toolroll 0.9.67 → 0.9.69

package/dist/builder.d.ts

@@ -1,3 +1,5 @@
+import { type NetworkProfile } from "./egress.js";
+import { type CheckAccess } from "./check-access.js";
 import type { WritesMode } from "./writes-mode.js";
 import type { LaunchNetwork } from "./invoke.js";
 import type { ProviderId } from "./contracts/provider.js";
@@ -187,6 +189,13 @@ export declare function redactSecretAssignments(text: string): string;
 /** A build's network (egress.ts): the one its approval sealed, or — sealed before network policies existed — the
  * narrowed legacy one (provider hosts and the repository's registries, nothing added since). */
 export declare function launchNetworkOf(store: Store, taskRef: number, profile: ExecutionProfile): LaunchNetwork;
+/** A build's checks' level and network: its approval's level as this platform can give it (sign-ins sealed before
+ * run sandboxed while sign-ins are off, and the run is stamped with that, what actually ran), and under sign-ins the network its
+ * approval sealed less its agent's own provider hosts (never its checks'). */
+export declare function checkLaunchOf(store: Store, runId: number, profile: ExecutionProfile, platform?: NodeJS.Platform): {
+    access: CheckAccess;
+    network: NetworkProfile | null;
+};
 /** Where a build may write (writes-mode.ts): what its approval sealed, or — sealed before write allowlists — anywhere
  * its fence allows, as it was approved. */
 export declare function launchWritesOf(profile: ExecutionProfile): WritesMode;

package/dist/builder.js

@@ -1,4 +1,5 @@
 import { legacyNetwork, repositoryEcosystems } from "./egress.js";
+import { CHECK_ACCESS_DEFAULT, checkAccessHere, checkNetworkOf } from "./check-access.js";
 import { checkoutGit } from "./teardown-git.js";
 import { isAcpProvider } from "./acp-agents.js";
 import { OBSERVATION_MAILBOX, observationBrief, parseObservationCases, collectObservations } from "./observations.js";
@@ -74,7 +75,7 @@ import { captureParkEvidence, captureTerminalDiff, captureBaseTree, evidenceRoot
 import { attemptKeyOf, closeRunQuestions, noteOpenTool, recordAgentTurn } from "./agent-board.js";
 import { openStatusFile, pulseAgentBoard, removeStatusFile, statusBrief } from "./agent-pulse.js";
 import { withAgentTurns } from "./agent-turns.js";
-import { PROOF_LIMITS, parseProof, serializeProof, adjudicate, artifactManifestOnly, sameDiffStatFacts } from "./proof.js";
+import { PROOF_LIMITS, parseProof, serializeProof, adjudicate, sameDiffStatFacts } from "./proof.js";
 import { parseHandoffArtifact } from "./contracts/handoff.js";
 import { captureReviewContext } from "./review-context.js";
 import { authoritySnapshotDigest, classifyRevisionAuthority, isMilestoneRegression, milestonesOf, parseExecutionPlanDocument, parsePlanRevisionProposal, parseProgressSnapshot, renderExecutionPlanDocument, PROGRESS_LIMITS, REVISION_LIMITS, } from "./plan.js";
@@ -268,7 +269,26 @@ function buildCheckoutGit(given, worktree, mainCheckout = null) {
 /** A run's setup and check commands, in its build's fence, writing where the approval this build runs under sealed
  * (never the scope as it may since have been rewritten; invoke.ts fencedCommands). */
 function commandRunner(store, runId, profile, inner) {
-    return fencedCommands(store, runId, launchWritesOf(profile), inner);
+    // How far its checks reach (check-access.ts): what its approval sealed, stamped on the run (again: the dispatch stamped
+    // it first) so a later check of its result never runs wider; under sign-ins, behind its checks' own network.
+    const { access, network } = checkLaunchOf(store, runId, profile);
+    store.stampRunCheckAccess(runId, access, network);
+    return fencedCommands(store, runId, launchWritesOf(profile), inner, undefined, access, network ?? undefined);
+}
+/** A build's checks' level and network: its approval's level as this platform can give it (sign-ins sealed before
+ * run sandboxed while sign-ins are off, and the run is stamped with that, what actually ran), and under sign-ins the network its
+ * approval sealed less its agent's own provider hosts (never its checks'). */
+export function checkLaunchOf(store, runId, profile, platform = process.platform) {
+    const access = checkAccessHere(profile.checkAccess ?? CHECK_ACCESS_DEFAULT, platform);
+    if (access !== "sign-ins")
+        return { access, network: null };
+    const taskRef = store.getRun(runId)?.taskRef;
+    const sealed = taskRef === undefined ? undefined : launchNetworkOf(store, taskRef, profile);
+    // No sealed network to narrow from: its checks run sandboxed.
+    if (sealed === undefined || !("policy" in sealed))
+        return { access: CHECK_ACCESS_DEFAULT, network: null };
+    const repo = store.refForId(taskRef)?.repo ?? null;
+    return { access, network: checkNetworkOf(sealed.policy, profile.provider, repo === null ? { mode: "allowlist", hosts: [], loopback: "proxy-only" } : store.projectNetwork(repo)) };
 }
 /** Where a build may write (writes-mode.ts): what its approval sealed, or — sealed before write allowlists — anywhere
  * its fence allows, as it was approved. */
@@ -369,7 +389,7 @@ export function proveApprovedProfile(scope, given) {
  * that forgot one is exactly the caller this is protecting against.
  */
 export async function build(store, request) {
-    const { taskId, taskRef, runner, worktree, branch, now, permissionMode = "auto", skipPermissions = false, provider = "claude", model, maxTurns = DEFAULT_MAX_TURNS, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS, agent, git: givenGit = run, } = request;
+    const { taskId, taskRef, runner, worktree, branch, now, permissionMode = "auto", skipPermissions = false, provider = "claude", maxTurns = DEFAULT_MAX_TURNS, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS, agent, git: givenGit = run, } = request;
     // The plane's own git on this build's checkout runs hardened, and never where the checkout's config names a command.
     const git = buildCheckoutGit(givenGit, worktree, store.getWorktree(worktree)?.repo ?? null);
     const scope = store.getScope(taskId);
@@ -422,6 +442,12 @@ export async function build(store, request) {
     // resume below can match on them honestly.
     const provenScopeDigest = scope?.approvedDigest ?? "";
     const provenProfileDigest = profileDigestOf(effective.profile);
+    // Its checks' level and network, stamped now with the proof: a batched result that runs no command here still
+    // carries what its approval allows its checks (check-access.ts).
+    {
+        const launch = checkLaunchOf(store, request.runId, effective.profile);
+        store.stampRunCheckAccess(request.runId, launch.access, launch.network);
+    }
     store.stampRun(request.runId, {
         scopeDigest: provenScopeDigest,
         profileDigest: provenProfileDigest,
@@ -1527,7 +1553,7 @@ export async function settleProviderOutcome(captured, result) {
         }
         catch { /* The commit gate still excludes it. */ }
     }
-    const { store, request, agent, git, worktree, branch, baseRevision, taskId, taskRef, runner, provider, scope, effective, answers, timeoutMs, root, mailbox, done, proof, clock } = captured;
+    const { store, request, agent, git, worktree, branch, baseRevision, taskId, taskRef, runner, provider, scope, effective, answers, timeoutMs, root, mailbox, done, clock } = captured;
     // THE STOP FENCE after the provider (v52): a stop recorded while the
     // agent ran ends the attempt HERE, before any handoff is read, any park
     // sealed, or any commit made — whatever the process wrote is preserved
@@ -3534,29 +3560,6 @@ async function stripEvidenceImages(git, worktree) {
     const rest = await git(GIT, ["--no-optional-locks", "diff", "--cached", "--quiet"], { cwd: worktree });
     return { ok: true, notice: evidenceImagesNotice(images), staged: rest.code !== 0 };
 }
-/**
- * `claude --output-format json` returns an envelope: the result is the
- * summary, and the session id is what lets a malformed park be repaired by
- * resuming the conversation that produced it instead of paying for a new one.
- */
-function envelope(stdout) {
-    try {
-        const parsed = JSON.parse(stdout);
-        return {
-            summary: typeof parsed.result === "string" && parsed.result.trim() !== ""
-                ? parsed.result.trim()
-                : "unattended build",
-            ...(typeof parsed.session_id === "string" && parsed.session_id !== ""
-                ? { sessionId: parsed.session_id }
-                : {}),
-        };
-    }
-    catch {
-        // An agent that printed something unparseable still did work — and a
-        // session nobody can name simply cannot be resumed.
-        return { summary: "unattended build" };
-    }
-}
 /**
  * What a non-zero agent exit means, in words a person can act on: the
  * harness's own result line names the ending (a turn ceiling, an error

package/dist/canonical-json.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Deterministic JSON for digests and equality. These bytes are sealed into approvals and stored digests, so neither
+ * function may change its output for any input. The two differ on purpose and must stay distinct:
+ *
+ * - `canonicalJson` drops object keys whose value is undefined and returns JSON.stringify's own answer for a bare
+ *   value (an undefined array element therefore renders as nothing: `[,1]`).
+ * - `canonicalJsonUndefinedAsNull` keeps every key and renders an undefined (or otherwise unserializable) value as
+ *   `null` — the planner contract's bytes.
+ *
+ * Both sort object keys by UTF-16 code units and keep arrays in order.
+ */
+export declare function canonicalJson(value: unknown): string;
+/** Stable JSON for hashing and equality only — no filling, no trimming; undefined reads as null. */
+export declare function canonicalJsonUndefinedAsNull(value: unknown): string;

package/dist/canonical-json.js

@@ -0,0 +1,36 @@
+/**
+ * Deterministic JSON for digests and equality. These bytes are sealed into approvals and stored digests, so neither
+ * function may change its output for any input. The two differ on purpose and must stay distinct:
+ *
+ * - `canonicalJson` drops object keys whose value is undefined and returns JSON.stringify's own answer for a bare
+ *   value (an undefined array element therefore renders as nothing: `[,1]`).
+ * - `canonicalJsonUndefinedAsNull` keeps every key and renders an undefined (or otherwise unserializable) value as
+ *   `null` — the planner contract's bytes.
+ *
+ * Both sort object keys by UTF-16 code units and keep arrays in order.
+ */
+export function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const entries = Object.entries(value)
+            .filter(([, v]) => v !== undefined)
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+            .map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`);
+        return `{${entries.join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+/** Stable JSON for hashing and equality only — no filling, no trimming; undefined reads as null. */
+export function canonicalJsonUndefinedAsNull(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJsonUndefinedAsNull).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const body = value;
+        return `{${Object.keys(body)
+            .sort()
+            .map(key => `${JSON.stringify(key)}:${canonicalJsonUndefinedAsNull(body[key])}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "null";
+}

package/dist/chat-actions.js

@@ -16,7 +16,6 @@ import { changeKnowledge, knowledgeVersion, knowledgeView, } from "./project-kno
 import { passwordlessSessionFor, approve, authenticateApprover, describeScope, scopeAuthorityOf, freshnessFor, spendingOnlyOnSuccess, ssoNowAvailable, withFreshness, } from "./scope.js";
 import { readVerifiedArtifact, scanForSecrets } from "./evidence.js";
 import { readAuthModeStrict } from "./keys.js";
-import { parseProof } from "./proof.js";
 import { acceptAndCompleteAsOperator, assignmentOf } from "./assignment.js";
 import { getDecision, recordDecision, retireDecision } from "./project-memory.js";
 import { resumeTaskStop, taskControlOf } from "./task-control.js";
@@ -26,7 +25,7 @@ import { saveScript, scriptDigest, validateScript } from "./flow-scripts.js";
 import { addCardToFlow, advanceFlows, cancelFlowCard, crossProjectProblem, decideFlowCard, flowCardHref, flowCardText, flowDefinitionOf, moveCardInFlow } from "./flow-engine.js";
 import { chooseFlowCard, flowPersonOf } from "./flow-send.js";
 import { assignFlowCard, commentOnFlowCard, flowPeople, mentionsIn, watchFlowCard } from "./flow-people.js";
-import { addFlowTriggerTo, describeTrigger, readLinearKey, removeFlowTrigger, scheduleFromWords, takesDeliveries, triggerConfigOf, validateTriggerConfig } from "./flow-triggers.js";
+import { addFlowTriggerTo, describeTrigger, readLinearKey, removeFlowTrigger, takesDeliveries, triggerConfigOf, validateTriggerConfig } from "./flow-triggers.js";
 import { describeSchedule, parseSchedule } from "./flow-schedule.js";
 import { dirname } from "node:path";
 import { handleOf, parseSoul, SOUL_CHARS, SUBAGENT_TEMPLATES, subagentLabel } from "./subagents.js";

package/dist/chat-admission.d.ts

@@ -0,0 +1,19 @@
+import type { ChatBinding, ChatState } from "./chat-delivery-state.js";
+import type { ChatEventBody } from "./contracts/chat-content.js";
+import type { ChatApp } from "./contracts/flow.js";
+/**
+ * Whether a received message or tap, already proved to come from this app, may be queued — and under which binding.
+ * A room (any conversation that isn't a direct message) is taken only while it follows a conversation, for the words
+ * that make it follow one, or when it feeds a flow (v89: anyone's message then, as a card with no say over anything).
+ * A pairing message comes only from someone unpaired, in a direct message; everything else only from a live paired
+ * member in their own conversation or a followed room. Null when it is not taken.
+ */
+export declare function admitChatEvent(state: ChatState, app: ChatApp, installation: string, event: {
+    kind: "message" | "pair" | "action";
+    member: string;
+    channel: string;
+    isRoom: boolean;
+    payload: ChatEventBody;
+}): {
+    binding: ChatBinding | null;
+} | null;

package/dist/chat-admission.js

@@ -0,0 +1,22 @@
+import { channelInbox } from "./chat-inbox.js";
+import { roomCommand } from "./chat-rooms.js";
+/**
+ * Whether a received message or tap, already proved to come from this app, may be queued — and under which binding.
+ * A room (any conversation that isn't a direct message) is taken only while it follows a conversation, for the words
+ * that make it follow one, or when it feeds a flow (v89: anyone's message then, as a card with no say over anything).
+ * A pairing message comes only from someone unpaired, in a direct message; everything else only from a live paired
+ * member in their own conversation or a followed room. Null when it is not taken.
+ */
+export function admitChatEvent(state, app, installation, event) {
+    const { kind, member, channel, isRoom, payload } = event;
+    const words = "text" in payload ? payload.text ?? "" : "";
+    const inbox = isRoom && kind === "message" ? channelInbox(state.store, app, installation, channel, words) : { watched: false, command: false };
+    const roomish = isRoom && (state.room(installation, channel) !== null || (kind === "message" && roomCommand(words) !== null) || inbox.watched || inbox.command);
+    if (isRoom && !roomish)
+        return null;
+    const binding = state.bindingFor(installation, member);
+    const open = inbox.watched && !inbox.command;
+    if (kind === "pair" ? !!binding || isRoom : !open && (!binding || !state.live(binding) || (binding.channel !== channel && !roomish)))
+        return null;
+    return { binding };
+}

package/dist/chat-channel.js

@@ -9,7 +9,7 @@ import { LEAD_TOOL_SCHEMAS } from "./lead-tools.js";
 import { verifyApproverStanding } from "./principal.js";
 import { canonicalProject } from "./project.js";
 import { phoneText, projectLabel } from "./telegram-status.js";
-import { CHAT_CONTROLS, chatControlHref, chatResultHref, isChatControl, } from "./chat-controls.js";
+import { CHAT_CONTROLS, chatControlHref, isChatControl, } from "./chat-controls.js";
 import { CHAT_TASK_ACTIONS, isChatTaskAction } from "./chat-task-actions.js";
 export function channelRepos(store, approver, registry) {
     const seen = new Set();

package/dist/chat-delivery.js

@@ -23,7 +23,6 @@ import { phoneText, PHONE_HELP, phoneCommand, phoneStatus, phoneTaskView, phoneT
 import { applyRoomInbound, conversationRow, roomCardApprover, roomCommand, roomGrantAllowed, roomMessagesAfter, roomMessageText, teamDomain } from "./chat-rooms.js";
 import { isTelegramProgressNotification, proposalTaskOf } from "./store.js";
 import { isShotsKind, resultShotsFor } from "./result-shots.js";
-import { CHAT_APP_NAMES } from "./flow-triggers.js";
 import { answersPrompt, applyDecideFeedback, applyDecideTap, decideFallbackLink, decideOffer, decideTargetOf, hasLiveDecideTokens, linksFor, mergedText, mintDecideButtons, offerFingerprint, openPromptFor, recordChatMerge } from "./chat-decide.js";
 import { mergePullRequest } from "./pull-request-flow.js";
 import { attentionSubjectOf, neverHeld, watchedPing } from "./agent-board.js";

package/dist/chat-follow.d.ts

@@ -0,0 +1,17 @@
+/** A pause that ends early, and quietly, when `signal` aborts. */
+export declare const abortablePause: (signal: AbortSignal) => (ms: number) => Promise<void>;
+/**
+ * Works the queue while this connection stays the current, leased one: each pass takes in saved events, plans room
+ * messages, delivers one part and plans notifications (when they are on), checking it is still current between steps.
+ * A pass waits while the connection isn't ready (offline, or the provider asked to retry later).
+ */
+export declare function workChatQueue(steps: {
+    same: () => boolean;
+    ready: () => boolean;
+    pause: (ms: number) => Promise<void>;
+    notifications: () => boolean;
+    process: () => Promise<unknown>;
+    rooms: () => Promise<unknown>;
+    deliver: () => Promise<unknown>;
+    notify: () => Promise<unknown>;
+}): Promise<void>;

package/dist/chat-follow.js

@@ -0,0 +1,32 @@
+/** The loop every hosted chat connection (Slack, Discord, Teams) runs over its saved queue. */
+import { setTimeout as sleep } from "node:timers/promises";
+/** A pause that ends early, and quietly, when `signal` aborts. */
+export const abortablePause = (signal) => async (ms) => {
+    try {
+        await sleep(ms, undefined, { signal });
+    }
+    catch {
+        /* shutdown */
+    }
+};
+/**
+ * Works the queue while this connection stays the current, leased one: each pass takes in saved events, plans room
+ * messages, delivers one part and plans notifications (when they are on), checking it is still current between steps.
+ * A pass waits while the connection isn't ready (offline, or the provider asked to retry later).
+ */
+export async function workChatQueue(steps) {
+    while (steps.same()) {
+        if (!steps.ready()) {
+            await steps.pause(1000);
+            continue;
+        }
+        await steps.process();
+        if (steps.same())
+            await steps.rooms();
+        if (steps.same())
+            await steps.deliver();
+        if (steps.same() && steps.notifications())
+            await steps.notify();
+        await steps.pause(1000);
+    }
+}

package/dist/chat-messages.js

@@ -8,7 +8,6 @@
  *
  * Imports the store's types only (no runtime cycle): the store builds its chats on it.
  */
-import { join } from "node:path";
 import { neverHeld, watchedPing } from "./agent-board.js";
 import { ChatCore } from "./chat-core.js";
 import { readChatMessageBody, readChatPart, savedChatEventBody, savedChatPart } from "./contracts/chat-content.js";

package/dist/chat-settings-page.d.ts

@@ -0,0 +1,23 @@
+import type { Store } from "./store.js";
+import { type Html } from "./html.js";
+import { type ChatIdentity } from "./chat-delivery-state.js";
+export type ChatSettingsOptions = {
+    code?: string;
+    problem?: string;
+    now?: Date;
+    who?: string;
+};
+/** What differs between the Slack and Discord settings pages; everything else is one page. */
+export type ChatSettingsPage = {
+    provider: "slack" | "discord";
+    label: string;
+    credentials: ChatIdentity | null;
+    /** How to create the app, shown before it is connected. */
+    setup: Html;
+    /** The connect form's fields around the password. */
+    connect: (password: Html) => Html;
+    /** The "Access and setup" paragraphs. */
+    access: Html;
+};
+/** Settings → Slack or Discord: connect the app once, then each teammate pairs their own account. */
+export declare function chatSettingsHtml(store: Store, dir: string, options: ChatSettingsOptions, page: ChatSettingsPage): Html;

package/dist/chat-settings-page.js

@@ -0,0 +1,41 @@
+import { loadPrimary } from "./webhooks.js";
+import { html, postForm } from "./html.js";
+import { ChatState } from "./chat-delivery-state.js";
+/** Settings → Slack or Discord: connect the app once, then each teammate pairs their own account. */
+export function chatSettingsHtml(store, dir, options, page) {
+    const { provider, label, credentials } = page, state = new ChatState(store, provider), bindings = credentials ? state.bindings(credentials.installation).filter(one => state.live(one)) : [], binding = options.who === undefined ? null : bindings.find(one => one.approver === options.who) ?? null, others = bindings.length - (binding === null ? 0 : 1);
+    const runtime = credentials ? state.runtime(credentials.installation) : null;
+    const now = options.now ?? new Date(), live = runtime &&
+        runtime.leaseUntil !== null &&
+        runtime.leaseUntil > now.toISOString() &&
+        runtime.connected;
+    const password = html `<label>Your Toolroll password<input style="min-height:44px" type="password" name="password" autocomplete="current-password" required></label>`;
+    const post = (action, content) => postForm(`/settings/${provider}/${action}`, content, { attrs: { class: "card" } });
+    const parts = [];
+    if (!credentials) {
+        parts.push(html `<p>Manage projects and review results in a private ${label} conversation.</p>`, page.setup, post("connect", page.connect(password)));
+    }
+    else {
+        parts.push(html `<p><strong>${credentials.workspace}</strong> · ${live ? "Connected" : "Waiting for connection"}</p>`);
+        if (runtime?.problem)
+            parts.push(html `<p role="status">${String(runtime.problem)}</p>`);
+        if (!live && !runtime?.problem)
+            parts.push(html `<p>Keep the Toolroll worker running to receive ${label} messages.</p>`);
+        if (options.code) {
+            parts.push(html `<h2>Pair your account</h2><p>Send this in a direct message to your Toolroll ${label} app. It expires in 10 minutes.</p>`, html `<label>Pairing message<input type="text" readonly value="pair ${options.code}" autocomplete="off" style="width:100%;max-width:100%;font-size:14px;min-height:44px"></label>`, html `<a class="button-link" style="min-height:44px;white-space:nowrap" href="/settings/${provider}">Check connection</a>`);
+        }
+        else if (binding && state.live(binding)) {
+            const { pending, dropped: failed } = state.partCounts(binding.id);
+            parts.push(html `<p>Your ${label} account is paired.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} paired too.` : ""}${pending ? ` ${pending} replies waiting to send.` : ""}${failed ? ` ${failed} replies could not be delivered. Open the saved chat to recover them.` : ""}</p>`, html `<p>Try “What needs my attention?” or “Show the evidence for the latest result.”</p>`, html `<p><a href="/chat">Open saved chat</a></p>`, loadPrimary(process.env, dir) === provider
+                ? html `<p>Task updates are sent here.</p>`
+                : post("alerts", html `<button type="submit">Send task updates here</button>`));
+        }
+        else {
+            parts.push(post("pair", html `<h2>Pair your account</h2><p>Your paired ${label} account can read your connected projects and confirm proposed changes. Password approvals still open in Toolroll.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} already paired.` : ""}</p>${password}<button type="submit">Create pairing code</button>`));
+        }
+        if (binding && state.live(binding) && !options.code)
+            parts.push(post("unpair", html `${password}<p class="meta">Unpairing ends every open button in your chat. Teammates are unaffected.</p><button type="submit">Unpair my account</button>`));
+        parts.push(html `<details><summary>Connection settings</summary>${post("disconnect", html `${password}<button type="submit">Disconnect ${label}</button>`)}</details>`);
+    }
+    return html `<section style="max-width:42rem;overflow-wrap:anywhere"><p><a href="/settings">Settings</a></p><h1>${label}</h1>${options.problem ? html `<p class="problem" role="alert">${options.problem}</p>` : ""}${parts}<details><summary>Access and setup</summary>${page.access}</details></section>`;
+}

package/dist/check-access.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Check access (v132, docs/plans/check-access.md): how far a project's setup and check commands reach beyond the
+ * plane's check fence. `sandboxed` (the default) is the fence as it is; `sign-ins` also reads the exact sign-in files
+ * of Claude, Codex and gh, under the project's network fence; `unsandboxed` runs them with no OS fence, trusted by the
+ * whole instance, for a project whose checks must create sandboxes themselves (Toolroll's own). Widening is an instance
+ * operator's act with a password typed now; any approver for the project may narrow it back.
+ */
+import { type NetworkProfile, type ProjectNetwork } from "./egress.js";
+export declare const CHECK_ACCESS_LEVELS: readonly ["sandboxed", "sign-ins", "unsandboxed"];
+export type CheckAccess = typeof CHECK_ACCESS_LEVELS[number];
+export declare const CHECK_ACCESS_DEFAULT: CheckAccess;
+export declare const isCheckAccess: (value: unknown) => value is CheckAccess;
+/** A stored or sealed value as a level: anything missing or unreadable is the narrowest, never a wider one. */
+export declare const checkAccessOf: (value: unknown) => CheckAccess;
+export declare const widerThan: (a: CheckAccess, b: CheckAccess) => boolean;
+/** The narrowest of several levels (none given: the default). */
+export declare const narrowestAccess: (levels: readonly CheckAccess[]) => CheckAccess;
+/** The level as a person reads it, in a sentence's middle ("Checks: …"). */
+export declare function checkAccessWords(level: CheckAccess): string;
+/** What each wider level means, said before anyone chooses it. */
+export declare const CHECK_ACCESS_WARNINGS: Readonly<Record<Exclude<CheckAccess, "sandboxed">, string>>;
+/** The services whose sign-ins a `sign-ins` check reads: Claude's and Codex's own hosts (egress.ts), and GitHub's. */
+export declare const SIGN_IN_HOSTS: readonly string[];
+/** Which of those a project's network doesn't allow (an open network allows all). The check's network is never widened
+ * for them: the operator adds them, as a network change of its own. */
+export declare function signInHostsMissing(network: ProjectNetwork): string[];
+/** The narrower of two networks: every host both allow (a wildcard allows what it covers), local services only if both
+ * do, open only if both are. A check never reaches what either its sealed network or the project's current one refuses. */
+export declare function narrowestNetwork(a: NetworkProfile, b: NetworkProfile): NetworkProfile;
+/** A build's checks' own network: what its approval sealed, less its agent's provider hosts (those are the agent's, never
+ * its checks'); narrower if a project host happens to be one of them. */
+export declare function checkNetworkOf(sealed: NetworkProfile, provider: string, project: ProjectNetwork): NetworkProfile;
+/** Off everywhere, for now (0.9.69): no `sign-ins`. Reading a sign-in file resolves its parent folders by path (Node
+ * has no openat), and each review round found another way a build or a check could swap a folder on that path between
+ * the checks and the read (on Linux a Claude build can write ~/.claude outright). Until that read is race-free, no
+ * check gets sign-ins: setting the level is refused, a level saved or sealed before (or copied in from another
+ * database) runs sandboxed, a scope seals sandboxed, and the sign-ins launch refuses first thing. The code behind it
+ * (signInGrants, readGrantedFile, the copies, the network fence) stays, guarded, for when such a reader exists; flip
+ * SIGN_INS_READY then (Linux stays off until its copies are race-free too). */
+export declare const SIGN_INS_READY = false;
+export declare const signInsAvailable: (platform?: NodeJS.Platform) => boolean;
+/** Why sign-ins can't be chosen here, said plainly (null: they can). */
+export declare const signInsUnavailableWords: (platform?: NodeJS.Platform) => string | null;
+/** The level checks actually get on this platform: `sign-ins` where it isn't available is `sandboxed` (narrower, never
+ * wider). Everything that seals, launches or stamps a check's level goes through this. */
+export declare const checkAccessHere: (level: CheckAccess, platform?: NodeJS.Platform) => CheckAccess;
+/** How a project's checks actually run here, as the settings page and `project check-access` say it: with no OS fence
+ * on this machine and unconfined running allowed by an operator, without a sandbox whatever is saved (never said to be
+ * sandboxed); otherwise the saved level as this platform can give it. */
+export declare function checkAccessRunsAs(level: CheckAccess, here: {
+    platform: NodeJS.Platform;
+    fenced: boolean;
+    unconfinedAllowed: boolean;
+}): CheckAccess;

package/dist/check-access.js

@@ -0,0 +1,80 @@
+/**
+ * Check access (v132, docs/plans/check-access.md): how far a project's setup and check commands reach beyond the
+ * plane's check fence. `sandboxed` (the default) is the fence as it is; `sign-ins` also reads the exact sign-in files
+ * of Claude, Codex and gh, under the project's network fence; `unsandboxed` runs them with no OS fence, trusted by the
+ * whole instance, for a project whose checks must create sandboxes themselves (Toolroll's own). Widening is an instance
+ * operator's act with a password typed now; any approver for the project may narrow it back.
+ */
+import { PROVIDER_HOSTS } from "./egress.js";
+export const CHECK_ACCESS_LEVELS = ["sandboxed", "sign-ins", "unsandboxed"];
+export const CHECK_ACCESS_DEFAULT = "sandboxed";
+export const isCheckAccess = (value) => typeof value === "string" && CHECK_ACCESS_LEVELS.includes(value);
+/** A stored or sealed value as a level: anything missing or unreadable is the narrowest, never a wider one. */
+export const checkAccessOf = (value) => isCheckAccess(value) ? value : CHECK_ACCESS_DEFAULT;
+const RANK = { sandboxed: 0, "sign-ins": 1, unsandboxed: 2 };
+export const widerThan = (a, b) => RANK[a] > RANK[b];
+/** The narrowest of several levels (none given: the default). */
+export const narrowestAccess = (levels) => levels.reduce((low, one) => RANK[one] < RANK[low] ? one : low, levels.length === 0 ? CHECK_ACCESS_DEFAULT : "unsandboxed");
+/** The level as a person reads it, in a sentence's middle ("Checks: …"). */
+export function checkAccessWords(level) {
+    return level === "sandboxed" ? "sandboxed" : level === "sign-ins" ? "sandboxed, with model and GitHub sign-ins" : "not sandboxed";
+}
+/** What each wider level means, said before anyone chooses it. */
+export const CHECK_ACCESS_WARNINGS = {
+    "sign-ins": "This project's checks can read your Claude, Codex and GitHub sign-ins. Its tests could use or send those credentials anywhere its network setting allows. Only choose this for projects you trust.",
+    unsandboxed: "This project's checks get your full access to this machine and to Toolroll itself, including its database and every sign-in. Only for a project whose checks must create sandboxes themselves, such as Toolroll's own.",
+};
+/** The services whose sign-ins a `sign-ins` check reads: Claude's and Codex's own hosts (egress.ts), and GitHub's. */
+export const SIGN_IN_HOSTS = [...PROVIDER_HOSTS["claude"], ...PROVIDER_HOSTS["codex"], "github.com", "api.github.com"];
+/** Which of those a project's network doesn't allow (an open network allows all). The check's network is never widened
+ * for them: the operator adds them, as a network change of its own. */
+export function signInHostsMissing(network) {
+    if (network.mode === "open")
+        return [];
+    const covered = (host) => network.hosts.some(one => one === host || (one.startsWith("*.") && host.endsWith(one.slice(1))));
+    return SIGN_IN_HOSTS.filter(host => !covered(host));
+}
+/** The narrower of two networks: every host both allow (a wildcard allows what it covers), local services only if both
+ * do, open only if both are. A check never reaches what either its sealed network or the project's current one refuses. */
+export function narrowestNetwork(a, b) {
+    const loopback = a.loopback === "any" && b.loopback === "any" ? "any" : "proxy-only";
+    if (a.mode === "open" && b.mode === "open")
+        return { version: 1, mode: "open", hosts: [], loopback };
+    if (a.mode === "open")
+        return { ...b, loopback };
+    if (b.mode === "open")
+        return { ...a, loopback };
+    const covers = (list, host) => list.some(one => one === host || (one.startsWith("*.") && (host.endsWith(one.slice(1)) || host === one)));
+    const hosts = [...new Set([...a.hosts.filter(host => covers(b.hosts, host)), ...b.hosts.filter(host => covers(a.hosts, host))])].sort();
+    return { version: 1, mode: "allowlist", hosts, loopback };
+}
+/** A build's checks' own network: what its approval sealed, less its agent's provider hosts (those are the agent's, never
+ * its checks'); narrower if a project host happens to be one of them. */
+export function checkNetworkOf(sealed, provider, project) {
+    if (sealed.mode === "open")
+        return sealed;
+    // A provider host the project itself lists (an operator added it, for its sign-ins, say) is the checks' too.
+    const agent = new Set((PROVIDER_HOSTS[provider] ?? []).filter(host => !project.hosts.includes(host)));
+    return { ...sealed, hosts: sealed.hosts.filter(host => !agent.has(host)) };
+}
+/** Off everywhere, for now (0.9.69): no `sign-ins`. Reading a sign-in file resolves its parent folders by path (Node
+ * has no openat), and each review round found another way a build or a check could swap a folder on that path between
+ * the checks and the read (on Linux a Claude build can write ~/.claude outright). Until that read is race-free, no
+ * check gets sign-ins: setting the level is refused, a level saved or sealed before (or copied in from another
+ * database) runs sandboxed, a scope seals sandboxed, and the sign-ins launch refuses first thing. The code behind it
+ * (signInGrants, readGrantedFile, the copies, the network fence) stays, guarded, for when such a reader exists; flip
+ * SIGN_INS_READY then (Linux stays off until its copies are race-free too). */
+export const SIGN_INS_READY = false;
+export const signInsAvailable = (platform = process.platform) => SIGN_INS_READY && platform !== "linux";
+/** Why sign-ins can't be chosen here, said plainly (null: they can). */
+export const signInsUnavailableWords = (platform = process.platform) => signInsAvailable(platform) ? null
+    : "Not available yet: sign-ins can't be shared with checks safely. Choose Sandboxed or Not sandboxed.";
+/** The level checks actually get on this platform: `sign-ins` where it isn't available is `sandboxed` (narrower, never
+ * wider). Everything that seals, launches or stamps a check's level goes through this. */
+export const checkAccessHere = (level, platform = process.platform) => level === "sign-ins" && !signInsAvailable(platform) ? CHECK_ACCESS_DEFAULT : level;
+/** How a project's checks actually run here, as the settings page and `project check-access` say it: with no OS fence
+ * on this machine and unconfined running allowed by an operator, without a sandbox whatever is saved (never said to be
+ * sandboxed); otherwise the saved level as this platform can give it. */
+export function checkAccessRunsAs(level, here) {
+    return !here.fenced && here.unconfinedAllowed ? "unsandboxed" : checkAccessHere(level, here.platform);
+}

package/dist/claim.js

@@ -749,7 +749,7 @@ export const MAX_STRIKES = 3;
 function sealInterrupted(store, leaseId, args) {
     const { runId, taskId, stopRun, now } = args;
     const db = store.handle;
-    const run = openAttempt(store, leaseId, runId, "an interruption");
+    openAttempt(store, leaseId, runId, "an interruption");
     // A lease the world moved past still ends its run as interrupted — that IS the honest ending — touching no task state.
     const fenced = !releaseAs(store, leaseId, "interrupted", now);
     if (args.message !== undefined && args.message.trim() !== "") {
@@ -797,7 +797,7 @@ function sealInterrupted(store, leaseId, args) {
 function sealHandBack(store, leaseId, args) {
     const { runId, taskId, now } = args;
     const db = store.handle;
-    const run = openAttempt(store, leaseId, runId, "a hand-back");
+    openAttempt(store, leaseId, runId, "a hand-back");
     // A lease the world moved past still ends its run as interrupted — that IS the honest ending — touching no task state.
     const fenced = !releaseAs(store, leaseId, "interrupted", now);
     if (args.message.trim() !== "")
@@ -974,7 +974,6 @@ const PLAN_BACKOFF_MS = [60_000, 2 * 60_000, 4 * 60_000];
  */
 function sealPlan(store, leaseId, args) {
     const { runId, taskId, plan, now } = args;
-    const db = store.handle;
     // The ingestion record (contract handoff, task 1) is composed here from
     // the filed terms and the drafted plan; its file and row land inside the
     // transaction below, only after the stale-source check admits the draft.
@@ -1199,7 +1198,7 @@ function describeSourceDrift(source, current) {
  */
 function sealRevision(store, leaseId, args) {
     const { runId, taskId, taskRef, revision, now } = args;
-    const run = openAttempt(store, leaseId, runId, "a plan revision", "builder");
+    openAttempt(store, leaseId, runId, "a plan revision", "builder");
     const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
     if (stopped !== null)
         return { ok: false, reason: "stopped" };
@@ -1249,7 +1248,6 @@ function sealRevision(store, leaseId, args) {
  */
 function sealPlanFailure(store, leaseId, args) {
     const { runId, taskId, failure: kind, message, now } = args;
-    const db = store.handle;
     const run = openAttempt(store, leaseId, runId, "a failure", "planner");
     const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
     if (stopped !== null)
@@ -1331,7 +1329,6 @@ function sealPlanFailure(store, leaseId, args) {
  */
 function sealScout(store, leaseId, args) {
     const { runId, taskId, report, now } = args;
-    const db = store.handle;
     const run = openAttempt(store, leaseId, runId, "a report", "scout");
     const stopped = interruptIfStopped(store, { leaseId, runId, taskId, now });
     if (stopped !== null)

package/dist/claude-print.d.ts

@@ -0,0 +1,12 @@
+import type { ExecResult, run } from "./exec.js";
+export type CommandRunner = (file: string, args: readonly string[], options: Parameters<typeof run>[2]) => Promise<ExecResult>;
+/** No tools, no permission prompts, no MCP servers, nothing kept: a `claude -p` call that can only answer. */
+export declare const CLAUDE_NO_TOOLS_ARGS: readonly string[];
+/** `--model <model>`, or nothing for the CLI's own default. */
+export declare const claudeModelArgs: (model: string) => string[];
+/** What a failed call's output says when this computer's Claude isn't signed in. */
+export declare const CLAUDE_SIGNED_OUT: RegExp;
+/** `claude -p --output-format json` stdout as its one object, or null. */
+export declare function claudeJsonBody(stdout: string, cap: number): Record<string, unknown> | null;
+/** Runs `work` in a fresh temporary folder named `<prefix>…`, removed afterwards whatever happens. */
+export declare function inScratchDir<T>(prefix: string, work: (dir: string) => Promise<T>): Promise<T>;

package/dist/claude-print.js

@@ -0,0 +1,34 @@
+/**
+ * The parts every bare `claude -p` call shares: a throwaway working folder, the flags that leave it with no tools,
+ * no MCP servers and no saved session, and reading its one JSON reply. Each caller still builds its own argv around
+ * these, in its own order.
+ */
+import { Buffer } from "node:buffer";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { strictJsonParse } from "./converse.js";
+/** No tools, no permission prompts, no MCP servers, nothing kept: a `claude -p` call that can only answer. */
+export const CLAUDE_NO_TOOLS_ARGS = [
+    "--safe-mode", "--no-session-persistence", "--tools", "", "--permission-mode", "dontAsk",
+    "--permission-prompts", "none", "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}',
+];
+/** `--model <model>`, or nothing for the CLI's own default. */
+export const claudeModelArgs = (model) => (model === "default" ? [] : ["--model", model]);
+/** What a failed call's output says when this computer's Claude isn't signed in. */
+export const CLAUDE_SIGNED_OUT = /not logged in|login|authenticat/i;
+/** `claude -p --output-format json` stdout as its one object, or null. */
+export function claudeJsonBody(stdout, cap) {
+    const parsed = strictJsonParse(Buffer.from(stdout, "utf8"), cap, 12);
+    return parsed.ok && typeof parsed.value === "object" && parsed.value !== null && !Array.isArray(parsed.value) ? parsed.value : null;
+}
+/** Runs `work` in a fresh temporary folder named `<prefix>…`, removed afterwards whatever happens. */
+export async function inScratchDir(prefix, work) {
+    const dir = mkdtempSync(join(tmpdir(), prefix));
+    try {
+        return await work(dir);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}