAT_MOVES).map(([table, moved]) => [table, { moved }])),
     action_ledger: { appendOnly: true }, ledger_seal: { appendOnly: true }, ledger_checkpoint: { appendOnly: true },
@@ -401,7 +404,11 @@ const HISTORY_RULES = {
     // v121: live steering's columns and a run's attempt key read none, and no sends, the same way.
     // v122: a project's recorded remote reads none the same way.
     // v123: a plan authorization's basis reads the operating mode, and a trigger firing reads not on time and no script ran.
-    ...addedColumns(V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS),
+    // v126: a receipt's state, acceptance time and held item, a trigger's credential generation and turned-away count,
+    // and who made a card read none, 0, or none. A table with an earlier rule (flow_trigger's v115 move) keeps it too.
+    // v128: a lead message's pending flag reads waiting exactly for a team queue's unadmitted operator message.
+    ...Object.fromEntries(Object.entries(addedColumns(V119_ADDED_COLUMNS, V120_ADDED_COLUMNS, V121_ADDED_COLUMNS, V122_ADDED_COLUMNS, V123_ADDED_COLUMNS, V125_ADDED_COLUMNS, V126_ADDED_COLUMNS, V128_ADDED_COLUMNS, V129_ADDED_COLUMNS))
+        .map(([table, rule]) => [table, { ...EARLIER_RULES[table], ...rule }])),
 };
 /** The tables a migration may remove whole (v115's removed features). */
 export const RETIRED_TABLES = Object.freeze(Object.keys(HISTORY_RULES).filter(name => HISTORY_RULES[name].retired));
@@ -908,8 +915,10 @@ function ungate(j) {
         db.exec("PRAGMA busy_timeout=5000");
         if (updateGateOwned(db, j.id))
             removeUpdateGate(db, j.id);
-        else
+        else {
             removeCodingUpdateGate(db, j.id);
+            removeTerminalUpdateGate(db, j.id);
+        }
     }
     finally {
         db.close();
@@ -920,6 +929,7 @@ function ungateCoding(j) {
     try {
         db.exec("PRAGMA busy_timeout=5000");
         removeCodingUpdateGate(db, j.id);
+        removeTerminalUpdateGate(db, j.id);
     }
     finally {
         db.close();

package/dist/tools-ui.js

@@ -1,6 +1,6 @@
 /** Settings → Tools: one project's MCP servers, in plain words. Secrets are
  * entered here and nowhere else, and never shown again. */
-import { html, postForm } from "./html.js";
+import { html, postForm, reauth } from "./html.js";
 import { brandMarkHtml, TILE_PHONE } from "./brand-mark.js";
 import { signedIn } from "./oauth-run-token.js";
 import { credentialModeOf, toolCommandLine, toolStanding } from "./project-tools.js";
@@ -15,7 +15,7 @@ export function toolsProjectPicker(projects, chosen, keep = {}) {
 }
 /** Choosing another project marks every form on the page as stale before it reloads, so a tap racing the reload is refused. */
 export const TOOLS_PROJECT_SCRIPT = `(function(){var s=document.querySelector('select[data-tools-project]');if(!s)return;s.addEventListener('change',function(){document.querySelectorAll('input[name=shown]').forEach(function(i){i.value=s.value;});});})();`;
-const password = html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`;
+const password = html `${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}`;
 function toolCard(one, base, manage, project, research = null) {
     const { tool, secretsSet } = one;
     const standing = toolStanding(tool, secretsSet);

package/dist/unfenced-test-support.d.ts

@@ -0,0 +1,2 @@
+import type { Store } from "./store.js";
+export declare function allowWhereUnfenced<T extends Store>(store: T): T;

package/dist/unfenced-test-support.js

@@ -0,0 +1,11 @@
+/**
+ * Tests that run real commands on a machine with no OS fence (CI's Ubuntu runners, where unprivileged namespaces are
+ * off) allow unconfined agents on their own store, as an instance operator there would; anywhere a fence exists,
+ * nothing changes and the fence is what the test runs under.
+ */
+import { linuxFenceAvailable, macosFenceAvailable } from "./agent-fence.js";
+export function allowWhereUnfenced(store) {
+    if (!macosFenceAvailable() && !linuxFenceAvailable())
+        store.setUnfencedAgentsAllowed(true, "test", new Date(0));
+    return store;
+}