toolroll 0.9.67 → 0.9.69

package/dist/invoke.d.ts

@@ -21,12 +21,11 @@ import { type VersionProbe } from "./attest.js";
 import type { Store } from "./store.js";
 import type { RunOptions } from "./exec.js";
 import type { Runner } from "./worktree.js";
+import { type NetworkFence, type SignInGrants } from "./agent-fence.js";
+import { type CheckAccess } from "./check-access.js";
 import { type WritesMode } from "./agent-fence.js";
 import { type NetworkProfile } from "./egress.js";
 export type { ProviderRunner } from "./provider.js";
-/** The claude binary name — kept for the legacy quota rows and tests that
- * describe history; new code carries a resolved AgentSpec instead. */
-export declare const PROVIDER_BINARY = "claude";
 export type ProviderUsage = {
     tokensIn: number | null;
     tokensOut: number | null;
@@ -120,11 +119,46 @@ export declare function invokeAgent(store: Store, runId: number, spec: AgentSpec
  * Their network stays as it was. A machine without an OS fence runs them as before; a fence that can't be prepared
  * (a checkout whose binding no longer proves) runs nothing.
  */
-export declare function fencedCommands(store: Store, runId: number, writes: WritesMode, inner: Runner, available?: () => boolean): Runner;
+export declare function fencedCommands(store: Store, runId: number, writes: WritesMode, inner: Runner, available?: () => boolean, access?: CheckAccess, network?: NetworkProfile): Runner;
 /**
  * A project's checks run in a checkout of a result's commit made for them (result-follow-ups.ts, batch-checks.ts), in
  * the same fence as a build's commands: Toolroll's state, credentials, other projects and runs denied; under the
  * project's writes setting, only that checkout, its Git data, its own temp folder, the project's caches and its check
  * database writable. Where nothing can confine them, they run only when an instance operator allowed unconfined agents.
  */
-export declare function fencedCheckoutCommands(store: Store, repo: string, checkout: string, inner: Runner, available?: () => boolean): Runner;
+export declare function fencedCheckoutCommands(store: Store, repo: string, checkout: string, inner: Runner, available?: () => boolean, access?: CheckAccess, network?: NetworkProfile): Runner;
+/**
+ * A `sign-ins` check's launch (check-access.ts): its exact sign-in files and its own transcript folder
+ * (agent-fence.ts signInGrants), Codex's config and sign-in copied into a home of the launch's own (private, gone with
+ * the launch; ~/.codex itself stays fenced), gh pointed at its own folder, and the network the check runs under:
+ * open, or its allowlist through a proxy of its own (on Linux, carried in by a bridge). Nothing about it is started
+ * unless all of it is.
+ */
+export declare function signInsLaunch(store: Store, own: string, temp: string, checkout: string, policy: NetworkProfile, gitPaths: readonly string[], platform?: NodeJS.Platform): Promise<{
+    grants: SignInGrants;
+    network: NetworkFence;
+    env: Record<string, string>;
+    close(): Promise<void>;
+} | {
+    problem: string;
+}>;
+/** How a check at `access` actually runs here: unsandboxed where no OS fence exists (and an operator allowed that), else
+ * as asked. Recorded on every check's receipt, so a check that ran without a sandbox is never shown as sandboxed. */
+export declare function actualCheckAccess(store: Store, access: CheckAccess): CheckAccess;
+/**
+ * A check of saved results, in their own checkout (batch-checks.ts, result-follow-ups.ts), worked out right before each
+ * command: never wider than any of those results' own checks ran, nor than the project allows now; under sign-ins, the
+ * narrowest of their sealed check networks and the project's current one. A result with no sealed network runs it
+ * sandboxed.
+ */
+export declare function checkoutLaunchOf(store: Store, repo: string, runIds: readonly number[], platform?: NodeJS.Platform): {
+    access: CheckAccess;
+    network: NetworkProfile | undefined;
+};
+/** The widest level a check's commands actually ran at (what its receipt says). */
+export declare const widestRan: (levels: readonly CheckAccess[]) => CheckAccess;
+/** A check log's line for how its commands ran, when wider than sandboxed (shown with the log). */
+export declare const ranAtLine: (level: CheckAccess) => string | null;
+/** A saved result's check command runner (batch-checks.ts, result-follow-ups.ts): its level and network worked out right
+ * now (checkoutLaunchOf), and how it actually runs told to `ran`. */
+export declare function checkoutRunner(store: Store, repo: string, checkout: string, inner: Runner, runIds: readonly number[], ran: (level: CheckAccess) => void, platform?: NodeJS.Platform): Runner;

package/dist/invoke.js

@@ -29,19 +29,17 @@ import { witnessedRunner } from "./process-custody.js";
 import { underStopWatch } from "./task-control.js";
 import { childDatabaseEnv, isolatedChildDatabase, removeChildDatabase as removeAgentDatabase } from "./child-database.js";
 import { RunSignInError, noToolsArgs, prepareRunTools } from "./project-tools.js";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { poolRootOf } from "./worktree.js";
-import { BRIDGE_DIR } from "./agent-fence.js";
+import { BRIDGE_DIR, checkLaunchRoot, readGrantedFile, SIGN_IN_COPIES_DIR, signInCopiesRoot, signInGrants } from "./agent-fence.js";
+import { CHECK_ACCESS_DEFAULT, checkAccessHere, narrowestAccess, narrowestNetwork, signInsAvailable } from "./check-access.js";
 import { agentFence, buildCacheEnv, buildCacheFolder, grantFolder, writeAllowlist, WRITES_DEFAULT, CheckoutBindingError, trustedWorktreeBinding, checkoutGitEnv, HARDENED_GIT_ARGS, codexFenceArgv, fenceGrants, fencedGitEnv, linuxFenceAvailable, linuxFenced, macosFenceAvailable, macosFenced, NO_GRANTS, runFolders, taskBoundary } from "./agent-fence.js";
-import { proxyEnv, providerOnlyNetwork, startEgressProxy } from "./egress.js";
+import { proxyEnv, providerOnlyNetwork, repositoryEcosystems, resolveNetwork, startEgressProxy } from "./egress.js";
 import { bridgeFits, startEgressBridge } from "./egress-bridge.js";
 import { claudeConfigDir, claudeDefaults, codexDefaults, codexHomeDir, isolatedCodexHome } from "./provider-home.js";
 import { billingOf, claudeBillingFrom, seenBilling } from "./spend.js";
-/** The claude binary name — kept for the legacy quota rows and tests that
- * describe history; new code carries a resolved AgentSpec instead. */
-export const PROVIDER_BINARY = "claude";
 /** "Within seconds": how soon a silent failed run must end for its stderr to
  * be read for the sign-in signal. */
 const AUTH_EARLY_EXIT_MS = 30_000;
@@ -64,6 +62,11 @@ function claudeSettingsAuthProblem(configDir) {
     catch (error) {
         if (error.code === "ENOENT")
             return null;
+        // A sandbox around the plane (a project check's fence, say) may hide the file while the CLI still signs in from its
+        // keychain. Isolated builds never load it, and a login that needed it fails within seconds and is reported as one.
+        const code = error.code;
+        if (code === "EPERM" || code === "EACCES")
+            return null;
         return "Can't read your Claude settings.json to check sign-in. Restore access to that file and try again. Isolated builds do not load it.";
     }
     let settings;
@@ -967,21 +970,27 @@ function runFence(store, runId, provider, keyHome, ownTools, writes = WRITES_DEF
  * Their network stays as it was. A machine without an OS fence runs them as before; a fence that can't be prepared
  * (a checkout whose binding no longer proves) runs nothing.
  */
-export function fencedCommands(store, runId, writes, inner, available = () => macosFenceAvailable() || linuxFenceAvailable()) {
+export function fencedCommands(store, runId, writes, inner, available = () => macosFenceAvailable() || linuxFenceAvailable(), access = CHECK_ACCESS_DEFAULT, network) {
     // An injected runner (tests) starts no real command, as an injected agent starts no real agent (invokeAgent).
     if (inner !== runCommand)
         return inner;
     return async (file, args, options) => {
-        // As a build itself: where nothing can confine them, they run only when an instance operator allowed unconfined agents.
+        // As a build itself: where nothing can confine them, they run only when an instance operator allowed unconfined agents
+        // (and the run says so: its checks ran without a sandbox, whatever was sealed).
         if (!available()) {
-            if (store.unfencedAgentsAllowed())
+            if (store.unfencedAgentsAllowed()) {
+                store.stampRunCheckAccess(runId, "unsandboxed");
                 return inner(file, args, options);
+            }
             return { code: 1, stdout: "", stderr: "This machine can't confine the build's commands (no macOS sandbox, no working bubblewrap), so they didn't run. Install bubblewrap, or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`.\n", timedOut: false, notFound: false };
         }
-        const own = realpathSync(mkdtempSync(join(tmpdir(), "so-cmd-")));
+        const own = realpathSync(mkdtempSync(join(checkLaunchRoot(), "so-cmd-")));
         try {
             const temp = join(own, "tmp");
             mkdirSync(temp, { mode: 0o700 });
+            // Not sandboxed (check-access.ts): the project's checks are trusted by the whole instance, as before 0.9.66.
+            if (access === "unsandboxed")
+                return await inner(file, args, { ...options, env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp } });
             const fenced = runFence(store, runId, "command", undefined, own, writes);
             if (fenced.problem !== undefined)
                 return { code: 1, stdout: "", stderr: `${fenced.problem}\n`, timedOut: false, notFound: false };
@@ -991,12 +1000,24 @@ export function fencedCommands(store, runId, writes, inner, available = () => ma
             const database = options?.env?.["TOOLROLL_DB"];
             const checkData = database === undefined || fenced.grants.writes === undefined ? null : grantFolder(dirname(database), false);
             const grants = checkData === null ? fenced.grants : { ...fenced.grants, writes: { ...fenced.grants.writes, subpaths: [...fenced.grants.writes.subpaths, checkData] } };
-            return await inner(file, args, {
-                ...options,
-                fence: fenced.fence,
-                fenceGrants: grants,
-                env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(fenced.cache === undefined || fenced.grants.writes === undefined ? {} : buildCacheEnv(fenced.cache)) },
-            });
+            const checkout = store.getRun(runId)?.worktree ?? null;
+            const signIns = access !== "sign-ins" ? null : checkout === null ? { problem: "The check's checkout is unknown, so its sign-ins can't be granted." }
+                : network === undefined ? { problem: "A check with sign-ins has no network sealed for it, so nothing ran." }
+                    : await signInsLaunch(store, own, temp, checkout, network, fenced.gitPaths ?? []);
+            if (signIns !== null && "problem" in signIns)
+                return { code: 1, stdout: "", stderr: `${signIns.problem}\n`, timedOut: false, notFound: false };
+            try {
+                return await inner(file, args, {
+                    ...options,
+                    fence: fenced.fence,
+                    fenceGrants: signIns === null ? grants : { ...grants, signIns: signIns.grants, network: signIns.network },
+                    env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(fenced.cache === undefined || fenced.grants.writes === undefined ? {} : buildCacheEnv(fenced.cache)), ...(signIns?.env ?? {}) },
+                    ...(signIns === null ? {} : { omitEnv: [...(options?.omitEnv ?? []), ...SIGN_INS_OMITTED_ENV] }),
+                });
+            }
+            finally {
+                await signIns?.close();
+            }
         }
         finally {
             rmSync(own, { recursive: true, force: true });
@@ -1009,7 +1030,7 @@ export function fencedCommands(store, runId, writes, inner, available = () => ma
  * project's writes setting, only that checkout, its Git data, its own temp folder, the project's caches and its check
  * database writable. Where nothing can confine them, they run only when an instance operator allowed unconfined agents.
  */
-export function fencedCheckoutCommands(store, repo, checkout, inner, available = () => macosFenceAvailable() || linuxFenceAvailable()) {
+export function fencedCheckoutCommands(store, repo, checkout, inner, available = () => macosFenceAvailable() || linuxFenceAvailable(), access = CHECK_ACCESS_DEFAULT, network) {
     if (inner !== runCommand)
         return inner;
     return async (file, args, options) => {
@@ -1021,10 +1042,13 @@ export function fencedCheckoutCommands(store, repo, checkout, inner, available =
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
             return inner(file, args, options);
-        const own = realpathSync(mkdtempSync(join(tmpdir(), "so-cmd-")));
+        const own = realpathSync(mkdtempSync(join(checkLaunchRoot(), "so-cmd-")));
         try {
             const temp = join(own, "tmp");
             mkdirSync(temp, { mode: 0o700 });
+            // Not sandboxed (check-access.ts): the project's checks are trusted by the whole instance, as before 0.9.66.
+            if (access === "unsandboxed")
+                return await inner(file, args, { ...options, env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp } });
             let binding;
             try {
                 binding = trustedWorktreeBinding(repo, checkout);
@@ -1042,12 +1066,24 @@ export function fencedCheckoutCommands(store, repo, checkout, inner, available =
             const base = fenceGrants({ databaseFile, worktree: checkout, boundary, runFolders: folders, linked: linkedFor(store, checkout), binding, poolRoots });
             const grants = allowed === null ? base
                 : { ...base, readOnly: [...new Set([...base.readOnly, ...allowed.readOnly])].sort(), writes: { ...allowed.writes, subpaths: [...allowed.writes.subpaths, ...(checkData === null ? [] : [checkData])] } };
-            return await inner(file, args, {
-                ...options,
-                fence: agentFence({ databaseFile, worktree: checkout, boundary, binding, runFolders: folders, extra: allowed?.deny ?? [] }),
-                fenceGrants: grants,
-                env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(allowed === null ? {} : buildCacheEnv(cache)) },
-            });
+            // With sign-ins, under the network its caller proved for it (the narrowest of its results' sealed check networks and
+            // the project's current one): none given, nothing runs.
+            const signIns = access !== "sign-ins" ? null : network === undefined ? { problem: "A check with sign-ins has no network sealed for it, so nothing ran." }
+                : await signInsLaunch(store, own, temp, checkout, network, [binding.gitdir, join(binding.main, ".git")]);
+            if (signIns !== null && "problem" in signIns)
+                return { code: 1, stdout: "", stderr: `${signIns.problem}\n`, timedOut: false, notFound: false };
+            try {
+                return await inner(file, args, {
+                    ...options,
+                    fence: agentFence({ databaseFile, worktree: checkout, boundary, binding, runFolders: folders, extra: allowed?.deny ?? [] }),
+                    fenceGrants: signIns === null ? grants : { ...grants, signIns: signIns.grants, network: signIns.network },
+                    env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(allowed === null ? {} : buildCacheEnv(cache)), ...(signIns?.env ?? {}) },
+                    ...(signIns === null ? {} : { omitEnv: [...(options?.omitEnv ?? []), ...SIGN_INS_OMITTED_ENV] }),
+                });
+            }
+            finally {
+                await signIns?.close();
+            }
         }
         finally {
             rmSync(own, { recursive: true, force: true });
@@ -1116,3 +1152,124 @@ async function codexLoginBilling(binary, omitEnv) {
 function plainLines(stdout) {
     return stdout.split("\n").filter(line => !line.trimStart().startsWith("{")).join("\n");
 }
+/** What a `sign-ins` check never inherits: a caller's choice of Claude's config folder (Claude's keychain sign-in is
+ * keyed to its default one; check-access.ts). gh's and Codex's are set to the granted ones instead. */
+const SIGN_INS_OMITTED_ENV = ["CLAUDE_CONFIG_DIR"];
+/**
+ * A `sign-ins` check's launch (check-access.ts): its exact sign-in files and its own transcript folder
+ * (agent-fence.ts signInGrants), Codex's config and sign-in copied into a home of the launch's own (private, gone with
+ * the launch; ~/.codex itself stays fenced), gh pointed at its own folder, and the network the check runs under:
+ * open, or its allowlist through a proxy of its own (on Linux, carried in by a bridge). Nothing about it is started
+ * unless all of it is.
+ */
+export async function signInsLaunch(store, own, temp, checkout, policy, gitPaths, platform = process.platform) {
+    // The belt (check-access.ts signInsAvailable, off for now): no sign-in file is read, copied or granted, whatever level
+    // reached this far. Its callers already run such a check sandboxed; anything else that asks runs nothing.
+    if (!signInsAvailable(platform))
+        return { problem: "Sign-ins can't be shared with checks yet, so nothing ran." };
+    const home = homedir();
+    const grants = signInGrants(home, checkout);
+    const cleanup = [];
+    // Codex's files are copied, each read only as the real file it is (readGrantedFile: no link, here or above it).
+    const codex = join(own, "codex");
+    mkdirSync(codex, { mode: 0o700 });
+    for (const name of ["config.toml", "auth.json"]) {
+        const bytes = readGrantedFile(join(realpathSync(home), ".codex", name));
+        if (bytes !== null)
+            writeFileSync(join(codex, name), bytes, { mode: 0o600 });
+    }
+    // On Linux every granted file is bound from a copy of its own, made the same way (bubblewrap binds a source path, and
+    // a link swapped in after validation must never be what it binds). A Mac's sandbox checks the real path itself.
+    // Not reached for now: the belt above refuses until reading these files is race-free.
+    if (process.platform === "linux") {
+        const copies = {};
+        // Under Toolroll's own state folder, which every fence denies whole (a launch's folder in a shared /tmp isn't masked
+        // from a launch already running): bubblewrap binds from the original root, so only this check sees them.
+        const database = store.databaseFile();
+        if (database === null || database === "" || database === ":memory:")
+            return { problem: "A check with sign-ins needs Toolroll's state folder, so nothing ran." };
+        const state = dirname(realpathSync(database));
+        try {
+            mkdirSync(join(state, SIGN_IN_COPIES_DIR), { mode: 0o700 });
+        }
+        catch { /* there already: checked next */ }
+        // Only the real, private folder Toolroll made (this user's, 0700, no link): never a link planted where it should be.
+        const parent = signInCopiesRoot(state);
+        if (parent === null)
+            return { problem: "The sign-in copies folder isn't a private folder of Toolroll's, so nothing ran." };
+        const folder = mkdtempSync(join(parent, `c-${process.pid}-`));
+        cleanup.push(folder);
+        grants.read.forEach((path, index) => {
+            const bytes = readGrantedFile(path);
+            if (bytes === null)
+                return;
+            const copy = join(folder, String(index));
+            writeFileSync(copy, bytes, { mode: 0o600 });
+            copies[path] = copy;
+        });
+        grants.read = grants.read.filter(path => copies[path] !== undefined);
+        grants.copies = copies;
+    }
+    let egress = null;
+    let bridge = null;
+    const close = async () => { await egress?.close(); await bridge?.close(); for (const one of cleanup)
+        rmSync(one, { recursive: true, force: true }); };
+    try {
+        const env = { CODEX_HOME: codex, GH_CONFIG_DIR: join(home, ".config", "gh"), XDG_CONFIG_HOME: join(home, ".config") };
+        if (policy.mode === "open")
+            return { grants, network: { mode: "open" }, env, close };
+        // Exactly the project's network: the services the sign-ins are for are reached only if the operator allowed their
+        // hosts (check-access.ts signInHostsMissing says which are missing; never added here).
+        egress = await startEgressProxy({ hosts: policy.hosts });
+        const network = { mode: "allowlist", proxyPort: egress.port, brokerPorts: [], loopback: policy.loopback, socketRoots: [temp, realpathSync(checkout)] };
+        if (linuxFenceAvailable()) {
+            const database = store.databaseFile();
+            const fenced = database === null || database === "" || database === ":memory:" ? undefined : join(dirname(realpathSync(database)), BRIDGE_DIR);
+            bridge = await startEgressBridge([egress.port], fenced !== undefined && bridgeFits(fenced) ? fenced : undefined);
+            network.bridge = { folder: realpathSync(bridge.folder), forwarder: realpathSync(bridge.forwarder), node: process.execPath };
+            // Its private /tmp gives back its checkout, its launch folder and its checkout's own Git data (as a build's does).
+            network.keep = [realpathSync(checkout), own, ...gitPaths.filter(path => existsSync(path))];
+        }
+        return { grants, network, env: { ...env, ...proxyEnv(egress, policy.loopback) }, close };
+    }
+    catch (error) {
+        await close();
+        return { problem: `The check's network could not be set up, so nothing ran: ${error instanceof Error ? error.message : String(error)}` };
+    }
+}
+/** How a check at `access` actually runs here: unsandboxed where no OS fence exists (and an operator allowed that), else
+ * as asked. Recorded on every check's receipt, so a check that ran without a sandbox is never shown as sandboxed. */
+export function actualCheckAccess(store, access) {
+    return macosFenceAvailable() || linuxFenceAvailable() || !store.unfencedAgentsAllowed() ? access : "unsandboxed";
+}
+/**
+ * A check of saved results, in their own checkout (batch-checks.ts, result-follow-ups.ts), worked out right before each
+ * command: never wider than any of those results' own checks ran, nor than the project allows now; under sign-ins, the
+ * narrowest of their sealed check networks and the project's current one. A result with no sealed network runs it
+ * sandboxed.
+ */
+export function checkoutLaunchOf(store, repo, runIds, platform = process.platform) {
+    // As checks can get it: sign-ins (off for now; a stamp or setting from before, or another database) run sandboxed.
+    const access = checkAccessHere(narrowestAccess([store.projectCheckAccess(repo), ...runIds.map(id => store.runCheckAccess(id))]), platform);
+    if (access !== "sign-ins")
+        return { access, network: undefined };
+    const sealed = runIds.map(id => store.runCheckNetwork(id));
+    if (sealed.length === 0 || sealed.some(one => one === null))
+        return { access: CHECK_ACCESS_DEFAULT, network: undefined };
+    const live = resolveNetwork("command", store.projectNetwork(repo), repositoryEcosystems(repo));
+    return { access, network: sealed.reduce((low, one) => narrowestNetwork(low, one), live) };
+}
+/** The widest level a check's commands actually ran at (what its receipt says). */
+export const widestRan = (levels) => levels.includes("unsandboxed") ? "unsandboxed" : levels.includes("sign-ins") ? "sign-ins" : CHECK_ACCESS_DEFAULT;
+/** A check log's line for how its commands ran, when wider than sandboxed (shown with the log). */
+export const ranAtLine = (level) => level === "sandboxed" ? null
+    : `=== Check access ===\n${level === "unsandboxed" ? "These commands ran without a sandbox." : "These commands ran sandboxed, with model and GitHub sign-ins."}`;
+/** A saved result's check command runner (batch-checks.ts, result-follow-ups.ts): its level and network worked out right
+ * now (checkoutLaunchOf), and how it actually runs told to `ran`. */
+export function checkoutRunner(store, repo, checkout, inner, runIds, ran, platform = process.platform) {
+    return (file, args, options) => {
+        const launch = checkoutLaunchOf(store, repo, runIds, platform);
+        ran(actualCheckAccess(store, launch.access));
+        return fencedCheckoutCommands(store, repo, checkout, inner, undefined, launch.access, launch.network)(file, args, options);
+    };
+}

package/dist/is-record.d.ts

@@ -0,0 +1,2 @@
+/** A plain object: not null, not an array. */
+export declare const isRecord: (value: unknown) => value is Record<string, unknown>;

package/dist/is-record.js

@@ -0,0 +1,2 @@
+/** A plain object: not null, not an array. */
+export const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/lead-doors.d.ts

@@ -1,5 +1,5 @@
 import { type SharedActionOptions } from './chat-actions.js';
-import { type CoordinatorProposal, type LeadProposal, type Store } from "./store.js";
+import { type LeadProposal, type Store } from "./store.js";
 import type { VerifiedApprover } from "./principal.js";
 import { type TeamChatProviderResolver } from './team-chat-authorization.js';
 export type ProposalKind = LeadProposal["kind"];
@@ -78,7 +78,3 @@ export declare function dismissLeadProposal(store: Store, who: VerifiedApprover,
  */
 export declare function confirmCoordinatorProposal(store: Store, who: VerifiedApprover, proposalId: number, now: Date, options: DoorOptions): DoorOutcome;
 export declare function dismissCoordinatorProposal(store: Store, who: VerifiedApprover, proposalId: number, now: Date): boolean;
-/** Which door renders a coordinator proposal for this reader: the repo must be admitted. */
-export declare function coordinatorProposalVisible(who: {
-    repos: readonly string[];
-}, proposal: CoordinatorProposal): boolean;

package/dist/lead-doors.js

@@ -260,10 +260,6 @@ export function dismissCoordinatorProposal(store, who, proposalId, now) {
         return store.casCoordinatorProposal(proposalId, "pending", "dismissed", who.name, null, now);
     });
 }
-/** Which door renders a coordinator proposal for this reader: the repo must be admitted. */
-export function coordinatorProposalVisible(who, proposal) {
-    return who.repos.includes(proposal.repo);
-}
 /**
  * The shared executor: one kind, one payload, the operator's own act
  * through the primitive that owns it. Module-private (v3 review, finding

package/dist/lead-tools.js

@@ -1,5 +1,4 @@
 import { sweepLine, sweepTable } from "./lead-sweep.js";
-import { TEXT_LIMITS } from "./text-limits.js";
 import { connectionsOf, oneClickOf } from "./mcp-connect.js";
 import { checkLevelFromWords, isCheckLevel } from "./check-levels.js";
 import { policyParts } from "./policy.js";
@@ -39,9 +38,9 @@ import { CHAT_TASK_ACTIONS, chatTaskRun, chatTaskStamp, isChatTaskAction } from
 import { Buffer } from "node:buffer";
 import { LEAD_ASK_OTHER } from "./store.js";
 import { hasDisguisedText, hasForbiddenControls } from "./decision.js";
-import { readVerifiedArtifact, readVerifiedReport, scanForSecrets } from "./evidence.js";
+import { readVerifiedArtifact, scanForSecrets } from "./evidence.js";
 import { parseAcceptanceCriteria } from "./scope.js";
-import { diagnoseTaskDispatch, withDispatchDiagnoses } from "./dispatch.js";
+import { diagnoseTaskDispatch } from "./dispatch.js";
 import { agentChoicesFor, routeOfTask, INSTALLATION_SCOPE } from "./agentconfig.js";
 import { isNewModel, modelWords, priceWords, runtimeStates, seenModels } from "./model-catalog.js";
 import { agentsSummary, chosenWords, PHASES, postureWords, routeProblems, sameSpec, sizeSourceWords, sizeWords, specWords } from "./phase-routing.js";
@@ -55,7 +54,7 @@ import { planInChat } from "./chat-decide.js";
 import { flowDecisionAt } from "./telegram-flow.js";
 import { flowPersonOf } from "./flow-send.js";
 import { flowInsights } from "./flow-insights.js";
-import { describeTrigger, FLOW_TRIGGER_KINDS, triggerConfigOf } from "./flow-triggers.js";
+import { describeTrigger, triggerConfigOf } from "./flow-triggers.js";
 export const LEAD_MAX_PROPOSALS_PER_TURN = 5;
 export { reportSummaryFor } from "./report-summary.js";
 import { reportSummaryFor } from "./report-summary.js";
@@ -63,8 +62,6 @@ import { labelOf, nameOf, summaryOf, zonesOf } from "./subagent-admin.js";
 import { SUBAGENT_TEMPLATES, withSection } from "./subagents.js";
 import { callOutcome, callWords, defaultRule, ruleWords } from "./subagent-tools.js";
 import { deskOf, routinesOf } from "./subagent-desk.js";
-import { KITS } from "./kits.js";
-import { STARTER_IDS } from "./flow-starters.js";
 import { undoFor, weekOf, weekWords } from "./subagent-week.js";
 import { PERSON_ID, personEntry, teamRoomOf } from "./lead-people.js";
 import { aboutYouOf, checkAboutYouLine } from "./lead-about.js";

package/dist/live-detail.d.ts

@@ -10,7 +10,6 @@ export type LiveDetailSetting = {
 };
 /** Whether this project's live conversations show commands. Unknown or absent is off. */
 export declare function liveCommandsShown(store: Store, repo: string | null): boolean;
-export declare function liveDetailSetting(store: Store, repo: string): LiveDetailSetting | null;
 /** Save the setting and its ledger line in one transaction. The caller has proved who is asking (and, to turn it on, their password). */
 export declare function setLiveCommands(store: Store, change: {
     repo: string;

package/dist/live-detail.js

@@ -26,12 +26,6 @@ export function liveCommandsShown(store, repo) {
         return false;
     }
 }
-export function liveDetailSetting(store, repo) {
-    const row = store.handle.prepare("SELECT repo, commands, updated_by, updated_at FROM live_detail_setting WHERE repo = ?").get(repo);
-    if (row === undefined)
-        return null;
-    return { repo: String(row["repo"]), commands: Number(row["commands"]) === 1, updatedBy: String(row["updated_by"]), updatedAt: String(row["updated_at"]) };
-}
 /** Save the setting and its ledger line in one transaction. The caller has proved who is asking (and, to turn it on, their password). */
 export function setLiveCommands(store, change, now) {
     store.transact(() => {

package/dist/live-terminal.js

@@ -13,6 +13,7 @@ import { existsSync, mkdirSync, readlinkSync, realpathSync, statSync } from "nod
 import { delimiter, isAbsolute, join } from "node:path";
 import { codingEnvironment } from "./coding-provider.js";
 import { teardownGit, refusal } from "./teardown-git.js";
+import { sleep } from "./sleep.js";
 export const TERMINAL_PROGRAMS = ["claude", "codex", "shell"];
 /** At most this many running sessions per console, and this many kept at all (ended ones count until removed). */
 export const MAX_LIVE_TERMINALS = 8;
@@ -404,7 +405,7 @@ export class TerminalHost {
     }
     async sweep(session) {
         const grace = this.options.closeGraceMs ?? CLOSE_GRACE_MS;
-        const pause = (ms) => new Promise(resolve => setTimeout(resolve, ms));
+        const pause = sleep;
         const leaderGone = () => session.pty === null;
         let readable = true;
         const members = () => {

package/dist/live.d.ts

@@ -16,7 +16,6 @@
 import { type KeyState, type LiveActivityKind, type LiveRecord, type LiveRecorderOptions } from "./live-records.js";
 export declare const LIVE_LINE_CAP: number;
 export declare const LIVE_FILE_CAP: number;
-export declare const LIVE_CAP_MARKER = "[the live view stopped at its size cap \u2014 the run record continues]";
 export declare const LIVE_REDACTED_LINE = "[a credential-shaped line was redacted]";
 /** Finalized runs keep their live file this long for the final drain. */
 export declare const LIVE_RETAIN_MS: number;

package/dist/live.js

@@ -16,10 +16,9 @@
 import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { join } from "node:path";
 import { scanForSecrets } from "./evidence.js";
-import { createLiveRecorder, LIVE_CAP_WORDS, parseLiveRecords, redactLiveLines, projectLiveText, serializeLiveRecord } from "./live-records.js";
+import { createLiveRecorder, parseLiveRecords, redactLiveLines, projectLiveText, serializeLiveRecord } from "./live-records.js";
 export const LIVE_LINE_CAP = 2 * 1024;
 export const LIVE_FILE_CAP = 4 * 1024 * 1024;
-export const LIVE_CAP_MARKER = LIVE_CAP_WORDS;
 export const LIVE_REDACTED_LINE = "[a credential-shaped line was redacted]";
 /** Finalized runs keep their live file this long for the final drain. */
 export const LIVE_RETAIN_MS = 24 * 60 * 60 * 1000;

package/dist/mcp-core.js

@@ -9,13 +9,11 @@
  * `tools/call` results with `isError: true`.
  */
 import { dirname, join } from 'node:path';
-import { statSync } from 'node:fs';
 import { repositoryContextRead } from './repository-context.js';
 import { ASSIGNMENT_TOOLS, assignmentForCoordinator } from "./assignment-adapters.js";
 import { parseContract, toModelSchema } from "./contracts/contract.js";
 import { GATEWAY_TOOL_INPUTS, GATEWAY_TOOL_OUTPUTS } from "./contracts/gateway-tools.js";
 import { reportToolOutput } from "./contracts/lead-tools.js";
-import { PACKAGE_VERSION } from "./version.js";
 import { authenticateCoordinator, fileCoordinatorProposal, statusFor, listTasksFor, taskDetailFor, } from "./coordinator.js";
 import { ISO_STAMP_RULE, decisionOver, decisionsOver, labelRepos, queueOver, recapOver } from "./lead-tools.js";
 import { proposeAsCoordinator } from "./coordinator-proposals.js";

package/dist/memory-pass.js

@@ -13,7 +13,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { basename, join } from 'node:path';
+import { join } from 'node:path';
 import { scanForSecrets, readVerifiedArtifact } from './evidence.js';
 import { changeKnowledge, knowledgeView } from './project-knowledge.js';
 import { listDecisions, recordDecision } from './project-memory.js';

package/dist/model-catalog.js

@@ -14,7 +14,7 @@ import { delimiter, join } from "node:path";
 import { fetchOpenRouterModels } from "./openrouter-models.js";
 import { codexModelSchema, codexModelsCacheSchema, npmLatestSchema } from "./contracts/model-catalog.js";
 import { readCappedBody } from "./converse.js";
-import { validModelId } from "./provider.js";
+import {} from "./provider.js";
 import { activeUpdateWork } from "./desktop-update-gate.js";
 export const MODELS_SCHEMA = `
 CREATE TABLE IF NOT EXISTS model_seen (

package/dist/modes.js

@@ -15,6 +15,7 @@
  */
 import { createHash } from "node:crypto";
 import { CHAT_PROVIDERS, isChatProvider } from "./contracts/chat-tables.js";
+import { canonicalJson } from "./canonical-json.js";
 export const MODE_MAX_DAYS = 7;
 /** The presets are STARTING POINTS the ceremony renders in full — the
  * signature always covers the resolved terms, never a label. */
@@ -57,18 +58,6 @@ export function presetTerms(name, absoluteExpiry) {
             absoluteExpiry,
         };
 }
-function canonicalJson(value) {
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJson).join(",")}]`;
-    if (value !== null && typeof value === "object") {
-        const entries = Object.entries(value)
-            .filter(([, v]) => v !== undefined)
-            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
-            .map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`);
-        return `{${entries.join(",")}}`;
-    }
-    return JSON.stringify(value);
-}
 export function modeTermsJson(terms) {
     return canonicalJson(terms);
 }

package/dist/operate.d.ts

@@ -67,6 +67,10 @@ export type OperateOptions = {
     flowStepIo?: Partial<StepIo>;
     /** Injected by tests: how often a worker's flow passes run beside its builds (default FLOW_EVERY_MS). */
     flowEveryMs?: number;
+    /** Injected by tests: the operating system this runs on (check access: no sign-ins on Linux yet). */
+    platform?: NodeJS.Platform;
+    /** Injected by tests: whether this machine has an OS fence for checks (macOS sandbox or bubblewrap). */
+    fenceAvailable?: () => boolean;
     /** Injected by tests: how `flows import` fetches a flow file's address. */
     flowFetch?: FetchLike;
     /** Injected by tests: how `integrations` checks reach services (fetch, gh, sign-in checks, mail servers). */