toolroll 0.9.65 → 0.9.67

package/dist/store.d.ts

@@ -1,3 +1,4 @@
+import { type WritesMode } from "./writes-mode.js";
 import { type ProjectNetwork, type RunNetworkRecord } from "./egress.js";
 import { type AcpLaunch } from "./acp-attest.js";
 import { type ChatBinding } from "./chat-core.js";
@@ -178,7 +179,7 @@ export type SealedLedgerEntry = LedgerEntry & {
         hash: string;
     } | null;
 };
-export declare const SCHEMA_VERSION = 130;
+export declare const SCHEMA_VERSION = 131;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export declare const V118_MERGED_TABLES: Readonly<Record<string, CredentialKind>>;
 /**
@@ -315,6 +316,8 @@ export declare const V129_ADDED_COLUMNS: Readonly<Record<string, Readonly<Record
 /** v130: a project's network (an approver's setting, egress.ts ProjectNetwork as JSON) and the installation's choice
  * whether an agent may run where no OS confinement exists (one row; 0 until an instance operator turns it on). */
 export declare const CONFINEMENT_SCHEMA = "\nCREATE TABLE IF NOT EXISTS project_network (\n  repo          TEXT PRIMARY KEY,\n  network_json  TEXT NOT NULL CHECK (length(network_json) <= 16384),\n  updated_at    TEXT NOT NULL,\n  updated_by    TEXT NOT NULL\n);\nCREATE TABLE IF NOT EXISTS confinement_setting (\n  id               INTEGER PRIMARY KEY CHECK (id = 1),\n  unfenced_allowed INTEGER NOT NULL DEFAULT 0 CHECK (unfenced_allowed IN (0, 1)),\n  updated_at       TEXT,\n  updated_by       TEXT\n);\nINSERT OR IGNORE INTO confinement_setting (id, unfenced_allowed) VALUES (1, 0);\n";
+/** v131: where a project's builds may write (an approver's setting, agent-fence.ts WritesMode). */
+export declare const PROJECT_WRITES_SCHEMA = "\nCREATE TABLE IF NOT EXISTS project_writes (\n  repo        TEXT PRIMARY KEY,\n  mode        TEXT NOT NULL CHECK (mode IN ('workspace', 'anywhere')),\n  updated_at  TEXT NOT NULL,\n  updated_by  TEXT NOT NULL\n);\n";
 /** v129: a finished run's How it ran, derived from its own records on first view (display only: never a verdict). Its
  * parser version says when to derive again; `steps` says how complete the step detail was, and why not. */
 export declare const RUN_EFFICIENCY_SCHEMA = "\nCREATE TABLE IF NOT EXISTS run_efficiency (\n  run             INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,\n  parser_version  INTEGER NOT NULL,\n  steps           TEXT NOT NULL CHECK (steps IN ('complete','truncated','expired','absent')),\n  steps_reason    TEXT,\n  payload_json    TEXT NOT NULL CHECK (length(payload_json) <= 16384),\n  derived_at      TEXT NOT NULL\n);\n";
@@ -6884,6 +6887,13 @@ export declare class Store {
         before: ProjectNetwork;
         after: ProjectNetwork;
     };
+    /** Where a project's builds may write (agent-fence.ts): its saved setting, or only their workspace. */
+    projectWrites(repo: string): WritesMode;
+    /** An approver changed where a project's builds may write: saved, and in the ledger as before → after. */
+    setProjectWrites(repo: string, mode: WritesMode, by: string, now: Date): {
+        before: WritesMode;
+        after: WritesMode;
+    };
     /** Whether this installation lets an agent run where no OS confinement exists (off unless an operator said so). */
     unfencedAgentsAllowed(): boolean;
     setUnfencedAgentsAllowed(allowed: boolean, by: string, now: Date): void;

package/dist/store.js

@@ -1,3 +1,4 @@
+import { WRITES_DEFAULT } from "./writes-mode.js";
 import { PROJECT_NETWORK_DEFAULT, projectNetworkFromValue, runNetworkFromValue } from "./egress.js";
 import { isAcpProfile, isAcpProvider } from "./acp-agents.js";
 import { ACP_CONFORMANCE_VERSION, launchFromJson } from "./acp-attest.js";
@@ -715,7 +716,9 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // v130 adds, and changes no saved row: what a project's builds may reach on the network (project_network; egress.ts,
 // docs/plans/agent-baseline-hardening.md arc 1) and whether this installation lets an agent run with no OS confinement
 // (confinement_setting, one row; off unless an instance operator turns it on).
-export const SCHEMA_VERSION = 130;
+// v131 adds, and changes no saved row: where a project's builds may write (project_writes; agent-fence.ts, docs/plans/
+// agent-baseline-hardening.md arc 2) — only their workspace unless an approver chose anywhere.
+export const SCHEMA_VERSION = 131;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -848,7 +851,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -976,6 +979,15 @@ CREATE TABLE IF NOT EXISTS confinement_setting (
 );
 INSERT OR IGNORE INTO confinement_setting (id, unfenced_allowed) VALUES (1, 0);
 `;
+/** v131: where a project's builds may write (an approver's setting, agent-fence.ts WritesMode). */
+export const PROJECT_WRITES_SCHEMA = `
+CREATE TABLE IF NOT EXISTS project_writes (
+  repo        TEXT PRIMARY KEY,
+  mode        TEXT NOT NULL CHECK (mode IN ('workspace', 'anywhere')),
+  updated_at  TEXT NOT NULL,
+  updated_by  TEXT NOT NULL
+);
+`;
 /** v129: a finished run's How it ran, derived from its own records on first view (display only: never a verdict). Its
  * parser version says when to derive again; `steps` says how complete the step detail was, and why not. */
 export const RUN_EFFICIENCY_SCHEMA = `
@@ -3915,6 +3927,8 @@ function initializeStore(db, file) {
     db.exec(RUN_EFFICIENCY_SCHEMA);
     // v130: a project's network and whether an agent may run unconfined (new tables only).
     db.exec(CONFINEMENT_SCHEMA);
+    // v131: where a project's builds may write (a new table only).
+    db.exec(PROJECT_WRITES_SCHEMA);
     // v123: a flow that runs on its own (flow-unattended.ts): its grants and daily runs (new tables), and which authority
     // armed a plan's unchanged-plan approval (plan_authorization.basis, V123_ADDED_COLUMNS: saved rows read the mode).
     db.exec(FLOW_UNATTENDED_SCHEMA);
@@ -18246,6 +18260,23 @@ export class Store {
             return { before, after };
         });
     }
+    /** Where a project's builds may write (agent-fence.ts): its saved setting, or only their workspace. */
+    projectWrites(repo) {
+        const mode = this.db.prepare("SELECT mode FROM project_writes WHERE repo = ?").get(repo)?.["mode"];
+        // A damaged row reads as the narrower setting, never the wider one.
+        return mode === "anywhere" ? "anywhere" : WRITES_DEFAULT;
+    }
+    /** An approver changed where a project's builds may write: saved, and in the ledger as before → after. */
+    setProjectWrites(repo, mode, by, now) {
+        return this.transact(() => {
+            const before = this.projectWrites(repo);
+            this.db.prepare(`INSERT INTO project_writes (repo, mode, updated_at, updated_by) VALUES (?, ?, ?, ?)
+        ON CONFLICT (repo) DO UPDATE SET mode = excluded.mode, updated_at = excluded.updated_at, updated_by = excluded.updated_by`).run(repo, mode, now.toISOString(), by);
+            const after = this.projectWrites(repo);
+            this.recordPolicy(by, repo, "build writes", before, after, now);
+            return { before, after };
+        });
+    }
     /** Whether this installation lets an agent run where no OS confinement exists (off unless an operator said so). */
     unfencedAgentsAllowed() {
         return Number(this.db.prepare("SELECT unfenced_allowed FROM confinement_setting WHERE id = 1").get()?.["unfenced_allowed"] ?? 0) === 1;

package/dist/teardown-git.d.ts

@@ -8,7 +8,29 @@ export declare const REFUSED_CODE = 128;
 /** The command-running setting a `git config --list --show-scope -z` listing sets, or null. Only local and worktree
  * scope count: teardown commands never read system or global config. */
 export declare function commandSetting(listing: string): string | null;
+/** The `-c` settings that carry the operator's own values (CARRIED_VALUES, LFS_FILTER) from a global/system listing. */
+export declare function carriedSettings(listing: string): string[];
 /** Why a teardown command was refused, or null when `result` isn't a refusal. */
 export declare function refusal(result: ExecResult): string | null;
 /** The one way teardown runs git, including the target checkout immediately before removal. */
 export declare function teardownGit(runner?: Runner): Git;
+/**
+ * Git on a build's checkout, as the plane runs it outside every fence (staging, committing and inspecting the build's
+ * work): the same fixed hardening as teardown (no hooks, fsmonitor, ext transport, credential helpers or automatic
+ * maintenance, no submodule recursion, no signing), refused outright when the checkout's own config includes a file
+ * or names a command — a filter, an external diff, a textconv, a pager — which a build could have planted. It reads no
+ * global or system config: only their values (identity, line endings, a standard git-lfs install) are carried over.
+ * It never enters a submodule or nested repository (whose config it never read).
+ */
+/**
+ * Whether a checkout's own git config (its repository's config and its worktree's config.worktree) includes another
+ * file, read without git: every git command follows includes as it starts, so an include of the build's could point
+ * git at any file, a pipe that never ends among them. Each file is read only as the regular file it is, bounded; one
+ * that can't be read so counts as including.
+ */
+export declare function checkoutIncludes(checkout: string): boolean;
+/** Whether the checkout's .lfsconfig (read as git parses it, that file only) sets any git-lfs key that could name a
+ * program (anything but INERT_LFS). A file that
+ * isn't a plain one, or doesn't parse, counts as naming one. */
+export declare function lfsExtensionIn(checkout: string): boolean;
+export declare function checkoutGit(inner?: Runner): Runner;

package/dist/teardown-git.js

@@ -10,7 +10,8 @@
  * any of them the command never runs. The refusal is a failed git result, so every caller's existing doubt applies and
  * nothing is removed.
  */
-import { existsSync, readdirSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { existsSync, lstatSync, readdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { run } from "./exec.js";
 import { ENV, ENV_ALLOWLIST } from "./remote-main.js";
@@ -31,6 +32,10 @@ const COMMAND_KEYS = [
     "diff.*.command", "diff.*.textconv", "merge.*.driver", "gpg.program", "gpg.*.program", "uploadpack.packobjectshook",
     "remote.*.uploadpack", "remote.*.receivepack", "remote.*.vcs", "pager.*", "include.path", "includeif.*.path",
 ].map(key => new RegExp(`^${key.replace(/\./g, "\\.").replace(/\*/g, ".+")}$`));
+/** git-lfs settings that name no program (where it fetches, what, whether it checks locks, how it signs in); any other
+ * `lfs.*` key in a checkout's own config could (extensions, custom and standalone transfer agents), so it's refused. */
+const INERT_LFS = /^lfs\.(url|pushurl|fetchinclude|fetchexclude|locksverify|repositoryformatversion|.+\.access|.+\.locksverify|setlockablereadonly|skipdownloaderrors|concurrenttransfers)$/;
+const lfsCommand = (key) => key.startsWith("lfs.") && !INERT_LFS.test(key);
 /** core.fsmonitor as a boolean is git's own daemon; anything else is a command to run. */
 const BOOLEAN = /^(|true|false|yes|no|on|off|-?\d+)$/i;
 /** The command-running setting a `git config --list --show-scope -z` listing sets, or null. Only local and worktree
@@ -45,11 +50,40 @@ export function commandSetting(listing) {
         const newline = entry.indexOf("\n");
         const key = (newline < 0 ? entry : entry.slice(0, newline)).toLowerCase();
         const value = newline < 0 ? "" : entry.slice(newline + 1);
-        if (key === "core.fsmonitor" ? !BOOLEAN.test(value.trim()) : COMMAND_KEYS.some(pattern => pattern.test(key)))
+        if (key === "core.fsmonitor" ? !BOOLEAN.test(value.trim()) : COMMAND_KEYS.some(pattern => pattern.test(key)) || lfsCommand(key))
             return key;
     }
     return null;
 }
+/**
+ * What the plane's git on a build's checkout keeps of the operator's own (global and system) configuration: values,
+ * never commands — identity, line endings, ignore and case settings — and git-lfs's filters only as git-lfs itself
+ * installs them, exactly. Everything else there (filters, diff drivers, fsmonitor, signing and its key commands,
+ * whatever an include brings in) is left out, so nothing in it can run a file of the checkout's.
+ */
+const CARRIED_VALUES = new Set(["user.name", "user.email", "core.autocrlf", "core.eol", "core.safecrlf", "core.excludesfile", "core.ignorecase",
+    "core.precomposeunicode", "core.quotepath", "core.filemode", "core.symlinks", "core.longpaths"]);
+const LFS_FILTER = {
+    "filter.lfs.clean": "git-lfs clean -- %f", "filter.lfs.smudge": "git-lfs smudge -- %f", "filter.lfs.process": "git-lfs filter-process", "filter.lfs.required": "true",
+};
+/** The `-c` settings that carry the operator's own values (CARRIED_VALUES, LFS_FILTER) from a global/system listing. */
+export function carriedSettings(listing) {
+    const fields = listing.split("\0");
+    const carried = new Map();
+    for (let at = 0; at + 1 < fields.length; at += 2) {
+        if (fields[at] !== "global" && fields[at] !== "system")
+            continue;
+        const entry = fields[at + 1];
+        const newline = entry.indexOf("\n");
+        if (newline < 0)
+            continue;
+        const key = entry.slice(0, newline).toLowerCase();
+        const value = entry.slice(newline + 1);
+        if (CARRIED_VALUES.has(key) || LFS_FILTER[key] === value)
+            carried.set(key, value);
+    }
+    return [...carried].flatMap(([key, value]) => ["-c", `${key}=${value}`]);
+}
 /** Why a teardown command was refused, or null when `result` isn't a refusal. */
 export function refusal(result) {
     return result.code === REFUSED_CODE && result.stderr.startsWith(REFUSED_PREFIX) ? result.stderr.slice(REFUSED_PREFIX.length).trim() : null;
@@ -117,3 +151,103 @@ export function teardownGit(runner = run) {
         return runner("git", [...TEARDOWN_FLAGS, ...safeArgs], options(cwd));
     };
 }
+/**
+ * Git on a build's checkout, as the plane runs it outside every fence (staging, committing and inspecting the build's
+ * work): the same fixed hardening as teardown (no hooks, fsmonitor, ext transport, credential helpers or automatic
+ * maintenance, no submodule recursion, no signing), refused outright when the checkout's own config includes a file
+ * or names a command — a filter, an external diff, a textconv, a pager — which a build could have planted. It reads no
+ * global or system config: only their values (identity, line endings, a standard git-lfs install) are carried over.
+ * It never enters a submodule or nested repository (whose config it never read).
+ */
+/**
+ * Whether a checkout's own git config (its repository's config and its worktree's config.worktree) includes another
+ * file, read without git: every git command follows includes as it starts, so an include of the build's could point
+ * git at any file, a pipe that never ends among them. Each file is read only as the regular file it is, bounded; one
+ * that can't be read so counts as including.
+ */
+export function checkoutIncludes(checkout) {
+    const regular = (path) => {
+        try {
+            const held = lstatSync(path);
+            if (!held.isFile() || held.size > 1024 * 1024)
+                return null;
+            return readFileSync(path, "utf8");
+        }
+        catch {
+            return null;
+        }
+    };
+    let gitdir = join(checkout, ".git");
+    try {
+        if (!lstatSync(gitdir).isDirectory()) {
+            // As git reads a .git file: "gitdir: " then the path, one line; anything else (more lines, stray space) refused.
+            const text = (regular(gitdir) ?? "").replace(/\r?\n$/, "");
+            if (!text.startsWith("gitdir: ") || /[\r\n]/.test(text))
+                return true;
+            const pointer = text.slice("gitdir: ".length);
+            if (pointer === "" || pointer !== pointer.trim())
+                return true;
+            gitdir = resolve(checkout, pointer);
+        }
+    }
+    catch {
+        return true;
+    }
+    const common = (() => { const named = regular(join(gitdir, "commondir"))?.trim(); return named === undefined || named === "" ? gitdir : resolve(gitdir, named); })();
+    for (const path of [join(common, "config"), join(gitdir, "config.worktree")]) {
+        if (!existsSync(path) && path.endsWith("config.worktree"))
+            continue;
+        const text = regular(path);
+        if (text === null || /^\s*\[\s*include(if)?\b/im.test(text))
+            return true;
+        // And as git itself parses it, includes not followed (only this one regular file, from a neutral folder, with no
+        // other config read): an include git sees by any spelling is refused.
+        const parsed = spawnSync("git", ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
+        if (parsed.status !== 0 || parsed.stdout.split("\0").some(name => /^(include\.path|includeif\..*\.path)$/i.test(name)))
+            return true;
+    }
+    return false;
+}
+/** Whether the checkout's .lfsconfig (read as git parses it, that file only) sets any git-lfs key that could name a
+ * program (anything but INERT_LFS). A file that
+ * isn't a plain one, or doesn't parse, counts as naming one. */
+export function lfsExtensionIn(checkout) {
+    const path = join(checkout, ".lfsconfig");
+    try {
+        if (!lstatSync(path).isFile())
+            return true;
+    }
+    catch {
+        return false;
+    }
+    const parsed = spawnSync("git", ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
+    return parsed.status !== 0 || parsed.stdout.split("\0").filter(Boolean).some(name => lfsCommand(name.toLowerCase()) || /^include(if)?\./i.test(name));
+}
+export function checkoutGit(inner = run) {
+    return async (file, args, options) => {
+        if (file !== "git")
+            return inner(file, args, options);
+        const cwd = options?.cwd;
+        if (cwd === undefined || checkoutIncludes(cwd))
+            return refused("the checkout's git config includes another file, or couldn't be read as a plain file");
+        // git-lfs also reads .lfsconfig from the checkout: one that names an extension (a command it would run) is refused.
+        if (lfsExtensionIn(cwd))
+            return refused("the checkout's .lfsconfig sets a git-lfs key that can run a command");
+        // The checkout's own config may name no command.
+        const own = await inner("git", ["--no-optional-locks", "config", "--list", "--show-scope", "-z"], options);
+        if (own.code !== 0)
+            return refused("its config couldn't be read");
+        const key = commandSetting(own.stdout);
+        if (key !== null)
+            return refused(`the checkout's git config sets ${key}, which can run a command`);
+        // The operator's own config contributes values only (carriedSettings); git then reads no global or system config.
+        const carried = carriedSettings(own.stdout);
+        const env = { ...(options?.env ?? {}), GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null" };
+        // Never into a submodule or nested repository, whose own config this never read: status and diff skip them.
+        const safeArgs = [...args];
+        const command = safeArgs.findIndex(arg => arg === "status" || arg === "diff");
+        if (command >= 0 && !safeArgs.includes("--ignore-submodules=all"))
+            safeArgs.splice(command + 1, 0, "--ignore-submodules=all");
+        return inner("git", [...TEARDOWN_FLAGS, "-c", "diff.ignoreSubmodules=all", "-c", "commit.gpgsign=false", "-c", "tag.gpgsign=false", ...carried, ...safeArgs], { ...options, env });
+    };
+}

package/dist/tool-broker.d.ts

@@ -11,7 +11,13 @@ export type BrokerOptions = {
     omitEnv?: readonly string[];
     /** Toolroll's own settings for a local server (the run's isolated database), passed as they are. */
     pass?: Readonly<Record<string, string>>;
+    /** Where a local server starts: a folder the build can't write (never its checkout). */
     cwd?: string;
+    /** Folders the build writes (its checkout, its caches): a server whose command, or a path it's given, resolves inside
+     * one is never started, since it would run the build's own bytes outside the build's limits. */
+    untrusted?: readonly string[];
+    /** Why a local server may not start unwrapped (no fence for it here), read when it would; null when it may. */
+    unwrapped?: () => string | null;
     /** How a local server is started inside its run's fence, read when it starts (the fence is fixed after the tools). */
     wrap?: () => ((file: string, args: readonly string[]) => {
         file: string;
@@ -35,5 +41,11 @@ export declare const SERVER_ENV: readonly string[];
 /** A local server's environment: the allowlisted names from `base` (and its LC_* locale), less `omit`, then `pass`,
  * then the tool's own values. */
 export declare function serverEnv(base: NodeJS.ProcessEnv, omit: readonly string[], pass: Readonly<Record<string, string>>, values: Readonly<Record<string, string>>): NodeJS.ProcessEnv;
+/**
+ * The first of a server's command and path-like arguments that resolves inside an untrusted folder (a build's checkout
+ * or caches), or null. The command is resolved as spawn would: a path against `cwd`, a bare name through PATH; an
+ * argument counts when it names an existing path (relative to `cwd`) or is written as one (`./x`, `../x`, `/x`).
+ */
+export declare function workspaceBytes(command: string, args: readonly string[], cwd: string | undefined, path: string | undefined, untrusted: readonly string[]): string | null;
 /** Start one launch's broker on a loopback port. */
 export declare function startToolBroker(tools: readonly BrokeredTool[], options?: BrokerOptions): Promise<ToolBroker>;

package/dist/tool-broker.js

@@ -20,6 +20,8 @@
 import { spawn } from "node:child_process";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
+import { accessSync, constants, existsSync, realpathSync } from "node:fs";
+import { delimiter, isAbsolute, resolve, sep } from "node:path";
 const BODY_LIMIT = 4 * 1024 * 1024;
 const ANSWER_LIMIT = 32 * 1024 * 1024;
 const STOP_GRACE_MS = 2_000;
@@ -59,6 +61,54 @@ export function serverEnv(base, omit, pass, values) {
         delete env[name];
     return Object.assign(env, pass, values);
 }
+/**
+ * The first of a server's command and path-like arguments that resolves inside an untrusted folder (a build's checkout
+ * or caches), or null. The command is resolved as spawn would: a path against `cwd`, a bare name through PATH; an
+ * argument counts when it names an existing path (relative to `cwd`) or is written as one (`./x`, `../x`, `/x`).
+ */
+export function workspaceBytes(command, args, cwd, path, untrusted) {
+    if (untrusted.length === 0)
+        return null;
+    const base = cwd ?? process.cwd();
+    // Canonical on-disk names, folded where the filesystem ignores case (macOS, Windows), so `/Users/a/CHECKOUT` is the checkout.
+    const fold = process.platform === "darwin" || process.platform === "win32" ? (one) => one.toLowerCase() : (one) => one;
+    const real = (one) => { try {
+        return fold(realpathSync.native(one));
+    }
+    catch {
+        return fold(resolve(one));
+    } };
+    const roots = untrusted.map(real);
+    const within = (one) => { const at = real(one); return roots.some(root => at === root || at.startsWith(`${root}${sep}`)); };
+    // A root's name anywhere in an argument (inline code, a list of paths) counts, however it's spelled.
+    const mentions = (arg) => { const text = fold(arg); return roots.some(root => text.includes(root)) || untrusted.some(root => text.includes(fold(root))); };
+    const located = command.includes("/") || command.includes(sep) ? resolve(base, command)
+        : (path ?? "").split(delimiter).filter(Boolean).map(dir => resolve(base, dir, command)).find(one => { try {
+            accessSync(one, constants.X_OK);
+            return true;
+        }
+        catch {
+            return false;
+        } }) ?? null;
+    if (located !== null && within(located))
+        return located;
+    // A relative path once meant "in the checkout" (servers started there): it is refused rather than read elsewhere.
+    if (!isAbsolute(command) && (command.includes("/") || command.includes(sep)))
+        return `${command} (a relative path)`;
+    for (const arg of args) {
+        if (mentions(arg))
+            return `${arg} (names what this build writes)`;
+        // A flag's value (`--config=x`, `-c=x`) is checked as its own argument.
+        for (const piece of [arg, ...(arg.startsWith("-") && arg.includes("=") ? [arg.slice(arg.indexOf("=") + 1)] : [])]) {
+            if (piece.startsWith("./") || piece.startsWith("../"))
+                return `${piece} (a relative path)`;
+            const candidate = resolve(base, piece);
+            if ((isAbsolute(piece) || existsSync(candidate)) && within(candidate))
+                return candidate;
+        }
+    }
+    return null;
+}
 /** A local server, started on first use and spoken to over its stdin and stdout. */
 class LocalServer {
     tool;
@@ -68,6 +118,7 @@ class LocalServer {
     buffer = "";
     next = 1;
     pending = new Map();
+    refusal = null;
     constructor(tool, options) {
         this.tool = tool;
         this.options = options;
@@ -75,7 +126,19 @@ class LocalServer {
     pid() { return this.child?.pid ?? null; }
     start() {
         const env = serverEnv(this.options.env ?? process.env, this.options.omitEnv ?? [], this.options.pass ?? {}, this.tool.values);
+        const planted = workspaceBytes(this.tool.spec.command, this.tool.spec.args, this.options.cwd, env["PATH"], this.options.untrusted ?? []);
+        if (planted !== null) {
+            this.refusal = `The tool's server would run ${planted}, inside what this build can write, so it was not started.`;
+            return null;
+        }
         const wrap = this.options.wrap?.() ?? null;
+        if (wrap === null) {
+            const why = this.options.unwrapped?.() ?? null;
+            if (why !== null) {
+                this.refusal = why;
+                return null;
+            }
+        }
         const { file, args } = wrap === null ? { file: this.tool.spec.command, args: [...this.tool.spec.args] } : wrap(this.tool.spec.command, this.tool.spec.args);
         const child = spawn(file, args, { env, ...(this.options.cwd === undefined ? {} : { cwd: this.options.cwd }), stdio: ["pipe", "pipe", "ignore"], detached: process.platform !== "win32" });
         this.child = child;
@@ -131,8 +194,9 @@ class LocalServer {
         // A new session (a reconnect) starts a fresh server: a server answers initialize once.
         if (message.method === "initialize" && this.initialized)
             this.stop();
-        if (this.child === null)
-            this.start();
+        if (this.child === null && this.start() === null) {
+            return Promise.resolve(isRequest(message) ? rpcError(message.id, this.refusal ?? "The tool could not start.") : null);
+        }
         if (message.method === "initialize")
             this.initialized = true;
         if (!isRequest(message)) {

package/dist/unfenced-test-support.d.ts

@@ -0,0 +1,2 @@
+import type { Store } from "./store.js";
+export declare function allowWhereUnfenced<T extends Store>(store: T): T;

package/dist/unfenced-test-support.js

@@ -0,0 +1,11 @@
+/**
+ * Tests that run real commands on a machine with no OS fence (CI's Ubuntu runners, where unprivileged namespaces are
+ * off) allow unconfined agents on their own store, as an instance operator there would; anywhere a fence exists,
+ * nothing changes and the fence is what the test runs under.
+ */
+import { linuxFenceAvailable, macosFenceAvailable } from "./agent-fence.js";
+export function allowWhereUnfenced(store) {
+    if (!macosFenceAvailable() && !linuxFenceAvailable())
+        store.setUnfencedAgentsAllowed(true, "test", new Date(0));
+    return store;
+}

package/dist/writes-mode.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Where a build may write (docs/plans/agent-baseline-hardening.md arc 2). `workspace`: only its allowlist (agent-fence.ts
+ * WriteAllowlist), whatever its permission mode; `anywhere`: anywhere its fence doesn't deny, as builds did before.
+ */
+export type WritesMode = "workspace" | "anywhere";
+export declare const WRITES_DEFAULT: WritesMode;
+export declare const isWritesMode: (value: unknown) => value is WritesMode;
+/** What an approval card and the CLI say of where a build may write (absent: sealed before write allowlists). */
+export declare function writesWords(writes: WritesMode | undefined): string;

package/dist/writes-mode.js

@@ -0,0 +1,8 @@
+export const WRITES_DEFAULT = "workspace";
+export const isWritesMode = (value) => value === "workspace" || value === "anywhere";
+/** What an approval card and the CLI say of where a build may write (absent: sealed before write allowlists). */
+export function writesWords(writes) {
+    return writes === "workspace" ? "only its checkout, its caches and its temp folder"
+        : writes === "anywhere" ? "anywhere outside Toolroll's fenced folders (an approver's choice)"
+            : "anywhere outside Toolroll's fenced folders (approved before write limits)";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.65",
+  "version": "0.9.67",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"
@@ -84,6 +84,8 @@
     "@types/react-dom": "19.3.0",
     "@types/ws": "8.18.2",
     "@xterm/addon-fit": "0.11.0",
+    "@xterm/addon-unicode11": "0.9.0",
+    "@xterm/addon-webgl": "0.19.0",
     "@xterm/xterm": "6.0.0",
     "@xyflow/react": "12.12.0",
     "class-variance-authority": "0.7.1",
@@ -124,6 +126,8 @@
   },
   "dependencies": {
     "@slack/socket-mode": "3.1.0",
+    "@xterm/addon-serialize": "0.14.0",
+    "@xterm/headless": "6.0.0",
     "discord.js": "14.27.0",
     "imapflow": "2.2.5",
     "mailparser": "3.9.36",