toolroll 0.9.65 → 0.9.67

package/dist/builder.js

@@ -1,4 +1,5 @@
 import { legacyNetwork, repositoryEcosystems } from "./egress.js";
+import { checkoutGit } from "./teardown-git.js";
 import { isAcpProvider } from "./acp-agents.js";
 import { OBSERVATION_MAILBOX, observationBrief, parseObservationCases, collectObservations } from "./observations.js";
 import { checkCommandFor, effectiveCheckLevel, recordRunCheckLevel } from "./check-levels.js";
@@ -41,9 +42,9 @@ import { PREPARED_EVIDENCE_FILE, PREPARED_EVIDENCE_GIT, preparedScreenshotMatche
  * watchdog and a high runaway-turn breaker still stop a pathological loop;
  * repair remains narrowly time-bounded because its job is narrowly scoped.
  */
-import { existsSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, realpathSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { run, runClaudeStreamJsonl, runOwnerTag, streamsInput } from "./exec.js";
 import { stopRequestedFor, stopWords, underStopWatch } from "./task-control.js";
 import { witnessedRunner } from "./process-custody.js";
@@ -58,7 +59,7 @@ import { heartbeat as runnerHeartbeat } from "./runner.js";
 import { MARKER as LEASE_MARKER } from "./worktree.js";
 import { parseDecision, parseHandoff, repairPrompt, HEADLESS_RULE, HANDOFF_CONCLUSION_CAP, HANDOFF_ITEM_CAP, HANDOFF_LIST_CAP, HANDOFF_PAYLOAD_CAP } from "./decision.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { invokeAgent } from "./invoke.js";
+import { fencedCommands, invokeAgent } from "./invoke.js";
 import { TELEGRAM_TOKEN_ENVS } from "./names.js";
 import { OPENROUTER_ENV_KEY, auditOf, ALL_CREDENTIAL_ENV } from "./provider.js";
 import { liveLogContext } from "./live-detail.js";
@@ -237,6 +238,43 @@ export function launchNetworkOf(store, taskRef, profile) {
     const repo = store.refForId(taskRef)?.repo ?? null;
     return { policy: legacyNetwork(profile.provider, repo === null ? [] : repositoryEcosystems(repo)) };
 }
+/** Asking a checkout which branch it is on: reads no file a build wrote and runs nothing. */
+const BRANCH_QUERIES = [
+    ["--no-optional-locks", "rev-parse", "--abbrev-ref", "HEAD"], ["--no-optional-locks", "symbolic-ref", "--short", "-q", "HEAD"],
+];
+/**
+ * The plane's git as a build runs it: hardened (teardown-git.ts checkoutGit) for every call, failing closed, but one —
+ * asking the project's own main checkout which branch it is on (its config is the operator's, and the query runs
+ * nothing). An injected runner (`request.git`: tests only; production always runs git itself) is used as given.
+ */
+function buildCheckoutGit(given, worktree, mainCheckout = null) {
+    if (given !== run)
+        return given;
+    const hardened = checkoutGit(given);
+    const real = (path) => { try {
+        return realpathSync(resolve(path));
+    }
+    catch {
+        return null;
+    } };
+    const trusted = mainCheckout === null ? null : real(mainCheckout);
+    const own = real(worktree);
+    return (file, args, options) => {
+        const at = options?.cwd === undefined ? null : real(options.cwd);
+        const query = BRANCH_QUERIES.some(one => one.length === args.length && one.every((word, index) => args[index] === word));
+        return trusted !== null && at === trusted && at !== own && query ? given(file, args, options) : hardened(file, args, options);
+    };
+}
+/** A run's setup and check commands, in its build's fence, writing where the approval this build runs under sealed
+ * (never the scope as it may since have been rewritten; invoke.ts fencedCommands). */
+function commandRunner(store, runId, profile, inner) {
+    return fencedCommands(store, runId, launchWritesOf(profile), inner);
+}
+/** Where a build may write (writes-mode.ts): what its approval sealed, or — sealed before write allowlists — anywhere
+ * its fence allows, as it was approved. */
+export function launchWritesOf(profile) {
+    return profile.writes ?? "anywhere";
+}
 export function proveApprovedProfile(scope, given) {
     // The raw terms first (raw authority repair): a scope whose stored terms
     // do not read back exactly proves nothing — not the filtered reading.
@@ -331,7 +369,9 @@ export function proveApprovedProfile(scope, given) {
  * that forgot one is exactly the caller this is protecting against.
  */
 export async function build(store, request) {
-    const { taskId, taskRef, runner, worktree, branch, now, permissionMode = "auto", skipPermissions = false, provider = "claude", model, maxTurns = DEFAULT_MAX_TURNS, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS, agent, git = run, } = request;
+    const { taskId, taskRef, runner, worktree, branch, now, permissionMode = "auto", skipPermissions = false, provider = "claude", model, maxTurns = DEFAULT_MAX_TURNS, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS, agent, git: givenGit = run, } = request;
+    // The plane's own git on this build's checkout runs hardened, and never where the checkout's config names a command.
+    const git = buildCheckoutGit(givenGit, worktree, store.getWorktree(worktree)?.repo ?? null);
     const scope = store.getScope(taskId);
     const approval = approvalOf(scope);
     if (!approval.approved) {
@@ -625,7 +665,7 @@ export async function build(store, request) {
             // Setup runs under the stop watch (v52), owned by this run: an
             // operator's stop ends the setup's process group and the attempt
             // settles as interrupted below, never as a setup failure.
-            const made = await underStopWatch(store, request.runId, () => runWithIsolatedDatabase(witnessedRunner(store, request.runId, request.clock ?? (() => now), runSetup), shell.file, shell.args, {
+            const made = await underStopWatch(store, request.runId, () => runWithIsolatedDatabase(witnessedRunner(store, request.runId, request.clock ?? (() => now), commandRunner(store, request.runId, effective.profile, runSetup)), shell.file, shell.args, {
                 cwd: worktree,
                 timeoutMs: setupWanted.timeoutMs,
                 processGroup: true,
@@ -1310,6 +1350,7 @@ export async function build(store, request) {
             ...watchdogsOf(effective.profile, effective.timeoutMs),
             omitEnv: AGENT_ENV_DENYLIST,
             network: launchNetworkOf(store, request.taskRef, effective.profile),
+            writes: launchWritesOf(effective.profile),
             ...(agent === undefined ? {} : { runner: agent }),
             onSpawn: (pid) => { spawned = true; request.onProviderSpawn?.(pid); },
             onStreamEvent: (event) => liveLog.observe(event),
@@ -1774,7 +1815,7 @@ export async function settleProviderOutcome(captured, result) {
                 };
                 if (!eligible())
                     throw Error("The observation source or execution authority changed.");
-                const execute = (file, args, options) => underStopWatch(store, request.runId, () => runWithIsolatedDatabase(witnessedRunner(store, request.runId, clock, request.verify ?? run), file, args, {
+                const execute = (file, args, options) => underStopWatch(store, request.runId, () => runWithIsolatedDatabase(witnessedRunner(store, request.runId, clock, commandRunner(store, request.runId, captured.effective.profile, request.verify ?? run)), file, args, {
                     ...options, processGroup: true, owner: runOwnerTag(store, request.runId), beforeSpawn: eligible,
                     onSpawn: pid => request.onProviderSpawn?.(pid), envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST,
                 }));
@@ -2234,7 +2275,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
         const runVerification = async (label) => {
             const streamed = { stdout: false, stderr: false };
             // The check runs under the stop watch (v52), owned by this run.
-            const result = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, verifyRunner), verifyShell.file, verifyShell.args, {
+            const result = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, commandRunner(store, runId, captured.effective.profile, verifyRunner)), verifyShell.file, verifyShell.args, {
                 cwd: worktree,
                 timeoutMs: configured.timeoutMs,
                 processGroup: true,
@@ -2276,7 +2317,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
             detachShared(worktree, depsRoot);
             const label = "Own install · approved project setup (package.json or lockfile changed)";
             const setupShell = approvedCommandShell(live.command);
-            const installed = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, request.setup ?? run), setupShell.file, setupShell.args, {
+            const installed = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, commandRunner(store, runId, captured.effective.profile, request.setup ?? run)), setupShell.file, setupShell.args, {
                 cwd: worktree,
                 timeoutMs: live.timeoutMs,
                 processGroup: true,
@@ -2295,7 +2336,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
             checkLog.push(attemptLog(label, live.command, installed));
             if (installed.notFound || installed.timedOut || installed.code !== 0)
                 return "own-install-failed";
-            return await sealedTreeState(request.git ?? run) === "clean" ? null : "setup-changed-files";
+            return await sealedTreeState(buildCheckoutGit(request.git ?? run, worktree)) === "clean" ? null : "setup-changed-files";
         };
         const ownInstall = await ownInstallIfChanged();
         const first = ownInstall === null ? await runVerification("Project check · attempt 1") : null;
@@ -2339,7 +2380,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
                 verifyCommand = { configured: true, ran: false, attemptFailed: true, failure: "custody-lost" };
             }
             else {
-                const gitRunner = request.git ?? run;
+                const gitRunner = buildCheckoutGit(request.git ?? run, worktree);
                 const beforeSetup = await sealedTreeState(gitRunner);
                 if (beforeSetup === "head-moved") {
                     verifyCommand = { configured: true, ran: false, attemptFailed: true, failure: "checkout-moved" };
@@ -2366,7 +2407,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
                     else {
                         const setupRunner = request.setup ?? run;
                         const setupShell = approvedCommandShell(liveBeforeSetup.command);
-                        const restored = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, setupRunner), setupShell.file, setupShell.args, {
+                        const restored = await underStopWatch(store, runId, () => runWithIsolatedDatabase(witnessedRunner(store, runId, now, commandRunner(store, runId, captured.effective.profile, setupRunner)), setupShell.file, setupShell.args, {
                             cwd: worktree,
                             timeoutMs: liveBeforeSetup.timeoutMs,
                             processGroup: true,
@@ -2653,6 +2694,7 @@ async function resumeUnhandedWork(captured, sessionId) {
             ...watchdogsOf(effective.profile, effective.timeoutMs),
             omitEnv: AGENT_ENV_DENYLIST,
             network: launchNetworkOf(store, request.taskRef, effective.profile),
+            writes: launchWritesOf(effective.profile),
             ...(agent === undefined ? {} : { runner: agent }),
             ...(request.onProviderSpawn === undefined ? {} : { onSpawn: request.onProviderSpawn }),
             clock,
@@ -2867,7 +2909,7 @@ async function ingestPark(args) {
                 ? watchdogsOf(args.profile, args.profile.repairTimeoutSeconds * 1000, true)
                 : { timeoutMs: args.profile !== undefined ? args.profile.repairTimeoutSeconds * 1000 : REPAIR_TIMEOUT_MS }),
             omitEnv: AGENT_ENV_DENYLIST,
-            ...(args.profile === undefined ? {} : { network: launchNetworkOf(store, request.taskRef, args.profile) }),
+            ...(args.profile === undefined ? {} : { network: launchNetworkOf(store, request.taskRef, args.profile), writes: launchWritesOf(args.profile) }),
             ...(agent === undefined ? {} : { runner: agent }),
             ...(request.onProviderSpawn === undefined ? {} : { onSpawn: request.onProviderSpawn }),
             clock,

package/dist/contracts/console-api.d.ts

@@ -83,6 +83,7 @@ export declare const CONSOLE_FORMS: {
     readonly projectConcurrency: FormContract<"concurrency" | "repo">;
     readonly projectLiveView: FormContract<"act" | "nonce" | "password" | "repo">;
     readonly projectNetwork: FormContract<"hosts" | "local" | "mode" | "password" | "repo">;
+    readonly projectWrites: FormContract<"password" | "repo" | "writes">;
     readonly projectDelete: FormContract<"name" | "password" | "repo" | "step">;
     readonly policy: FormContract<"ceiling" | "models" | "password" | "provider" | "tools">;
     readonly approval: FormContract<"not_requester" | "password" | "paths" | "protect" | "repo">;

package/dist/contracts/console-api.js

@@ -92,6 +92,7 @@ export const CONSOLE_FORMS = {
     projectConcurrency: formContract("POST /settings/project/concurrency", ["repo", "concurrency"]),
     projectLiveView: formContract("POST /settings/project/live-view", ["repo", "act", "password", "nonce"]),
     projectNetwork: formContract("POST /settings/project/network", ["repo", "mode", "local", "hosts", "password"]),
+    projectWrites: formContract("POST /settings/project/writes", ["repo", "writes", "password"]),
     projectDelete: formContract("POST /settings/project/delete", ["repo", "name", "step", "password"]),
     policy: formContract("POST /settings/policy", ["password", "provider", "models", "tools", "ceiling"]),
     approval: formContract("POST /settings/approval", ["repo", "password", "protect", "paths", "not_requester"]),

package/dist/invoke.d.ts

@@ -20,6 +20,8 @@ import { type AgentSpec, type Invocation, type ProviderRunner, type AgentEnding
 import { type VersionProbe } from "./attest.js";
 import type { Store } from "./store.js";
 import type { RunOptions } from "./exec.js";
+import type { Runner } from "./worktree.js";
+import { type WritesMode } from "./agent-fence.js";
 import { type NetworkProfile } from "./egress.js";
 export type { ProviderRunner } from "./provider.js";
 /** The claude binary name — kept for the legacy quota rows and tests that
@@ -109,4 +111,20 @@ export declare function invokeAgent(store: Store, runId: number, spec: AgentSpec
     keyHome?: string;
     accumulateUsage?: boolean;
     network?: LaunchNetwork;
+    writes?: WritesMode;
 }): Promise<InvokeResult>;
+/**
+ * A build's setup and check commands, run in its fence (arc 2): the same denies as its agent's (Toolroll's state,
+ * credentials, other projects and runs), its write allowlist when its approval sealed one (its checkout and Git data,
+ * its project's caches, and a temp folder of the command's own), and its package managers pointed at those caches.
+ * Their network stays as it was. A machine without an OS fence runs them as before; a fence that can't be prepared
+ * (a checkout whose binding no longer proves) runs nothing.
+ */
+export declare function fencedCommands(store: Store, runId: number, writes: WritesMode, inner: Runner, available?: () => boolean): Runner;
+/**
+ * A project's checks run in a checkout of a result's commit made for them (result-follow-ups.ts, batch-checks.ts), in
+ * the same fence as a build's commands: Toolroll's state, credentials, other projects and runs denied; under the
+ * project's writes setting, only that checkout, its Git data, its own temp folder, the project's caches and its check
+ * database writable. Where nothing can confine them, they run only when an instance operator allowed unconfined agents.
+ */
+export declare function fencedCheckoutCommands(store: Store, repo: string, checkout: string, inner: Runner, available?: () => boolean): Runner;

package/dist/invoke.js

@@ -29,12 +29,12 @@ import { witnessedRunner } from "./process-custody.js";
 import { underStopWatch } from "./task-control.js";
 import { childDatabaseEnv, isolatedChildDatabase, removeChildDatabase as removeAgentDatabase } from "./child-database.js";
 import { RunSignInError, noToolsArgs, prepareRunTools } from "./project-tools.js";
-import { mkdirSync, readFileSync, realpathSync } from "node:fs";
-import { homedir } from "node:os";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { poolRootOf } from "./worktree.js";
 import { BRIDGE_DIR } from "./agent-fence.js";
-import { agentFence, CheckoutBindingError, trustedWorktreeBinding, checkoutGitEnv, HARDENED_GIT_ARGS, codexFenceArgv, fenceGrants, fencedGitEnv, linuxFenceAvailable, linuxFenced, macosFenceAvailable, macosFenced, NO_GRANTS, runFolders, taskBoundary } from "./agent-fence.js";
+import { agentFence, buildCacheEnv, buildCacheFolder, grantFolder, writeAllowlist, WRITES_DEFAULT, CheckoutBindingError, trustedWorktreeBinding, checkoutGitEnv, HARDENED_GIT_ARGS, codexFenceArgv, fenceGrants, fencedGitEnv, linuxFenceAvailable, linuxFenced, macosFenceAvailable, macosFenced, NO_GRANTS, runFolders, taskBoundary } from "./agent-fence.js";
 import { proxyEnv, providerOnlyNetwork, startEgressProxy } from "./egress.js";
 import { bridgeFits, startEgressBridge } from "./egress-bridge.js";
 import { claudeConfigDir, claudeDefaults, codexDefaults, codexHomeDir, isolatedCodexHome } from "./provider-home.js";
@@ -239,7 +239,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // re-supply survives resolveChildEnv's chat-key strip); in
     // "subscription" mode the key is STRIPPED from the child so the CLI's
     // own login is used — its key is retained, just not handed over.
-    const { runner, clock: _clock, versionProbe: _probe, keyHome, timeoutMs: _hardTimeout, idleTimeoutMs: _idleTimeout, stdin: _callerStdin, accumulateUsage: _accumulateUsage, liveInput: _liveInput, acpCheck: _acpCheck, network: launchNetwork, ...runOptions } = options;
+    const { runner, clock: _clock, versionProbe: _probe, keyHome, timeoutMs: _hardTimeout, idleTimeoutMs: _idleTimeout, stdin: _callerStdin, accumulateUsage: _accumulateUsage, liveInput: _liveInput, acpCheck: _acpCheck, network: launchNetwork, writes: launchWrites, ...runOptions } = options;
     // The live setting is read STRICTLY (atomic authority closure): a
     // present mode file that says neither word is a value-shaped refusal
     // before any stamp or process — never the subscription default a
@@ -300,12 +300,21 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // The project's tools (v80): exactly its MCP servers, and none of the
     // operator's global or a repository's own, served by this launch's broker
     // (tool-broker.ts), which alone holds their secrets. A review keeps its isolation.
+    // Set once the fence is known: a fenced build's servers never start outside a fence.
+    let serverMustBeFenced = false;
+    // What the build writes (its checkout, its project's caches): a tool server never runs from there, nor reads it at all.
+    const serverUntrusted = workspace === null ? [] : toolUntrusted(store, workspace, keyHome);
     const launchTools = invocation.phase === "review" ? null : await runTools(store, runId, spec, options.keyHome, clock, invocation.readOnlyTools, invocation.researchWithheld, containment, {
         env: { ...process.env, ...(runOptions.env ?? {}) },
         omitEnv: [...(runOptions.omitEnv ?? []), ...ALL_CREDENTIAL_ENV],
         pass: childDatabaseEnv(isolatedDb.file),
-        ...(workspace === null ? {} : { cwd: workspace }),
+        // A tool server starts in a folder the build can't write, and never runs the build's own bytes (arc 2).
+        cwd: keyHome ?? homedir(),
+        untrusted: serverUntrusted,
         wrap: () => serverFence,
+        // A fenced build's tool servers start only in a fence too, unless an instance operator allowed unconfined agents.
+        unwrapped: () => serverMustBeFenced && !store.unfencedAgentsAllowed()
+            ? "This machine can't confine the tool's server (no macOS sandbox, no working bubblewrap), so it was not started." : null,
     });
     if (launchTools !== null && "refused" in launchTools) {
         removeAgentDatabase(isolatedDb.dir);
@@ -333,7 +342,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // tool servers outside its command sandbox, so its own launch folder is
     // fenced too; Claude reads its config from there, inside the sandbox.
     const ownTools = tools?.privateDir === undefined ? null : realpathSync(tools.privateDir);
-    const fenceOf = invocation.phase === "review" ? { fence: [], fileTools: [], grants: NO_GRANTS, gitPaths: [], problem: undefined } : runFence(store, runId, spec.provider, options.keyHome, codexHarness ? null : ownTools);
+    const fenceOf = invocation.phase === "review" ? { fence: [], fileTools: [], grants: NO_GRANTS, gitPaths: [], cache: undefined, problem: undefined } : runFence(store, runId, spec.provider, options.keyHome, codexHarness ? null : ownTools, launchWrites ?? WRITES_DEFAULT);
     if (fenceOf.problem !== undefined) {
         tools?.cleanup();
         codexHome?.cleanup();
@@ -372,12 +381,16 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // A tool server the broker starts is fenced by what this platform supports, whatever the provider: Codex's own
     // profile fences only its agent's commands, and the broker starts servers outside it.
     if (fence.length > 0) {
-        // A tool server keeps its own reach (it holds its tool's secrets, not the agent's code): never the agent's network.
-        const serverGrants = () => { const { network: _agentOnly, ...rest } = grants; return rest; };
+        // A tool server keeps its own reach (it holds its tool's secrets, not the agent's code): never the agent's network,
+        // nor its write allowlist (a server keeps its own state where it always has).
+        const serverGrants = () => { const { network: _agentOnly, writes: _agentWrites, ...rest } = grants; return rest; };
+        // Nor read what the build wrote: however its arguments are spelled, no byte of the checkout or caches can load.
+        const serverDenies = [...fence, ...serverUntrusted.filter(path => existsSync(path)).map(path => realpathSync(path))];
         if (macosFenceAvailable())
-            serverFence = (file, args) => macosFenced(file, args, fence, serverGrants());
+            serverFence = (file, args) => macosFenced(file, args, serverDenies, serverGrants());
         else if (linuxFenceAvailable())
-            serverFence = (file, args) => linuxFenced(file, args, fence, serverGrants());
+            serverFence = (file, args) => linuxFenced(file, args, serverDenies, serverGrants());
+        serverMustBeFenced = true;
     }
     // No silent fallback (arc 1): a build this machine can't confine at the OS — Claude reduced to its own file-tool
     // rules, Gemini to nothing — doesn't start unless the instance operator allowed unconfined agents here. An injected
@@ -457,6 +470,10 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         ...(egress === null || !("policy" in network) ? {} : proxyEnv(egress, network.policy.loopback)),
         // Its own temp folder, where its tools' sockets may live (the only one its fence admits besides its checkout).
         ...(runTemp === null ? {} : { TMPDIR: runTemp, TMP: runTemp, TEMP: runTemp }),
+        // Claude's own working folder goes there too (it is otherwise the shared /tmp/claude-<uid>).
+        ...(runTemp === null || spec.provider !== "claude" ? {} : { CLAUDE_CODE_TMPDIR: runTemp }),
+        // A workspace build's package managers keep their caches in its project's own folder (arc 2).
+        ...(fenceOf.cache === undefined || grants.writes === undefined ? {} : buildCacheEnv(fenceOf.cache)),
         // This key is deliberately last: no caller may point an agent back at
         // the live control database through a generic RunOptions override.
         ...childDatabaseEnv(isolatedDb.file),
@@ -906,7 +923,7 @@ function linkedFor(store, worktree) {
 /** The paths this run's agent may not reach: the state folder around the live database (but not its own worktree),
  * ~/.toolroll (or its older name), its task boundary and other launches' private folders; what the fence gives back
  * (FenceGrants); and what only Claude's file tools refuse. */
-function runFence(store, runId, provider, keyHome, ownTools) {
+function runFence(store, runId, provider, keyHome, ownTools, writes = WRITES_DEFAULT) {
     try {
         // A plane always has a database file; an in-memory store (a test) has nothing to fence.
         const databaseFile = store.databaseFile();
@@ -921,22 +938,128 @@ function runFence(store, runId, provider, keyHome, ownTools) {
         const binding = worktree === null || row === null ? null : trustedWorktreeBinding(row.repo, worktree, poolRoots);
         const boundary = worktree === null ? null : taskBoundary({ worktree, provider, ...home, binding });
         const folders = runFolders(ownTools);
+        // A build with a checkout writes only its workspace unless its approval said anywhere (arc 2): its checkout and
+        // Git data, its launch folder, its project's caches and the provider state its CLI must write.
+        const allowed = worktree === null || row === null || writes !== "workspace" ? null
+            : writeAllowlist({ provider, home: keyHome ?? homedir(), worktree, binding, launchFolder: ownTools, cache: buildCacheFolder(row.repo, keyHome ?? homedir()) });
+        const fence = agentFence({ databaseFile, worktree, ...home, boundary, binding, runFolders: folders, extra: allowed?.deny ?? [] });
+        const grants = fenceGrants({ databaseFile, worktree, boundary, runFolders: folders, linked: linkedFor(store, worktree), binding, ...home, poolRoots });
         return {
-            fence: agentFence({ databaseFile, worktree, ...home, boundary, binding, runFolders: folders }),
+            fence,
             fileTools: boundary?.fileTools ?? [],
             // The shared install is granted only as the plane linked it: this checkout's project and stamped setup.
             // Every plane checkout pool is denied around this one: the plane's own beside the database, and the one this
             // checkout was recorded in (a --pool elsewhere), so another project's worktree, present at launch, is out of reach. Native wrappers also cover later creations.
-            grants: fenceGrants({ databaseFile, worktree, boundary, runFolders: folders, linked: linkedFor(store, worktree), binding, ...home,
-                poolRoots }),
+            grants: allowed === null ? grants : { ...grants, writes: allowed.writes, readOnly: [...new Set([...grants.readOnly, ...allowed.readOnly])].sort() },
             // The checkout's own Git data, which a private /tmp gives back beside the checkout (agent-fence.ts linuxFenced).
             gitPaths: binding === null ? [] : [binding.gitdir, join(binding.main, ".git")],
+            ...(allowed === null || row === null ? {} : { cache: buildCacheFolder(row.repo, keyHome ?? homedir()) }),
         };
     }
     catch (error) {
         return { fence: [], fileTools: [], grants: NO_GRANTS, problem: error instanceof CheckoutBindingError ? error.message : "The build fence could not be prepared." };
     }
 }
+/**
+ * A build's setup and check commands, run in its fence (arc 2): the same denies as its agent's (Toolroll's state,
+ * credentials, other projects and runs), its write allowlist when its approval sealed one (its checkout and Git data,
+ * its project's caches, and a temp folder of the command's own), and its package managers pointed at those caches.
+ * Their network stays as it was. A machine without an OS fence runs them as before; a fence that can't be prepared
+ * (a checkout whose binding no longer proves) runs nothing.
+ */
+export function fencedCommands(store, runId, writes, inner, available = () => macosFenceAvailable() || linuxFenceAvailable()) {
+    // An injected runner (tests) starts no real command, as an injected agent starts no real agent (invokeAgent).
+    if (inner !== runCommand)
+        return inner;
+    return async (file, args, options) => {
+        // As a build itself: where nothing can confine them, they run only when an instance operator allowed unconfined agents.
+        if (!available()) {
+            if (store.unfencedAgentsAllowed())
+                return inner(file, args, options);
+            return { code: 1, stdout: "", stderr: "This machine can't confine the build's commands (no macOS sandbox, no working bubblewrap), so they didn't run. Install bubblewrap, or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`.\n", timedOut: false, notFound: false };
+        }
+        const own = realpathSync(mkdtempSync(join(tmpdir(), "so-cmd-")));
+        try {
+            const temp = join(own, "tmp");
+            mkdirSync(temp, { mode: 0o700 });
+            const fenced = runFence(store, runId, "command", undefined, own, writes);
+            if (fenced.problem !== undefined)
+                return { code: 1, stdout: "", stderr: `${fenced.problem}\n`, timedOut: false, notFound: false };
+            if (fenced.fence.length === 0)
+                return inner(file, args, options);
+            // A self-hosted check's own database (child-database.ts) is the command's to write too.
+            const database = options?.env?.["TOOLROLL_DB"];
+            const checkData = database === undefined || fenced.grants.writes === undefined ? null : grantFolder(dirname(database), false);
+            const grants = checkData === null ? fenced.grants : { ...fenced.grants, writes: { ...fenced.grants.writes, subpaths: [...fenced.grants.writes.subpaths, checkData] } };
+            return await inner(file, args, {
+                ...options,
+                fence: fenced.fence,
+                fenceGrants: grants,
+                env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(fenced.cache === undefined || fenced.grants.writes === undefined ? {} : buildCacheEnv(fenced.cache)) },
+            });
+        }
+        finally {
+            rmSync(own, { recursive: true, force: true });
+        }
+    };
+}
+/**
+ * A project's checks run in a checkout of a result's commit made for them (result-follow-ups.ts, batch-checks.ts), in
+ * the same fence as a build's commands: Toolroll's state, credentials, other projects and runs denied; under the
+ * project's writes setting, only that checkout, its Git data, its own temp folder, the project's caches and its check
+ * database writable. Where nothing can confine them, they run only when an instance operator allowed unconfined agents.
+ */
+export function fencedCheckoutCommands(store, repo, checkout, inner, available = () => macosFenceAvailable() || linuxFenceAvailable()) {
+    if (inner !== runCommand)
+        return inner;
+    return async (file, args, options) => {
+        if (!available()) {
+            if (store.unfencedAgentsAllowed())
+                return inner(file, args, options);
+            return { code: 1, stdout: "", stderr: "This machine can't confine the project's checks (no macOS sandbox, no working bubblewrap), so they didn't run. Install bubblewrap, or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`.\n", timedOut: false, notFound: false };
+        }
+        const databaseFile = store.databaseFile();
+        if (databaseFile === null)
+            return inner(file, args, options);
+        const own = realpathSync(mkdtempSync(join(tmpdir(), "so-cmd-")));
+        try {
+            const temp = join(own, "tmp");
+            mkdirSync(temp, { mode: 0o700 });
+            let binding;
+            try {
+                binding = trustedWorktreeBinding(repo, checkout);
+            }
+            catch {
+                return { code: 1, stdout: "", stderr: "The check's checkout couldn't be bound to its project, so nothing ran.\n", timedOut: false, notFound: false };
+            }
+            const poolRoots = [join(dirname(databaseFile), "worktrees"), ...store.listWorktrees().map(record => poolRootOf(record.path, record.repo))];
+            const boundary = taskBoundary({ worktree: checkout, provider: "command", binding });
+            const folders = runFolders(own);
+            const cache = buildCacheFolder(repo);
+            const allowed = store.projectWrites(repo) !== "workspace" ? null : writeAllowlist({ provider: "command", home: homedir(), worktree: checkout, binding, launchFolder: own, cache });
+            const database = options?.env?.["TOOLROLL_DB"];
+            const checkData = allowed === null || database === undefined ? null : grantFolder(dirname(database), false);
+            const base = fenceGrants({ databaseFile, worktree: checkout, boundary, runFolders: folders, linked: linkedFor(store, checkout), binding, poolRoots });
+            const grants = allowed === null ? base
+                : { ...base, readOnly: [...new Set([...base.readOnly, ...allowed.readOnly])].sort(), writes: { ...allowed.writes, subpaths: [...allowed.writes.subpaths, ...(checkData === null ? [] : [checkData])] } };
+            return await inner(file, args, {
+                ...options,
+                fence: agentFence({ databaseFile, worktree: checkout, boundary, binding, runFolders: folders, extra: allowed?.deny ?? [] }),
+                fenceGrants: grants,
+                env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(allowed === null ? {} : buildCacheEnv(cache)) },
+            });
+        }
+        finally {
+            rmSync(own, { recursive: true, force: true });
+        }
+    };
+}
+/** What a build writes that a tool server must never run from: its checkout and its project's caches. A checkout with
+ * no record never gets this far: its fence refuses the launch (runFence) before any tool server can start. */
+function toolUntrusted(store, workspace, keyHome) {
+    const row = store.getWorktree(workspace);
+    return [workspace, ...(row === null ? [] : [buildCacheFolder(row.repo, keyHome ?? homedir())])];
+}
 /** The operator's own model choices a build routed with no model keeps (provider-home.ts). */
 function inheritedDefaults(provider, env, home) {
     if (provider === "claude")

package/dist/live-terminal.d.ts

@@ -6,8 +6,6 @@ export declare const MAX_LIVE_TERMINALS = 8;
 export declare const MAX_KEPT_TERMINALS = 16;
 /** At most this many pages attached to one session (a desktop, a phone, a spare tab or two). */
 export declare const MAX_VIEWERS = 4;
-/** Raw output kept per session for a page that attaches later. */
-export declare const SCROLLBACK_BYTES: number;
 /** After SIGHUP, the terminal's processes have this long before SIGKILL. */
 export declare const CLOSE_GRACE_MS = 2000;
 /** Typed input not yet read by the program, per terminal: past this, more is refused until it reads. */
@@ -54,15 +52,24 @@ export declare const ttyName: (path: unknown) => string | null;
 export declare function pendingInputOf(pty: unknown): number;
 /** node-pty, if this install has it (an optional dependency with prebuilt binaries); null when it doesn't load. */
 export declare function loadPtySpawn(): PtySpawn | null;
-/** Raw output, oldest dropped first, never more than `cap` bytes. */
-export declare class Scrollback {
-    private readonly cap;
-    private chunks;
-    private size;
-    constructor(cap?: number);
-    push(chunk: Buffer): void;
-    bytes(): Buffer;
-    get length(): number;
+/** How many lines above the screen a terminal keeps for a page that attaches later. */
+export declare const SCREEN_SCROLLBACK_LINES = 5000;
+/**
+ * The terminal as a page would see it now: every byte the program writes is parsed by a headless xterm here, so a page
+ * that attaches later gets the screen, its scrollback and its modes (the alternate screen of a full-screen program, the
+ * cursor, colours, bracketed paste, mouse reporting) — never a replay of raw output cut at an arbitrary byte, which
+ * could split an escape sequence or redraw a full-screen program garbled.
+ */
+export declare class ScreenMirror {
+    private readonly lines;
+    private readonly terminal;
+    private readonly serializer;
+    constructor(cols: number, rows: number, lines?: number);
+    write(data: string): void;
+    resize(cols: number, rows: number): void;
+    /** The screen as of this call (after everything written before it), handed to `done` once parsed. */
+    snapshot(done: (screen: string) => void): void;
+    dispose(): void;
 }
 /** One attached page. The host never waits on it. */
 export type TerminalViewer = {
@@ -138,7 +145,8 @@ export type TerminalHostOptions = {
     /** Start, close and remove, for the event log (never input or output). */
     record?: (event: "start" | "close" | "remove" | "exit", session: TerminalSummary) => void;
     maxSessions?: number;
-    scrollbackBytes?: number;
+    /** Lines above the screen a terminal keeps for a page that attaches later (SCREEN_SCROLLBACK_LINES). */
+    scrollbackLines?: number;
     closeGraceMs?: number;
     ledger?: TerminalLedger;
     /** The process table (tests stand a failing one in); null when it can't be read. */
@@ -175,7 +183,10 @@ export declare class TerminalHost {
         cols: number;
         rows: number;
     }, admit?: () => string | null): Promise<TerminalSummary>;
-    /** Attach a page: it gets the scrollback, then `hello`, then live output. Returns its detach. */
+    /**
+     * Attach a page: it gets the screen as it is now (ScreenMirror), then `hello`, then live output — what the program
+     * writes meanwhile is held and sent after the screen, in order. Returns its detach.
+     */
     attach(id: string, viewer: TerminalViewer): () => void;
     /** How many pages are attached now. */
     viewerCount(id: string): number;