toolroll 0.9.67 → 0.9.69

package/CHANGELOG.md

@@ -1,5 +1,75 @@
 # Changelog
 
+## 0.9.69 — 2026-10-23
+
+- **Choose how far a project's checks reach.** Settings → Project has a new
+  Check access section, and `toolroll project check-access --repo <p>` shows
+  or sets the same thing. **Sandboxed** (the default) runs a project's setup
+  and check commands in the plane's fence, as before. **Not sandboxed** runs
+  them with your full access, as before 0.9.66: for a project whose checks
+  must create sandboxes themselves, such as Toolroll's own.
+- Widening takes an instance operator with their password typed now (a
+  remembered sign-in or a single sign-on recheck doesn't count). Any approver
+  for the project can narrow it back. Each change is in the ledger.
+- The level is part of what you approve. A scope seals it, the approval card
+  says "Checks: not sandboxed", and tasks already approved keep the level
+  they were approved with. Each run records the level its checks actually ran
+  at, and the result page says when they ran without a sandbox. Later checks
+  of a saved result never run wider than that run did. A mode, a grant or a
+  chat confirmation can't approve a wider level; only a person's password can.
+- **A third level, "Sandboxed, with model and GitHub sign-ins", is built but
+  off.** It would let a check read your Claude, Codex and GitHub sign-in files.
+  Reading those files safely needs a way to open a file that a running build
+  can't redirect partway (Node can't do that yet), so the option is shown
+  disabled with the reason. Choosing it is refused, and a level saved before
+  runs sandboxed and says so.
+- **The fence holds your home configuration by name.** `~/.codex`,
+  `~/.config/gh`, `~/.ssh` and the rest are denied whether or not they exist
+  when a build starts, so a build can't create one or swap it for a link
+  later. The folders above them can't be renamed or made during a build.
+- A check's temporary folder on a Mac is now short (under `/private/tmp`), so
+  tests that open a unix socket there work inside the fence. Other launches'
+  folders stay out of reach.
+- With no OS sandbox on the machine and unconfined running allowed, the
+  settings page and `project check-access` say checks run without a sandbox,
+  whatever level is saved.
+
+## 0.9.68 — 2026-10-23
+
+- **The lead chat is redesigned.** Your messages sit in grey bubbles and the
+  lead's replies read as plain text, with code blocks. Its work folds into one
+  "Worked …" line, live steps show a spinner and then a check, and anything
+  waiting on you carries a "Needs you" chip. The message box is one row that
+  grows as you type, with a send arrow (Queue while a reply runs).
+- **Comment on a line of a change.** In a result's Changes tab, a pin on any
+  line opens a one-line comment. Enter sends it to the lead as its next
+  message, naming the file, line and run and quoting the line. The thread
+  shows it as a reference, the quoted line, and your words. On a phone the
+  result opens as a sheet over the chat.
+- **A fenced check can build bundles from the shared dependencies.** On a Mac
+  the sandbox let a build look up the linked copy's folder but not list it,
+  so esbuild couldn't find node_modules ("could not resolve react"). That one
+  folder may now be listed; nothing in it is readable beyond node_modules.
+  The console's own browser build also resolves through the checkout's links.
+- The release check passes inside the plane's macOS check sandbox: tests that
+  need to create a sandbox or watch other processes skip there and still run
+  in CI, and the browser journeys' throwaway planes run their agents inside
+  the check's own sandbox.
+- A Claude build no longer refuses to start when a sandbox around Toolroll
+  hides your Claude settings file: it signs in from the keychain as before,
+  and a sign-in that needed the file still fails quickly and says so.
+- The test suite reads its own home and temp folders, never yours, so it runs
+  the same on your machine and inside a check's sandbox. Tests that need a
+  socket path shorter than any folder the sandbox allows, and the one browser
+  journey that resumes a saved Claude session, skip inside the sandbox and
+  still run in CI.
+- `toolroll release` no longer stops at merge when GitHub has already deleted
+  the merged branch: it looks a few times, 2 seconds apart, before calling the
+  delete a failure (0.9.66 and 0.9.67 both stopped there).
+- Leaner code, with every feature kept (about 5,600 fewer lines). The
+  deprecated team and native session commands are gone, and `chat` and
+  `brief` without `--local` refuse when a central profile is saved.
+
 ## 0.9.67 — 2026-10-23
 
 - **A project's checks read their own dependencies again.** 0.9.66 began

package/dist/acp-client.js

@@ -1,3 +1,4 @@
+import { isRecord } from "./is-record.js";
 /**
  * The Agent Client Protocol, from the plane's side (docs/plans/acp-adapter.md).
  *
@@ -37,9 +38,6 @@ const TEXT_CAP = 2048;
 const USAGE_CAP = 8 * 1024;
 const PROTOCOL_VERSION = 1;
 const STOP_REASONS = new Set(["end_turn", "max_tokens", "max_turn_requests", "refusal", "cancelled"]);
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function bounded(text, cap) {
     return text.length <= cap ? text : text.slice(0, cap);
 }

package/dist/agent-board.d.ts

@@ -1,6 +1,5 @@
 import type { Store } from "./store.js";
 export type AgentTurn = "busy" | "idle" | "crashed";
-export declare const AGENT_TURNS: readonly AgentTurn[];
 export type AgentSaid = "working" | "blocked" | "done";
 /** A busy run whose transcript and activity are both this old is Stuck. */
 export declare const STUCK_AFTER_MS: number;

package/dist/agent-board.js

@@ -27,7 +27,6 @@
  * Display state, never evidence: nothing here changes a run's outcome.
  */
 import { randomBytes } from "node:crypto";
-export const AGENT_TURNS = ["busy", "idle", "crashed"];
 /** A busy run whose transcript and activity are both this old is Stuck. */
 export const STUCK_AFTER_MS = 4 * 60_000;
 /** With a tool call still open (a long test run is silent), it is Stuck only after this long. */

package/dist/agent-fence.d.ts

@@ -1,6 +1,9 @@
 import type { LoopbackMode } from "./egress.js";
 /** Beside the database: where Linux builds' network bridges are made (its name reads as secret wherever it is). */
 export declare const BRIDGE_DIR = "bridge-secrets";
+/** Where a Linux sign-ins check's copies of its sign-in files live while it runs (check-access.ts): one folder per launch,
+ * `c-<pid>-…`, beside the database; fenced from every build by name, like the bridges. */
+export declare const SIGN_IN_COPIES_DIR = "sign-in-copies";
 /** How a launch was fenced, as recorded on the run and said on the task. */
 export type FenceMethod = "codex-profile" | "macos-sandbox" | "linux-bubblewrap" | "claude-rules" | "none";
 /** Only the plane's recorded repository may supply an own-Git exemption. */
@@ -38,6 +41,9 @@ export type TaskBoundary = {
     fileTools: string[];
     readOnly: string[];
     lookup: string[];
+    /** Every home configuration name the launch may not reach, by name, whether or not it exists now (macOS: Seatbelt
+     * denies a path that isn't there yet, so a build can't create it, or later replace it with a link). */
+    homeNames?: string[];
 };
 /**
  * Everything outside a task's own folders that a build could otherwise
@@ -54,14 +60,24 @@ export declare function taskBoundary(options: {
     binding?: WorktreeBinding | null;
 }): TaskBoundary;
 /** Where launches keep their private folders (the system temp folder), and this launch's own tool folder. */
+/** Where launches keep their private folders: `root` (the system temp folder) and, on a Mac, `also` the short shared one
+ * a check's launch folder is made in (/private/tmp, so its unix sockets fit); `own` is this launch's. */
 export type RunFolders = {
     root: string;
     own: string | null;
+    also?: string[];
 };
 /** The prefixes of every launch's private folders: its tools' config, a Codex build's own home, and a Linux build's
  * network bridge (egress-bridge.ts). */
 export declare const RUN_FOLDER_PREFIXES: readonly ["so-tools-", "so-codex-", "so-net-", "so-cmd-"];
 export declare function runFolders(own: string | null, root?: string): RunFolders;
+/** Where a check's launch folder is made on a Mac: a short shared folder, so its TMPDIR leaves room for a unix socket
+ * path (about 104 bytes); every other launch folder there is denied by pattern, as under the system temp folder. */
+export declare const CHECK_LAUNCH_ROOT_MACOS = "/private/tmp";
+/** The folder a check's launch folder is made in: on a Mac the short one, elsewhere the system temp folder (unchanged). */
+export declare const checkLaunchRoot: () => string;
+/** Every root launch folders are made under (the system temp folder, and on a Mac the short shared one). */
+export declare const runRoots: (folders: RunFolders) => string[];
 /**
  * What a fence gives back beside its denied paths. Each is narrow and none
  * ever writes: `readOnly` is read, never written (other tasks' git
@@ -81,6 +97,11 @@ export type FenceGrants = {
     pool?: CheckoutPool;
     network?: NetworkFence;
     writes?: WriteAllowlist;
+    /** macOS: the home configuration names denied by name, present or not (TaskBoundary.homeNames). */
+    homeNames?: string[];
+    /** A `sign-ins` check's exact sign-in files (read) and its checkout's own Claude transcript folder (written):
+     * check-access.ts, signInGrants. Bound back over the home fence by path, never a pattern or a parent folder. */
+    signIns?: SignInGrants;
 };
 export { isWritesMode, WRITES_DEFAULT, type WritesMode } from "./writes-mode.js";
 /**
@@ -328,3 +349,40 @@ export declare const FENCE_SUMMARY: readonly {
 }[];
 /** FENCE_SUMMARY as README's markdown table. */
 export declare function fenceSummaryMarkdown(): string;
+/** What a `sign-ins` check reads and writes beyond its fence (check-access.ts). */
+export type SignInGrants = {
+    read: string[];
+    transcripts: string[];
+    copies?: Record<string, string>;
+};
+/**
+ * A `sign-ins` check's grants: each sign-in file only as the real regular file it is (never a link, nor reached
+ * through one), and on a Mac the checkout's own Claude transcript folder (made when absent, only as the real folder it
+ * is), whose session files alone are written so a session the check starts can be resumed. Nothing else under
+ * ~/.claude, ~/.codex or ~/.config is granted.
+ */
+export declare function signInGrants(home: string, checkout: string, platform?: NodeJS.Platform): SignInGrants;
+/**
+ * A sign-in file's bytes, read only as the real regular file it is: its folder reached through no link (its real path
+ * is its own), and the file itself opened without following a link and checked as a regular file through what was
+ * opened, so a link swapped in at the file's own name is never read. Null for anything else.
+ *
+ * Its folders are still resolved by name (Node has no openat), so a folder above it swapped for a link between the
+ * checks and the open would be followed. That is detected after the fact: every folder from / down to the file's own
+ * is looked at (no link, the same device and inode) before the open and again after it, the file's real path is
+ * checked again, and the name must still be the very file that was opened. Any difference reads nothing.
+ *
+ * Residual risk: a swap made and undone entirely between the two looks isn't seen. On a Mac every build's and check's
+ * fence denies the home configuration names (~/.codex among them) by name, present or not, so no build or sandboxed
+ * check can make that swap; only a check the operator set to Not sandboxed, or the person themselves, still could.
+ * `afterOpen` is for tests: it runs between the open and the second look.
+ */
+export declare function readGrantedFile(path: string, seams?: {
+    afterOpen?: () => void;
+}): Buffer | null;
+/**
+ * The sign-in copies folder in a state folder (check-access.ts; Linux checks only, and sign-ins are off for now), or null:
+ * only the real folder Toolroll made there, owned by this user, mode 0700, reached through no link. Anything else (a
+ * link planted at that name, someone else's folder, one others may open) is never used: nothing is copied into it.
+ */
+export declare function signInCopiesRoot(state: string, uid?: number | undefined): string | null;

package/dist/agent-fence.js

@@ -44,7 +44,7 @@ import { INSTANCE_DIR } from "./console-instance.js";
 import { ACP_AGENTS, ACP_PROVIDER_IDS } from "./acp-agents.js";
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { readMonitoring } from "./monitoring-settings.js";
@@ -52,6 +52,9 @@ import { existingFolders } from "./names.js";
 import { DEPS_FOLDER, linkedKey, readyCopy, sharedCopies } from "./shared-deps.js";
 /** Beside the database: where Linux builds' network bridges are made (its name reads as secret wherever it is). */
 export const BRIDGE_DIR = "bridge-secrets";
+/** Where a Linux sign-ins check's copies of its sign-in files live while it runs (check-access.ts): one folder per launch,
+ * `c-<pid>-…`, beside the database; fenced from every build by name, like the bridges. */
+export const SIGN_IN_COPIES_DIR = "sign-in-copies";
 /** Names that are secrets wherever the database lives (used when its folder is shared with other things). */
 const SENSITIVE_NAME = /(^up-login\.txt$|token|secret|login|password|credential|vapid|keys?\b|\.pem$|\.key$|^backups$|^evidence$|^remote$|^sign-in\.json$|^monitoring\.json$)/i;
 function real(path) {
@@ -136,6 +139,8 @@ export function agentFence(options) {
     let runFolder = null;
     /** The bridges' folder, likewise. */
     let bridgeFolder = null;
+    /** The sign-in copies folder, likewise. */
+    let copiesFolder = null;
     const home = real(options.home ?? homedir());
     const worktree = options.worktree === null ? null : real(options.worktree);
     if (options.databaseFile !== null && options.databaseFile !== "" && options.databaseFile !== ":memory:") {
@@ -168,6 +173,23 @@ export function agentFence(options) {
         // refuses a root that isn't a private folder: egress-bridge.ts).
         bridgeFolder = bridges;
         fence.add(bridges);
+        // The sign-in copies (check-access.ts): made before any build starts and fenced from every build, by its own name as
+        // well as where it leads (as the bridges and the run folder are), whether or not the state folder is Toolroll's own.
+        // A Linux check binds its own copy from outside its sandbox, so nothing here is granted back. Never swept: a copy a
+        // launch that died left behind stays in this fenced, private folder (walking a folder a build might swap is the
+        // greater risk); a root that isn't Toolroll's private folder is never used (signInCopiesRoot).
+        const copies = join(state, SIGN_IN_COPIES_DIR);
+        try {
+            lstatSync(copies);
+        }
+        catch {
+            try {
+                mkdirSync(copies, { mode: 0o700 });
+            }
+            catch { /* fenced below either way */ }
+        }
+        copiesFolder = copies;
+        fence.add(copies);
         runFolder = join(state, INSTANCE_DIR);
         const present = () => { try {
             lstatSync(runFolder);
@@ -227,12 +249,12 @@ export function agentFence(options) {
             fence.add(path);
     for (const path of options.boundary?.protectedShell ?? [])
         fence.add(real(path));
-    const protectedPaths = new Set([...fence].flatMap(path => path === runFolder || path === bridgeFolder ? [path, real(path)] : [real(path)]));
+    const protectedPaths = new Set([...fence].flatMap(path => path === runFolder || path === bridgeFolder || path === copiesFolder ? [path, real(path)] : [real(path)]));
     for (const path of options.boundary?.shell ?? [])
         fence.add(path);
     const binding = options.binding;
     const needed = binding === undefined || binding === null ? [] : [binding.gitdir, real(join(binding.main, ".git"))];
-    return [...new Set([...fence].flatMap(path => path === runFolder || path === bridgeFolder ? [path, real(path)] : [real(path)]))].filter(path => {
+    return [...new Set([...fence].flatMap(path => path === runFolder || path === bridgeFolder || path === copiesFolder ? [path, real(path)] : [real(path)]))].filter(path => {
         if (protectedPaths.has(path) || !needed.some(target => target === path || inside(target, path)))
             return true;
         console.warn(`Dropped build fence entry covering this checkout's own Git data: ${path}`);
@@ -365,15 +387,28 @@ export function taskBoundary(options) {
         }
     }
     const fileTools = options.provider === "claude" ? present(CLAUDE_FILE_TOOL_HOME).filter(path => !shell.has(path)) : [];
-    return { protectedShell, shell: [...shell].sort(), fileTools: fileTools.sort(), readOnly: [...readOnly].sort(), lookup: [...lookup].sort() };
+    // By name too, present or not: a build started while ~/.codex is absent must never make it (and later swap it for a
+    // link while a sign-ins check reads through it). Only Seatbelt uses these (macosFenceProfile); bubblewrap can only
+    // mask what exists, and Codex's own sandbox takes existing paths.
+    const homeNames = HOME_CONFIGURATION.filter(name => !own.has(name)).map(name => join(home, name)).sort();
+    return { protectedShell, shell: [...shell].sort(), fileTools: fileTools.sort(), readOnly: [...readOnly].sort(), lookup: [...lookup].sort(), homeNames };
 }
 /** The prefixes of every launch's private folders: its tools' config, a Codex build's own home, and a Linux build's
  * network bridge (egress-bridge.ts). */
 export const RUN_FOLDER_PREFIXES = ["so-tools-", "so-codex-", "so-net-", "so-cmd-"];
-export function runFolders(own, root = tmpdir()) {
-    return { root: real(root), own: own === null ? null : real(own) };
+export function runFolders(own, root) {
+    // The system's own roots (not one a caller names): on a Mac, checks' launch folders are under the short one too.
+    const also = root === undefined && process.platform === "darwin" && existsSync(CHECK_LAUNCH_ROOT_MACOS) ? [CHECK_LAUNCH_ROOT_MACOS] : [];
+    return { root: real(root ?? tmpdir()), own: own === null ? null : real(own), ...(also.length === 0 ? {} : { also }) };
 }
-/** Every other launch's private folder there now. */
+/** Where a check's launch folder is made on a Mac: a short shared folder, so its TMPDIR leaves room for a unix socket
+ * path (about 104 bytes); every other launch folder there is denied by pattern, as under the system temp folder. */
+export const CHECK_LAUNCH_ROOT_MACOS = "/private/tmp";
+/** The folder a check's launch folder is made in: on a Mac the short one, elsewhere the system temp folder (unchanged). */
+export const checkLaunchRoot = () => process.platform === "darwin" && existsSync(CHECK_LAUNCH_ROOT_MACOS) ? CHECK_LAUNCH_ROOT_MACOS : tmpdir();
+/** Every other launch's private folder in the system temp folder now, each only as the real folder it is (a link planted
+ * there is never followed, nor fenced in its target's place) and this user's own. A shared root (`also`, /private/tmp on
+ * a Mac) is never listed: anyone may plant entries there, so it is fenced by name pattern alone. */
 function otherRunFolders(folders) {
     let entries = [];
     try {
@@ -382,8 +417,21 @@ function otherRunFolders(folders) {
     catch {
         entries = [];
     }
-    return entries.filter(entry => RUN_FOLDER_PREFIXES.some(prefix => entry.startsWith(prefix))).map(entry => join(folders.root, entry)).filter(path => path !== folders.own);
+    const uid = process.getuid?.();
+    return entries.filter(entry => RUN_FOLDER_PREFIXES.some(prefix => entry.startsWith(prefix))).map(entry => join(folders.root, entry)).filter(path => {
+        if (path === folders.own)
+            return false;
+        try {
+            const held = lstatSync(path);
+            return held.isDirectory() && !held.isSymbolicLink() && (uid === undefined || held.uid === uid);
+        }
+        catch {
+            return false;
+        }
+    });
 }
+/** Every root launch folders are made under (the system temp folder, and on a Mac the short shared one). */
+export const runRoots = (folders) => [folders.root, ...(folders.also ?? [])];
 export { isWritesMode, WRITES_DEFAULT } from "./writes-mode.js";
 /** Claude's transcript folder for a working folder: its path with every character but a letter or digit made `-`
  * (Claude Code's own naming; a name over 200 characters gets a suffix, so it is granted by prefix). */
@@ -618,6 +666,7 @@ export function fenceGrants(options) {
     }
     const pool = options.poolRoots === undefined ? undefined : checkoutPool({ roots: options.poolRoots, worktree: options.worktree, binding: options.binding ?? null, ...(options.home === undefined ? {} : { home: options.home }) });
     return { readOnly: [...options.boundary?.readOnly ?? []], readable, lookup: [...new Set(lookup)].sort(), ...(options.runFolders === undefined ? {} : { runFolders: options.runFolders }),
+        ...(options.boundary?.homeNames === undefined || options.boundary.homeNames.length === 0 ? {} : { homeNames: [...options.boundary.homeNames] }),
         ...(pool === undefined || pool.deny.length === 0 ? {} : { pool }) };
 }
 /** The setup a shared copy was installed by (its ready note), or null. */
@@ -668,8 +717,9 @@ export function codexFenceArgv(fence, fullAccess, grants = NO_GRANTS) {
     // Codex's harness reads its own launch files outside the command sandbox.
     // Deny the namespace, including folders created after this policy was built.
     if (grants.runFolders !== undefined) {
-        for (const prefix of RUN_FOLDER_PREFIXES) {
-            deny.push(join(grants.runFolders.root, `${prefix}*`), join(grants.runFolders.root, `${prefix}*`, "**"));
+        for (const root of runRoots(grants.runFolders)) {
+            for (const prefix of RUN_FOLDER_PREFIXES)
+                deny.push(join(root, `${prefix}*`), join(root, `${prefix}*`, "**"));
         }
     }
     // Launch folders can already be in the base fence when invoke appends them.
@@ -701,11 +751,11 @@ export function codexFenceArgv(fence, fullAccess, grants = NO_GRANTS) {
         for (const path of held.write)
             access.set(path, "write");
     }
-    // Denies are keyed where they resolve; the console's run folder is also denied by its own pathname, so a link there
-    // stays unreplaceable, not only its target.
+    // Denies are keyed where they resolve; the console's run folder and the sign-in copies folder are also denied by their
+    // own pathname, so a link there stays unreplaceable, not only its target.
     for (const path of deny) {
         access.set(real(path), "deny");
-        if (basename(path) === INSTANCE_DIR)
+        if (basename(path) === INSTANCE_DIR || basename(path) === SIGN_IN_COPIES_DIR)
             access.set(path, "deny");
     }
     const filesystem = [...access].map(([path, mode]) => `${toml(path)}=${toml(mode)}`);
@@ -859,7 +909,16 @@ export function macosFenceProfile(fence, grants = NO_GRANTS) {
     const paths = (filter, list) => list.map(path => `(${filter} ${seatbelt(path)})`).join(" ");
     const folders = grants.runFolders;
     const pool = grants.pool;
-    const above = ownedAncestors([...fence, ...grants.readOnly, ...pool?.deny ?? []], [folders?.root ?? real(tmpdir())]);
+    const homeNames = grants.homeNames ?? [];
+    const above = ownedAncestors([...fence, ...grants.readOnly, ...homeNames, ...pool?.deny ?? []], folders === undefined ? [real(tmpdir())] : runRoots(folders));
+    // A home name's folder that isn't there yet (~/.config for ~/.config/gh): made by the build, it could be a link to
+    // anywhere and carry the name out of its deny, so nothing may make it while the build runs.
+    const missingAbove = [...new Set(homeNames.flatMap(name => {
+            const out = [];
+            for (let folder = dirname(name); folder !== dirname(folder) && !existsSync(folder); folder = dirname(folder))
+                out.push(folder);
+            return out;
+        }))].sort();
     return [
         "(version 1)",
         "(allow default)",
@@ -878,12 +937,29 @@ export function macosFenceProfile(fence, grants = NO_GRANTS) {
         ]),
         ...(pool === undefined || pool.lookup.length === 0 ? [] : [`(allow file-read-metadata ${paths("literal", pool.lookup)})`]),
         ...(fence.length === 0 ? [] : [`(deny file-read* file-write* ${paths("subpath", fence)})`]),
+        // The home configuration by name, there or not: nothing may create, read, replace or write one (the sign-ins grants
+        // after this give back only their exact files).
+        ...(homeNames.length === 0 ? [] : [`(deny file-read* file-write* ${paths("subpath", homeNames)})`]),
+        ...(missingAbove.length === 0 ? [] : [`(deny file-write* ${paths("literal", missingAbove)})`]),
         ...(grants.readOnly.length === 0 ? [] : [`(deny file-write* ${paths("subpath", grants.readOnly)})`]),
-        ...(folders === undefined ? [] : [`(deny file-read* file-write* (regex #"^${seatbeltRegex(folders.root)}/(${RUN_FOLDER_PREFIXES.map(seatbeltRegex).join("|")})"))`]),
+        ...(folders === undefined ? [] : runRoots(folders).map(root => `(deny file-read* file-write* (regex #"^${seatbeltRegex(root)}/(${RUN_FOLDER_PREFIXES.map(seatbeltRegex).join("|")})"))`)),
         ...(grants.lookup.length === 0 ? [] : [`(allow file-read-metadata ${paths("literal", grants.lookup)})`]),
         // Denied whole above, granted back narrowly here (a later rule wins): an entry made after launch beside it stays denied.
         ...(grants.readable.length === 0 ? [] : [`(allow file-read* file-test-existence ${paths("subpath", grants.readable)})`]),
-        ...(folders?.own == null ? [] : [`(allow file-read* file-write* ${paths("subpath", [folders.own])})`]),
+        // A sign-ins check (check-access.ts): its exact sign-in files read, its own transcript folder written; nothing else
+        // of the home configuration comes back.
+        ...(grants.signIns === undefined || grants.signIns.read.length === 0 ? [] : [`(allow file-read* ${paths("literal", grants.signIns.read)})`]),
+        // Its own transcript folder: only the session files directly in it (a session can be resumed). Nothing else there —
+        // never memory/ or any folder Claude would load into a later real session — comes back.
+        ...(grants.signIns === undefined || grants.signIns.transcripts.length === 0 ? [] : [
+            `(allow file-read-data file-read-metadata ${paths("literal", grants.signIns.transcripts)})`,
+            `(allow file-read* file-write* ${grants.signIns.transcripts.map(folder => `(regex #"^${seatbeltRegex(folder)}/[^/]+\\.jsonl$")`).join(" ")})`,
+        ]),
+        // Each readable copy's own folder can be listed, never read: bundlers such as esbuild find node_modules by listing
+        // its parent, which a lookup alone refuses (the Linux and Codex fences list it as read-only already).
+        ...(grants.readable.length === 0 ? [] : [`(allow file-read-data ${paths("literal", [...new Set(grants.readable.map(one => dirname(one)))])})`]),
+        // Its own launch folder: what is in it, never the folder itself (it can't be renamed, removed or replaced by a link).
+        ...(folders?.own == null ? [] : [`(allow file-read* file-write* ${paths("subpath", [folders.own])})`, `(deny file-write* ${paths("literal", [folders.own])})`]),
         '(deny sysctl-read (sysctl-name-prefix "kern.procargs"))',
         "(deny process-info-pidinfo)",
         "(allow process-info-pidinfo (target same-sandbox))",
@@ -982,8 +1058,8 @@ const SECRET_SEGMENT = SPLIT_SECRET_PATTERNS.map(patternTest);
  */
 function linuxGrants(fence, grants) {
     const folders = grants.runFolders;
-    const launchFolder = (path) => folders !== undefined && inside(path, folders.root) && path !== folders.own && !(folders.own != null && inside(path, folders.own))
-        && RUN_FOLDER_PREFIXES.some(prefix => relative(folders.root, path).split(sep)[0].startsWith(prefix));
+    const launchFolder = (path) => folders !== undefined && path !== folders.own && !(folders.own != null && inside(path, folders.own))
+        && runRoots(folders).some(root => inside(path, root) && RUN_FOLDER_PREFIXES.some(prefix => relative(root, path).split(sep)[0].startsWith(prefix)));
     const secretBelow = (path) => fence.some(one => inside(path, one) && relative(one, path).split(sep).some(segment => SECRET_SEGMENT.some(test => test.test(segment))));
     const ok = (path, readOnlyGrant) => existsSync(path) && !fence.includes(path) && !launchFolder(path) && !secretBelow(path)
         && !(readOnlyGrant && fence.some(one => inside(path, one)));
@@ -1010,6 +1086,14 @@ export function linuxFenced(file, args, fence, grants = NO_GRANTS) {
     const pool = grants.pool?.deny ?? [];
     const own = grants.pool?.own != null && existsSync(grants.pool.own) ? ["--bind", grants.pool.own, grants.pool.own] : [];
     const kept = linuxGrants([...fence, ...pool], grants).flatMap(path => ["--ro-bind", path, path]);
+    // A sign-ins check's exact files, bound back over the masks (validated when granted: signInGrants).
+    const signIns = grants.signIns === undefined ? [] : [
+        // Each from the launch's own copy (made from the validated, opened file), never the path itself: a link swapped in
+        // after validation is never followed by the bind. A file with no copy isn't granted.
+        ...grants.signIns.read.flatMap(path => { const copy = grants.signIns.copies?.[path]; return copy !== undefined && existsSync(copy) ? ["--ro-bind", copy, path] : []; }),
+        // Bubblewrap can't bind by pattern: a session transcript folder is never given back writable on Linux (a check
+        // there can't resume a Claude session; it can't plant anything a later session loads either).
+    ];
     // A confined network: a network and a process view of its own, the host's sockets out of reach (a socket in a
     // mounted folder is not network, so they are masked), and the run's proxy and broker carried in by the forwarder.
     const isolated = network === null ? [] : [
@@ -1034,7 +1118,7 @@ export function linuxFenced(file, args, fence, grants = NO_GRANTS) {
     const services = writes === undefined || network !== null ? [] : linuxHostSockets(undefined, undefined, undefined, true).flatMap(mask);
     const command = network === null ? [file, ...args]
         : [network.bridge.node, network.bridge.forwarder, network.bridge.folder, ...[network.proxyPort, ...network.brokerPorts].map(String), "--", file, ...args];
-    return { file: "bwrap", args: [...root, ...privateTmp, ...writable, ...pool.flatMap(mask), ...own, ...fence.flatMap(mask), ...kept, ...services, ...isolated, "--die-with-parent", "--", ...command] };
+    return { file: "bwrap", args: [...root, ...privateTmp, ...writable, ...pool.flatMap(mask), ...own, ...fence.flatMap(mask), ...kept, ...signIns, ...services, ...isolated, "--die-with-parent", "--", ...command] };
 }
 /** The host's own sockets a process in a mounted filesystem could still talk to (D-Bus, the display, container
  * engines), wherever they exist here. */
@@ -1161,3 +1245,114 @@ export const FENCE_SUMMARY = [
 export function fenceSummaryMarkdown() {
     return ["| | Auto | Full access |", "|---|---|---|", ...FENCE_SUMMARY.map(row => `| ${row.agent} | ${row.auto} | ${row.full} |`)].join("\n");
 }
+/** The sign-in files a `sign-ins` check reads, by fixed name under the person's home (never from the environment, so no
+ * caller's CLAUDE_CONFIG_DIR or GH_CONFIG_DIR points a grant at .ssh): Claude's account and settings (and, on Linux,
+ * its credentials file; on a Mac they are in the keychain), and gh's hosts and config. Codex reads copies in a folder
+ * of the launch's own (invoke.ts), so nothing of ~/.codex is granted. */
+const SIGN_IN_FILES = (platform) => [
+    ".claude.json", join(".claude", "settings.json"), ...(platform === "linux" ? [join(".claude", ".credentials.json")] : []),
+    join(".config", "gh", "hosts.yml"), join(".config", "gh", "config.yml"),
+];
+/**
+ * A `sign-ins` check's grants: each sign-in file only as the real regular file it is (never a link, nor reached
+ * through one), and on a Mac the checkout's own Claude transcript folder (made when absent, only as the real folder it
+ * is), whose session files alone are written so a session the check starts can be resumed. Nothing else under
+ * ~/.claude, ~/.codex or ~/.config is granted.
+ */
+export function signInGrants(home, checkout, platform = process.platform) {
+    const base = real(home);
+    const read = SIGN_IN_FILES(platform).map(name => join(base, name)).filter(path => {
+        try {
+            const held = lstatSync(path);
+            // One name only: a hard link made to another file (Toolroll's database, say) would be read through this grant.
+            return held.isFile() && !held.isSymbolicLink() && held.nlink === 1 && realpathSync(path) === path;
+        }
+        catch {
+            return false;
+        }
+    });
+    const transcript = claudeProjectFolder(base, real(checkout));
+    // A transcript folder Claude would name by prefix (a very long checkout path) isn't granted: never a prefix of others.
+    const folder = transcript.byPrefix || !existsSync(join(base, ".claude")) ? null : grantFolder(transcript.path);
+    return { read, transcripts: folder === null || platform !== "darwin" ? [] : [folder] };
+}
+/**
+ * A sign-in file's bytes, read only as the real regular file it is: its folder reached through no link (its real path
+ * is its own), and the file itself opened without following a link and checked as a regular file through what was
+ * opened, so a link swapped in at the file's own name is never read. Null for anything else.
+ *
+ * Its folders are still resolved by name (Node has no openat), so a folder above it swapped for a link between the
+ * checks and the open would be followed. That is detected after the fact: every folder from / down to the file's own
+ * is looked at (no link, the same device and inode) before the open and again after it, the file's real path is
+ * checked again, and the name must still be the very file that was opened. Any difference reads nothing.
+ *
+ * Residual risk: a swap made and undone entirely between the two looks isn't seen. On a Mac every build's and check's
+ * fence denies the home configuration names (~/.codex among them) by name, present or not, so no build or sandboxed
+ * check can make that swap; only a check the operator set to Not sandboxed, or the person themselves, still could.
+ * `afterOpen` is for tests: it runs between the open and the second look.
+ */
+export function readGrantedFile(path, seams = {}) {
+    const folder = dirname(path);
+    const chain = [];
+    for (let at = folder;; at = dirname(at)) {
+        chain.push(at);
+        if (at === dirname(at))
+            break;
+    }
+    const look = () => {
+        const held = [];
+        for (const at of chain) {
+            const one = lstatSync(at);
+            if (one.isSymbolicLink() || !one.isDirectory())
+                return null;
+            held.push({ dev: one.dev, ino: one.ino });
+        }
+        return held;
+    };
+    const same = (a, b) => a.length === b.length && a.every((one, index) => one.dev === b[index].dev && one.ino === b[index].ino);
+    try {
+        const before = look();
+        if (before === null || realpathSync(folder) !== folder)
+            return null;
+        const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const held = fstatSync(fd);
+            if (!held.isFile() || held.nlink !== 1)
+                return null;
+            seams.afterOpen?.();
+            const after = look();
+            if (after === null || !same(before, after) || realpathSync(folder) !== folder)
+                return null;
+            const named = lstatSync(path);
+            if (named.isSymbolicLink() || named.dev !== held.dev || named.ino !== held.ino)
+                return null;
+            const bytes = readFileSync(fd);
+            // And once more after the read: what was read must still be what the checked name holds.
+            const last = look();
+            return last !== null && same(before, last) ? bytes : null;
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The sign-in copies folder in a state folder (check-access.ts; Linux checks only, and sign-ins are off for now), or null:
+ * only the real folder Toolroll made there, owned by this user, mode 0700, reached through no link. Anything else (a
+ * link planted at that name, someone else's folder, one others may open) is never used: nothing is copied into it.
+ */
+export function signInCopiesRoot(state, uid = process.getuid?.()) {
+    const root = join(state, SIGN_IN_COPIES_DIR);
+    try {
+        const held = lstatSync(root);
+        if (held.isSymbolicLink() || !held.isDirectory() || (uid !== undefined && held.uid !== uid) || (held.mode & 0o777) !== 0o700)
+            return null;
+        return grantFolder(root, false) === root ? root : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/agentconfig.d.ts

@@ -65,7 +65,7 @@ export type ProfileResolution = {
 export declare function resolveScopeProfile(store: Store, repo: string | null, ref: Pick<TaskRef, "agentProvider" | "agentModel"> | undefined, flags: PhaseFlags & {
     repairModel?: string | undefined;
     permissionMode?: UnattendedPermissionMode | undefined;
-}): ProfileResolution;
+}, platform?: NodeJS.Platform): ProfileResolution;
 /**
  * The two candidate tiers the routing policy chooses between, per phase,
  * read from configuration ONLY — never inferred from a model's name:

package/dist/agentconfig.js

@@ -21,6 +21,7 @@
  */
 import { PROJECT_NETWORK_DEFAULT, repositoryEcosystems, resolveNetwork } from "./egress.js";
 import { WRITES_DEFAULT } from "./writes-mode.js";
+import { checkAccessHere } from "./check-access.js";
 import { isProviderId, validateSpec } from "./provider.js";
 import { ACP_LIMITS, CLAUDE_LIMITS, CODEX_SHAPED_LIMITS, GEMINI_LIMITS } from "./scope.js";
 import { ACP_AGENTS, isAcpProvider } from "./acp-agents.js";
@@ -102,7 +103,7 @@ ref) {
     const valid = validateSpec(spec);
     return valid.ok ? { ok: true, spec, source: flags.model !== undefined ? "flag" : source } : { ok: false, problem: valid.problem };
 }
-export function resolveScopeProfile(store, repo, ref, flags) {
+export function resolveScopeProfile(store, repo, ref, flags, platform = process.platform) {
     const build = resolvePhaseAgent(store, "build", repo, flags, ref);
     if (!build.ok)
         return { ok: false, reason: "unknown-provider", problem: build.problem };
@@ -199,7 +200,10 @@ export function resolveScopeProfile(store, repo, ref, flags) {
     const network = resolveNetwork(provider, repo === null ? PROJECT_NETWORK_DEFAULT : store.projectNetwork(repo), repo === null ? [] : repositoryEcosystems(repo));
     // Where the build may write (writes-mode.ts): the project's setting, sealed likewise.
     const writes = repo === null ? WRITES_DEFAULT : store.projectWrites(repo);
-    return { ok: true, profile: { ...profile, network, writes }, provenance: { resolvedFrom: build.source, repairFrom } };
+    // How far its checks reach (check-access.ts): the project's setting as checks can get it (sign-ins, off for now,
+    // seal as sandboxed: an approval never claims what its checks won't get), sealed only when wider than sandboxed.
+    const checkAccess = repo === null ? "sandboxed" : checkAccessHere(store.projectCheckAccess(repo), platform);
+    return { ok: true, profile: { ...profile, network, writes, ...(checkAccess === "sandboxed" ? {} : { checkAccess }) }, provenance: { resolvedFrom: build.source, repairFrom } };
 }
 const PHASE_NOUN = { plan: "planner", build: "builder", repair: "repair", review: "reviewer" };
 export function resolveRouteCandidates(store, repo, pins = {}) {