toolroll 0.9.65 → 0.9.67

package/CHANGELOG.md

@@ -1,5 +1,62 @@
 # Changelog
 
+## 0.9.67 — 2026-10-23
+
+- **A project's checks read their own dependencies again.** 0.9.66 began
+  running checks in a fenced checkout but left out the grant for the shared
+  install the checkout links, so any check that loaded a package failed
+  ("could not resolve"). The linked copy is readable again; others stay fenced.
+- **Builds that write only their workspace resolve host names again on a
+  Mac.** 0.9.66 denied every unix socket to such a build, including the
+  system's DNS service, so with an open network nothing resolved (npm, git,
+  any fetch failed with "could not resolve host"). The DNS socket is allowed;
+  every other socket stays denied.
+- 0.9.66 as released to the console, published: its macOS check failed on a
+  test whose socket path outgrew macOS's 104-byte limit in the runner's temp
+  folder. The test now makes its sockets under /tmp. The browser journeys'
+  model stand-ins also keep their call journal where a workspace-only build
+  may write, so the release check runs them under the default sandbox.
+- `toolroll project network` takes `--open` and `--allowlist` again, and
+  reads `--remove <hosts>` and `--local any|none` as values: the shared flag
+  parser had refused the first two and read the others as switches.
+
+## 0.9.66 — 2026-10-22 (tagged, not published)
+
+- **The board is live to watch.** A strip of workers sits above the lanes:
+  what each is building on this board, its stage and a running clock (or
+  offline, or no build here). A card that changes lane slides there, a new one
+  drops in, and a worker that picks up work lights up once — all off under
+  reduced motion. Building cards show three quiet steps (setting up, writing,
+  checking and committing) from the run's own phase, never a percent. On a phone
+  the lane sections now use the full width.
+- **Builds write only their workspace.** A new per-project setting (Settings →
+  Project → Where builds write, `toolroll project writes`), sealed into each
+  approval: by default a build writes only its checkout and commit data, the
+  project's package caches, its temp folder and its agent's session files —
+  never your shell profile, login items, agent settings or the repository's Git
+  config and hooks. `anywhere` keeps the old behaviour; approvals from before
+  keep it too. Enforced by Seatbelt, bubblewrap and Codex's own profile.
+- **Setup and check commands run in the build's fence**, with their own temp
+  folder and the project's caches.
+- **The plane's Git on a build's checkout runs hardened** (no hooks, fsmonitor
+  or submodules) and refuses a checkout whose config names a command.
+- **Tool servers start outside the checkout** and never run a file the build
+  wrote.
+- **A live terminal comes back as its screen.** The server keeps each
+  terminal's screen (a headless xterm), so a page that reconnects gets the
+  screen, its last 5,000 lines and its modes — a full-screen program like
+  Claude Code or Codex redraws whole, never from a raw replay cut mid-sequence.
+- **Terminals draw on the GPU** where the browser allows (falling back when it
+  doesn't), with Unicode 11 widths for emoji and wide characters.
+- **`toolroll release` finishes when GitHub deletes the merged branch
+  itself.** A delete that fails because the branch is already gone counts as
+  done; one that fails while the branch is still there still stops.
+- **`toolroll release` merges a Homebrew tap that runs no checks on a
+  change.** It no longer waits out its time limit for checks that will never
+  come. Any check run or commit status that does appear is still judged (each
+  app on its own), and a tap whose workflows run on pull requests still needs
+  its own GitHub Actions run to pass.
+
 ## 0.9.65 — 2026-10-22
 
 0.9.64 was tagged but never published: a macOS check failed on Node 24.

package/README.md

@@ -581,8 +581,26 @@ and launch tools remain available.
 
 | | Auto | Full access |
 |---|---|---|
-| **Codex / OpenRouter** (any OS) | Codex's workspace sandbox (workspace writes, no network) with the fence | Codex's sandbox widened to write anywhere, with the fence; its commands reach the network only when the project's network is open |
-| **Claude, Gemini, ACP agents** | macOS: the agent runs inside a Seatbelt sandbox that denies the fence. Linux: inside bubblewrap. Neither (Windows, or Linux without bubblewrap): the build doesn't start, unless an instance operator allows unconfined agents | same |
+| **Codex / OpenRouter** (any OS) | Codex's sandbox with the fence: writes only the checkout, its Git data and the project's caches (anywhere outside the fence, under a project set to write anywhere); no network | the same writes, with the fence; its commands reach the network only when the project's network is open |
+| **Claude, Gemini, ACP agents** | macOS: inside a Seatbelt sandbox that denies the fence and writes only the checkout, its Git data, the project's caches, the run's temp folder and the agent's own session files. Linux: the same in bubblewrap, with a /tmp of its own. Neither (Windows, or Linux without bubblewrap): the build doesn't start, unless an instance operator allows unconfined agents | same |
+
+**Where a build writes.** Each approved scope also seals where its build may
+write. By default (Settings → Project → **Where builds write**, or `toolroll
+project writes --repo <p> workspace`) a build writes only its checkout, its
+checkout's commit data (never the repository's Git config, hooks or info, other
+checkouts' data or submodules), the project's own package caches (npm, pnpm,
+yarn, pip, uv, Go, Cargo, Gradle: its package managers are pointed there), the
+run's temp folder, and the session files its agent CLI must keep. Your shell
+profile, login items, `~/.claude` settings and everything else stay as they
+are; Claude's other live sessions aren't even readable. A project whose tools
+must write elsewhere can choose `anywhere` (outside the fence, as before);
+approvals from before this setting keep writing anywhere, as they were approved.
+The build's setup, check, follow-up and batch commands run in the same fence.
+Toolroll's own Git on a build's checkout runs hardened (no hooks, fsmonitor,
+submodules or signing), reads none of your global Git config but its plain values
+(identity, line endings, a standard git-lfs install), and refuses a checkout
+whose config includes a file or names a command; a project's tool servers can't
+read the checkout and never run a file the build wrote.
 
 **The network.** Each approved scope says what its build may reach: the
 agent's provider, the package registries the project uses (npm, PyPI,

package/dist/agent-fence.d.ts

@@ -60,7 +60,7 @@ export type RunFolders = {
 };
 /** The prefixes of every launch's private folders: its tools' config, a Codex build's own home, and a Linux build's
  * network bridge (egress-bridge.ts). */
-export declare const RUN_FOLDER_PREFIXES: readonly ["so-tools-", "so-codex-", "so-net-"];
+export declare const RUN_FOLDER_PREFIXES: readonly ["so-tools-", "so-codex-", "so-net-", "so-cmd-"];
 export declare function runFolders(own: string | null, root?: string): RunFolders;
 /**
  * What a fence gives back beside its denied paths. Each is narrow and none
@@ -80,7 +80,61 @@ export type FenceGrants = {
     runFolders?: RunFolders;
     pool?: CheckoutPool;
     network?: NetworkFence;
+    writes?: WriteAllowlist;
 };
+export { isWritesMode, WRITES_DEFAULT, type WritesMode } from "./writes-mode.js";
+/**
+ * The only places a `workspace` build writes: `subpaths`, each a folder (or file) writable whole, and `prefixes`, a file
+ * with the temporary names it is atomically replaced through, or a folder named by a pattern (a regex on macOS;
+ * elsewhere the path alone, when it exists). Everything else is read-only to the build; its fence's denies and read-only grants still hold inside these.
+ */
+export type WriteAllowlist = {
+    subpaths: string[];
+    prefixes: WritePrefix[];
+};
+/** A file or folder named by `path` followed by what `suffix` (a regular expression, anchored at its end) allows. */
+export type WritePrefix = {
+    path: string;
+    suffix: string;
+};
+/** Claude's transcript folder for a working folder: its path with every character but a letter or digit made `-`
+ * (Claude Code's own naming; a name over 200 characters gets a suffix, so it is granted by prefix). */
+export declare function claudeProjectFolder(home: string, cwd: string): {
+    path: string;
+    byPrefix: boolean;
+};
+/**
+ * A folder a write grant may name: made when absent, then only as the real folder it is — never a link, nor reached
+ * through one (its real path is its parent's real path and its own name). A build can rewrite what it may write, so a
+ * folder it was given could otherwise come back as a link to anywhere and be granted, followed, on its next launch.
+ * Null when it isn't such a folder: nothing is granted, and the write it was for fails.
+ */
+export declare function grantFolder(path: string, create?: boolean): string | null;
+/**
+ * What a `workspace` build writes and what it loses (arc 2): its checkout, its checkout's Git data (less the shared
+ * repository's config, hooks and info, which Git runs or reads as commands), its own launch folder (its temp is there),
+ * its project's cache folder, the terminal devices, and only the provider state its CLI must write (measured: Claude's
+ * transcript folder for this checkout; Gemini's history, temp and project list; an ACP agent's own folders). The
+ * folders named here are made first, so the provider never has to make them where it can't. `deny` is what this
+ * provider must not even read (Claude's live sessions' keys).
+ */
+export declare function writeAllowlist(options: {
+    provider: string;
+    home: string;
+    worktree: string;
+    binding: WorktreeBinding | null;
+    launchFolder: string | null;
+    cache: string | null;
+}): {
+    writes: WriteAllowlist;
+    readOnly: string[];
+    deny: string[];
+};
+/** Where a project's builds keep their package caches: one folder per project (one trust domain), never used by the
+ * plane's own tools, below the user's cache folder. */
+export declare function buildCacheFolder(repo: string, home?: string, platform?: NodeJS.Platform, env?: Readonly<Record<string, string | undefined>>): string;
+/** The environment that points a build's package managers at its project's cache folder, not the user's own. */
+export declare function buildCacheEnv(folder: string): Record<string, string>;
 /**
  * A launch's network confinement (egress.ts, docs/plans/agent-baseline-hardening.md arc 1). `open`: the network as it
  * always was. `allowlist`: nothing leaves the machine but through the run's own proxy (`proxyPort`); the run's tool
@@ -233,6 +287,8 @@ export declare function macosFenceProfile(fence: readonly string[], grants?: Fen
  */
 export declare function macosNetworkRules(network: NetworkFence | undefined): string[];
 export declare const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
+/** Where macOS's resolver (mDNSResponder) answers: every name lookup on a Mac is a message to this socket. */
+export declare const MACOS_DNS_SOCKET = "/private/var/run/mDNSResponder";
 /**
  * Whether this machine can run an agent inside the macOS fence (checked once). Not from inside another
  * sandbox: a Toolroll a fenced process starts (the end-to-end journeys a flow's check zone runs) can't nest
@@ -260,4 +316,15 @@ export declare function linuxFenced(file: string, args: readonly string[], fence
 };
 /** The host's own sockets a process in a mounted filesystem could still talk to (D-Bus, the display, container
  * engines), wherever they exist here. */
-export declare function linuxHostSockets(uid?: number | undefined, home?: string, tmp?: string): string[];
+export declare function linuxHostSockets(uid?: number | undefined, home?: string, tmp?: string, followLinks?: boolean, env?: Readonly<Record<string, string | undefined>>): string[];
+/**
+ * What each agent's fence gives it, by permission mode: the one table README's "What an agent can reach" shows
+ * (fenceSummaryMarkdown; a test holds them equal).
+ */
+export declare const FENCE_SUMMARY: readonly {
+    agent: string;
+    auto: string;
+    full: string;
+}[];
+/** FENCE_SUMMARY as README's markdown table. */
+export declare function fenceSummaryMarkdown(): string;

package/dist/agent-fence.js

@@ -43,7 +43,8 @@
 import { INSTANCE_DIR } from "./console-instance.js";
 import { ACP_AGENTS, ACP_PROVIDER_IDS } from "./acp-agents.js";
 import { spawnSync } from "node:child_process";
-import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { readMonitoring } from "./monitoring-settings.js";
@@ -368,7 +369,7 @@ export function taskBoundary(options) {
 }
 /** The prefixes of every launch's private folders: its tools' config, a Codex build's own home, and a Linux build's
  * network bridge (egress-bridge.ts). */
-export const RUN_FOLDER_PREFIXES = ["so-tools-", "so-codex-", "so-net-"];
+export const RUN_FOLDER_PREFIXES = ["so-tools-", "so-codex-", "so-net-", "so-cmd-"];
 export function runFolders(own, root = tmpdir()) {
     return { root: real(root), own: own === null ? null : real(own) };
 }
@@ -383,6 +384,161 @@ function otherRunFolders(folders) {
     }
     return entries.filter(entry => RUN_FOLDER_PREFIXES.some(prefix => entry.startsWith(prefix))).map(entry => join(folders.root, entry)).filter(path => path !== folders.own);
 }
+export { isWritesMode, WRITES_DEFAULT } from "./writes-mode.js";
+/** Claude's transcript folder for a working folder: its path with every character but a letter or digit made `-`
+ * (Claude Code's own naming; a name over 200 characters gets a suffix, so it is granted by prefix). */
+export function claudeProjectFolder(home, cwd) {
+    const slug = cwd.replace(/[^a-zA-Z0-9]/g, "-");
+    return slug.length > 200 ? { path: join(home, ".claude", "projects", slug.slice(0, 200)), byPrefix: true } : { path: join(home, ".claude", "projects", slug), byPrefix: false };
+}
+/**
+ * A folder a write grant may name: made when absent, then only as the real folder it is — never a link, nor reached
+ * through one (its real path is its parent's real path and its own name). A build can rewrite what it may write, so a
+ * folder it was given could otherwise come back as a link to anywhere and be granted, followed, on its next launch.
+ * Null when it isn't such a folder: nothing is granted, and the write it was for fails.
+ */
+export function grantFolder(path, create = true) {
+    if (create) {
+        try {
+            mkdirSync(path, { recursive: true, mode: 0o700 });
+        }
+        catch { /* checked below */ }
+    }
+    try {
+        const held = lstatSync(path);
+        if (held.isSymbolicLink() || !held.isDirectory())
+            return null;
+        // Nor through a link of this user's anywhere above it (a system alias, /var → /private/var, is root's and fine).
+        const uid = process.getuid?.();
+        for (let folder = dirname(resolve(path)); folder !== dirname(folder); folder = dirname(folder)) {
+            const above = lstatSync(folder);
+            if (above.isSymbolicLink() && (uid === undefined || above.uid === uid))
+                return null;
+        }
+        const at = realpathSync(path);
+        return at === join(realpathSync(dirname(path)), basename(path)) ? at : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The data folders an ACP agent writes besides a ~/.local/share|state root, per agent, only where known: Goose's
+ * sessions and state; Qwen Code (a Gemini CLI fork) its history and temp, as Gemini measured. An agent not listed
+ * (Cursor, Cline: their settings sit among their data) writes nothing of its own under a workspace build until its
+ * layout is measured; a project using one chooses `anywhere`.
+ */
+const ACP_DATA = {
+    goose: [".local/share/goose", ".local/state/goose"],
+    qwen: [".qwen/tmp", ".qwen/history"],
+};
+/** The suffix Claude Code gives a transcript folder whose name it shortened: `-` and a hash, nothing else. */
+const CLAUDE_SHORTENED = "-[a-z0-9]+(/|$)";
+/** A file and the temporary names it is replaced through (`name.tmp-1`, `name.json.12345`), never a folder below it. */
+const ATOMIC_NAMES = "([.~][^/]*)?$";
+/** The parts of a repository's shared Git data a commit in a worktree writes: objects, refs and their logs (and the
+ * packed refs). Its config, hooks, info, other worktrees' data and submodules' are never among them. */
+function commitGitData(common) {
+    const made = (path) => { try {
+        mkdirSync(path, { recursive: true });
+    }
+    catch { /* granted as named */ } return real(path); };
+    return {
+        subpaths: ["objects", "refs", "logs"].map(name => grantFolder(join(common, name))).filter((path) => path !== null),
+        prefixes: [{ path: join(common, "packed-refs"), suffix: ATOMIC_NAMES }],
+        // Alternates there would let objects come from anywhere.
+        readOnly: [made(join(common, "objects", "info"))],
+    };
+}
+/**
+ * What a `workspace` build writes and what it loses (arc 2): its checkout, its checkout's Git data (less the shared
+ * repository's config, hooks and info, which Git runs or reads as commands), its own launch folder (its temp is there),
+ * its project's cache folder, the terminal devices, and only the provider state its CLI must write (measured: Claude's
+ * transcript folder for this checkout; Gemini's history, temp and project list; an ACP agent's own folders). The
+ * folders named here are made first, so the provider never has to make them where it can't. `deny` is what this
+ * provider must not even read (Claude's live sessions' keys).
+ */
+export function writeAllowlist(options) {
+    const home = real(options.home);
+    const worktree = real(options.worktree);
+    const subpaths = new Set([worktree]);
+    const prefixes = new Map();
+    const readOnly = new Set();
+    const deny = new Set();
+    const made = (path) => { try {
+        mkdirSync(path, { recursive: true, mode: 0o700 });
+    }
+    catch { /* granted as named either way */ } return real(path); };
+    const grant = (path, create = true) => { const at = grantFolder(path, create); if (at !== null)
+        subpaths.add(at); };
+    if (options.binding !== null) {
+        const common = real(join(options.binding.main, ".git"));
+        const gitdir = real(options.binding.gitdir);
+        grant(gitdir, false);
+        // The shared Git data a commit writes, and nothing Git reads as commands or settings: the shared config (filters,
+        // hooks path, fsmonitor), hooks, info (attributes, excludes), other worktrees' data and submodules' stay as they are.
+        const data = commitGitData(common);
+        for (const path of data.subpaths)
+            subpaths.add(path);
+        for (const one of data.prefixes)
+            prefixes.set(`${one.path}\0${one.suffix}`, one);
+        for (const path of data.readOnly)
+            readOnly.add(path);
+        // This worktree's own settings file, present (empty) so it is held read-only everywhere, a bind included.
+        const own = join(gitdir, "config.worktree");
+        try {
+            if (!existsSync(own))
+                writeFileSync(own, "", { mode: 0o644, flag: "wx" });
+        }
+        catch { /* held read-only by name */ }
+        readOnly.add(own);
+    }
+    if (options.launchFolder !== null)
+        grant(options.launchFolder, false);
+    if (options.cache !== null)
+        grant(options.cache);
+    if (options.provider === "claude") {
+        const folder = claudeProjectFolder(home, worktree);
+        if (folder.byPrefix) {
+            made(dirname(folder.path));
+            prefixes.set(folder.path, { path: folder.path, suffix: CLAUDE_SHORTENED });
+        }
+        else
+            grant(folder.path);
+        deny.add(join(home, ".claude", "sessions"));
+    }
+    else if (options.provider === "gemini") {
+        for (const name of ["history", "tmp"])
+            grant(join(home, ".gemini", name));
+        prefixes.set("gemini", { path: join(home, ".gemini", "projects.json"), suffix: ATOMIC_NAMES });
+    }
+    else if (Object.hasOwn(ACP_AGENTS, options.provider)) {
+        // An ACP agent's configuration stays read-only whole (its MCP servers, hooks, plugins, agents and commands could
+        // otherwise be planted for the operator's next session of it); only its known data folders are written (ACP_DATA).
+        for (const name of ACP_AGENTS[options.provider].home)
+            if (/^\.local\/(share|state)\//.test(name))
+                grant(join(home, name));
+        for (const name of ACP_DATA[options.provider] ?? [])
+            grant(join(home, name));
+    }
+    return { writes: { subpaths: [...subpaths].sort(), prefixes: [...prefixes.values()].sort((a, b) => a.path.localeCompare(b.path)) }, readOnly: [...readOnly].sort(), deny: [...deny].sort() };
+}
+/** Where a project's builds keep their package caches: one folder per project (one trust domain), never used by the
+ * plane's own tools, below the user's cache folder. */
+export function buildCacheFolder(repo, home = homedir(), platform = process.platform, env = process.env) {
+    const root = platform === "darwin" ? join(home, "Library", "Caches") : env["XDG_CACHE_HOME"] !== undefined && isAbsolute(env["XDG_CACHE_HOME"]) ? env["XDG_CACHE_HOME"] : join(home, ".cache");
+    return join(root, "toolroll-builds", createHash("sha256").update(real(repo)).digest("hex").slice(0, 16));
+}
+/** The environment that points a build's package managers at its project's cache folder, not the user's own. */
+export function buildCacheEnv(folder) {
+    const at = (name) => join(folder, name);
+    return {
+        npm_config_cache: at("npm"), npm_config_store_dir: at("pnpm"), YARN_CACHE_FOLDER: at("yarn"), BUN_INSTALL_CACHE_DIR: at("bun"),
+        COREPACK_HOME: at("corepack"), npm_config_devdir: at("node-gyp"), PIP_CACHE_DIR: at("pip"), UV_CACHE_DIR: at("uv"),
+        GOCACHE: at("go-build"), GOMODCACHE: at("go-mod"), CARGO_HOME: at("cargo"), GRADLE_USER_HOME: at("gradle"),
+        DENO_DIR: at("deno"), XDG_CACHE_HOME: at("xdg"),
+    };
+}
 /**
  * Services a sandboxed process could ask to act outside the sandbox for it (macOS): open a URL in a browser (Launch
  * Services), script another application (Apple Events), fetch in the background (nsurlsessiond), look a name up
@@ -524,7 +680,14 @@ export function codexFenceArgv(fence, fullAccess, grants = NO_GRANTS) {
     // Codex lets the more specific path win: no read grant inside a pool, but the build's own checkout.
     const pooled = (path) => pool !== undefined && pool.deny.some(one => path === one || inside(path, one))
         && !(pool.own !== null && (path === pool.own || inside(path, pool.own)));
-    if (fullAccess)
+    // Full access writes anywhere its fence allows, unless the build writes only its workspace (arc 2): then exactly its
+    // allowlist, in either mode, beside the workspace Codex's own profile gives.
+    // Codex's own workspace profile also writes the shared temp folders; a workspace build starts from its read-only
+    // profile instead, with exactly the allowlist (its checkout among it) written back.
+    if (grants.writes !== undefined)
+        for (const path of grants.writes.subpaths)
+            access.set(real(path), "write");
+    else if (fullAccess)
         access.set("/", "write");
     for (const path of readOnly)
         if (!pooled(real(path)))
@@ -548,7 +711,7 @@ export function codexFenceArgv(fence, fullAccess, grants = NO_GRANTS) {
     const filesystem = [...access].map(([path, mode]) => `${toml(path)}=${toml(mode)}`);
     return [
         "-c", 'default_permissions="standing-orders"',
-        "-c", 'permissions.standing-orders.extends=":workspace"',
+        "-c", `permissions.standing-orders.extends=${grants.writes === undefined ? '":workspace"' : '":read-only"'}`,
         "-c", `permissions.standing-orders.filesystem={${filesystem.join(",")}}`,
         // Codex's command sandbox can't route through a proxy: its commands reach the network only when the run's sealed
         // network is open (and Full access asked for it), and are offline otherwise.
@@ -700,6 +863,14 @@ export function macosFenceProfile(fence, grants = NO_GRANTS) {
     return [
         "(version 1)",
         "(allow default)",
+        // A workspace build writes only its allowlist (and the terminal devices); every deny and read-only rule after this
+        // still holds inside it.
+        ...(grants.writes === undefined ? [] : [
+            "(deny file-write*)",
+            `(allow file-write* (subpath "/dev")${grants.writes.subpaths.length === 0 ? "" : ` ${paths("subpath", grants.writes.subpaths)}`}${grants.writes.prefixes.map(one => ` (regex #"^${seatbeltRegex(one.path)}${one.suffix}")`).join("")})`,
+            // A granted folder itself can't be renamed, removed or replaced (by a link to anywhere, say): only what is in it.
+            ...(grants.writes.subpaths.length === 0 ? [] : [`(deny file-write* ${paths("literal", grants.writes.subpaths)})`]),
+        ]),
         ...(pool === undefined || pool.deny.length === 0 ? [] : [`(deny file-read* file-write* ${paths("subpath", pool.deny)})`]),
         ...(pool?.own == null ? [] : [
             `(allow file-read* file-write* ${paths("subpath", [pool.own])})`,
@@ -720,6 +891,14 @@ export function macosFenceProfile(fence, grants = NO_GRANTS) {
         "(deny mach-task-name)",
         ...(above.length === 0 ? [] : [`(deny file-write* ${paths("literal", above)})`]),
         ...macosNetworkRules(grants.network),
+        // A workspace build reaches no unix socket but its own (a container engine's, an agent's, a database's would act
+        // outside its limits for it), whatever its network: a confined network has its own rule for this already. Its open
+        // network still names hosts: the system's DNS service answers on a unix socket, and without it nothing resolves.
+        ...(grants.writes === undefined || grants.network?.mode === "allowlist" ? [] : [
+            "(deny network-outbound (remote unix-socket))",
+            `(allow network-outbound (remote unix-socket (path-literal ${seatbelt(MACOS_DNS_SOCKET)})))`,
+            ...(grants.writes.subpaths.length === 0 ? [] : [`(allow network-outbound ${grants.writes.subpaths.map(root => `(remote unix-socket (subpath ${seatbelt(root)}))`).join(" ")})`]),
+        ]),
     ].join("\n");
 }
 /**
@@ -741,6 +920,8 @@ export function macosNetworkRules(network) {
     ];
 }
 export const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
+/** Where macOS's resolver (mDNSResponder) answers: every name lookup on a Mac is a message to this socket. */
+export const MACOS_DNS_SOCKET = "/private/var/run/mDNSResponder";
 /** A process already inside a Seatbelt sandbox (an agent's, or a flow check zone's) can't apply another: sandbox-exec says so. */
 const NESTED_SANDBOX = /sandbox_apply: Operation not permitted/;
 let seatbeltWorks = null;
@@ -833,19 +1014,31 @@ export function linuxFenced(file, args, fence, grants = NO_GRANTS) {
     // mounted folder is not network, so they are masked), and the run's proxy and broker carried in by the forwarder.
     const isolated = network === null ? [] : [
         "--unshare-net", "--unshare-pid", "--proc", "/proc",
-        ...linuxHostSockets().flatMap(mask),
+        ...linuxHostSockets(undefined, undefined, undefined, grants.writes !== undefined).flatMap(mask),
         "--ro-bind", network.bridge.folder, network.bridge.folder,
     ];
     // A confined build gets a /tmp of its own (other programs' sockets, other runs' folders and anything planted there
     // all out of sight at once), with only its own folders there given back; every mask and grant below still applies.
-    const privateTmp = network === null ? [] : ["--tmpfs", "/tmp", ...(network.keep ?? []).filter(path => inside(path, "/tmp") && existsSync(path)).flatMap(path => ["--bind", path, path])];
+    // A workspace build (arc 2) sees the whole filesystem read-only, a /dev of its own and a /tmp of its own, with only
+    // its allowlist bound back writable; its own checkout's Git data is in that list.
+    const writes = grants.writes;
+    const root = writes === undefined ? ["--dev-bind", "/", "/"] : ["--ro-bind", "/", "/", "--dev", "/dev"];
+    const writable = writes === undefined ? [] : [...writes.subpaths, ...writes.prefixes.map(one => one.path)].filter(path => existsSync(path)).flatMap(path => ["--bind", path, path]);
+    // What a private /tmp gives back is read-only for a workspace build (its writable part is bound again after): the
+    // checkout's whole shared Git data among it must not come back writable.
+    // A confined network brings a /tmp of its own (arc 1); a workspace build with an open network sees the shared /tmp
+    // read-only like the rest of the root, its own folders there bound back writable.
+    const privateTmp = network === null ? [] : ["--tmpfs", "/tmp", ...(network?.keep ?? []).filter(path => inside(path, "/tmp") && existsSync(path)).flatMap(path => [writes === undefined ? "--bind" : "--ro-bind", path, path])];
+    // A workspace build never reaches the host's own services either (a container engine would write anywhere for it),
+    // whatever its network: confined networks mask them below already.
+    const services = writes === undefined || network !== null ? [] : linuxHostSockets(undefined, undefined, undefined, true).flatMap(mask);
     const command = network === null ? [file, ...args]
         : [network.bridge.node, network.bridge.forwarder, network.bridge.folder, ...[network.proxyPort, ...network.brokerPorts].map(String), "--", file, ...args];
-    return { file: "bwrap", args: ["--dev-bind", "/", "/", ...privateTmp, ...pool.flatMap(mask), ...own, ...fence.flatMap(mask), ...kept, ...isolated, "--die-with-parent", "--", ...command] };
+    return { file: "bwrap", args: [...root, ...privateTmp, ...writable, ...pool.flatMap(mask), ...own, ...fence.flatMap(mask), ...kept, ...services, ...isolated, "--die-with-parent", "--", ...command] };
 }
 /** The host's own sockets a process in a mounted filesystem could still talk to (D-Bus, the display, container
  * engines), wherever they exist here. */
-export function linuxHostSockets(uid = process.getuid?.(), home = homedir(), tmp = "/tmp") {
+export function linuxHostSockets(uid = process.getuid?.(), home = homedir(), tmp = "/tmp", followLinks = false, env = process.env) {
     // The system's own, root-owned: resolved (/var/run is a link to /run) so bubblewrap mounts over the real path, once.
     const system = [
         ...(uid === undefined ? [] : [`/run/user/${uid}`]), "/run/dbus", "/var/run/dbus", "/var/run/docker.sock", "/run/docker.sock", "/run/containerd", "/run/podman",
@@ -874,10 +1067,97 @@ export function linuxHostSockets(uid = process.getuid?.(), home = homedir(), tmp
             return false;
         }
     };
-    for (const path of [".docker", ".colima", ".orbstack", ".lima", ".rd", ".local/share/containers"].map(name => join(home, name)))
+    for (const path of [".docker", ".colima", ".orbstack", ".lima", ".rd", ".local/share/containers"].map(name => join(home, name))) {
         if (owned(path))
             masks.add(path);
-    // /tmp's sockets (the display's, an SSH agent's, a multiplexer's, editors') go with the build's private /tmp.
-    void tmp;
+        // A workspace build can't plant a link in the home folder, so a link there is the operator's own: its target is
+        // masked too (an engine moved elsewhere).
+        else if (followLinks) {
+            try {
+                if (lstatSync(path).isSymbolicLink())
+                    masks.add(realpathSync(path));
+            }
+            catch { /* dangling */ }
+        }
+    }
+    // An engine Toolroll's own environment points at, wherever it is (never the build's to choose): always masked. So is
+    // the SSH agent it names (it signs as you), which a shared /tmp would otherwise leave in reach.
+    for (const name of ["DOCKER_HOST", "CONTAINER_HOST"]) {
+        const socket = /^unix:\/\/(\/.+)$/.exec(env[name] ?? "")?.[1];
+        if (socket !== undefined) {
+            try {
+                masks.add(realpathSync(socket));
+            }
+            catch { /* not there */ }
+        }
+    }
+    const agent = env["SSH_AUTH_SOCK"];
+    if (agent !== undefined && isAbsolute(agent)) {
+        try {
+            const socket = realpathSync(agent);
+            masks.add(socket);
+            // The folder an agent makes for its socket (ssh-XXXX in /tmp) too, so a socket it makes next is out of reach.
+            if (inside(socket, real(tmp)) && dirname(socket) !== real(tmp) && !lstatSync(dirname(socket)).isSymbolicLink())
+                masks.add(dirname(socket));
+        }
+        catch { /* not there */ }
+    }
+    // A build that shares /tmp (a workspace build with an open network) reaches none of the sockets there either: every
+    // socket two levels down (a multiplexer's, an agent's, a display's, an editor's), and the folder that holds it, taken
+    // as it is (never through a link). Toolroll's own launch folders are fenced by name already.
+    if (followLinks) {
+        const socketIn = (folder, depth) => {
+            let found = false;
+            let entries = [];
+            try {
+                entries = readdirSync(folder);
+            }
+            catch {
+                return false;
+            }
+            for (const entry of entries) {
+                const path = join(folder, entry);
+                if (RUN_FOLDER_PREFIXES.some(prefix => entry.startsWith(prefix)))
+                    continue;
+                let held;
+                try {
+                    held = lstatSync(path);
+                }
+                catch {
+                    continue;
+                }
+                if (held.isSocket()) {
+                    masks.add(path);
+                    found = true;
+                }
+                else if (held.isDirectory() && !held.isSymbolicLink() && depth > 0 && socketIn(path, depth - 1)) {
+                    masks.add(path);
+                    found = true;
+                }
+            }
+            return found;
+        };
+        socketIn(tmp, 1);
+    }
     return [...masks].sort();
 }
+/**
+ * What each agent's fence gives it, by permission mode: the one table README's "What an agent can reach" shows
+ * (fenceSummaryMarkdown; a test holds them equal).
+ */
+export const FENCE_SUMMARY = [
+    {
+        agent: "**Codex / OpenRouter** (any OS)",
+        auto: "Codex's sandbox with the fence: writes only the checkout, its Git data and the project's caches (anywhere outside the fence, under a project set to write anywhere); no network",
+        full: "the same writes, with the fence; its commands reach the network only when the project's network is open",
+    },
+    {
+        agent: "**Claude, Gemini, ACP agents**",
+        auto: "macOS: inside a Seatbelt sandbox that denies the fence and writes only the checkout, its Git data, the project's caches, the run's temp folder and the agent's own session files. Linux: the same in bubblewrap, with a /tmp of its own. Neither (Windows, or Linux without bubblewrap): the build doesn't start, unless an instance operator allows unconfined agents",
+        full: "same",
+    },
+];
+/** FENCE_SUMMARY as README's markdown table. */
+export function fenceSummaryMarkdown() {
+    return ["| | Auto | Full access |", "|---|---|---|", ...FENCE_SUMMARY.map(row => `| ${row.agent} | ${row.auto} | ${row.full} |`)].join("\n");
+}

package/dist/agentconfig.js

@@ -20,6 +20,7 @@
  * the caller snapshots it into the run row.
  */
 import { PROJECT_NETWORK_DEFAULT, repositoryEcosystems, resolveNetwork } from "./egress.js";
+import { WRITES_DEFAULT } from "./writes-mode.js";
 import { isProviderId, validateSpec } from "./provider.js";
 import { ACP_LIMITS, CLAUDE_LIMITS, CODEX_SHAPED_LIMITS, GEMINI_LIMITS } from "./scope.js";
 import { ACP_AGENTS, isAcpProvider } from "./acp-agents.js";
@@ -196,7 +197,9 @@ export function resolveScopeProfile(store, repo, ref, flags) {
     // What the build may reach (egress.ts): resolved now, from the project's setting, the provider's own hosts and the
     // registries the repository's own HEAD names, and sealed with the rest of the profile.
     const network = resolveNetwork(provider, repo === null ? PROJECT_NETWORK_DEFAULT : store.projectNetwork(repo), repo === null ? [] : repositoryEcosystems(repo));
-    return { ok: true, profile: { ...profile, network }, provenance: { resolvedFrom: build.source, repairFrom } };
+    // Where the build may write (writes-mode.ts): the project's setting, sealed likewise.
+    const writes = repo === null ? WRITES_DEFAULT : store.projectWrites(repo);
+    return { ok: true, profile: { ...profile, network, writes }, provenance: { resolvedFrom: build.source, repairFrom } };
 }
 const PHASE_NOUN = { plan: "planner", build: "builder", repair: "repair", review: "reviewer" };
 export function resolveRouteCandidates(store, repo, pins = {}) {

package/dist/batch-checks.js

@@ -18,6 +18,7 @@
  * The queue is the follow-up check ledger (result-follow-ups.ts), with `batch` requests: the same
  * claim, receipts, abandoned-check reading, status projection and Merge gate. The policy is an
  * append-only ledger entry, like the check level. */
+import { fencedCheckoutCommands } from "./invoke.js";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -161,7 +162,7 @@ async function checkCohort(store, root, repo, cohort, deps) {
                 return { conflict: false, tested, outcome: { ran: false, failure: "The project's approved setup changed before the check started." }, setupFailed: false };
             if (liveSetup !== null) {
                 const shell = approvedCommandShell(liveSetup.command);
-                const prepared = await runWithIsolatedDatabase(runner, shell.file, shell.args, { cwd: checkout, timeoutMs: liveSetup.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
+                const prepared = await runWithIsolatedDatabase(fencedCheckoutCommands(store, repo, checkout, runner), shell.file, shell.args, { cwd: checkout, timeoutMs: liveSetup.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
                 note(set, section(`${label} · approved project setup on ${tested.slice(0, 7)}`, liveSetup.command, prepared));
                 if (prepared.code !== 0 || prepared.timedOut || prepared.notFound)
                     return { conflict: false, tested, outcome: { ran: false, failure: "The project's setup failed, so the check didn't run." }, setupFailed: true };
@@ -170,7 +171,7 @@ async function checkCohort(store, root, repo, cohort, deps) {
             if (live === null || live.digest !== command.digest)
                 return { conflict: false, tested, outcome: { ran: false, failure: "The approved check changed before it started." }, setupFailed: false };
             const shell = approvedCommandShell(live.command);
-            const ran = await runWithIsolatedDatabase(runner, shell.file, shell.args, { cwd: checkout, timeoutMs: live.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
+            const ran = await runWithIsolatedDatabase(fencedCheckoutCommands(store, repo, checkout, runner), shell.file, shell.args, { cwd: checkout, timeoutMs: live.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
             note(set, section(`${label} · full check on ${tested.slice(0, 7)}`, live.command, ran));
             return { conflict: false, tested, setupFailed: false,
                 outcome: ran.timedOut ? { ran: false, failure: "The check ran out of time." } : ran.notFound ? { ran: false, failure: "The check couldn't start." } : { ran: true, exitCode: ran.code } };