toolroll 0.9.65 → 0.9.68

package/dist/password-bearer.d.ts

@@ -17,8 +17,6 @@ export declare const PASSWORD_BEARER_REFUSED = "Toolroll no longer accepts a pas
 export declare function isPasswordBearer(authorization: string | undefined): boolean;
 /** Whether this build still accepts a password bearer: only a release before PASSWORD_BEARER_REFUSED_FROM does. */
 export declare function passwordBearerAccepted(version?: string): boolean;
-/** A refusal's words for this request: unchanged, or with the replacement when it came with a password bearer. */
-export declare function withReplacement(authorization: string | undefined, message: string): string;
 /**
  * The refusal boundary for one password-bearer request, whichever adapter answers it: the deprecation is announced in
  * headers (RFC 9745 Deprecation, and a Warning naming the replacement), and any refusal's words, plain text or a JSON

package/dist/password-bearer.js

@@ -20,10 +20,6 @@ export function passwordBearerAccepted(version = PACKAGE_VERSION) {
             return have[index] < limit[index];
     return false;
 }
-/** A refusal's words for this request: unchanged, or with the replacement when it came with a password bearer. */
-export function withReplacement(authorization, message) {
-    return !isPasswordBearer(authorization) || message.includes("toolroll tokens create") ? message : `${message} ${PASSWORD_BEARER_WARNING}`;
-}
 /**
  * The refusal boundary for one password-bearer request, whichever adapter answers it: the deprecation is announced in
  * headers (RFC 9745 Deprecation, and a Warning naming the replacement), and any refusal's words, plain text or a JSON

package/dist/peek-cli.js

@@ -17,6 +17,7 @@
 import { spawn } from "node:child_process";
 import { liveWindowLines, readLiveWindow } from "./live.js";
 import { validKeyTail } from "./live-records.js";
+import { sleep } from "./sleep.js";
 export const PEEK_TAIL_LINES = 400;
 const ESC = "\u001b";
 const REPLACED = { offset: 0, lines: ["[the live view was replaced — starting over]"], state: "replaced" };
@@ -175,7 +176,7 @@ export async function runPeek(store, root, options) {
     try {
         paint();
         while (!stop) {
-            await new Promise(resolve => setTimeout(resolve, options.intervalMs ?? 500));
+            await sleep(options.intervalMs ?? 500);
             paint();
         }
     }

package/dist/peek.d.ts

@@ -5,9 +5,9 @@
  * gitattributes, hooks, clean/process filters, or external diff drivers —
  * the mechanisms finding 7 proved can execute repository-configured
  * commands. Change detection is a git-blob sha1 computed IN PROCESS against
- * the frozen base tree; the diff is a line-based Myers implemented here.
+ * the frozen base tree.
  *
- * Two layers, deliberately separated: the PURE core (sha1, diff, parsers,
+ * Two layers, deliberately separated: the PURE core (sha1, parsers,
  * aggregation — bytes in, structures out) and ONE I/O function,
  * observeWorktree — descriptor-DISCIPLINED, not descriptor-confined: Node
  * has no openat, so traversal is by pathname and a same-UID attacker
@@ -24,30 +24,6 @@
 /** git's own blob identity: sha1 over "blob <len>\0" + bytes. Computing it
  * here is what lets change detection never ask git about a working tree. */
 export declare function gitBlobSha1(bytes: Buffer): string;
-/** git's heuristic, near enough: a NUL in the first 8 KiB means binary —
- * named on the page, never diffed. */
-export declare function looksBinary(bytes: Buffer): boolean;
-export type Hunk = {
-    aStart: number;
-    aLines: number;
-    bStart: number;
-    bLines: number;
-    /** Prefixed lines: " ctx", "-old", "+new" — exactly unified-diff shape. */
-    lines: string[];
-};
-/**
- * Line-based Myers (the O(ND) greedy walk), bounded by the caller's caps —
- * inputs beyond the byte caps never reach here. Returns unified hunks with
- * three lines of context, or null when the edit distance exceeds `maxD`
- * (a rewrite is not usefully rendered as a diff — the caller says so).
- */
-export declare function diffLines(aText: string, bText: string, maxD?: number): Hunk[] | null;
-/** Render hunks as a unified patch body for one file, capped in bytes.
- * The cap drops the incomplete final line (finding 9), and says so. */
-export declare function renderUnified(path: string, hunks: Hunk[], capBytes: number): {
-    text: string;
-    truncated: boolean;
-};
 /**
  * New-file readability WITHOUT suppression (round-1 finding 19: ignore
  * parsing is gone — a pattern match can HIDE a name, and patterns are

package/dist/peek.js

@@ -5,9 +5,9 @@
  * gitattributes, hooks, clean/process filters, or external diff drivers —
  * the mechanisms finding 7 proved can execute repository-configured
  * commands. Change detection is a git-blob sha1 computed IN PROCESS against
- * the frozen base tree; the diff is a line-based Myers implemented here.
+ * the frozen base tree.
  *
- * Two layers, deliberately separated: the PURE core (sha1, diff, parsers,
+ * Two layers, deliberately separated: the PURE core (sha1, parsers,
  * aggregation — bytes in, structures out) and ONE I/O function,
  * observeWorktree — descriptor-DISCIPLINED, not descriptor-confined: Node
  * has no openat, so traversal is by pathname and a same-UID attacker
@@ -33,172 +33,6 @@ export function gitBlobSha1(bytes) {
         .update(bytes)
         .digest("hex");
 }
-/** git's heuristic, near enough: a NUL in the first 8 KiB means binary —
- * named on the page, never diffed. */
-export function looksBinary(bytes) {
-    return bytes.subarray(0, 8192).includes(0);
-}
-/**
- * Line-based Myers (the O(ND) greedy walk), bounded by the caller's caps —
- * inputs beyond the byte caps never reach here. Returns unified hunks with
- * three lines of context, or null when the edit distance exceeds `maxD`
- * (a rewrite is not usefully rendered as a diff — the caller says so).
- */
-export function diffLines(aText, bText, maxD = 2000) {
-    const a = aText.split("\n");
-    const b = bText.split("\n");
-    // A trailing newline yields one empty tail element on both sides; keep it —
-    // it makes "no newline at end" edits visible as a real line change.
-    const n = a.length;
-    const m = b.length;
-    const max = Math.min(n + m, maxD);
-    const offset = max;
-    // v[k] = furthest x on diagonal k; trace keeps a snapshot per d for backtrack.
-    let v = new Array(2 * max + 1).fill(0);
-    const trace = [];
-    let found = -1;
-    for (let d = 0; d <= max; d++) {
-        trace.push([...v]);
-        for (let k = -d; k <= d; k += 2) {
-            let x = k === -d || (k !== d && v[offset + k - 1] < v[offset + k + 1])
-                ? v[offset + k + 1]
-                : v[offset + k - 1] + 1;
-            let y = x - k;
-            while (x < n && y < m && a[x] === b[y]) {
-                x++;
-                y++;
-            }
-            v[offset + k] = x;
-            if (x >= n && y >= m) {
-                found = d;
-                break;
-            }
-        }
-        if (found >= 0)
-            break;
-    }
-    if (found < 0)
-        return null; // edit distance beyond maxD — not a diff, a replacement
-    const ops = [];
-    let x = n;
-    let y = m;
-    for (let d = found; d > 0; d--) {
-        const vd = trace[d];
-        const k = x - y;
-        const prevK = k === -d || (k !== d && vd[offset + k - 1] < vd[offset + k + 1])
-            ? k + 1
-            : k - 1;
-        const prevX = vd[offset + prevK];
-        const prevY = prevX - prevK;
-        while (x > prevX && y > prevY) {
-            ops.push("=");
-            x--;
-            y--;
-        }
-        if (d > 0) {
-            if (x === prevX) {
-                ops.push("+");
-                y--;
-            }
-            else {
-                ops.push("-");
-                x--;
-            }
-        }
-    }
-    while (x > 0 && y > 0) {
-        ops.push("=");
-        x--;
-        y--;
-    }
-    while (x > 0) {
-        ops.push("-");
-        x--;
-    }
-    while (y > 0) {
-        ops.push("+");
-        y--;
-    }
-    ops.reverse();
-    // Fold ops into hunks with 3 lines of context.
-    const CONTEXT = 3;
-    const hunks = [];
-    let ai = 0;
-    let bi = 0;
-    let current = null;
-    let trailingContext = 0;
-    const flush = () => {
-        if (current === null)
-            return;
-        // Trim context beyond CONTEXT at the tail.
-        while (trailingContext > CONTEXT) {
-            current.lines.pop();
-            current.aLines--;
-            current.bLines--;
-            trailingContext--;
-        }
-        hunks.push(current);
-        current = null;
-        trailingContext = 0;
-    };
-    for (const op of ops) {
-        if (op === "=") {
-            const line = a[ai];
-            if (current !== null) {
-                current.lines.push(` ${line}`);
-                current.aLines++;
-                current.bLines++;
-                trailingContext++;
-                if (trailingContext > CONTEXT * 2)
-                    flush();
-            }
-            ai++;
-            bi++;
-            continue;
-        }
-        if (current === null) {
-            const aStart = Math.max(0, ai - CONTEXT);
-            const bStart = Math.max(0, bi - CONTEXT);
-            current = { aStart: aStart + 1, aLines: 0, bStart: bStart + 1, bLines: 0, lines: [] };
-            for (let c = aStart; c < ai; c++) {
-                current.lines.push(` ${a[c]}`);
-                current.aLines++;
-                current.bLines++;
-            }
-        }
-        trailingContext = 0;
-        if (op === "-") {
-            current.lines.push(`-${a[ai]}`);
-            current.aLines++;
-            ai++;
-        }
-        else {
-            current.lines.push(`+${b[bi]}`);
-            current.bLines++;
-            bi++;
-        }
-    }
-    flush();
-    return hunks;
-}
-/** Render hunks as a unified patch body for one file, capped in bytes.
- * The cap drops the incomplete final line (finding 9), and says so. */
-export function renderUnified(path, hunks, capBytes) {
-    const header = `--- a/${path}\n+++ b/${path}\n`;
-    const parts = [header];
-    let bytes = Buffer.byteLength(header);
-    for (const hunk of hunks) {
-        const head = `@@ -${hunk.aStart},${hunk.aLines} +${hunk.bStart},${hunk.bLines} @@\n`;
-        const body = hunk.lines.join("\n") + "\n";
-        const size = Buffer.byteLength(head) + Buffer.byteLength(body);
-        if (bytes + size > capBytes) {
-            return { text: parts.join(""), truncated: true };
-        }
-        parts.push(head, body);
-        bytes += size;
-    }
-    return { text: parts.join(""), truncated: false };
-}
 export function aggregateNewNames(paths, groupAt = 10, rowCap = 200) {
     const bySegment = new Map();
     for (const path of paths) {

package/dist/phase-routing.d.ts

@@ -70,8 +70,6 @@ export { ROUTE_VERSION };
  * row; which route version it holds rides in the snapshot itself. */
 export declare const ROUTE_ERA = 1;
 export declare const PHASES: readonly Phase[];
-/** The review leg remains readable in signed history but is no longer scheduled. */
-export declare const ACTIVE_PHASES: readonly Phase[];
 /** The risk words a route sealed before v115 may carry (history); every route since says `routine`. */
 export type RiskLevel = (typeof RISKS)[number];
 export declare function isRiskLevel(value: unknown): value is RiskLevel;
@@ -86,8 +84,6 @@ export declare function isTaskSize(value: unknown): value is TaskSize;
 export declare function makesNoPlan(size: TaskSizing | null | undefined, risk: RiskLevel): boolean;
 /** Where a size came from, in words. */
 export declare function sizeSourceWords(source: SizeSource): string;
-/** Strict read of a stored sizing (the route contract's): exact keys, known words, bounded reason. */
-export declare function parseSizing(raw: unknown): TaskSizing | null;
 export declare function riskTitle(risk: RiskLevel): string;
 /** A runner's non-spending observation of one provider. `unknown` is a
  * real answer (claude has no login probe that does not spend) and is never

package/dist/phase-routing.js

@@ -50,7 +50,8 @@
  */
 import { ACP_AGENTS, isAcpProvider } from "./acp-agents.js";
 import { createHash } from "node:crypto";
-import { MODEL_ID_SHAPE, postureOf, readRouteOverrides, readSealedRoute, RISKS, ROUTE_PHASES, ROUTE_PROVIDERS, ROUTE_VERSION, TASK_SIZE_WORDS, taskSizingSchema, } from "./contracts/route.js";
+import { MODEL_ID_SHAPE, postureOf, readRouteOverrides, readSealedRoute, RISKS, ROUTE_PHASES, ROUTE_PROVIDERS, ROUTE_VERSION, TASK_SIZE_WORDS, } from "./contracts/route.js";
+import { canonicalJson } from "./canonical-json.js";
 export { MODEL_ID_SHAPE };
 // Type-only imports from provider.ts: it sits under evidence.ts and scope.ts
 // in the module graph, and this policy is imported by scope.ts — a value
@@ -79,8 +80,6 @@ export { ROUTE_VERSION };
  * row; which route version it holds rides in the snapshot itself. */
 export const ROUTE_ERA = 1;
 export const PHASES = ROUTE_PHASES;
-/** The review leg remains readable in signed history but is no longer scheduled. */
-export const ACTIVE_PHASES = ["plan", "build", "repair"];
 export function isRiskLevel(value) {
     return value === "routine" || value === "elevated" || value === "high";
 }
@@ -97,11 +96,6 @@ export function makesNoPlan(size, risk) {
 export function sizeSourceWords(source) {
     return source === "classifier" ? "sized automatically" : source === "person" ? "set by a person" : "sized from the description";
 }
-/** Strict read of a stored sizing (the route contract's): exact keys, known words, bounded reason. */
-export function parseSizing(raw) {
-    const parsed = taskSizingSchema.safeParse(raw);
-    return parsed.success ? parsed.data : null;
-}
 export function riskTitle(risk) {
     return risk === "high" ? "High risk" : risk === "elevated" ? "Elevated risk" : "Routine";
 }
@@ -481,19 +475,6 @@ export function sameSpec(a, b) {
     return a.provider === b.provider && a.model === b.model;
 }
 // ---- canonical bytes, digest, strict rehydration ---------------------------
-/** Deterministic JSON: object keys sorted recursively, arrays in order. */
-function canonicalJson(value) {
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJson).join(",")}]`;
-    if (value !== null && typeof value === "object") {
-        const entries = Object.entries(value)
-            .filter(([, v]) => v !== undefined)
-            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
-            .map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`);
-        return `{${entries.join(",")}}`;
-    }
-    return JSON.stringify(value);
-}
 /** The stored snapshot bytes: the version rides IN the snapshot. */
 export function canonicalRouteJson(route) {
     return canonicalJson({

package/dist/planner-source.d.ts

@@ -40,6 +40,7 @@ import type { Scope } from "./scope.js";
 import type { QualityMode } from "./quality.js";
 import type { RiskLevel } from "./phase-routing.js";
 import { type ContractChange, type ContractTerms } from "./contract-changes.js";
+import { canonicalJsonUndefinedAsNull } from "./canonical-json.js";
 export declare const PLANNER_SOURCE_VERSION = 1;
 export declare const PLANNER_SOURCE_LIMITS: {
     /** The whole recorded source before lossless prompt fencing. Equal to
@@ -132,7 +133,7 @@ export type PlannerSource = {
     outsideReference?: string;
 };
 /** Stable JSON for hashing and equality only — no filling, no trimming. */
-export declare function canonicalContractJson(value: unknown): string;
+export declare const canonicalContractJson: typeof canonicalJsonUndefinedAsNull;
 export declare function plannerSourceDigest(contract: PlannerContract): string;
 /**
  * The contract part, read from the store alone — no file I/O — so the plan

package/dist/planner-source.js

@@ -41,6 +41,7 @@ import { EVIDENCE_CAPS, readVerifiedArtifact } from "./evidence.js";
 import { TEXT_LIMITS } from "./text-limits.js";
 import { PLAN_TOUCHES } from "./contracts/plan.js";
 import { contractChangesOf } from "./contract-changes.js";
+import { canonicalJsonUndefinedAsNull } from "./canonical-json.js";
 export const PLANNER_SOURCE_VERSION = 1;
 export const PLANNER_SOURCE_LIMITS = {
     /** The whole recorded source before lossless prompt fencing. Equal to
@@ -56,18 +57,7 @@ export const PLANNER_SOURCE_LIMITS = {
     handoffTerms: TEXT_LIMITS.planPayloadBytes,
 };
 /** Stable JSON for hashing and equality only — no filling, no trimming. */
-export function canonicalContractJson(value) {
-    if (Array.isArray(value))
-        return `[${value.map(canonicalContractJson).join(",")}]`;
-    if (value !== null && typeof value === "object") {
-        const body = value;
-        return `{${Object.keys(body)
-            .sort()
-            .map(key => `${JSON.stringify(key)}:${canonicalContractJson(body[key])}`)
-            .join(",")}}`;
-    }
-    return JSON.stringify(value) ?? "null";
-}
+export const canonicalContractJson = canonicalJsonUndefinedAsNull;
 export function plannerSourceDigest(contract) {
     return createHash("sha256").update(`planner-source:v${PLANNER_SOURCE_VERSION}\n${canonicalContractJson(contract)}`, "utf8").digest("hex");
 }

package/dist/planner.js

@@ -38,6 +38,7 @@ import { proveTreeUntouched, snapshotIgnored } from "./tree-proof.js";
 import { CLAUDE_LIMITS, ACCEPTANCE_LIMITS } from "./scope.js";
 import { normalizeStructuredJson, storeStructuredAttempt, validationErrorsJson, STRUCTURED_REPAIR_ATTEMPTS, STRUCTURED_REPAIR_MAX_TURNS, STRUCTURED_REPAIR_TIMEOUT_MS, } from "./structured-output.js";
 import { contractChangesOf, describeContractChanges, plannerSourceBlock, } from "./planner-source.js";
+import { canonicalJsonUndefinedAsNull } from "./canonical-json.js";
 const GIT = "git";
 const AGENT_ENV_DENYLIST = [...TELEGRAM_TOKEN_ENVS];
 const DEFAULT_PLAN_TIMEOUT_MS = 20 * 60_000;
@@ -146,19 +147,6 @@ function plannerBrief(title, mailbox, planFile, answers, source, structured) {
         "work back for evidence nobody can produce.",
     ].join("\n");
 }
-/** Stable JSON for equality only — it does not fill, trim, or reinterpret. */
-function canonicalJson(value) {
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJson).join(",")}]`;
-    if (value !== null && typeof value === "object") {
-        const body = value;
-        return `{${Object.keys(body)
-            .sort()
-            .map(key => `${JSON.stringify(key)}:${canonicalJson(body[key])}`)
-            .join(",")}}`;
-    }
-    return JSON.stringify(value) ?? "null";
-}
 function decodeStructuredBytes(raw) {
     try {
         // Buffer#toString silently inserts U+FFFD for malformed sequences,
@@ -187,7 +175,7 @@ function planAuthorityAnchor(raw) {
         // canonicalJson is recursive. A byte-bounded but pathologically deep
         // JSON value can still exhaust the JS stack; that means its authority
         // cannot be frozen safely, so this output is not eligible for repair.
-        return canonicalJson({
+        return canonicalJsonUndefinedAsNull({
             goal: body["goal"],
             outOfScope: body["outOfScope"],
             touches: body["touches"],

package/dist/process-tree.d.ts

@@ -23,8 +23,6 @@ export type ProcessTreeObserver = {
     onObservationFailure?: (failure: ProcessObservationFailure) => void;
     onUnknown?: () => void;
 };
-/** Private supervisor pipe input. Keep only validated identifier diagnostics. */
-export declare function readProcessObservationFailure(value: unknown): ProcessObservationFailure | null;
 /** Capture current descendants before asking an owned process to exit.
  * A cooperative root may exit before the next periodic observation; even
  * a killed tool can retain its PID briefly after its process group is gone. */

package/dist/process-tree.js

@@ -78,16 +78,6 @@ function recordExits(child, rows) {
 }
 // Only fixed error codes survive; error messages/output can contain private data.
 const observationCodes = new Set(["EAGAIN", "EMFILE", "ENFILE", "ETIMEDOUT", "ENOBUFS", "ENOENT", "EPERM", "EACCES", "EIO", "ESRCH", "MALFORMED_SNAPSHOT", "SUPERVISOR_DIAGNOSTIC", "SQLITE_BUSY", "SQLITE_LOCKED", "SQLITE_READONLY", "SQLITE_IOERR", "SQLITE_CORRUPT", "SQLITE_FULL", "SQLITE_CONSTRAINT"]);
-/** Private supervisor pipe input. Keep only validated identifier diagnostics. */
-export function readProcessObservationFailure(value) {
-    if (typeof value !== "object" || value === null)
-        return null;
-    const row = value;
-    const { phase, operation, code, rootPid, at, identityUnknown } = row;
-    if (!["sample", "periodic", "final-exit", "stop", "supervisor"].includes(String(phase)) || !["snapshot", "descendant-write", "exit-write", "signal", "diagnostic-read"].includes(String(operation)) || typeof code !== "string" || (code !== "UNKNOWN" && !observationCodes.has(code)) || (rootPid !== null && (!Number.isSafeInteger(rootPid) || Number(rootPid) <= 0)) || typeof at !== "string" || !Number.isFinite(Date.parse(at)) || new Date(at).toISOString() !== at || typeof identityUnknown !== "boolean")
-        return null;
-    return { phase: phase, operation: operation, code, rootPid: rootPid, at, identityUnknown };
-}
 function failed(child, phase, operation, error, identitiesPreserved = false) {
     const tracked = observed.get(child);
     if (!tracked)

package/dist/project-delete-ui.d.ts

@@ -5,6 +5,7 @@
  * sign-in with the identity provider). The repository itself stays.
  */
 import type { ProjectNetwork } from "./egress.js";
+import type { WritesMode } from "./writes-mode.js";
 import { type Html } from "./html.js";
 import { type ProjectHoldings } from "./project-delete.js";
 export declare const PROJECT_DELETE_CSS: string;
@@ -44,6 +45,11 @@ export type ProjectSettingsView = {
         setting: ProjectNetwork;
         canChange: boolean;
     };
+    /** Where its builds may write (writes-mode.ts), and whether this person may change it. */
+    writes?: {
+        setting: WritesMode;
+        canChange: boolean;
+    };
 };
 /** The project's page: its path, what Toolroll holds for it, and (for an instance operator) Delete project. */
 export declare function projectSettingsHtml(view: ProjectSettingsView, notice: {

package/dist/project-delete-ui.js

@@ -14,6 +14,25 @@ export const PROJECT_DELETE_CSS = `.project-settings,.project-delete{max-width:7
     `.project-settings .build-access ul{margin:0 0 4px;padding-left:20px;font:var(--so-typography-body);color:var(--so-ink)}.project-settings .build-access li{margin:2px 0}.project-settings .build-access li .meta{color:var(--so-muted)}` +
     `.project-settings .build-access a.manage-tools{display:inline-flex;align-items:center;justify-content:center;min-height:44px;margin-top:4px;padding:0 14px;white-space:nowrap;background:var(--so-paper);color:var(--so-ink);border:1px solid var(--so-input-line);border-radius:var(--so-radius-md);font:var(--so-typography-label);text-decoration:none}` +
     `.project-settings .build-access a.manage-tools:hover{background:var(--so-raised)}.project-settings .build-access a.manage-tools:focus-visible,.project-settings .build-access summary:focus-visible{outline:2px solid var(--so-ink);outline-offset:2px}`;
+/** Where builds may write, said plainly; an approver changes it with their password. */
+function writesHtml(view) {
+    const writes = view.writes;
+    if (writes === undefined)
+        return "";
+    const said = writes.setting === "workspace"
+        ? html `<p>Builds write <strong>only their own checkout</strong>, its caches and its temp folder. Your shell profile, login items, agent settings and the repository's Git config and hooks stay as they are.</p>`
+        : html `<p>Builds may write <strong>anywhere</strong> outside Toolroll's own folders, your credentials and other projects.</p>`;
+    if (!writes.canChange)
+        return html `<section class="build-access writes-setting" id="writes" aria-labelledby="writes-title"><h2 id="writes-title">Where builds write</h2>${said}<p class="meta">An approver for this project can change this.</p></section>`;
+    const option = (value, label, detail) => html `<label class="check"><input type="radio" name="writes" value="${value}"${writes.setting === value ? html ` checked` : ""}> ${label}</label><p class="meta">${detail}</p>`;
+    const form = postForm("/settings/project/writes", html `
+    ${option("workspace", "Only their workspace (recommended)", "The checkout and its Git data, the project's own package caches, the build's temp folder, and what its agent needs to keep its session.")}
+    ${option("anywhere", "Anywhere outside Toolroll's fenced folders", "For a project whose tools must write elsewhere in your home folder or the shared temp folder. Credentials, Toolroll's own folders and other projects stay fenced.")}
+    <p class="meta">Tasks scoped from now on use this; tasks already approved keep what they were approved with.</p>
+    ${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}
+    <button type="submit">Save</button>`, { hidden: { repo: view.repo } });
+    return html `<section class="build-access writes-setting" id="writes" aria-labelledby="writes-title"><h2 id="writes-title">Where builds write</h2>${said}<details><summary>Change</summary>${form}</details></section>`;
+}
 /** Network: what the project's builds may reach, said plainly; an approver changes it with their password. */
 function networkHtml(view) {
     const network = view.network;
@@ -92,7 +111,7 @@ export function projectSettingsHtml(view, notice) {
     const remote = html `<section class="build-access recorded-remote" aria-labelledby="recorded-remote-title"><h2 id="recorded-remote-title">Recorded remote</h2>${view.remoteUrl
         ? html `<p class="path">${view.remoteUrl}</p>`
         : html `<p>No remote recorded. Landed work waits for your review.</p>`}<details><summary>Change remote</summary><p>An owner or instance operator can run:</p><p class="path">toolroll repos add &lt;project&gt; --remote &lt;url&gt;</p></details></section>`;
-    const head = html `${note(notice)}<p class="path">${view.repo}</p>${held}${remote}${buildsHtml(view)}${accessHtml(view)}${networkHtml(view)}${liveViewHtml(view)}`;
+    const head = html `${note(notice)}<p class="path">${view.repo}</p>${held}${remote}${buildsHtml(view)}${accessHtml(view)}${networkHtml(view)}${writesHtml(view)}${liveViewHtml(view)}`;
     if (!view.canDelete)
         return html `<section class="project-settings">${head}<p class="meta">An instance operator can delete a project.</p></section>`;
     const body = view.running.length > 0

package/dist/project-delete.d.ts

@@ -1,8 +1,6 @@
 import type { ExecResult } from "./exec.js";
 import type { Runner } from "./worktree.js";
 import { type Store } from "./store.js";
-/** What Toolroll names the branches it makes: toolroll/…, and standing-orders/… from before the rename. */
-export declare const OWN_BRANCH = "toolroll/";
 export declare const OWN_BRANCHES: readonly string[];
 export type ProjectHoldings = {
     tasks: number;

package/dist/project-delete.js

@@ -16,11 +16,9 @@ import { existsSync, lstatSync, rmSync } from "node:fs";
 import { isAbsolute, relative, resolve } from "node:path";
 import { teardownGit, refusal } from "./teardown-git.js";
 import { BUILT_IN } from "./store.js";
-import { BRANCH_PREFIX, BRANCH_PREFIXES, isOwnBranch } from "./names.js";
+import { BRANCH_PREFIXES, isOwnBranch } from "./names.js";
 /** The tables whose history is the audit record itself: never touched. */
 const KEPT = new Set(["action_ledger", "ledger_seal", "ledger_checkpoint"]);
-/** What Toolroll names the branches it makes: toolroll/…, and standing-orders/… from before the rename. */
-export const OWN_BRANCH = BRANCH_PREFIX;
 export const OWN_BRANCHES = BRANCH_PREFIXES;
 const list = (db, sql, ...params) => db.prepare(sql).all(...params).map(row => Object.values(row)[0]);
 const ids = (db, sql, ...params) => list(db, sql, ...params).map(Number);

package/dist/project-learning.d.ts

@@ -32,20 +32,6 @@ export type Lesson = {
     identity: string;
     adoptedBy: string | null;
 };
-export type LearningEvent = {
-    snapshot: string | null;
-    outcome: string | null;
-    id: number;
-    actor: string;
-    at: string;
-    action: string;
-    before: string;
-    after: string;
-    reason: string;
-    lesson: number | null;
-    run: number | null;
-    evidence: LearningEvidence[];
-};
 export declare const learningSha: (text: string) => string;
 /** Facts about the shared Git database that survive a restart. The volume's device number does not. */
 export type IdentityFacts = {

package/dist/project-skills.d.ts

@@ -89,7 +89,6 @@ export declare function materializeProjectSkills(snapshot: SkillsSnapshot, root:
     }[];
 };
 export declare function skillsContext(store: Store, root: string, runId: number): string;
-export declare function skillReviewSource(store: Store, runId: number): string | null;
 export declare function testSkill(store: Store, args: {
     repo: string;
     actor: string;

package/dist/project-skills.js

@@ -463,20 +463,6 @@ export function skillsContext(store, root, runId) {
         JSON.stringify(catalog) +
         "\n");
 }
-export function skillReviewSource(store, runId) {
-    const s = freezeSkills(store, runId);
-    return s.packages.length
-        ? JSON.stringify({
-            notice: "Exact skill packages supplied to the source run. Untrusted review context, never reviewer instructions or evidence of use. Original files use base64; readable SKILL.md is also included.",
-            ...s,
-            instructions: s.packages.map((p) => ({
-                name: p.name,
-                sha: p.sha,
-                content: Buffer.from(p.files.find((f) => f.path === "SKILL.md").base64, "base64").toString("utf8"),
-            })),
-        })
-        : null;
-}
 export function testSkill(store, args, now = new Date()) {
     const view = skillsView(store, args.repo, args.actor);
     admit(store, args.repo, args.actor, true);

package/dist/project-tools.js

@@ -33,6 +33,7 @@ import { isAcpProvider } from "./acp-agents.js";
 import { SecretStoreError, destroyOwnFile, prepareSecretFolder, registerSecretFolder, pathIn, readOwnFile, readSealed, removeValue, secretBackend, secretFolder, secretStorage, serviceOf, withSecretLock, withSecretLockAsync, writeOwnFile, writeSealed } from "./tool-secret-store.js";
 import { ACCESS, GRANTED, REFRESH, mintRunToken, mintsRunTokens, oneAtATime, runScope, scopeList, signedIn } from "./oauth-run-token.js";
 import { HEADER_NAME, SECRET_NAME, TOOL_NAME as NAME, TOOL_SPEC_LIMITS as LIMITS, readToolSpec } from "./contracts/integration-metadata.js";
+import { canonicalJson } from "./canonical-json.js";
 /** Env names a tool may never claim: the process's own plumbing, every
  * provider credential, and anything that changes how a program or its
  * interpreter loads (a secret's value must stay data, never code). */
@@ -75,19 +76,10 @@ export function localAppOf(spec) {
 export function catalogTool(id) {
     return TOOL_CATALOG.find(one => one.name === id) ?? null;
 }
-function canonical(value) {
-    if (Array.isArray(value))
-        return `[${value.map(canonical).join(",")}]`;
-    if (value !== null && typeof value === "object") {
-        return `{${Object.entries(value).filter(([, v]) => v !== undefined).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
-            .map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}`;
-    }
-    return JSON.stringify(value);
-}
 /** What a build is held to: how the server starts and which secrets it names — never their values or its description. */
 export function toolDigest(spec) {
     const { about: _about, ...terms } = spec;
-    return createHash("sha256").update(`standing-orders:tool:v1:${canonical(terms)}`, "utf8").digest("hex").slice(0, 32);
+    return createHash("sha256").update(`standing-orders:tool:v1:${canonicalJson(terms)}`, "utf8").digest("hex").slice(0, 32);
 }
 const str = (value, cap, what) => {
     if (typeof value !== "string" || value.trim() === "" || value.length > cap)

package/dist/provider.d.ts

@@ -335,23 +335,6 @@ export type ProviderMoneyCapabilities = {
     usageSemantics: "per-invocation" | "cumulative-session";
 };
 export declare const MONEY_CAPABILITIES: Record<ProviderId, ProviderMoneyCapabilities>;
-/**
- * The fail-closed budget-flag probe (finding 24's amendment): resolve
- * the EXACT executable that will spawn, read its version, and prove the
- * flag exists in that binary's own help — presence is a feature check
- * and nothing more.
- */
-export declare function probeBudgetCap(provider: ProviderId, runner: (command: string, argv: readonly string[], options: {
-    timeoutMs?: number;
-    omitEnv?: readonly string[];
-}) => Promise<ExecResult>): Promise<{
-    ok: true;
-    executable: string;
-    version: string;
-} | {
-    ok: false;
-    problem: string;
-}>;
 export declare function auditOf(provider: ProviderId): ProviderAudit;
 /**
  * A spec a person or a config row proposed, validated to a complete pair.