toolroll 0.9.65 → 0.9.68

package/CHANGELOG.md

@@ -1,5 +1,98 @@
 # Changelog
 
+## 0.9.68 — 2026-10-23
+
+- **The lead chat is redesigned.** Your messages sit in grey bubbles and the
+  lead's replies read as plain text, with code blocks. Its work folds into one
+  "Worked …" line, live steps show a spinner and then a check, and anything
+  waiting on you carries a "Needs you" chip. The message box is one row that
+  grows as you type, with a send arrow (Queue while a reply runs).
+- **Comment on a line of a change.** In a result's Changes tab, a pin on any
+  line opens a one-line comment. Enter sends it to the lead as its next
+  message, naming the file, line and run and quoting the line. The thread
+  shows it as a reference, the quoted line, and your words. On a phone the
+  result opens as a sheet over the chat.
+- **A fenced check can build bundles from the shared dependencies.** On a Mac
+  the sandbox let a build look up the linked copy's folder but not list it,
+  so esbuild couldn't find node_modules ("could not resolve react"). That one
+  folder may now be listed; nothing in it is readable beyond node_modules.
+  The console's own browser build also resolves through the checkout's links.
+- The release check passes inside the plane's macOS check sandbox: tests that
+  need to create a sandbox or watch other processes skip there and still run
+  in CI, and the browser journeys' throwaway planes run their agents inside
+  the check's own sandbox.
+- A Claude build no longer refuses to start when a sandbox around Toolroll
+  hides your Claude settings file: it signs in from the keychain as before,
+  and a sign-in that needed the file still fails quickly and says so.
+- The test suite reads its own home and temp folders, never yours, so it runs
+  the same on your machine and inside a check's sandbox. Tests that need a
+  socket path shorter than any folder the sandbox allows, and the one browser
+  journey that resumes a saved Claude session, skip inside the sandbox and
+  still run in CI.
+- `toolroll release` no longer stops at merge when GitHub has already deleted
+  the merged branch: it looks a few times, 2 seconds apart, before calling the
+  delete a failure (0.9.66 and 0.9.67 both stopped there).
+- Leaner code, with every feature kept (about 5,600 fewer lines). The
+  deprecated team and native session commands are gone, and `chat` and
+  `brief` without `--local` refuse when a central profile is saved.
+
+## 0.9.67 — 2026-10-23
+
+- **A project's checks read their own dependencies again.** 0.9.66 began
+  running checks in a fenced checkout but left out the grant for the shared
+  install the checkout links, so any check that loaded a package failed
+  ("could not resolve"). The linked copy is readable again; others stay fenced.
+- **Builds that write only their workspace resolve host names again on a
+  Mac.** 0.9.66 denied every unix socket to such a build, including the
+  system's DNS service, so with an open network nothing resolved (npm, git,
+  any fetch failed with "could not resolve host"). The DNS socket is allowed;
+  every other socket stays denied.
+- 0.9.66 as released to the console, published: its macOS check failed on a
+  test whose socket path outgrew macOS's 104-byte limit in the runner's temp
+  folder. The test now makes its sockets under /tmp. The browser journeys'
+  model stand-ins also keep their call journal where a workspace-only build
+  may write, so the release check runs them under the default sandbox.
+- `toolroll project network` takes `--open` and `--allowlist` again, and
+  reads `--remove <hosts>` and `--local any|none` as values: the shared flag
+  parser had refused the first two and read the others as switches.
+
+## 0.9.66 — 2026-10-22 (tagged, not published)
+
+- **The board is live to watch.** A strip of workers sits above the lanes:
+  what each is building on this board, its stage and a running clock (or
+  offline, or no build here). A card that changes lane slides there, a new one
+  drops in, and a worker that picks up work lights up once — all off under
+  reduced motion. Building cards show three quiet steps (setting up, writing,
+  checking and committing) from the run's own phase, never a percent. On a phone
+  the lane sections now use the full width.
+- **Builds write only their workspace.** A new per-project setting (Settings →
+  Project → Where builds write, `toolroll project writes`), sealed into each
+  approval: by default a build writes only its checkout and commit data, the
+  project's package caches, its temp folder and its agent's session files —
+  never your shell profile, login items, agent settings or the repository's Git
+  config and hooks. `anywhere` keeps the old behaviour; approvals from before
+  keep it too. Enforced by Seatbelt, bubblewrap and Codex's own profile.
+- **Setup and check commands run in the build's fence**, with their own temp
+  folder and the project's caches.
+- **The plane's Git on a build's checkout runs hardened** (no hooks, fsmonitor
+  or submodules) and refuses a checkout whose config names a command.
+- **Tool servers start outside the checkout** and never run a file the build
+  wrote.
+- **A live terminal comes back as its screen.** The server keeps each
+  terminal's screen (a headless xterm), so a page that reconnects gets the
+  screen, its last 5,000 lines and its modes — a full-screen program like
+  Claude Code or Codex redraws whole, never from a raw replay cut mid-sequence.
+- **Terminals draw on the GPU** where the browser allows (falling back when it
+  doesn't), with Unicode 11 widths for emoji and wide characters.
+- **`toolroll release` finishes when GitHub deletes the merged branch
+  itself.** A delete that fails because the branch is already gone counts as
+  done; one that fails while the branch is still there still stops.
+- **`toolroll release` merges a Homebrew tap that runs no checks on a
+  change.** It no longer waits out its time limit for checks that will never
+  come. Any check run or commit status that does appear is still judged (each
+  app on its own), and a tap whose workflows run on pull requests still needs
+  its own GitHub Actions run to pass.
+
 ## 0.9.65 — 2026-10-22
 
 0.9.64 was tagged but never published: a macOS check failed on Node 24.

package/README.md

@@ -581,8 +581,26 @@ and launch tools remain available.
 
 | | Auto | Full access |
 |---|---|---|
-| **Codex / OpenRouter** (any OS) | Codex's workspace sandbox (workspace writes, no network) with the fence | Codex's sandbox widened to write anywhere, with the fence; its commands reach the network only when the project's network is open |
-| **Claude, Gemini, ACP agents** | macOS: the agent runs inside a Seatbelt sandbox that denies the fence. Linux: inside bubblewrap. Neither (Windows, or Linux without bubblewrap): the build doesn't start, unless an instance operator allows unconfined agents | same |
+| **Codex / OpenRouter** (any OS) | Codex's sandbox with the fence: writes only the checkout, its Git data and the project's caches (anywhere outside the fence, under a project set to write anywhere); no network | the same writes, with the fence; its commands reach the network only when the project's network is open |
+| **Claude, Gemini, ACP agents** | macOS: inside a Seatbelt sandbox that denies the fence and writes only the checkout, its Git data, the project's caches, the run's temp folder and the agent's own session files. Linux: the same in bubblewrap, with a /tmp of its own. Neither (Windows, or Linux without bubblewrap): the build doesn't start, unless an instance operator allows unconfined agents | same |
+
+**Where a build writes.** Each approved scope also seals where its build may
+write. By default (Settings → Project → **Where builds write**, or `toolroll
+project writes --repo <p> workspace`) a build writes only its checkout, its
+checkout's commit data (never the repository's Git config, hooks or info, other
+checkouts' data or submodules), the project's own package caches (npm, pnpm,
+yarn, pip, uv, Go, Cargo, Gradle: its package managers are pointed there), the
+run's temp folder, and the session files its agent CLI must keep. Your shell
+profile, login items, `~/.claude` settings and everything else stay as they
+are; Claude's other live sessions aren't even readable. A project whose tools
+must write elsewhere can choose `anywhere` (outside the fence, as before);
+approvals from before this setting keep writing anywhere, as they were approved.
+The build's setup, check, follow-up and batch commands run in the same fence.
+Toolroll's own Git on a build's checkout runs hardened (no hooks, fsmonitor,
+submodules or signing), reads none of your global Git config but its plain values
+(identity, line endings, a standard git-lfs install), and refuses a checkout
+whose config includes a file or names a command; a project's tool servers can't
+read the checkout and never run a file the build wrote.
 
 **The network.** Each approved scope says what its build may reach: the
 agent's provider, the package registries the project uses (npm, PyPI,

package/dist/acp-client.js

@@ -1,3 +1,4 @@
+import { isRecord } from "./is-record.js";
 /**
  * The Agent Client Protocol, from the plane's side (docs/plans/acp-adapter.md).
  *
@@ -37,9 +38,6 @@ const TEXT_CAP = 2048;
 const USAGE_CAP = 8 * 1024;
 const PROTOCOL_VERSION = 1;
 const STOP_REASONS = new Set(["end_turn", "max_tokens", "max_turn_requests", "refusal", "cancelled"]);
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function bounded(text, cap) {
     return text.length <= cap ? text : text.slice(0, cap);
 }

package/dist/agent-board.d.ts

@@ -1,6 +1,5 @@
 import type { Store } from "./store.js";
 export type AgentTurn = "busy" | "idle" | "crashed";
-export declare const AGENT_TURNS: readonly AgentTurn[];
 export type AgentSaid = "working" | "blocked" | "done";
 /** A busy run whose transcript and activity are both this old is Stuck. */
 export declare const STUCK_AFTER_MS: number;

package/dist/agent-board.js

@@ -27,7 +27,6 @@
  * Display state, never evidence: nothing here changes a run's outcome.
  */
 import { randomBytes } from "node:crypto";
-export const AGENT_TURNS = ["busy", "idle", "crashed"];
 /** A busy run whose transcript and activity are both this old is Stuck. */
 export const STUCK_AFTER_MS = 4 * 60_000;
 /** With a tool call still open (a long test run is silent), it is Stuck only after this long. */

package/dist/agent-fence.d.ts

@@ -60,7 +60,7 @@ export type RunFolders = {
 };
 /** The prefixes of every launch's private folders: its tools' config, a Codex build's own home, and a Linux build's
  * network bridge (egress-bridge.ts). */
-export declare const RUN_FOLDER_PREFIXES: readonly ["so-tools-", "so-codex-", "so-net-"];
+export declare const RUN_FOLDER_PREFIXES: readonly ["so-tools-", "so-codex-", "so-net-", "so-cmd-"];
 export declare function runFolders(own: string | null, root?: string): RunFolders;
 /**
  * What a fence gives back beside its denied paths. Each is narrow and none
@@ -80,7 +80,61 @@ export type FenceGrants = {
     runFolders?: RunFolders;
     pool?: CheckoutPool;
     network?: NetworkFence;
+    writes?: WriteAllowlist;
 };
+export { isWritesMode, WRITES_DEFAULT, type WritesMode } from "./writes-mode.js";
+/**
+ * The only places a `workspace` build writes: `subpaths`, each a folder (or file) writable whole, and `prefixes`, a file
+ * with the temporary names it is atomically replaced through, or a folder named by a pattern (a regex on macOS;
+ * elsewhere the path alone, when it exists). Everything else is read-only to the build; its fence's denies and read-only grants still hold inside these.
+ */
+export type WriteAllowlist = {
+    subpaths: string[];
+    prefixes: WritePrefix[];
+};
+/** A file or folder named by `path` followed by what `suffix` (a regular expression, anchored at its end) allows. */
+export type WritePrefix = {
+    path: string;
+    suffix: string;
+};
+/** Claude's transcript folder for a working folder: its path with every character but a letter or digit made `-`
+ * (Claude Code's own naming; a name over 200 characters gets a suffix, so it is granted by prefix). */
+export declare function claudeProjectFolder(home: string, cwd: string): {
+    path: string;
+    byPrefix: boolean;
+};
+/**
+ * A folder a write grant may name: made when absent, then only as the real folder it is — never a link, nor reached
+ * through one (its real path is its parent's real path and its own name). A build can rewrite what it may write, so a
+ * folder it was given could otherwise come back as a link to anywhere and be granted, followed, on its next launch.
+ * Null when it isn't such a folder: nothing is granted, and the write it was for fails.
+ */
+export declare function grantFolder(path: string, create?: boolean): string | null;
+/**
+ * What a `workspace` build writes and what it loses (arc 2): its checkout, its checkout's Git data (less the shared
+ * repository's config, hooks and info, which Git runs or reads as commands), its own launch folder (its temp is there),
+ * its project's cache folder, the terminal devices, and only the provider state its CLI must write (measured: Claude's
+ * transcript folder for this checkout; Gemini's history, temp and project list; an ACP agent's own folders). The
+ * folders named here are made first, so the provider never has to make them where it can't. `deny` is what this
+ * provider must not even read (Claude's live sessions' keys).
+ */
+export declare function writeAllowlist(options: {
+    provider: string;
+    home: string;
+    worktree: string;
+    binding: WorktreeBinding | null;
+    launchFolder: string | null;
+    cache: string | null;
+}): {
+    writes: WriteAllowlist;
+    readOnly: string[];
+    deny: string[];
+};
+/** Where a project's builds keep their package caches: one folder per project (one trust domain), never used by the
+ * plane's own tools, below the user's cache folder. */
+export declare function buildCacheFolder(repo: string, home?: string, platform?: NodeJS.Platform, env?: Readonly<Record<string, string | undefined>>): string;
+/** The environment that points a build's package managers at its project's cache folder, not the user's own. */
+export declare function buildCacheEnv(folder: string): Record<string, string>;
 /**
  * A launch's network confinement (egress.ts, docs/plans/agent-baseline-hardening.md arc 1). `open`: the network as it
  * always was. `allowlist`: nothing leaves the machine but through the run's own proxy (`proxyPort`); the run's tool
@@ -233,6 +287,8 @@ export declare function macosFenceProfile(fence: readonly string[], grants?: Fen
  */
 export declare function macosNetworkRules(network: NetworkFence | undefined): string[];
 export declare const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
+/** Where macOS's resolver (mDNSResponder) answers: every name lookup on a Mac is a message to this socket. */
+export declare const MACOS_DNS_SOCKET = "/private/var/run/mDNSResponder";
 /**
  * Whether this machine can run an agent inside the macOS fence (checked once). Not from inside another
  * sandbox: a Toolroll a fenced process starts (the end-to-end journeys a flow's check zone runs) can't nest
@@ -260,4 +316,15 @@ export declare function linuxFenced(file: string, args: readonly string[], fence
 };
 /** The host's own sockets a process in a mounted filesystem could still talk to (D-Bus, the display, container
  * engines), wherever they exist here. */
-export declare function linuxHostSockets(uid?: number | undefined, home?: string, tmp?: string): string[];
+export declare function linuxHostSockets(uid?: number | undefined, home?: string, tmp?: string, followLinks?: boolean, env?: Readonly<Record<string, string | undefined>>): string[];
+/**
+ * What each agent's fence gives it, by permission mode: the one table README's "What an agent can reach" shows
+ * (fenceSummaryMarkdown; a test holds them equal).
+ */
+export declare const FENCE_SUMMARY: readonly {
+    agent: string;
+    auto: string;
+    full: string;
+}[];
+/** FENCE_SUMMARY as README's markdown table. */
+export declare function fenceSummaryMarkdown(): string;