toolroll 0.9.67 → 0.9.69

package/dist/store.js

@@ -1,5 +1,6 @@
 import { WRITES_DEFAULT } from "./writes-mode.js";
-import { PROJECT_NETWORK_DEFAULT, projectNetworkFromValue, runNetworkFromValue } from "./egress.js";
+import { checkAccessOf, widerThan } from "./check-access.js";
+import { networkFromValue, PROJECT_NETWORK_DEFAULT, projectNetworkFromValue, runNetworkFromValue } from "./egress.js";
 import { isAcpProfile, isAcpProvider } from "./acp-agents.js";
 import { ACP_CONFORMANCE_VERSION, launchFromJson } from "./acp-attest.js";
 import { reclaimDatabase } from "./database-reclaim.js";
@@ -68,13 +69,13 @@ import { containerEmptiness } from "./container-state.js";
 import { hasDisguisedText, hasForbiddenControls, validateNote } from "./decision.js";
 import { parseReviewContext, reviewContextCustodyProblem } from "./review-context.js";
 import { foldReview, manualReviewOnly } from "./proof.js";
-import { approvalOf, digestOf, canonicalProfileJson, chainFromJson, profileDigestOf, profileFromJson, scopeAuthorityOf, routeParityProblem, parseAcceptanceCriteria, exactAcceptance, exactStringList, exactSafeIntegerOrNull, exactKeys, GEMINI_LIMITS } from "./scope.js";
+import { approvalOf, digestOf, canonicalProfileJson, chainFromJson, profileDigestOf, profileFromJson, scopeAuthorityOf, routeParityProblem, parseAcceptanceCriteria, exactAcceptance, exactStringList, exactSafeIntegerOrNull } from "./scope.js";
 import { resolveScopeProfile, resolveRouteCandidates, exactPinOf, routeOfTask, agentChoicesFor } from "./agentconfig.js";
-import { canonicalOverridesJson, canonicalRouteJson, exactModelId, isRiskLevel, isTaskSize, headroomFrom, makesNoPlan, legOf, overridesFromJson, phaseOfRole, recommendRoute, routeDigestOf, routeFromJson, routeProblems, routeStampProblem, ROUTE_ERA, PROVIDER_ID_LIST, } from "./phase-routing.js";
+import { canonicalOverridesJson, canonicalRouteJson, isRiskLevel, isTaskSize, headroomFrom, makesNoPlan, legOf, overridesFromJson, phaseOfRole, recommendRoute, routeDigestOf, routeFromJson, routeProblems, routeStampProblem, ROUTE_ERA, PROVIDER_ID_LIST, } from "./phase-routing.js";
 import { readAuthModeStrict } from "./keys.js";
 import { modeDigestOf, modeTermsFromJson } from "./modes.js";
 import { readVerifiedArtifact } from "./evidence.js";
-import { isProviderId } from "./provider.js";
+import {} from "./provider.js";
 import { authenticate as runnerAuthenticate } from "./runner.js";
 import { stampNewProjectLevel } from "./check-levels.js";
 import { parseCheckProgressSnapshot } from "./check-progress.js";
@@ -718,7 +719,9 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // (confinement_setting, one row; off unless an instance operator turns it on).
 // v131 adds, and changes no saved row: where a project's builds may write (project_writes; agent-fence.ts, docs/plans/
 // agent-baseline-hardening.md arc 2) — only their workspace unless an approver chose anywhere.
-export const SCHEMA_VERSION = 131;
+// v132 adds, and changes no saved row: how far a project's checks reach beyond the check fence (project_check_access;
+// check-access.ts, docs/plans/check-access.md) — sandboxed unless an instance operator widened it.
+export const SCHEMA_VERSION = 132;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -851,7 +854,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -988,6 +991,15 @@ CREATE TABLE IF NOT EXISTS project_writes (
   updated_by  TEXT NOT NULL
 );
 `;
+/** v132: how far a project's checks reach beyond the check fence (check-access.ts CheckAccess). */
+export const PROJECT_CHECK_ACCESS_SCHEMA = `
+CREATE TABLE IF NOT EXISTS project_check_access (
+  repo        TEXT PRIMARY KEY,
+  level       TEXT NOT NULL CHECK (level IN ('sandboxed', 'sign-ins', 'unsandboxed')),
+  updated_at  TEXT NOT NULL,
+  updated_by  TEXT NOT NULL
+);
+`;
 /** v129: a finished run's How it ran, derived from its own records on first view (display only: never a verdict). Its
  * parser version says when to derive again; `steps` says how complete the step detail was, and why not. */
 export const RUN_EFFICIENCY_SCHEMA = `
@@ -1177,8 +1189,6 @@ CREATE INDEX IF NOT EXISTS sso_identity_account ON sso_identity (account);
  */
 /** The backend name the built-in store registers itself under. */
 export const BUILT_IN = "built-in";
-/** States from which no further work is dispatched. */
-export const TERMINAL_STATES = ["done", "failed", "cancelled"];
 export const LEAD_THREAD = { kind: "lead" };
 /** A lead_message row as a LeadMessage. */
 function readLeadMessageRow(row) {
@@ -1298,10 +1308,6 @@ function readFlowReceipt(row) {
     const optional = (key) => row[key] === null || row[key] === undefined ? null : String(row[key]);
     return { state, card, note: optional("note"), at: String(row["at"]), acceptedAt: optional("accepted_at"), itemJson: optional("item_json") };
 }
-/** `kind:name`, the unambiguous way a requirement names a capability. */
-export function capabilityKey(capability) {
-    return `${capability.kind}:${capability.name}`;
-}
 /** Parse `kind:name`; a bare name is refused rather than guessed at. */
 export function parseCapabilityKey(key) {
     const split = key.indexOf(":");
@@ -3929,6 +3935,11 @@ function initializeStore(db, file) {
     db.exec(CONFINEMENT_SCHEMA);
     // v131: where a project's builds may write (a new table only).
     db.exec(PROJECT_WRITES_SCHEMA);
+    // v132: how far a project's checks reach beyond the check fence (a new table), and the level each build's checks ran
+    // at (run.sandbox_access; saved rows read NULL: sandboxed).
+    db.exec(PROJECT_CHECK_ACCESS_SCHEMA);
+    addColumn(db, "run", "sandbox_access", "TEXT");
+    addColumn(db, "run", "sandbox_network", "TEXT");
     // v123: a flow that runs on its own (flow-unattended.ts): its grants and daily runs (new tables), and which authority
     // armed a plan's unchanged-plan approval (plan_authorization.basis, V123_ADDED_COLUMNS: saved rows read the mode).
     db.exec(FLOW_UNATTENDED_SCHEMA);
@@ -6413,11 +6424,6 @@ export class Store {
             .get(mutation.idempotencyKey);
         return row !== undefined;
     }
-    enqueueExternalIntent(mirror, kind, body, now) {
-        this.db
-            .prepare("INSERT INTO external_intent (mirror, kind, body, created_at) VALUES (?, ?, ?, ?)")
-            .run(mirror, kind, body, now.toISOString());
-    }
     pendingExternalIntents(limit = 50) {
         return this.db
             .prepare("SELECT id, mirror, kind, body, attempts FROM external_intent WHERE state = 'pending' ORDER BY id LIMIT ?")
@@ -6740,6 +6746,19 @@ export class Store {
                     .get(taskId);
                 if (writtenByLead !== undefined)
                     return false;
+                // CHECK ACCESS (v132, check-access.ts): a scope whose checks reach beyond the fence (sign-ins, or no sandbox at
+                // all) seals only on a person's password ceremony — never a mode, a grant, a chat confirmation or a carry.
+                const profileText = this.db.prepare("SELECT profile_json FROM task_scope WHERE task_id = ?").get(taskId)?.["profile_json"];
+                let sealedAccess;
+                try {
+                    const stored = typeof profileText === "string" ? JSON.parse(profileText) : null;
+                    sealedAccess = stored?.profile?.["checkAccess"];
+                }
+                catch {
+                    sealedAccess = "unreadable";
+                }
+                if (sealedAccess !== undefined)
+                    return false;
             }
             // SEPARATION OF DUTIES (v102), enforced in the primitive so no road
             // around it exists: a project's rules can refuse the requester, and
@@ -11423,54 +11442,6 @@ export class Store {
         return row === undefined ? null : { leaseId: String(row["lease_id"]) };
     }
     // ---- worker-process slots (v14, finding 26) ----------------------------
-    reserveExecutionSlots(runner, count, now) {
-        return this.transact(() => {
-            const ids = [];
-            for (let index = 0; index < count; index++) {
-                const inserted = this.db
-                    .prepare("INSERT INTO execution_slot (runner, reserved_at) VALUES (?, ?)")
-                    .run(runner, now.toISOString());
-                ids.push(Number(inserted.lastInsertRowid));
-            }
-            return ids;
-        });
-    }
-    /** reserved → running happens in the stamp-before-spawn moment, carrying
-     * the process group so recovery can ask the OS before freeing capacity. */
-    markSlotRunning(id, facts, now) {
-        const changed = this.db
-            .prepare(`UPDATE execution_slot SET state = 'running', run = ?, incarnation = ?, process_group = ?, running_at = ?
-          WHERE id = ? AND state = 'reserved'`)
-            .run(facts.run, facts.incarnation ?? null, facts.processGroup ?? null, now.toISOString(), id);
-        return Number(changed.changes) === 1;
-    }
-    /** A correction process replaces the exited provider in the same open
-     * root attempt. It may refresh only that attempt's exact occupied slot. */
-    refreshSlotProcess(id, facts) {
-        if (!Number.isInteger(facts.processGroup) || facts.processGroup <= 0)
-            return false;
-        const changed = this.db.prepare(`UPDATE execution_slot SET process_group = ?
-      WHERE id = ? AND state = 'running' AND run = ? AND incarnation IS ?
-        AND EXISTS (SELECT 1 FROM run WHERE id = ? AND outcome IS NULL)`)
-            .run(facts.processGroup, id, facts.run, facts.incarnation ?? null, facts.run);
-        return Number(changed.changes) === 1;
-    }
-    releaseExecutionSlot(id, now) {
-        const changed = this.db
-            .prepare("UPDATE execution_slot SET state = 'released', released_at = ? WHERE id = ? AND state IN ('reserved','running')")
-            .run(now.toISOString(), id);
-        return Number(changed.changes) === 1;
-    }
-    liveSlotCount(runner) {
-        const row = this.db
-            .prepare("SELECT COUNT(*) AS n FROM execution_slot WHERE runner = ? AND state IN ('reserved','running')")
-            .get(runner);
-        return Number(row?.["n"] ?? 0);
-    }
-    getExecutionSlot(id) {
-        const row = this.db.prepare("SELECT * FROM execution_slot WHERE id = ?").get(id);
-        return row === undefined ? null : readExecutionSlot(row);
-    }
     // ---- durable ceremony nonces (v14, findings 21/30) ---------------------
     /** Minted from a POST, never a GET. Bounded per approver; expired rows
      * are swept rather than accumulating. */
@@ -13528,40 +13499,6 @@ export class Store {
             repo: row["task_repo"] === null ? null : String(row["task_repo"]),
         }));
     }
-    /**
-     * The Work destination's one bounded page (workspace package 1 query):
-     * the newest tasks the viewer may see, with the viewer's already-proved
-     * admission bound BEFORE the ordering and the limit — never a wider
-     * read post-filtered in the caller. `admitted` is the resolved
-     * permitted repo set: `null` means unrestricted (every placed row),
-     * `[]` means no placed project is permitted (no placed row at all).
-     * `includeUnplaced` says whether NULL-repo rows belong to this viewer;
-     * an account restricted to projects never sees them, so they must not
-     * spend its page. Every predicate is a bound parameter; the limit is
-     * clamped here, not trusted from the caller. Read-only; the legacy
-     * `listTasksScoped` is untouched.
-     */
-    listWorkTasksAdmitted(admitted, includeUnplaced, limit) {
-        const page = Math.max(1, Math.min(Math.floor(limit), 500));
-        // SQLite accepts an empty IN list, so an empty admission binds as
-        // "no placed row" without any special SQL shape.
-        const rows = this.db
-            .prepare(`SELECT task.*, task_ref.repo AS task_repo FROM task
-         JOIN task_ref ON task_ref.backend = ? AND task_ref.external_id = task.id
-         WHERE ((task_ref.repo IS NULL AND ? = 1)
-             OR (task_ref.repo IS NOT NULL AND (? = 1 OR task_ref.repo IN (${(admitted ?? []).map(() => "?").join(",")}))))
-         ORDER BY task.created_at DESC, task.id DESC LIMIT ?`)
-            .all(BUILT_IN, includeUnplaced ? 1 : 0, admitted === null ? 1 : 0, ...(admitted ?? []), page);
-        return rows.map(row => ({
-            id: String(row["id"]),
-            title: String(row["title"]),
-            state: String(row["state"]),
-            createdAt: String(row["created_at"]),
-            updatedAt: String(row["updated_at"]),
-            priority: row["priority"] === null || row["priority"] === undefined ? 0 : Number(row["priority"]),
-            repo: row["task_repo"] === null ? null : String(row["task_repo"]),
-        }));
-    }
     /** Newest first, because the question is almost always "what just happened". */
     runsFor(taskRef) {
         return this.db
@@ -14507,10 +14444,6 @@ export class Store {
             .run(incident.run, incident.kind, now.toISOString());
         return Number(inserted.lastInsertRowid);
     }
-    incidentForRun(run) {
-        const row = this.db.prepare("SELECT * FROM incident WHERE run = ?").get(run);
-        return row === undefined ? null : readIncident(row);
-    }
     /** Unresolved, task attached, oldest first. No time window: these do not age out. */
     openIncidents(repo = null) {
         return this.db
@@ -14872,14 +14805,6 @@ export class Store {
             return Number(changes) === 1 ? { generation } : null;
         });
     }
-    /** Renew the lease AND re-prove the generation in one CAS — the last
-     * gate before the external call; a failed re-proof aborts the attempt. */
-    renewMergeClaim(id, generation, leaseMs, now) {
-        const { changes } = this.db
-            .prepare("UPDATE merge_intent SET claimed_until = ? WHERE id = ? AND state = 'claimed' AND generation = ?")
-            .run(new Date(now.getTime() + leaseMs).toISOString(), id, generation);
-        return Number(changes) === 1;
-    }
     /** STATE-SPECIFIC and TERMINALLY MONOTONIC (E1): the writer names the
      * state it believes it owns, and a terminal row is never overwritten —
      * a stale claim owner cannot un-merge what the observer already settled,
@@ -15029,14 +14954,6 @@ export class Store {
                 firingDeadline: row["firing_deadline"] === null ? null : String(row["firing_deadline"]),
             };
     }
-    latestObservation(githubRepo, prNumber) {
-        const row = this.db
-            .prepare("SELECT head_sha, state, observed_at, generation FROM ci_observation WHERE github_repo = ? AND pr_number = ?")
-            .get(githubRepo, prNumber);
-        return row === undefined || String(row["observed_at"]) === ""
-            ? null
-            : { headSha: String(row["head_sha"]), state: String(row["state"]), observedAt: String(row["observed_at"]), generation: Number(row["generation"]) };
-    }
     /** Revocation is immediate: intents not yet pushed die with the grant. */
     revokePublicationGrant(repo, by, now) {
         const { changes } = this.db
@@ -16635,9 +16552,6 @@ export class Store {
         const row = this.db.prepare("SELECT * FROM mate_turn WHERE approver = ? AND state IN ('queued','running') ORDER BY id DESC LIMIT 1").get(approver);
         return row === undefined ? null : readLeadTurn(row);
     }
-    leadStepsOf(leadTurn) {
-        return this.db.prepare("SELECT * FROM chat_turn WHERE mate_turn = ? ORDER BY id ASC").all(leadTurn).map(readChatTurn);
-    }
     // ---- projects ------------------------------------------------------------
     /** Remember a project was opened. Upsert keeps added_at; recency always moves.
      * A project added for the first time starts on Quick checks. */
@@ -16808,50 +16722,6 @@ export class Store {
             blockerRepo: row["blocker_repo"] === null || row["blocker_repo"] === undefined ? null : String(row["blocker_repo"]),
         }));
     }
-    /**
-     * Active work only, running first — the Work tab's page. Terminal history
-     * belongs to Done and the build ledger, never to this list.
-     */
-    listActiveWorkScoped(repo, now, limit = 50) {
-        const page = Math.max(1, Math.min(Math.floor(limit), 100));
-        return this.db
-            .prepare(`SELECT task.*, task_ref.repo AS task_repo, task_ref.strikes AS ref_strikes,
-           EXISTS (
-             SELECT 1 FROM task_scope
-             WHERE task_scope.task_id = task.id AND task_scope.approved_digest = task_scope.digest
-               AND task_scope.approved_at IS NOT NULL
-           ) AS approved,
-           EXISTS (
-             SELECT 1 FROM hold
-             WHERE hold.task_ref = task_ref.id AND (hold.until IS NULL OR hold.until > ?)
-           ) AS held,
-           (SELECT claim.runner FROM claim
-             WHERE claim.task_ref = task_ref.id AND claim.released_at IS NULL AND claim.expires_at > ?
-               AND claim.lease_generation = (
-                 SELECT MAX(newest.lease_generation) FROM claim AS newest
-                 WHERE newest.task_ref = claim.task_ref)
-             LIMIT 1) AS building_by
-         FROM task
-         JOIN task_ref ON task_ref.backend = ? AND task_ref.external_id = task.id
-         WHERE task.state IN ('running','queued')
-           AND (? IS NULL OR task_ref.repo IS NULL OR task_ref.repo = ?)
-         ORDER BY CASE task.state WHEN 'running' THEN 0 ELSE 1 END, task.updated_at DESC, task.id DESC
-         LIMIT ?`)
-            .all(now.toISOString(), now.toISOString(), BUILT_IN, repo, repo, page)
-            .map(row => ({
-            id: String(row["id"]),
-            title: String(row["title"]),
-            state: String(row["state"]),
-            createdAt: String(row["created_at"]),
-            updatedAt: String(row["updated_at"]),
-            priority: row["priority"] === null || row["priority"] === undefined ? 0 : Number(row["priority"]),
-            repo: row["task_repo"] === null ? null : String(row["task_repo"]),
-            approved: Number(row["approved"]) === 1,
-            held: Number(row["held"]) === 1,
-            buildingBy: row["building_by"] === null ? null : String(row["building_by"]),
-            strikes: Number(row["ref_strikes"]),
-        }));
-    }
     /**
      * Completed work, one row per done task with its final accepted run and
      * any publication attached — never composed from separate task and PR
@@ -19147,6 +19017,59 @@ export class Store {
         this.db.prepare("UPDATE lead_queue SET context_json = NULL WHERE message = ?").run(message);
         this.db.prepare("DELETE FROM memory_search WHERE kind = 'conversation' AND ref = ?").run(`message:${message}`);
     }
+    // ---- check access (v132, check-access.ts). Kept last in the class: the freshness tripwire pins method positions.
+    /** How far a project's checks reach beyond the check fence: its saved level, or sandboxed. */
+    projectCheckAccess(repo) {
+        // A damaged row reads as the narrowest level, never a wider one.
+        return checkAccessOf(this.db.prepare("SELECT level FROM project_check_access WHERE repo = ?").get(repo)?.["level"]);
+    }
+    /** Who last changed a project's check access, and when (null: never changed). */
+    projectCheckAccessChange(repo) {
+        const row = this.db.prepare("SELECT updated_by, updated_at FROM project_check_access WHERE repo = ?").get(repo);
+        return row === undefined ? null : { by: String(row["updated_by"]), at: String(row["updated_at"]) };
+    }
+    /** The level a run's setup and checks ran at (its sealed approval's, or unsandboxed where no OS fence exists). Its
+     * follow-up and batch checks never run wider than this. */
+    stampRunCheckAccess(runId, level, network = null) {
+        this.db.prepare("UPDATE run SET sandbox_access = ?, sandbox_network = ? WHERE id = ?").run(level, network === null ? null : JSON.stringify(network), runId);
+    }
+    /** The network a run's sign-ins checks ran under (null: none sealed; such a run's later checks run sandboxed). */
+    runCheckNetwork(runId) {
+        const text = this.db.prepare("SELECT sandbox_network FROM run WHERE id = ?").get(runId)?.["sandbox_network"];
+        if (typeof text !== "string")
+            return null;
+        try {
+            return networkFromValue(JSON.parse(text));
+        }
+        catch {
+            return null;
+        }
+    }
+    /** The level a run's checks ran at: missing or unreadable reads as sandboxed. */
+    runCheckAccess(runId) {
+        return checkAccessOf(this.db.prepare("SELECT sandbox_access FROM run WHERE id = ?").get(runId)?.["sandbox_access"]);
+    }
+    /** A project's check access changed: saved, and in the ledger as before → after. `may` is what the caller proved:
+     * "widen" only after an instance operator's password typed now; anything else may only narrow. The level is read again
+     * and compared in the same transaction as the write, so a change made while the caller was proving itself can't turn
+     * a narrowing into a widening. Refused: null, nothing written. */
+    setProjectCheckAccess(repo, level, by, now, authority) {
+        return this.transact(() => {
+            const before = this.projectCheckAccess(repo);
+            // Who is acting is proved again here too: an account revoked, demoted or moved off the project while its password
+            // was being checked changes nothing.
+            const account = this.accountOf(by);
+            if (account === null || account.revokedAt !== null || account.role !== "approver" || !this.accountCanAccess(by, repo))
+                return null;
+            if (widerThan(level, before) && (authority.may !== "widen" || !this.isInstanceOperator(by)))
+                return null;
+            this.db.prepare(`INSERT INTO project_check_access (repo, level, updated_at, updated_by) VALUES (?, ?, ?, ?)
+        ON CONFLICT (repo) DO UPDATE SET level = excluded.level, updated_at = excluded.updated_at, updated_by = excluded.updated_by`).run(repo, level, now.toISOString(), by);
+            const after = this.projectCheckAccess(repo);
+            this.recordPolicy(by, repo, "check access", before, after, now);
+            return { before, after };
+        });
+    }
 }
 /** A stored count or id that must be a whole, non-negative number — a
  * NULL, an empty string, a fraction, or text reads as null (v48 authority repair). */
@@ -19544,20 +19467,6 @@ function readTaskRef(row) {
         origin: String(row["origin"]) === "ours" ? "ours" : "theirs",
     };
 }
-function readExecutionSlot(row) {
-    const maybe = (key) => (row[key] === null || row[key] === undefined ? null : String(row[key]));
-    return {
-        id: Number(row["id"]),
-        runner: String(row["runner"]),
-        state: String(row["state"]),
-        run: row["run"] === null ? null : Number(row["run"]),
-        incarnation: maybe("incarnation"),
-        processGroup: row["process_group"] === null ? null : Number(row["process_group"]),
-        reservedAt: String(row["reserved_at"]),
-        runningAt: maybe("running_at"),
-        releasedAt: maybe("released_at"),
-    };
-}
 function readChatTurn(row) {
     const maybe = (key) => (row[key] === null || row[key] === undefined ? null : String(row[key]));
     const maybeN = (key) => (row[key] === null || row[key] === undefined ? null : Number(row[key]));

package/dist/structured-output.d.ts

@@ -20,7 +20,6 @@ export declare const REVIEW_OUTPUT_LIMITS: {
     readonly path: 300;
 };
 export declare const REVIEW_NOTE_CODE_POINTS: number;
-export declare const REVIEW_NOTE_GUIDANCE: string;
 export type StructuredNormalization = {
     text: string;
     changed: boolean;

package/dist/structured-output.js

@@ -16,7 +16,6 @@ export const STRUCTURED_REPAIR_TIMEOUT_MS = 5 * 60_000;
  * notes concise without imposing a second, stricter transport contract. */
 export const REVIEW_OUTPUT_LIMITS = { comments: 40, criteria: 12, note: TEXT_LIMITS.reviewNote, path: TEXT_LIMITS.reviewPath };
 export const REVIEW_NOTE_CODE_POINTS = Math.floor(REVIEW_OUTPUT_LIMITS.note / 2);
-export const REVIEW_NOTE_GUIDANCE = `Keep each comment and criterion note to one concise finding and its evidence. Aim for ${REVIEW_NOTE_CODE_POINTS} characters or fewer; the hard limit is ${REVIEW_OUTPUT_LIMITS.note} UTF-16 units. Preserve the conclusion and any needed provenance; omit repeated rubric text.`;
 /** Strip only unambiguous, whole-payload wrappers. */
 export function normalizeStructuredJson(raw) {
     let text = raw;

package/dist/subagent-work.d.ts

@@ -72,5 +72,3 @@ export declare function answerSubagentQuestion(store: Store, id: number, answer:
     ok: false;
     said: string;
 };
-/** A card's link, for messages about it. */
-export declare const subagentCardHref: (flow: number, card: number) => string;

package/dist/subagent-work.js

@@ -304,5 +304,3 @@ export function answerSubagentQuestion(store, id, answer, now) {
         return { ok: true, said: question.toolCall === null ? "Answered. It picks the card up again now." : choice?.id === APPROVE ? "Approved. The call is made now, exactly as shown." : "It won't make that call. It picks the card up again now." };
     });
 }
-/** A card's link, for messages about it. */
-export const subagentCardHref = (flow, card) => flowCardHref(flow, card);

package/dist/subagents.d.ts

@@ -1,4 +1,4 @@
-import { run, type ExecResult } from "./exec.js";
+import { type CommandRunner } from "./claude-print.js";
 import type { ContractResult } from "./contracts/contract.js";
 import { type TurnAnswer } from "./contracts/subagent-turn.js";
 import { type Overrun } from "./text-limits.js";
@@ -13,7 +13,6 @@ export type Soul = {
 };
 /** A handle from a name: "Maya" → "maya". */
 export declare const handleOf: (name: string) => string;
-export declare const isHandle: (value: unknown) => value is string;
 /** A soul file read: its name and role (front matter) and its sections. */
 export declare function parseSoul(text: string): {
     ok: true;
@@ -139,7 +138,6 @@ export type TurnReply = ({
 /** Runs one turn; injectable so tests never spend a subscription turn. */
 export type TurnRunner = (request: TurnRequest) => Promise<TurnReply>;
 export declare const TURN_TIMEOUT_MS = 180000;
-type CommandRunner = (file: string, args: readonly string[], options: Parameters<typeof run>[2]) => Promise<ExecResult>;
 /** The production runner: Claude through this computer's sign-in, answering in the turn schema (TURN_MODEL_SCHEMA), with no tools, no MCP servers and no repository. */
 export declare function claudeTurnRunner(runner?: CommandRunner): TurnRunner;
 /** How a subagent is named to people: "Maya · Support". */

package/dist/subagents.js

@@ -17,21 +17,17 @@
  * spending — those stay with people (or a signed hands-off mode).
  */
 import { Buffer } from "node:buffer";
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { strictJsonParse } from "./converse.js";
 import { scanForSecrets } from "./evidence.js";
 import { run } from "./exec.js";
+import { CLAUDE_NO_TOOLS_ARGS, CLAUDE_SIGNED_OUT, claudeJsonBody, claudeModelArgs, inScratchDir } from "./claude-print.js";
 import { ALL_CREDENTIAL_ENV } from "./provider.js";
 import { readTurnAnswer, TURN_MODEL_SCHEMA } from "./contracts/subagent-turn.js";
 import { LIMITS } from "./decision.js";
 import { overruns, TEXT_LIMITS } from "./text-limits.js";
 export const SOUL_CHARS = 12_000;
-const HANDLE = /^[a-z0-9][a-z0-9-]{0,31}$/;
 /** A handle from a name: "Maya" → "maya". */
 export const handleOf = (name) => name.toLowerCase().normalize("NFKD").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 32) || "subagent";
-export const isHandle = (value) => typeof value === "string" && HANDLE.test(value);
 /** A soul file read: its name and role (front matter) and its sections. */
 export function parseSoul(text) {
     const normal = text.replace(/\r\n?/g, "\n").trim();
@@ -220,36 +216,27 @@ export function readTurn(value, context) {
 export const TURN_TIMEOUT_MS = 180_000;
 /** The production runner: Claude through this computer's sign-in, answering in the turn schema (TURN_MODEL_SCHEMA), with no tools, no MCP servers and no repository. */
 export function claudeTurnRunner(runner = run) {
-    return async (request) => {
-        const dir = mkdtempSync(join(tmpdir(), "standing-orders-subagent-"));
+    return request => inScratchDir("standing-orders-subagent-", async (dir) => {
         const started = Date.now();
-        try {
-            const result = await runner("claude", [
-                "-p", "--output-format", "json", "--json-schema", JSON.stringify(TURN_MODEL_SCHEMA), "--safe-mode", "--no-session-persistence", "--tools", "", "--permission-mode", "dontAsk",
-                "--permission-prompts", "none", "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}',
-                ...(request.model === "default" ? [] : ["--model", request.model]),
-            ], { cwd: dir, stdin: request.prompt, timeoutMs: request.timeoutMs, maxBuffer: 512 * 1024, omitEnv: ALL_CREDENTIAL_ENV, processGroup: true });
-            if (result.notFound)
-                return { ok: false, said: "Claude isn't installed on this computer." };
-            if (result.timedOut)
-                return { ok: false, said: "Claude took too long to decide." };
-            const parsed = strictJsonParse(Buffer.from(result.stdout, "utf8"), 512 * 1024, 12);
-            const body = parsed.ok && typeof parsed.value === "object" && parsed.value !== null && !Array.isArray(parsed.value) ? parsed.value : null;
-            if (result.code !== 0 || body === null || body["is_error"] === true || body["subtype"] !== "success") {
-                const why = typeof body?.["subtype"] === "string" && body["subtype"] !== "success" ? ` (${String(body["subtype"]).replace(/_/g, " ").slice(0, 60)})` : result.code !== 0 ? ` (exit ${result.code})` : "";
-                return { ok: false, said: /not logged in|login|authenticat/i.test(`${result.stdout}${result.stderr}`) ? "Claude isn't signed in on this computer." : `Claude couldn't decide${why}.` };
-            }
-            const cost = costOf(body);
-            if (body["structured_output"] !== undefined && body["structured_output"] !== null)
-                return { ok: true, value: body["structured_output"], ms: Date.now() - started, ...cost };
-            const text = typeof body["result"] === "string" ? body["result"].trim().replace(/^```(?:json)?\n?|\n?```$/g, "") : "";
-            const inner = strictJsonParse(Buffer.from(text, "utf8"), 64 * 1024, 8);
-            return inner.ok ? { ok: true, value: inner.value, ms: Date.now() - started, ...cost } : { ok: false, said: "Claude's answer wasn't a decision.", ...cost };
+        const result = await runner("claude", [
+            "-p", "--output-format", "json", "--json-schema", JSON.stringify(TURN_MODEL_SCHEMA), ...CLAUDE_NO_TOOLS_ARGS, ...claudeModelArgs(request.model),
+        ], { cwd: dir, stdin: request.prompt, timeoutMs: request.timeoutMs, maxBuffer: 512 * 1024, omitEnv: ALL_CREDENTIAL_ENV, processGroup: true });
+        if (result.notFound)
+            return { ok: false, said: "Claude isn't installed on this computer." };
+        if (result.timedOut)
+            return { ok: false, said: "Claude took too long to decide." };
+        const body = claudeJsonBody(result.stdout, 512 * 1024);
+        if (result.code !== 0 || body === null || body["is_error"] === true || body["subtype"] !== "success") {
+            const why = typeof body?.["subtype"] === "string" && body["subtype"] !== "success" ? ` (${String(body["subtype"]).replace(/_/g, " ").slice(0, 60)})` : result.code !== 0 ? ` (exit ${result.code})` : "";
+            return { ok: false, said: CLAUDE_SIGNED_OUT.test(`${result.stdout}${result.stderr}`) ? "Claude isn't signed in on this computer." : `Claude couldn't decide${why}.` };
         }
-        finally {
-            rmSync(dir, { recursive: true, force: true });
-        }
-    };
+        const cost = costOf(body);
+        if (body["structured_output"] !== undefined && body["structured_output"] !== null)
+            return { ok: true, value: body["structured_output"], ms: Date.now() - started, ...cost };
+        const text = typeof body["result"] === "string" ? body["result"].trim().replace(/^```(?:json)?\n?|\n?```$/g, "") : "";
+        const inner = strictJsonParse(Buffer.from(text, "utf8"), 64 * 1024, 8);
+        return inner.ok ? { ok: true, value: inner.value, ms: Date.now() - started, ...cost } : { ok: false, said: "Claude's answer wasn't a decision.", ...cost };
+    });
 }
 /** What the CLI says a turn cost, and its tokens (cache reads and writes count as input). */
 function costOf(body) {

package/dist/subscription-chat.d.ts

@@ -1,5 +1,5 @@
 import { type LeadHistoryMessage, type LeadProviderAnswer, type LeadToolSchema } from "./converse.js";
-import { run, type ExecResult } from "./exec.js";
+import { type CommandRunner } from "./claude-print.js";
 import type { SubscriptionChatProviderId } from "./store.js";
 export type SubscriptionLeadRequest = {
     provider: SubscriptionChatProviderId;
@@ -27,7 +27,6 @@ export type SubscriptionLeadRunner = (request: SubscriptionLeadRequest) => Promi
     ok: false;
     problem: string;
 }>;
-type CommandRunner = (file: string, args: readonly string[], options: Parameters<typeof run>[2]) => Promise<ExecResult>;
 /** The model-visible request. Tool results are already redacted by leadView. */
 export declare function composeSubscriptionLeadPrompt(request: Omit<SubscriptionLeadRequest, "provider" | "model" | "timeoutMs" | "signal">): string;
 /** Strictly turn the harness's structured output into the provider-neutral answer. */
@@ -49,4 +48,3 @@ export declare function performSubscriptionLeadRequest(request: SubscriptionLead
     ok: false;
     problem: string;
 }>;
-export {};

package/dist/subscription-chat.js

@@ -16,6 +16,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { LEAD_MAX_CALLS_PER_STEP, LEAD_STEP_TEXT_CAP_BYTES, LEAD_TOOL_CALL_CAP_BYTES, LEAD_TOOL_CALL_ID_CAP_BYTES, strictJsonParse, tokenCount, } from "./converse.js";
 import { run } from "./exec.js";
+import { CLAUDE_NO_TOOLS_ARGS, claudeModelArgs } from "./claude-print.js";
 import { claudeStreamReader } from "./lead-progress.js";
 import { ALL_CREDENTIAL_ENV } from "./provider.js";
 import { claudeLimitsOf, noteLimits } from "./provider-limits.js";
@@ -215,9 +216,7 @@ export async function performSubscriptionLeadRequest(request, runner = run) {
                 // Streaming (someone is watching): the same answer, delivered as
                 // events whose final `result` line is the whole structured reply.
                 "-p", ...(streaming ? ["--output-format", "stream-json", "--verbose", "--include-partial-messages"] : ["--output-format", "json"]), "--json-schema", JSON.stringify(schema),
-                "--safe-mode", "--no-session-persistence", "--tools", "", "--permission-mode", "dontAsk",
-                "--permission-prompts", "none", "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}',
-                ...(request.model === "default" ? [] : ["--model", request.model]),
+                ...CLAUDE_NO_TOOLS_ARGS, ...claudeModelArgs(request.model),
             ];
         }
         const result = await runner(command, args, {

package/dist/surface.js

@@ -353,6 +353,7 @@ const GUIDE_ROWS = [
     operator("runner bind", "replace which repositories a worker may build in"),
     operator("runner capacity", "set how many tasks a worker runs at once; running work carries on, the new number applies at the next claim"),
     operator("project checks", "show or set a project's batch checks (--batch on|off, off by default): results that finish within 10 minutes share one full check on a temporary batch commit; nothing is merged into a real branch"),
+    operator("project check-access", "show or set how far a project's checks reach: sandboxed (the default), with model and GitHub sign-ins, or not sandboxed; an instance operator widens it with a password typed now"),
     operator("project concurrency", "set how many of a project's tasks build at once (default 2, never past the worker's capacity); running work carries on"),
     operator("coordinator mint", "mint the MCP filing credential — repo-bound, rate-limited, token shown once"),
     operator("coordinator revoke", "revoke an MCP filing credential"),
@@ -450,7 +451,7 @@ const REMOTE_STEP_UP = [
     // A person's own API tokens: a password step-up on the server's machine, or the console. Never with a token.
     "tokens create", "tokens list", "tokens revoke", "tokens rotate",
     "mode show", "mode set", "mode revoke", "chat-approval on", "review on", "review off", "config set", "config clear",
-    "verify set", "verify clear", "verify level", "project checks", "project concurrency", "intake grant", "intake clear", "webhook primary",
+    "verify set", "verify clear", "verify level", "project checks", "project check-access", "project concurrency", "intake grant", "intake clear", "webhook primary",
 ];
 const REMOTE_YES = [
     "status", "integrations", "ready", "gaps", "grants", "sync", "audit",

package/dist/task-sizing.d.ts

@@ -1,5 +1,5 @@
 import { type SizeAnswer } from "./contracts/task-sizing.js";
-import { run, type ExecResult } from "./exec.js";
+import { type CommandRunner } from "./claude-print.js";
 import { type TaskSizing } from "./phase-routing.js";
 import type { Store } from "./store.js";
 /** The classifier's whole budget, from asking to answer. */
@@ -24,7 +24,6 @@ export declare function planningSignals(input: SizingInput): boolean;
 export declare function heuristicSizing(input: SizingInput, why?: string | null): TaskSizing;
 /** What the classifier reads: the task as data, bounded, keys blanked. */
 export declare function sizingText(input: SizingInput): string;
-type CommandRunner = (file: string, args: readonly string[], options: Parameters<typeof run>[2]) => Promise<ExecResult>;
 /** A small Claude model on this computer's sign-in: no tools, no MCP servers, no repository, credential keys stripped.
  * The abort ends it: a late answer never keeps a command (or its process) waiting. */
 export declare function claudeSizer(runner?: CommandRunner, model?: string, budgetMs?: number): Sizer;
@@ -41,8 +40,6 @@ export declare function classifyTask(input: SizingInput, sizer: Sizer | null, bu
 /** Install the process's classifier for filings (the CLI, the console, the worker); returns how to remove it. Unset,
  * filings keep the description's size — tests never spend a turn. */
 export declare function installFilingSizer(sizer: Sizer, budgetMs?: number): () => void;
-/** Whether filings in this process are classified. */
-export declare function filingSizerInstalled(): boolean;
 /**
  * After a filing: ask the classifier (within the budget) and apply its size
  * to the still-unapproved task. Runs in the background; the filing already