toolroll 0.9.65 → 0.9.68

package/dist/subagents.js

@@ -17,21 +17,17 @@
  * spending — those stay with people (or a signed hands-off mode).
  */
 import { Buffer } from "node:buffer";
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { strictJsonParse } from "./converse.js";
 import { scanForSecrets } from "./evidence.js";
 import { run } from "./exec.js";
+import { CLAUDE_NO_TOOLS_ARGS, CLAUDE_SIGNED_OUT, claudeJsonBody, claudeModelArgs, inScratchDir } from "./claude-print.js";
 import { ALL_CREDENTIAL_ENV } from "./provider.js";
 import { readTurnAnswer, TURN_MODEL_SCHEMA } from "./contracts/subagent-turn.js";
 import { LIMITS } from "./decision.js";
 import { overruns, TEXT_LIMITS } from "./text-limits.js";
 export const SOUL_CHARS = 12_000;
-const HANDLE = /^[a-z0-9][a-z0-9-]{0,31}$/;
 /** A handle from a name: "Maya" → "maya". */
 export const handleOf = (name) => name.toLowerCase().normalize("NFKD").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 32) || "subagent";
-export const isHandle = (value) => typeof value === "string" && HANDLE.test(value);
 /** A soul file read: its name and role (front matter) and its sections. */
 export function parseSoul(text) {
     const normal = text.replace(/\r\n?/g, "\n").trim();
@@ -220,36 +216,27 @@ export function readTurn(value, context) {
 export const TURN_TIMEOUT_MS = 180_000;
 /** The production runner: Claude through this computer's sign-in, answering in the turn schema (TURN_MODEL_SCHEMA), with no tools, no MCP servers and no repository. */
 export function claudeTurnRunner(runner = run) {
-    return async (request) => {
-        const dir = mkdtempSync(join(tmpdir(), "standing-orders-subagent-"));
+    return request => inScratchDir("standing-orders-subagent-", async (dir) => {
         const started = Date.now();
-        try {
-            const result = await runner("claude", [
-                "-p", "--output-format", "json", "--json-schema", JSON.stringify(TURN_MODEL_SCHEMA), "--safe-mode", "--no-session-persistence", "--tools", "", "--permission-mode", "dontAsk",
-                "--permission-prompts", "none", "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}',
-                ...(request.model === "default" ? [] : ["--model", request.model]),
-            ], { cwd: dir, stdin: request.prompt, timeoutMs: request.timeoutMs, maxBuffer: 512 * 1024, omitEnv: ALL_CREDENTIAL_ENV, processGroup: true });
-            if (result.notFound)
-                return { ok: false, said: "Claude isn't installed on this computer." };
-            if (result.timedOut)
-                return { ok: false, said: "Claude took too long to decide." };
-            const parsed = strictJsonParse(Buffer.from(result.stdout, "utf8"), 512 * 1024, 12);
-            const body = parsed.ok && typeof parsed.value === "object" && parsed.value !== null && !Array.isArray(parsed.value) ? parsed.value : null;
-            if (result.code !== 0 || body === null || body["is_error"] === true || body["subtype"] !== "success") {
-                const why = typeof body?.["subtype"] === "string" && body["subtype"] !== "success" ? ` (${String(body["subtype"]).replace(/_/g, " ").slice(0, 60)})` : result.code !== 0 ? ` (exit ${result.code})` : "";
-                return { ok: false, said: /not logged in|login|authenticat/i.test(`${result.stdout}${result.stderr}`) ? "Claude isn't signed in on this computer." : `Claude couldn't decide${why}.` };
-            }
-            const cost = costOf(body);
-            if (body["structured_output"] !== undefined && body["structured_output"] !== null)
-                return { ok: true, value: body["structured_output"], ms: Date.now() - started, ...cost };
-            const text = typeof body["result"] === "string" ? body["result"].trim().replace(/^```(?:json)?\n?|\n?```$/g, "") : "";
-            const inner = strictJsonParse(Buffer.from(text, "utf8"), 64 * 1024, 8);
-            return inner.ok ? { ok: true, value: inner.value, ms: Date.now() - started, ...cost } : { ok: false, said: "Claude's answer wasn't a decision.", ...cost };
+        const result = await runner("claude", [
+            "-p", "--output-format", "json", "--json-schema", JSON.stringify(TURN_MODEL_SCHEMA), ...CLAUDE_NO_TOOLS_ARGS, ...claudeModelArgs(request.model),
+        ], { cwd: dir, stdin: request.prompt, timeoutMs: request.timeoutMs, maxBuffer: 512 * 1024, omitEnv: ALL_CREDENTIAL_ENV, processGroup: true });
+        if (result.notFound)
+            return { ok: false, said: "Claude isn't installed on this computer." };
+        if (result.timedOut)
+            return { ok: false, said: "Claude took too long to decide." };
+        const body = claudeJsonBody(result.stdout, 512 * 1024);
+        if (result.code !== 0 || body === null || body["is_error"] === true || body["subtype"] !== "success") {
+            const why = typeof body?.["subtype"] === "string" && body["subtype"] !== "success" ? ` (${String(body["subtype"]).replace(/_/g, " ").slice(0, 60)})` : result.code !== 0 ? ` (exit ${result.code})` : "";
+            return { ok: false, said: CLAUDE_SIGNED_OUT.test(`${result.stdout}${result.stderr}`) ? "Claude isn't signed in on this computer." : `Claude couldn't decide${why}.` };
         }
-        finally {
-            rmSync(dir, { recursive: true, force: true });
-        }
-    };
+        const cost = costOf(body);
+        if (body["structured_output"] !== undefined && body["structured_output"] !== null)
+            return { ok: true, value: body["structured_output"], ms: Date.now() - started, ...cost };
+        const text = typeof body["result"] === "string" ? body["result"].trim().replace(/^```(?:json)?\n?|\n?```$/g, "") : "";
+        const inner = strictJsonParse(Buffer.from(text, "utf8"), 64 * 1024, 8);
+        return inner.ok ? { ok: true, value: inner.value, ms: Date.now() - started, ...cost } : { ok: false, said: "Claude's answer wasn't a decision.", ...cost };
+    });
 }
 /** What the CLI says a turn cost, and its tokens (cache reads and writes count as input). */
 function costOf(body) {

package/dist/subscription-chat.d.ts

@@ -1,5 +1,5 @@
 import { type LeadHistoryMessage, type LeadProviderAnswer, type LeadToolSchema } from "./converse.js";
-import { run, type ExecResult } from "./exec.js";
+import { type CommandRunner } from "./claude-print.js";
 import type { SubscriptionChatProviderId } from "./store.js";
 export type SubscriptionLeadRequest = {
     provider: SubscriptionChatProviderId;
@@ -27,7 +27,6 @@ export type SubscriptionLeadRunner = (request: SubscriptionLeadRequest) => Promi
     ok: false;
     problem: string;
 }>;
-type CommandRunner = (file: string, args: readonly string[], options: Parameters<typeof run>[2]) => Promise<ExecResult>;
 /** The model-visible request. Tool results are already redacted by leadView. */
 export declare function composeSubscriptionLeadPrompt(request: Omit<SubscriptionLeadRequest, "provider" | "model" | "timeoutMs" | "signal">): string;
 /** Strictly turn the harness's structured output into the provider-neutral answer. */
@@ -49,4 +48,3 @@ export declare function performSubscriptionLeadRequest(request: SubscriptionLead
     ok: false;
     problem: string;
 }>;
-export {};

package/dist/subscription-chat.js

@@ -16,6 +16,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { LEAD_MAX_CALLS_PER_STEP, LEAD_STEP_TEXT_CAP_BYTES, LEAD_TOOL_CALL_CAP_BYTES, LEAD_TOOL_CALL_ID_CAP_BYTES, strictJsonParse, tokenCount, } from "./converse.js";
 import { run } from "./exec.js";
+import { CLAUDE_NO_TOOLS_ARGS, claudeModelArgs } from "./claude-print.js";
 import { claudeStreamReader } from "./lead-progress.js";
 import { ALL_CREDENTIAL_ENV } from "./provider.js";
 import { claudeLimitsOf, noteLimits } from "./provider-limits.js";
@@ -215,9 +216,7 @@ export async function performSubscriptionLeadRequest(request, runner = run) {
                 // Streaming (someone is watching): the same answer, delivered as
                 // events whose final `result` line is the whole structured reply.
                 "-p", ...(streaming ? ["--output-format", "stream-json", "--verbose", "--include-partial-messages"] : ["--output-format", "json"]), "--json-schema", JSON.stringify(schema),
-                "--safe-mode", "--no-session-persistence", "--tools", "", "--permission-mode", "dontAsk",
-                "--permission-prompts", "none", "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}',
-                ...(request.model === "default" ? [] : ["--model", request.model]),
+                ...CLAUDE_NO_TOOLS_ARGS, ...claudeModelArgs(request.model),
             ];
         }
         const result = await runner(command, args, {

package/dist/task-sizing.d.ts

@@ -1,5 +1,5 @@
 import { type SizeAnswer } from "./contracts/task-sizing.js";
-import { run, type ExecResult } from "./exec.js";
+import { type CommandRunner } from "./claude-print.js";
 import { type TaskSizing } from "./phase-routing.js";
 import type { Store } from "./store.js";
 /** The classifier's whole budget, from asking to answer. */
@@ -24,7 +24,6 @@ export declare function planningSignals(input: SizingInput): boolean;
 export declare function heuristicSizing(input: SizingInput, why?: string | null): TaskSizing;
 /** What the classifier reads: the task as data, bounded, keys blanked. */
 export declare function sizingText(input: SizingInput): string;
-type CommandRunner = (file: string, args: readonly string[], options: Parameters<typeof run>[2]) => Promise<ExecResult>;
 /** A small Claude model on this computer's sign-in: no tools, no MCP servers, no repository, credential keys stripped.
  * The abort ends it: a late answer never keeps a command (or its process) waiting. */
 export declare function claudeSizer(runner?: CommandRunner, model?: string, budgetMs?: number): Sizer;
@@ -41,8 +40,6 @@ export declare function classifyTask(input: SizingInput, sizer: Sizer | null, bu
 /** Install the process's classifier for filings (the CLI, the console, the worker); returns how to remove it. Unset,
  * filings keep the description's size — tests never spend a turn. */
 export declare function installFilingSizer(sizer: Sizer, budgetMs?: number): () => void;
-/** Whether filings in this process are classified. */
-export declare function filingSizerInstalled(): boolean;
 /**
  * After a filing: ask the classifier (within the budget) and apply its size
  * to the still-unapproved task. Runs in the background; the filing already

package/dist/task-sizing.js

@@ -15,15 +15,14 @@
  * The task text is data to the classifier, never instructions, and all it
  * can return is one of three sizes, a yes/no, and a short reason.
  */
-import { Buffer } from "node:buffer";
 import { randomUUID } from "node:crypto";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { readSizeAnswer, SIZING_MODEL_SCHEMA } from "./contracts/task-sizing.js";
-import { strictJsonParse } from "./converse.js";
 import { redactSecretLines, scanForSecrets } from "./evidence.js";
 import { run, terminateOwnedProcesses } from "./exec.js";
+import { CLAUDE_NO_TOOLS_ARGS, claudeJsonBody } from "./claude-print.js";
 import { JEV_MODEL, JEV_URL } from "./flow-sort.js";
 import { readProviderKey } from "./keys.js";
 import {} from "./phase-routing.js";
@@ -93,13 +92,11 @@ export function claudeSizer(runner = run, model = SIZING_CLAUDE_MODEL, budgetMs
                 sizingText(input),
             ].join("\n");
             const result = await runner("claude", [
-                "-p", "--output-format", "json", "--json-schema", JSON.stringify(SIZING_MODEL_SCHEMA), "--safe-mode", "--no-session-persistence", "--tools", "", "--permission-mode", "dontAsk",
-                "--permission-prompts", "none", "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}', "--model", model,
+                "-p", "--output-format", "json", "--json-schema", JSON.stringify(SIZING_MODEL_SCHEMA), ...CLAUDE_NO_TOOLS_ARGS, "--model", model,
             ], { cwd: dir, stdin: prompt, timeoutMs: budgetMs, maxBuffer: 256 * 1024, omitEnv: ALL_CREDENTIAL_ENV, processGroup: true, owner, beforeSpawn: () => !signal.aborted });
             if (signal.aborted || result.notFound || result.timedOut || result.code !== 0)
                 return null;
-            const parsed = strictJsonParse(Buffer.from(result.stdout, "utf8"), 256 * 1024, 12);
-            const body = parsed.ok && typeof parsed.value === "object" && parsed.value !== null && !Array.isArray(parsed.value) ? parsed.value : null;
+            const body = claudeJsonBody(result.stdout, 256 * 1024);
             if (body === null || body["is_error"] === true || body["subtype"] !== "success")
                 return null;
             return answerOf(body["structured_output"]);
@@ -184,10 +181,6 @@ export function installFilingSizer(sizer, budgetMs = SIZING_BUDGET_MS) {
     return () => { installed = previous; budget = previousBudget; };
 }
 let budget = SIZING_BUDGET_MS;
-/** Whether filings in this process are classified. */
-export function filingSizerInstalled() {
-    return installed !== null;
-}
 /**
  * After a filing: ask the classifier (within the budget) and apply its size
  * to the still-unapproved task. Runs in the background; the filing already

package/dist/teams-chat.js

@@ -6,12 +6,11 @@ import { chatAskButtons } from "./chat-ask.js";
 import { ChatDeliveryError, ChatState, chatHash, partContent } from "./chat-delivery-state.js";
 import { channelAccess, chatObject as object, heldForWatch, planChatNotifications, planRoomMessages, processChatEvent, splitChatText } from "./chat-delivery.js";
 import { PLATFORM_LIMITS } from "./text-limits.js";
-import { roomCommand } from "./chat-rooms.js";
 import { LEAD_MESSAGE_MAX_CHARS } from "./lead.js";
 import { renderReply } from "./reply-shape.js";
 import { armedCardText, armedYesLabel, proposalLink, proposalOutcomeText, proposalPreview } from "./chat-channel.js";
 import { chatFlowButtons } from "./chat-flow.js";
-import { channelInbox } from "./chat-inbox.js";
+import { admitChatEvent } from "./chat-admission.js";
 import { chatResultHref } from "./chat-controls.js";
 import { TeamsError } from "./teams-api.js";
 import { readTeamsSubmit } from "./contracts/teams-callback.js";
@@ -113,16 +112,10 @@ export function receiveTeams(state, identity, raw, serviceUrlClaim, now) {
             ...(Array.isArray(activity.attachments) && activity.attachments.length > 0 ? { unsupported: "Incoming files are not supported yet. Describe the request in a message; saved result screenshots open from their links." } : {}) };
         eventId = chatHash(`${identity.installation}:message:${id}`);
     }
-    const words = "text" in payload ? payload.text ?? "" : "";
-    // v89: a channel that feeds a flow takes anyone's message (as a card, with no say over anything); "flow 12" connects one.
-    const inbox = isRoom && kind === "message" ? channelInbox(state.store, "teams", identity.installation, channel, words) : { watched: false, command: false };
-    const roomish = isRoom && (state.room(identity.installation, channel) !== null || (kind === "message" && roomCommand(words) !== null) || inbox.watched || inbox.command);
-    if (isRoom && !roomish)
-        return false;
-    const binding = state.bindingFor(identity.installation, member);
-    const open = inbox.watched && !inbox.command;
-    if (kind === "pair" ? !!binding || isRoom : !open && (!binding || !state.live(binding) || (binding.channel !== channel && !roomish)))
+    const admitted = admitChatEvent(state, "teams", identity.installation, { kind, member, channel, isRoom, payload });
+    if (admitted === null)
         return false;
+    const { binding } = admitted;
     return state.store.transact(() => {
         state.setMeta(identity.installation, serviceKey(channel), activity.serviceUrl, now);
         return state.enqueue({

package/dist/teams.js

@@ -4,7 +4,7 @@ import { adapterPolicy } from "./server/route-policy.js";
  * has no client-initiated socket, so inbound activities arrive over HTTPS
  * and everything else runs from the database like the other channels. */
 import { randomBytes } from "node:crypto";
-import { setTimeout as sleep } from "node:timers/promises";
+import { abortablePause, workChatQueue } from "./chat-follow.js";
 import { ChatState } from "./chat-delivery-state.js";
 import { chatObject as object } from "./chat-delivery.js";
 import { loadTeamsCredentials, teamsAccessToken, teamsApi, verifyTeamsToken, TeamsError } from "./teams-api.js";
@@ -78,10 +78,7 @@ export async function handleTeamsHttp(request, response, options) {
 /** The worker-side loop: a lease per installation, one pass a second. */
 export async function followTeams(options) {
     const owner = randomBytes(16).toString("hex"), state = new ChatState(options.store, "teams");
-    const pause = async (ms) => { try {
-        await sleep(ms, undefined, { signal: options.signal });
-    }
-    catch { /* shutdown */ } };
+    const pause = abortablePause(options.signal);
     while (!options.signal.aborted) {
         const credentials = loadTeamsCredentials(options.dir);
         if (!credentials || !state.lease(credentials.installation, owner, new Date())) {
@@ -110,20 +107,16 @@ export async function followTeams(options) {
                 await pause(30_000);
                 continue;
             }
-            while (same()) {
-                if (state.retryAt(credentials.installation) > new Date().toISOString()) {
-                    await pause(1000);
-                    continue;
-                }
-                await processTeamsEvent(chat);
-                if (same())
-                    await planTeamsRooms(chat);
-                if (same())
-                    await deliverTeamsPart(chat);
-                if (same() && options.notifications())
-                    await planTeamsNotifications(chat);
-                await pause(1000);
-            }
+            await workChatQueue({
+                same,
+                ready: () => !(state.retryAt(credentials.installation) > new Date().toISOString()),
+                pause,
+                notifications: () => options.notifications(),
+                process: () => processTeamsEvent(chat),
+                rooms: () => planTeamsRooms(chat),
+                deliver: () => deliverTeamsPart(chat),
+                notify: () => planTeamsNotifications(chat),
+            });
         }
         catch {
             if (alive)

package/dist/teardown-git.d.ts

@@ -8,7 +8,29 @@ export declare const REFUSED_CODE = 128;
 /** The command-running setting a `git config --list --show-scope -z` listing sets, or null. Only local and worktree
  * scope count: teardown commands never read system or global config. */
 export declare function commandSetting(listing: string): string | null;
+/** The `-c` settings that carry the operator's own values (CARRIED_VALUES, LFS_FILTER) from a global/system listing. */
+export declare function carriedSettings(listing: string): string[];
 /** Why a teardown command was refused, or null when `result` isn't a refusal. */
 export declare function refusal(result: ExecResult): string | null;
 /** The one way teardown runs git, including the target checkout immediately before removal. */
 export declare function teardownGit(runner?: Runner): Git;
+/**
+ * Git on a build's checkout, as the plane runs it outside every fence (staging, committing and inspecting the build's
+ * work): the same fixed hardening as teardown (no hooks, fsmonitor, ext transport, credential helpers or automatic
+ * maintenance, no submodule recursion, no signing), refused outright when the checkout's own config includes a file
+ * or names a command — a filter, an external diff, a textconv, a pager — which a build could have planted. It reads no
+ * global or system config: only their values (identity, line endings, a standard git-lfs install) are carried over.
+ * It never enters a submodule or nested repository (whose config it never read).
+ */
+/**
+ * Whether a checkout's own git config (its repository's config and its worktree's config.worktree) includes another
+ * file, read without git: every git command follows includes as it starts, so an include of the build's could point
+ * git at any file, a pipe that never ends among them. Each file is read only as the regular file it is, bounded; one
+ * that can't be read so counts as including.
+ */
+export declare function checkoutIncludes(checkout: string): boolean;
+/** Whether the checkout's .lfsconfig (read as git parses it, that file only) sets any git-lfs key that could name a
+ * program (anything but INERT_LFS). A file that
+ * isn't a plain one, or doesn't parse, counts as naming one. */
+export declare function lfsExtensionIn(checkout: string): boolean;
+export declare function checkoutGit(inner?: Runner): Runner;

package/dist/teardown-git.js

@@ -10,7 +10,8 @@
  * any of them the command never runs. The refusal is a failed git result, so every caller's existing doubt applies and
  * nothing is removed.
  */
-import { existsSync, readdirSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { existsSync, lstatSync, readdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { run } from "./exec.js";
 import { ENV, ENV_ALLOWLIST } from "./remote-main.js";
@@ -31,6 +32,10 @@ const COMMAND_KEYS = [
     "diff.*.command", "diff.*.textconv", "merge.*.driver", "gpg.program", "gpg.*.program", "uploadpack.packobjectshook",
     "remote.*.uploadpack", "remote.*.receivepack", "remote.*.vcs", "pager.*", "include.path", "includeif.*.path",
 ].map(key => new RegExp(`^${key.replace(/\./g, "\\.").replace(/\*/g, ".+")}$`));
+/** git-lfs settings that name no program (where it fetches, what, whether it checks locks, how it signs in); any other
+ * `lfs.*` key in a checkout's own config could (extensions, custom and standalone transfer agents), so it's refused. */
+const INERT_LFS = /^lfs\.(url|pushurl|fetchinclude|fetchexclude|locksverify|repositoryformatversion|.+\.access|.+\.locksverify|setlockablereadonly|skipdownloaderrors|concurrenttransfers)$/;
+const lfsCommand = (key) => key.startsWith("lfs.") && !INERT_LFS.test(key);
 /** core.fsmonitor as a boolean is git's own daemon; anything else is a command to run. */
 const BOOLEAN = /^(|true|false|yes|no|on|off|-?\d+)$/i;
 /** The command-running setting a `git config --list --show-scope -z` listing sets, or null. Only local and worktree
@@ -45,11 +50,40 @@ export function commandSetting(listing) {
         const newline = entry.indexOf("\n");
         const key = (newline < 0 ? entry : entry.slice(0, newline)).toLowerCase();
         const value = newline < 0 ? "" : entry.slice(newline + 1);
-        if (key === "core.fsmonitor" ? !BOOLEAN.test(value.trim()) : COMMAND_KEYS.some(pattern => pattern.test(key)))
+        if (key === "core.fsmonitor" ? !BOOLEAN.test(value.trim()) : COMMAND_KEYS.some(pattern => pattern.test(key)) || lfsCommand(key))
             return key;
     }
     return null;
 }
+/**
+ * What the plane's git on a build's checkout keeps of the operator's own (global and system) configuration: values,
+ * never commands — identity, line endings, ignore and case settings — and git-lfs's filters only as git-lfs itself
+ * installs them, exactly. Everything else there (filters, diff drivers, fsmonitor, signing and its key commands,
+ * whatever an include brings in) is left out, so nothing in it can run a file of the checkout's.
+ */
+const CARRIED_VALUES = new Set(["user.name", "user.email", "core.autocrlf", "core.eol", "core.safecrlf", "core.excludesfile", "core.ignorecase",
+    "core.precomposeunicode", "core.quotepath", "core.filemode", "core.symlinks", "core.longpaths"]);
+const LFS_FILTER = {
+    "filter.lfs.clean": "git-lfs clean -- %f", "filter.lfs.smudge": "git-lfs smudge -- %f", "filter.lfs.process": "git-lfs filter-process", "filter.lfs.required": "true",
+};
+/** The `-c` settings that carry the operator's own values (CARRIED_VALUES, LFS_FILTER) from a global/system listing. */
+export function carriedSettings(listing) {
+    const fields = listing.split("\0");
+    const carried = new Map();
+    for (let at = 0; at + 1 < fields.length; at += 2) {
+        if (fields[at] !== "global" && fields[at] !== "system")
+            continue;
+        const entry = fields[at + 1];
+        const newline = entry.indexOf("\n");
+        if (newline < 0)
+            continue;
+        const key = entry.slice(0, newline).toLowerCase();
+        const value = entry.slice(newline + 1);
+        if (CARRIED_VALUES.has(key) || LFS_FILTER[key] === value)
+            carried.set(key, value);
+    }
+    return [...carried].flatMap(([key, value]) => ["-c", `${key}=${value}`]);
+}
 /** Why a teardown command was refused, or null when `result` isn't a refusal. */
 export function refusal(result) {
     return result.code === REFUSED_CODE && result.stderr.startsWith(REFUSED_PREFIX) ? result.stderr.slice(REFUSED_PREFIX.length).trim() : null;
@@ -117,3 +151,103 @@ export function teardownGit(runner = run) {
         return runner("git", [...TEARDOWN_FLAGS, ...safeArgs], options(cwd));
     };
 }
+/**
+ * Git on a build's checkout, as the plane runs it outside every fence (staging, committing and inspecting the build's
+ * work): the same fixed hardening as teardown (no hooks, fsmonitor, ext transport, credential helpers or automatic
+ * maintenance, no submodule recursion, no signing), refused outright when the checkout's own config includes a file
+ * or names a command — a filter, an external diff, a textconv, a pager — which a build could have planted. It reads no
+ * global or system config: only their values (identity, line endings, a standard git-lfs install) are carried over.
+ * It never enters a submodule or nested repository (whose config it never read).
+ */
+/**
+ * Whether a checkout's own git config (its repository's config and its worktree's config.worktree) includes another
+ * file, read without git: every git command follows includes as it starts, so an include of the build's could point
+ * git at any file, a pipe that never ends among them. Each file is read only as the regular file it is, bounded; one
+ * that can't be read so counts as including.
+ */
+export function checkoutIncludes(checkout) {
+    const regular = (path) => {
+        try {
+            const held = lstatSync(path);
+            if (!held.isFile() || held.size > 1024 * 1024)
+                return null;
+            return readFileSync(path, "utf8");
+        }
+        catch {
+            return null;
+        }
+    };
+    let gitdir = join(checkout, ".git");
+    try {
+        if (!lstatSync(gitdir).isDirectory()) {
+            // As git reads a .git file: "gitdir: " then the path, one line; anything else (more lines, stray space) refused.
+            const text = (regular(gitdir) ?? "").replace(/\r?\n$/, "");
+            if (!text.startsWith("gitdir: ") || /[\r\n]/.test(text))
+                return true;
+            const pointer = text.slice("gitdir: ".length);
+            if (pointer === "" || pointer !== pointer.trim())
+                return true;
+            gitdir = resolve(checkout, pointer);
+        }
+    }
+    catch {
+        return true;
+    }
+    const common = (() => { const named = regular(join(gitdir, "commondir"))?.trim(); return named === undefined || named === "" ? gitdir : resolve(gitdir, named); })();
+    for (const path of [join(common, "config"), join(gitdir, "config.worktree")]) {
+        if (!existsSync(path) && path.endsWith("config.worktree"))
+            continue;
+        const text = regular(path);
+        if (text === null || /^\s*\[\s*include(if)?\b/im.test(text))
+            return true;
+        // And as git itself parses it, includes not followed (only this one regular file, from a neutral folder, with no
+        // other config read): an include git sees by any spelling is refused.
+        const parsed = spawnSync("git", ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
+        if (parsed.status !== 0 || parsed.stdout.split("\0").some(name => /^(include\.path|includeif\..*\.path)$/i.test(name)))
+            return true;
+    }
+    return false;
+}
+/** Whether the checkout's .lfsconfig (read as git parses it, that file only) sets any git-lfs key that could name a
+ * program (anything but INERT_LFS). A file that
+ * isn't a plain one, or doesn't parse, counts as naming one. */
+export function lfsExtensionIn(checkout) {
+    const path = join(checkout, ".lfsconfig");
+    try {
+        if (!lstatSync(path).isFile())
+            return true;
+    }
+    catch {
+        return false;
+    }
+    const parsed = spawnSync("git", ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
+    return parsed.status !== 0 || parsed.stdout.split("\0").filter(Boolean).some(name => lfsCommand(name.toLowerCase()) || /^include(if)?\./i.test(name));
+}
+export function checkoutGit(inner = run) {
+    return async (file, args, options) => {
+        if (file !== "git")
+            return inner(file, args, options);
+        const cwd = options?.cwd;
+        if (cwd === undefined || checkoutIncludes(cwd))
+            return refused("the checkout's git config includes another file, or couldn't be read as a plain file");
+        // git-lfs also reads .lfsconfig from the checkout: one that names an extension (a command it would run) is refused.
+        if (lfsExtensionIn(cwd))
+            return refused("the checkout's .lfsconfig sets a git-lfs key that can run a command");
+        // The checkout's own config may name no command.
+        const own = await inner("git", ["--no-optional-locks", "config", "--list", "--show-scope", "-z"], options);
+        if (own.code !== 0)
+            return refused("its config couldn't be read");
+        const key = commandSetting(own.stdout);
+        if (key !== null)
+            return refused(`the checkout's git config sets ${key}, which can run a command`);
+        // The operator's own config contributes values only (carriedSettings); git then reads no global or system config.
+        const carried = carriedSettings(own.stdout);
+        const env = { ...(options?.env ?? {}), GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null" };
+        // Never into a submodule or nested repository, whose own config this never read: status and diff skip them.
+        const safeArgs = [...args];
+        const command = safeArgs.findIndex(arg => arg === "status" || arg === "diff");
+        if (command >= 0 && !safeArgs.includes("--ignore-submodules=all"))
+            safeArgs.splice(command + 1, 0, "--ignore-submodules=all");
+        return inner("git", [...TEARDOWN_FLAGS, "-c", "diff.ignoreSubmodules=all", "-c", "commit.gpgsign=false", "-c", "tag.gpgsign=false", ...carried, ...safeArgs], { ...options, env });
+    };
+}

package/dist/telegram-lead.js

@@ -1,5 +1,5 @@
 import { CHAT_ACTIONS, sharedActionAllowsChallenge, sharedActionPayload } from "./chat-actions.js";
-import { taskInCeiling, mirrorToTaskChat, couldNotAnswerText, channelRepos as telegramConversationRepos, resolveChannelLead as resolveTelegramLead, tooLongText, whichTaskText, replyContextFor, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText } from "./chat-channel.js";
+import { taskInCeiling, mirrorToTaskChat, couldNotAnswerText, channelRepos as telegramConversationRepos, resolveChannelLead as resolveTelegramLead, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText } from "./chat-channel.js";
 export { channelRepos as telegramConversationRepos, resolveChannelLead as resolveTelegramLead, tooLongText, whichTaskText, replyContextFor, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText, CHAT_ACTION_PARITY as TELEGRAM_ACTION_PARITY, parityGaps } from "./chat-channel.js";
 /**
  * The paired phone as one more way to use the same assistant.
@@ -23,7 +23,7 @@ export { channelRepos as telegramConversationRepos, resolveChannelLead as resolv
  * the console and CLI state), and the door re-proves everything again.
  */
 import { createHash, randomBytes } from "node:crypto";
-import { LEAD_MESSAGE_MAX_CHARS, leadFailureText, runLeadTurn } from "./lead.js";
+import { leadFailureText, runLeadTurn } from "./lead.js";
 import { confirmLeadProposal, dismissLeadProposal } from "./lead-doors.js";
 import { ceilingDigestOf, verifyApproverStanding } from "./principal.js";
 import { LEAD_ASK_OTHER } from "./store.js";

package/dist/telegram.js

@@ -27,7 +27,7 @@ import { chmodSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { closedQuestionWords, validateNote } from "./decision.js";
 import { isShotsKind, resultShotsFor } from "./result-shots.js";
-import { isLifecycleNotification, isTelegramProgressNotification, RESULT_SHOTS_KIND, TELEGRAM_HOLD_REASONS } from "./store.js";
+import { isLifecycleNotification, isTelegramProgressNotification, TELEGRAM_HOLD_REASONS } from "./store.js";
 import { telegramProgressCard } from "./telegram-progress.js";
 import { enqueueEveningDigests, finishedView, isTaskFact, joinsBatch, needsPerson, quietCardView } from "./chat-quiet.js";
 import { BATCH_MS, chatText, chatTitle, factLinkLabel, mentions, nameTelegramBot } from "./chat-voice.js";

package/dist/token-notices.d.ts

@@ -1,10 +1,3 @@
-/**
- * API token notices (v111): 7 days and 1 day before a token expires, its person is told once each, in their own chats
- * and browsers (a personal notification), and the ledger keeps it. Only the nearest notice newly due is sent, so a
- * token made with a day left says so once. Replaced and revoked tokens get none. The same pass records the end of each
- * rotated token whose overlap has passed; it already signs no one in (tokenLive), so a late pass grants nothing.
- */
-import { tokenLive } from "./api-tokens.js";
 import type { Store } from "./store.js";
 export declare const TOKEN_NOTICE_KIND = "api-token-expiry";
 export declare function tokenNoticePass(store: Store, now: Date): {
@@ -14,9 +7,5 @@ export declare function tokenNoticePass(store: Store, now: Date): {
     }[];
     ended: number;
 };
-/** Whether a token's console card warns that it expires soon (within the first notice's days). */
-export declare function expiresSoon(token: Parameters<typeof tokenLive>[0] & {
-    replacedBy: string | null;
-}, now: number): boolean;
 /** The loop beside the console: a pass a minute. */
 export declare function startTokenNotices(store: Store, everyMs?: number): () => void;

package/dist/token-notices.js

@@ -4,7 +4,7 @@
  * token made with a day left says so once. Replaced and revoked tokens get none. The same pass records the end of each
  * rotated token whose overlap has passed; it already signs no one in (tokenLive), so a late pass grants nothing.
  */
-import { expiryNoticeDue, EXPIRY_NOTICE_DAYS, tokenLive } from "./api-tokens.js";
+import { expiryNoticeDue, EXPIRY_NOTICE_DAYS } from "./api-tokens.js";
 export const TOKEN_NOTICE_KIND = "api-token-expiry";
 export function tokenNoticePass(store, now) {
     const ended = store.endRotatedApiTokens(now);
@@ -32,10 +32,6 @@ export function tokenNoticePass(store, now) {
     }
     return { sent, ended };
 }
-/** Whether a token's console card warns that it expires soon (within the first notice's days). */
-export function expiresSoon(token, now) {
-    return expiryNoticeDue(token, now) !== null;
-}
 /** The loop beside the console: a pass a minute. */
 export function startTokenNotices(store, everyMs = 60_000) {
     let stopped = false;

package/dist/tool-broker.d.ts

@@ -11,7 +11,13 @@ export type BrokerOptions = {
     omitEnv?: readonly string[];
     /** Toolroll's own settings for a local server (the run's isolated database), passed as they are. */
     pass?: Readonly<Record<string, string>>;
+    /** Where a local server starts: a folder the build can't write (never its checkout). */
     cwd?: string;
+    /** Folders the build writes (its checkout, its caches): a server whose command, or a path it's given, resolves inside
+     * one is never started, since it would run the build's own bytes outside the build's limits. */
+    untrusted?: readonly string[];
+    /** Why a local server may not start unwrapped (no fence for it here), read when it would; null when it may. */
+    unwrapped?: () => string | null;
     /** How a local server is started inside its run's fence, read when it starts (the fence is fixed after the tools). */
     wrap?: () => ((file: string, args: readonly string[]) => {
         file: string;
@@ -35,5 +41,11 @@ export declare const SERVER_ENV: readonly string[];
 /** A local server's environment: the allowlisted names from `base` (and its LC_* locale), less `omit`, then `pass`,
  * then the tool's own values. */
 export declare function serverEnv(base: NodeJS.ProcessEnv, omit: readonly string[], pass: Readonly<Record<string, string>>, values: Readonly<Record<string, string>>): NodeJS.ProcessEnv;
+/**
+ * The first of a server's command and path-like arguments that resolves inside an untrusted folder (a build's checkout
+ * or caches), or null. The command is resolved as spawn would: a path against `cwd`, a bare name through PATH; an
+ * argument counts when it names an existing path (relative to `cwd`) or is written as one (`./x`, `../x`, `/x`).
+ */
+export declare function workspaceBytes(command: string, args: readonly string[], cwd: string | undefined, path: string | undefined, untrusted: readonly string[]): string | null;
 /** Start one launch's broker on a loopback port. */
 export declare function startToolBroker(tools: readonly BrokeredTool[], options?: BrokerOptions): Promise<ToolBroker>;