toolroll 0.9.68 → 0.9.69

package/dist/builder.d.ts

@@ -1,3 +1,5 @@
+import { type NetworkProfile } from "./egress.js";
+import { type CheckAccess } from "./check-access.js";
 import type { WritesMode } from "./writes-mode.js";
 import type { LaunchNetwork } from "./invoke.js";
 import type { ProviderId } from "./contracts/provider.js";
@@ -187,6 +189,13 @@ export declare function redactSecretAssignments(text: string): string;
 /** A build's network (egress.ts): the one its approval sealed, or — sealed before network policies existed — the
  * narrowed legacy one (provider hosts and the repository's registries, nothing added since). */
 export declare function launchNetworkOf(store: Store, taskRef: number, profile: ExecutionProfile): LaunchNetwork;
+/** A build's checks' level and network: its approval's level as this platform can give it (sign-ins sealed before
+ * run sandboxed while sign-ins are off, and the run is stamped with that, what actually ran), and under sign-ins the network its
+ * approval sealed less its agent's own provider hosts (never its checks'). */
+export declare function checkLaunchOf(store: Store, runId: number, profile: ExecutionProfile, platform?: NodeJS.Platform): {
+    access: CheckAccess;
+    network: NetworkProfile | null;
+};
 /** Where a build may write (writes-mode.ts): what its approval sealed, or — sealed before write allowlists — anywhere
  * its fence allows, as it was approved. */
 export declare function launchWritesOf(profile: ExecutionProfile): WritesMode;

package/dist/builder.js

@@ -1,4 +1,5 @@
 import { legacyNetwork, repositoryEcosystems } from "./egress.js";
+import { CHECK_ACCESS_DEFAULT, checkAccessHere, checkNetworkOf } from "./check-access.js";
 import { checkoutGit } from "./teardown-git.js";
 import { isAcpProvider } from "./acp-agents.js";
 import { OBSERVATION_MAILBOX, observationBrief, parseObservationCases, collectObservations } from "./observations.js";
@@ -268,7 +269,26 @@ function buildCheckoutGit(given, worktree, mainCheckout = null) {
 /** A run's setup and check commands, in its build's fence, writing where the approval this build runs under sealed
  * (never the scope as it may since have been rewritten; invoke.ts fencedCommands). */
 function commandRunner(store, runId, profile, inner) {
-    return fencedCommands(store, runId, launchWritesOf(profile), inner);
+    // How far its checks reach (check-access.ts): what its approval sealed, stamped on the run (again: the dispatch stamped
+    // it first) so a later check of its result never runs wider; under sign-ins, behind its checks' own network.
+    const { access, network } = checkLaunchOf(store, runId, profile);
+    store.stampRunCheckAccess(runId, access, network);
+    return fencedCommands(store, runId, launchWritesOf(profile), inner, undefined, access, network ?? undefined);
+}
+/** A build's checks' level and network: its approval's level as this platform can give it (sign-ins sealed before
+ * run sandboxed while sign-ins are off, and the run is stamped with that, what actually ran), and under sign-ins the network its
+ * approval sealed less its agent's own provider hosts (never its checks'). */
+export function checkLaunchOf(store, runId, profile, platform = process.platform) {
+    const access = checkAccessHere(profile.checkAccess ?? CHECK_ACCESS_DEFAULT, platform);
+    if (access !== "sign-ins")
+        return { access, network: null };
+    const taskRef = store.getRun(runId)?.taskRef;
+    const sealed = taskRef === undefined ? undefined : launchNetworkOf(store, taskRef, profile);
+    // No sealed network to narrow from: its checks run sandboxed.
+    if (sealed === undefined || !("policy" in sealed))
+        return { access: CHECK_ACCESS_DEFAULT, network: null };
+    const repo = store.refForId(taskRef)?.repo ?? null;
+    return { access, network: checkNetworkOf(sealed.policy, profile.provider, repo === null ? { mode: "allowlist", hosts: [], loopback: "proxy-only" } : store.projectNetwork(repo)) };
 }
 /** Where a build may write (writes-mode.ts): what its approval sealed, or — sealed before write allowlists — anywhere
  * its fence allows, as it was approved. */
@@ -422,6 +442,12 @@ export async function build(store, request) {
     // resume below can match on them honestly.
     const provenScopeDigest = scope?.approvedDigest ?? "";
     const provenProfileDigest = profileDigestOf(effective.profile);
+    // Its checks' level and network, stamped now with the proof: a batched result that runs no command here still
+    // carries what its approval allows its checks (check-access.ts).
+    {
+        const launch = checkLaunchOf(store, request.runId, effective.profile);
+        store.stampRunCheckAccess(request.runId, launch.access, launch.network);
+    }
     store.stampRun(request.runId, {
         scopeDigest: provenScopeDigest,
         profileDigest: provenProfileDigest,

package/dist/check-access.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Check access (v132, docs/plans/check-access.md): how far a project's setup and check commands reach beyond the
+ * plane's check fence. `sandboxed` (the default) is the fence as it is; `sign-ins` also reads the exact sign-in files
+ * of Claude, Codex and gh, under the project's network fence; `unsandboxed` runs them with no OS fence, trusted by the
+ * whole instance, for a project whose checks must create sandboxes themselves (Toolroll's own). Widening is an instance
+ * operator's act with a password typed now; any approver for the project may narrow it back.
+ */
+import { type NetworkProfile, type ProjectNetwork } from "./egress.js";
+export declare const CHECK_ACCESS_LEVELS: readonly ["sandboxed", "sign-ins", "unsandboxed"];
+export type CheckAccess = typeof CHECK_ACCESS_LEVELS[number];
+export declare const CHECK_ACCESS_DEFAULT: CheckAccess;
+export declare const isCheckAccess: (value: unknown) => value is CheckAccess;
+/** A stored or sealed value as a level: anything missing or unreadable is the narrowest, never a wider one. */
+export declare const checkAccessOf: (value: unknown) => CheckAccess;
+export declare const widerThan: (a: CheckAccess, b: CheckAccess) => boolean;
+/** The narrowest of several levels (none given: the default). */
+export declare const narrowestAccess: (levels: readonly CheckAccess[]) => CheckAccess;
+/** The level as a person reads it, in a sentence's middle ("Checks: …"). */
+export declare function checkAccessWords(level: CheckAccess): string;
+/** What each wider level means, said before anyone chooses it. */
+export declare const CHECK_ACCESS_WARNINGS: Readonly<Record<Exclude<CheckAccess, "sandboxed">, string>>;
+/** The services whose sign-ins a `sign-ins` check reads: Claude's and Codex's own hosts (egress.ts), and GitHub's. */
+export declare const SIGN_IN_HOSTS: readonly string[];
+/** Which of those a project's network doesn't allow (an open network allows all). The check's network is never widened
+ * for them: the operator adds them, as a network change of its own. */
+export declare function signInHostsMissing(network: ProjectNetwork): string[];
+/** The narrower of two networks: every host both allow (a wildcard allows what it covers), local services only if both
+ * do, open only if both are. A check never reaches what either its sealed network or the project's current one refuses. */
+export declare function narrowestNetwork(a: NetworkProfile, b: NetworkProfile): NetworkProfile;
+/** A build's checks' own network: what its approval sealed, less its agent's provider hosts (those are the agent's, never
+ * its checks'); narrower if a project host happens to be one of them. */
+export declare function checkNetworkOf(sealed: NetworkProfile, provider: string, project: ProjectNetwork): NetworkProfile;
+/** Off everywhere, for now (0.9.69): no `sign-ins`. Reading a sign-in file resolves its parent folders by path (Node
+ * has no openat), and each review round found another way a build or a check could swap a folder on that path between
+ * the checks and the read (on Linux a Claude build can write ~/.claude outright). Until that read is race-free, no
+ * check gets sign-ins: setting the level is refused, a level saved or sealed before (or copied in from another
+ * database) runs sandboxed, a scope seals sandboxed, and the sign-ins launch refuses first thing. The code behind it
+ * (signInGrants, readGrantedFile, the copies, the network fence) stays, guarded, for when such a reader exists; flip
+ * SIGN_INS_READY then (Linux stays off until its copies are race-free too). */
+export declare const SIGN_INS_READY = false;
+export declare const signInsAvailable: (platform?: NodeJS.Platform) => boolean;
+/** Why sign-ins can't be chosen here, said plainly (null: they can). */
+export declare const signInsUnavailableWords: (platform?: NodeJS.Platform) => string | null;
+/** The level checks actually get on this platform: `sign-ins` where it isn't available is `sandboxed` (narrower, never
+ * wider). Everything that seals, launches or stamps a check's level goes through this. */
+export declare const checkAccessHere: (level: CheckAccess, platform?: NodeJS.Platform) => CheckAccess;
+/** How a project's checks actually run here, as the settings page and `project check-access` say it: with no OS fence
+ * on this machine and unconfined running allowed by an operator, without a sandbox whatever is saved (never said to be
+ * sandboxed); otherwise the saved level as this platform can give it. */
+export declare function checkAccessRunsAs(level: CheckAccess, here: {
+    platform: NodeJS.Platform;
+    fenced: boolean;
+    unconfinedAllowed: boolean;
+}): CheckAccess;

package/dist/check-access.js

@@ -0,0 +1,80 @@
+/**
+ * Check access (v132, docs/plans/check-access.md): how far a project's setup and check commands reach beyond the
+ * plane's check fence. `sandboxed` (the default) is the fence as it is; `sign-ins` also reads the exact sign-in files
+ * of Claude, Codex and gh, under the project's network fence; `unsandboxed` runs them with no OS fence, trusted by the
+ * whole instance, for a project whose checks must create sandboxes themselves (Toolroll's own). Widening is an instance
+ * operator's act with a password typed now; any approver for the project may narrow it back.
+ */
+import { PROVIDER_HOSTS } from "./egress.js";
+export const CHECK_ACCESS_LEVELS = ["sandboxed", "sign-ins", "unsandboxed"];
+export const CHECK_ACCESS_DEFAULT = "sandboxed";
+export const isCheckAccess = (value) => typeof value === "string" && CHECK_ACCESS_LEVELS.includes(value);
+/** A stored or sealed value as a level: anything missing or unreadable is the narrowest, never a wider one. */
+export const checkAccessOf = (value) => isCheckAccess(value) ? value : CHECK_ACCESS_DEFAULT;
+const RANK = { sandboxed: 0, "sign-ins": 1, unsandboxed: 2 };
+export const widerThan = (a, b) => RANK[a] > RANK[b];
+/** The narrowest of several levels (none given: the default). */
+export const narrowestAccess = (levels) => levels.reduce((low, one) => RANK[one] < RANK[low] ? one : low, levels.length === 0 ? CHECK_ACCESS_DEFAULT : "unsandboxed");
+/** The level as a person reads it, in a sentence's middle ("Checks: …"). */
+export function checkAccessWords(level) {
+    return level === "sandboxed" ? "sandboxed" : level === "sign-ins" ? "sandboxed, with model and GitHub sign-ins" : "not sandboxed";
+}
+/** What each wider level means, said before anyone chooses it. */
+export const CHECK_ACCESS_WARNINGS = {
+    "sign-ins": "This project's checks can read your Claude, Codex and GitHub sign-ins. Its tests could use or send those credentials anywhere its network setting allows. Only choose this for projects you trust.",
+    unsandboxed: "This project's checks get your full access to this machine and to Toolroll itself, including its database and every sign-in. Only for a project whose checks must create sandboxes themselves, such as Toolroll's own.",
+};
+/** The services whose sign-ins a `sign-ins` check reads: Claude's and Codex's own hosts (egress.ts), and GitHub's. */
+export const SIGN_IN_HOSTS = [...PROVIDER_HOSTS["claude"], ...PROVIDER_HOSTS["codex"], "github.com", "api.github.com"];
+/** Which of those a project's network doesn't allow (an open network allows all). The check's network is never widened
+ * for them: the operator adds them, as a network change of its own. */
+export function signInHostsMissing(network) {
+    if (network.mode === "open")
+        return [];
+    const covered = (host) => network.hosts.some(one => one === host || (one.startsWith("*.") && host.endsWith(one.slice(1))));
+    return SIGN_IN_HOSTS.filter(host => !covered(host));
+}
+/** The narrower of two networks: every host both allow (a wildcard allows what it covers), local services only if both
+ * do, open only if both are. A check never reaches what either its sealed network or the project's current one refuses. */
+export function narrowestNetwork(a, b) {
+    const loopback = a.loopback === "any" && b.loopback === "any" ? "any" : "proxy-only";
+    if (a.mode === "open" && b.mode === "open")
+        return { version: 1, mode: "open", hosts: [], loopback };
+    if (a.mode === "open")
+        return { ...b, loopback };
+    if (b.mode === "open")
+        return { ...a, loopback };
+    const covers = (list, host) => list.some(one => one === host || (one.startsWith("*.") && (host.endsWith(one.slice(1)) || host === one)));
+    const hosts = [...new Set([...a.hosts.filter(host => covers(b.hosts, host)), ...b.hosts.filter(host => covers(a.hosts, host))])].sort();
+    return { version: 1, mode: "allowlist", hosts, loopback };
+}
+/** A build's checks' own network: what its approval sealed, less its agent's provider hosts (those are the agent's, never
+ * its checks'); narrower if a project host happens to be one of them. */
+export function checkNetworkOf(sealed, provider, project) {
+    if (sealed.mode === "open")
+        return sealed;
+    // A provider host the project itself lists (an operator added it, for its sign-ins, say) is the checks' too.
+    const agent = new Set((PROVIDER_HOSTS[provider] ?? []).filter(host => !project.hosts.includes(host)));
+    return { ...sealed, hosts: sealed.hosts.filter(host => !agent.has(host)) };
+}
+/** Off everywhere, for now (0.9.69): no `sign-ins`. Reading a sign-in file resolves its parent folders by path (Node
+ * has no openat), and each review round found another way a build or a check could swap a folder on that path between
+ * the checks and the read (on Linux a Claude build can write ~/.claude outright). Until that read is race-free, no
+ * check gets sign-ins: setting the level is refused, a level saved or sealed before (or copied in from another
+ * database) runs sandboxed, a scope seals sandboxed, and the sign-ins launch refuses first thing. The code behind it
+ * (signInGrants, readGrantedFile, the copies, the network fence) stays, guarded, for when such a reader exists; flip
+ * SIGN_INS_READY then (Linux stays off until its copies are race-free too). */
+export const SIGN_INS_READY = false;
+export const signInsAvailable = (platform = process.platform) => SIGN_INS_READY && platform !== "linux";
+/** Why sign-ins can't be chosen here, said plainly (null: they can). */
+export const signInsUnavailableWords = (platform = process.platform) => signInsAvailable(platform) ? null
+    : "Not available yet: sign-ins can't be shared with checks safely. Choose Sandboxed or Not sandboxed.";
+/** The level checks actually get on this platform: `sign-ins` where it isn't available is `sandboxed` (narrower, never
+ * wider). Everything that seals, launches or stamps a check's level goes through this. */
+export const checkAccessHere = (level, platform = process.platform) => level === "sign-ins" && !signInsAvailable(platform) ? CHECK_ACCESS_DEFAULT : level;
+/** How a project's checks actually run here, as the settings page and `project check-access` say it: with no OS fence
+ * on this machine and unconfined running allowed by an operator, without a sandbox whatever is saved (never said to be
+ * sandboxed); otherwise the saved level as this platform can give it. */
+export function checkAccessRunsAs(level, here) {
+    return !here.fenced && here.unconfinedAllowed ? "unsandboxed" : checkAccessHere(level, here.platform);
+}

package/dist/contracts/console-api.d.ts

@@ -84,6 +84,7 @@ export declare const CONSOLE_FORMS: {
     readonly projectLiveView: FormContract<"act" | "nonce" | "password" | "repo">;
     readonly projectNetwork: FormContract<"hosts" | "local" | "mode" | "password" | "repo">;
     readonly projectWrites: FormContract<"password" | "repo" | "writes">;
+    readonly projectCheckAccess: FormContract<"confirm-open" | "level" | "password" | "repo">;
     readonly projectDelete: FormContract<"name" | "password" | "repo" | "step">;
     readonly policy: FormContract<"ceiling" | "models" | "password" | "provider" | "tools">;
     readonly approval: FormContract<"not_requester" | "password" | "paths" | "protect" | "repo">;

package/dist/contracts/console-api.js

@@ -93,6 +93,7 @@ export const CONSOLE_FORMS = {
     projectLiveView: formContract("POST /settings/project/live-view", ["repo", "act", "password", "nonce"]),
     projectNetwork: formContract("POST /settings/project/network", ["repo", "mode", "local", "hosts", "password"]),
     projectWrites: formContract("POST /settings/project/writes", ["repo", "writes", "password"]),
+    projectCheckAccess: formContract("POST /settings/project/check-access", ["repo", "level", "confirm-open", "password"]),
     projectDelete: formContract("POST /settings/project/delete", ["repo", "name", "step", "password"]),
     policy: formContract("POST /settings/policy", ["password", "provider", "models", "tools", "ceiling"]),
     approval: formContract("POST /settings/approval", ["repo", "password", "protect", "paths", "not_requester"]),

package/dist/invoke.d.ts

@@ -21,6 +21,8 @@ import { type VersionProbe } from "./attest.js";
 import type { Store } from "./store.js";
 import type { RunOptions } from "./exec.js";
 import type { Runner } from "./worktree.js";
+import { type NetworkFence, type SignInGrants } from "./agent-fence.js";
+import { type CheckAccess } from "./check-access.js";
 import { type WritesMode } from "./agent-fence.js";
 import { type NetworkProfile } from "./egress.js";
 export type { ProviderRunner } from "./provider.js";
@@ -117,11 +119,46 @@ export declare function invokeAgent(store: Store, runId: number, spec: AgentSpec
  * Their network stays as it was. A machine without an OS fence runs them as before; a fence that can't be prepared
  * (a checkout whose binding no longer proves) runs nothing.
  */
-export declare function fencedCommands(store: Store, runId: number, writes: WritesMode, inner: Runner, available?: () => boolean): Runner;
+export declare function fencedCommands(store: Store, runId: number, writes: WritesMode, inner: Runner, available?: () => boolean, access?: CheckAccess, network?: NetworkProfile): Runner;
 /**
  * A project's checks run in a checkout of a result's commit made for them (result-follow-ups.ts, batch-checks.ts), in
  * the same fence as a build's commands: Toolroll's state, credentials, other projects and runs denied; under the
  * project's writes setting, only that checkout, its Git data, its own temp folder, the project's caches and its check
  * database writable. Where nothing can confine them, they run only when an instance operator allowed unconfined agents.
  */
-export declare function fencedCheckoutCommands(store: Store, repo: string, checkout: string, inner: Runner, available?: () => boolean): Runner;
+export declare function fencedCheckoutCommands(store: Store, repo: string, checkout: string, inner: Runner, available?: () => boolean, access?: CheckAccess, network?: NetworkProfile): Runner;
+/**
+ * A `sign-ins` check's launch (check-access.ts): its exact sign-in files and its own transcript folder
+ * (agent-fence.ts signInGrants), Codex's config and sign-in copied into a home of the launch's own (private, gone with
+ * the launch; ~/.codex itself stays fenced), gh pointed at its own folder, and the network the check runs under:
+ * open, or its allowlist through a proxy of its own (on Linux, carried in by a bridge). Nothing about it is started
+ * unless all of it is.
+ */
+export declare function signInsLaunch(store: Store, own: string, temp: string, checkout: string, policy: NetworkProfile, gitPaths: readonly string[], platform?: NodeJS.Platform): Promise<{
+    grants: SignInGrants;
+    network: NetworkFence;
+    env: Record<string, string>;
+    close(): Promise<void>;
+} | {
+    problem: string;
+}>;
+/** How a check at `access` actually runs here: unsandboxed where no OS fence exists (and an operator allowed that), else
+ * as asked. Recorded on every check's receipt, so a check that ran without a sandbox is never shown as sandboxed. */
+export declare function actualCheckAccess(store: Store, access: CheckAccess): CheckAccess;
+/**
+ * A check of saved results, in their own checkout (batch-checks.ts, result-follow-ups.ts), worked out right before each
+ * command: never wider than any of those results' own checks ran, nor than the project allows now; under sign-ins, the
+ * narrowest of their sealed check networks and the project's current one. A result with no sealed network runs it
+ * sandboxed.
+ */
+export declare function checkoutLaunchOf(store: Store, repo: string, runIds: readonly number[], platform?: NodeJS.Platform): {
+    access: CheckAccess;
+    network: NetworkProfile | undefined;
+};
+/** The widest level a check's commands actually ran at (what its receipt says). */
+export declare const widestRan: (levels: readonly CheckAccess[]) => CheckAccess;
+/** A check log's line for how its commands ran, when wider than sandboxed (shown with the log). */
+export declare const ranAtLine: (level: CheckAccess) => string | null;
+/** A saved result's check command runner (batch-checks.ts, result-follow-ups.ts): its level and network worked out right
+ * now (checkoutLaunchOf), and how it actually runs told to `ran`. */
+export declare function checkoutRunner(store: Store, repo: string, checkout: string, inner: Runner, runIds: readonly number[], ran: (level: CheckAccess) => void, platform?: NodeJS.Platform): Runner;

package/dist/invoke.js

@@ -29,13 +29,14 @@ import { witnessedRunner } from "./process-custody.js";
 import { underStopWatch } from "./task-control.js";
 import { childDatabaseEnv, isolatedChildDatabase, removeChildDatabase as removeAgentDatabase } from "./child-database.js";
 import { RunSignInError, noToolsArgs, prepareRunTools } from "./project-tools.js";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { poolRootOf } from "./worktree.js";
-import { BRIDGE_DIR } from "./agent-fence.js";
+import { BRIDGE_DIR, checkLaunchRoot, readGrantedFile, SIGN_IN_COPIES_DIR, signInCopiesRoot, signInGrants } from "./agent-fence.js";
+import { CHECK_ACCESS_DEFAULT, checkAccessHere, narrowestAccess, narrowestNetwork, signInsAvailable } from "./check-access.js";
 import { agentFence, buildCacheEnv, buildCacheFolder, grantFolder, writeAllowlist, WRITES_DEFAULT, CheckoutBindingError, trustedWorktreeBinding, checkoutGitEnv, HARDENED_GIT_ARGS, codexFenceArgv, fenceGrants, fencedGitEnv, linuxFenceAvailable, linuxFenced, macosFenceAvailable, macosFenced, NO_GRANTS, runFolders, taskBoundary } from "./agent-fence.js";
-import { proxyEnv, providerOnlyNetwork, startEgressProxy } from "./egress.js";
+import { proxyEnv, providerOnlyNetwork, repositoryEcosystems, resolveNetwork, startEgressProxy } from "./egress.js";
 import { bridgeFits, startEgressBridge } from "./egress-bridge.js";
 import { claudeConfigDir, claudeDefaults, codexDefaults, codexHomeDir, isolatedCodexHome } from "./provider-home.js";
 import { billingOf, claudeBillingFrom, seenBilling } from "./spend.js";
@@ -969,21 +970,27 @@ function runFence(store, runId, provider, keyHome, ownTools, writes = WRITES_DEF
  * Their network stays as it was. A machine without an OS fence runs them as before; a fence that can't be prepared
  * (a checkout whose binding no longer proves) runs nothing.
  */
-export function fencedCommands(store, runId, writes, inner, available = () => macosFenceAvailable() || linuxFenceAvailable()) {
+export function fencedCommands(store, runId, writes, inner, available = () => macosFenceAvailable() || linuxFenceAvailable(), access = CHECK_ACCESS_DEFAULT, network) {
     // An injected runner (tests) starts no real command, as an injected agent starts no real agent (invokeAgent).
     if (inner !== runCommand)
         return inner;
     return async (file, args, options) => {
-        // As a build itself: where nothing can confine them, they run only when an instance operator allowed unconfined agents.
+        // As a build itself: where nothing can confine them, they run only when an instance operator allowed unconfined agents
+        // (and the run says so: its checks ran without a sandbox, whatever was sealed).
         if (!available()) {
-            if (store.unfencedAgentsAllowed())
+            if (store.unfencedAgentsAllowed()) {
+                store.stampRunCheckAccess(runId, "unsandboxed");
                 return inner(file, args, options);
+            }
             return { code: 1, stdout: "", stderr: "This machine can't confine the build's commands (no macOS sandbox, no working bubblewrap), so they didn't run. Install bubblewrap, or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`.\n", timedOut: false, notFound: false };
         }
-        const own = realpathSync(mkdtempSync(join(tmpdir(), "so-cmd-")));
+        const own = realpathSync(mkdtempSync(join(checkLaunchRoot(), "so-cmd-")));
         try {
             const temp = join(own, "tmp");
             mkdirSync(temp, { mode: 0o700 });
+            // Not sandboxed (check-access.ts): the project's checks are trusted by the whole instance, as before 0.9.66.
+            if (access === "unsandboxed")
+                return await inner(file, args, { ...options, env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp } });
             const fenced = runFence(store, runId, "command", undefined, own, writes);
             if (fenced.problem !== undefined)
                 return { code: 1, stdout: "", stderr: `${fenced.problem}\n`, timedOut: false, notFound: false };
@@ -993,12 +1000,24 @@ export function fencedCommands(store, runId, writes, inner, available = () => ma
             const database = options?.env?.["TOOLROLL_DB"];
             const checkData = database === undefined || fenced.grants.writes === undefined ? null : grantFolder(dirname(database), false);
             const grants = checkData === null ? fenced.grants : { ...fenced.grants, writes: { ...fenced.grants.writes, subpaths: [...fenced.grants.writes.subpaths, checkData] } };
-            return await inner(file, args, {
-                ...options,
-                fence: fenced.fence,
-                fenceGrants: grants,
-                env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(fenced.cache === undefined || fenced.grants.writes === undefined ? {} : buildCacheEnv(fenced.cache)) },
-            });
+            const checkout = store.getRun(runId)?.worktree ?? null;
+            const signIns = access !== "sign-ins" ? null : checkout === null ? { problem: "The check's checkout is unknown, so its sign-ins can't be granted." }
+                : network === undefined ? { problem: "A check with sign-ins has no network sealed for it, so nothing ran." }
+                    : await signInsLaunch(store, own, temp, checkout, network, fenced.gitPaths ?? []);
+            if (signIns !== null && "problem" in signIns)
+                return { code: 1, stdout: "", stderr: `${signIns.problem}\n`, timedOut: false, notFound: false };
+            try {
+                return await inner(file, args, {
+                    ...options,
+                    fence: fenced.fence,
+                    fenceGrants: signIns === null ? grants : { ...grants, signIns: signIns.grants, network: signIns.network },
+                    env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(fenced.cache === undefined || fenced.grants.writes === undefined ? {} : buildCacheEnv(fenced.cache)), ...(signIns?.env ?? {}) },
+                    ...(signIns === null ? {} : { omitEnv: [...(options?.omitEnv ?? []), ...SIGN_INS_OMITTED_ENV] }),
+                });
+            }
+            finally {
+                await signIns?.close();
+            }
         }
         finally {
             rmSync(own, { recursive: true, force: true });
@@ -1011,7 +1030,7 @@ export function fencedCommands(store, runId, writes, inner, available = () => ma
  * project's writes setting, only that checkout, its Git data, its own temp folder, the project's caches and its check
  * database writable. Where nothing can confine them, they run only when an instance operator allowed unconfined agents.
  */
-export function fencedCheckoutCommands(store, repo, checkout, inner, available = () => macosFenceAvailable() || linuxFenceAvailable()) {
+export function fencedCheckoutCommands(store, repo, checkout, inner, available = () => macosFenceAvailable() || linuxFenceAvailable(), access = CHECK_ACCESS_DEFAULT, network) {
     if (inner !== runCommand)
         return inner;
     return async (file, args, options) => {
@@ -1023,10 +1042,13 @@ export function fencedCheckoutCommands(store, repo, checkout, inner, available =
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
             return inner(file, args, options);
-        const own = realpathSync(mkdtempSync(join(tmpdir(), "so-cmd-")));
+        const own = realpathSync(mkdtempSync(join(checkLaunchRoot(), "so-cmd-")));
         try {
             const temp = join(own, "tmp");
             mkdirSync(temp, { mode: 0o700 });
+            // Not sandboxed (check-access.ts): the project's checks are trusted by the whole instance, as before 0.9.66.
+            if (access === "unsandboxed")
+                return await inner(file, args, { ...options, env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp } });
             let binding;
             try {
                 binding = trustedWorktreeBinding(repo, checkout);
@@ -1044,12 +1066,24 @@ export function fencedCheckoutCommands(store, repo, checkout, inner, available =
             const base = fenceGrants({ databaseFile, worktree: checkout, boundary, runFolders: folders, linked: linkedFor(store, checkout), binding, poolRoots });
             const grants = allowed === null ? base
                 : { ...base, readOnly: [...new Set([...base.readOnly, ...allowed.readOnly])].sort(), writes: { ...allowed.writes, subpaths: [...allowed.writes.subpaths, ...(checkData === null ? [] : [checkData])] } };
-            return await inner(file, args, {
-                ...options,
-                fence: agentFence({ databaseFile, worktree: checkout, boundary, binding, runFolders: folders, extra: allowed?.deny ?? [] }),
-                fenceGrants: grants,
-                env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(allowed === null ? {} : buildCacheEnv(cache)) },
-            });
+            // With sign-ins, under the network its caller proved for it (the narrowest of its results' sealed check networks and
+            // the project's current one): none given, nothing runs.
+            const signIns = access !== "sign-ins" ? null : network === undefined ? { problem: "A check with sign-ins has no network sealed for it, so nothing ran." }
+                : await signInsLaunch(store, own, temp, checkout, network, [binding.gitdir, join(binding.main, ".git")]);
+            if (signIns !== null && "problem" in signIns)
+                return { code: 1, stdout: "", stderr: `${signIns.problem}\n`, timedOut: false, notFound: false };
+            try {
+                return await inner(file, args, {
+                    ...options,
+                    fence: agentFence({ databaseFile, worktree: checkout, boundary, binding, runFolders: folders, extra: allowed?.deny ?? [] }),
+                    fenceGrants: signIns === null ? grants : { ...grants, signIns: signIns.grants, network: signIns.network },
+                    env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(allowed === null ? {} : buildCacheEnv(cache)), ...(signIns?.env ?? {}) },
+                    ...(signIns === null ? {} : { omitEnv: [...(options?.omitEnv ?? []), ...SIGN_INS_OMITTED_ENV] }),
+                });
+            }
+            finally {
+                await signIns?.close();
+            }
         }
         finally {
             rmSync(own, { recursive: true, force: true });
@@ -1118,3 +1152,124 @@ async function codexLoginBilling(binary, omitEnv) {
 function plainLines(stdout) {
     return stdout.split("\n").filter(line => !line.trimStart().startsWith("{")).join("\n");
 }
+/** What a `sign-ins` check never inherits: a caller's choice of Claude's config folder (Claude's keychain sign-in is
+ * keyed to its default one; check-access.ts). gh's and Codex's are set to the granted ones instead. */
+const SIGN_INS_OMITTED_ENV = ["CLAUDE_CONFIG_DIR"];
+/**
+ * A `sign-ins` check's launch (check-access.ts): its exact sign-in files and its own transcript folder
+ * (agent-fence.ts signInGrants), Codex's config and sign-in copied into a home of the launch's own (private, gone with
+ * the launch; ~/.codex itself stays fenced), gh pointed at its own folder, and the network the check runs under:
+ * open, or its allowlist through a proxy of its own (on Linux, carried in by a bridge). Nothing about it is started
+ * unless all of it is.
+ */
+export async function signInsLaunch(store, own, temp, checkout, policy, gitPaths, platform = process.platform) {
+    // The belt (check-access.ts signInsAvailable, off for now): no sign-in file is read, copied or granted, whatever level
+    // reached this far. Its callers already run such a check sandboxed; anything else that asks runs nothing.
+    if (!signInsAvailable(platform))
+        return { problem: "Sign-ins can't be shared with checks yet, so nothing ran." };
+    const home = homedir();
+    const grants = signInGrants(home, checkout);
+    const cleanup = [];
+    // Codex's files are copied, each read only as the real file it is (readGrantedFile: no link, here or above it).
+    const codex = join(own, "codex");
+    mkdirSync(codex, { mode: 0o700 });
+    for (const name of ["config.toml", "auth.json"]) {
+        const bytes = readGrantedFile(join(realpathSync(home), ".codex", name));
+        if (bytes !== null)
+            writeFileSync(join(codex, name), bytes, { mode: 0o600 });
+    }
+    // On Linux every granted file is bound from a copy of its own, made the same way (bubblewrap binds a source path, and
+    // a link swapped in after validation must never be what it binds). A Mac's sandbox checks the real path itself.
+    // Not reached for now: the belt above refuses until reading these files is race-free.
+    if (process.platform === "linux") {
+        const copies = {};
+        // Under Toolroll's own state folder, which every fence denies whole (a launch's folder in a shared /tmp isn't masked
+        // from a launch already running): bubblewrap binds from the original root, so only this check sees them.
+        const database = store.databaseFile();
+        if (database === null || database === "" || database === ":memory:")
+            return { problem: "A check with sign-ins needs Toolroll's state folder, so nothing ran." };
+        const state = dirname(realpathSync(database));
+        try {
+            mkdirSync(join(state, SIGN_IN_COPIES_DIR), { mode: 0o700 });
+        }
+        catch { /* there already: checked next */ }
+        // Only the real, private folder Toolroll made (this user's, 0700, no link): never a link planted where it should be.
+        const parent = signInCopiesRoot(state);
+        if (parent === null)
+            return { problem: "The sign-in copies folder isn't a private folder of Toolroll's, so nothing ran." };
+        const folder = mkdtempSync(join(parent, `c-${process.pid}-`));
+        cleanup.push(folder);
+        grants.read.forEach((path, index) => {
+            const bytes = readGrantedFile(path);
+            if (bytes === null)
+                return;
+            const copy = join(folder, String(index));
+            writeFileSync(copy, bytes, { mode: 0o600 });
+            copies[path] = copy;
+        });
+        grants.read = grants.read.filter(path => copies[path] !== undefined);
+        grants.copies = copies;
+    }
+    let egress = null;
+    let bridge = null;
+    const close = async () => { await egress?.close(); await bridge?.close(); for (const one of cleanup)
+        rmSync(one, { recursive: true, force: true }); };
+    try {
+        const env = { CODEX_HOME: codex, GH_CONFIG_DIR: join(home, ".config", "gh"), XDG_CONFIG_HOME: join(home, ".config") };
+        if (policy.mode === "open")
+            return { grants, network: { mode: "open" }, env, close };
+        // Exactly the project's network: the services the sign-ins are for are reached only if the operator allowed their
+        // hosts (check-access.ts signInHostsMissing says which are missing; never added here).
+        egress = await startEgressProxy({ hosts: policy.hosts });
+        const network = { mode: "allowlist", proxyPort: egress.port, brokerPorts: [], loopback: policy.loopback, socketRoots: [temp, realpathSync(checkout)] };
+        if (linuxFenceAvailable()) {
+            const database = store.databaseFile();
+            const fenced = database === null || database === "" || database === ":memory:" ? undefined : join(dirname(realpathSync(database)), BRIDGE_DIR);
+            bridge = await startEgressBridge([egress.port], fenced !== undefined && bridgeFits(fenced) ? fenced : undefined);
+            network.bridge = { folder: realpathSync(bridge.folder), forwarder: realpathSync(bridge.forwarder), node: process.execPath };
+            // Its private /tmp gives back its checkout, its launch folder and its checkout's own Git data (as a build's does).
+            network.keep = [realpathSync(checkout), own, ...gitPaths.filter(path => existsSync(path))];
+        }
+        return { grants, network, env: { ...env, ...proxyEnv(egress, policy.loopback) }, close };
+    }
+    catch (error) {
+        await close();
+        return { problem: `The check's network could not be set up, so nothing ran: ${error instanceof Error ? error.message : String(error)}` };
+    }
+}
+/** How a check at `access` actually runs here: unsandboxed where no OS fence exists (and an operator allowed that), else
+ * as asked. Recorded on every check's receipt, so a check that ran without a sandbox is never shown as sandboxed. */
+export function actualCheckAccess(store, access) {
+    return macosFenceAvailable() || linuxFenceAvailable() || !store.unfencedAgentsAllowed() ? access : "unsandboxed";
+}
+/**
+ * A check of saved results, in their own checkout (batch-checks.ts, result-follow-ups.ts), worked out right before each
+ * command: never wider than any of those results' own checks ran, nor than the project allows now; under sign-ins, the
+ * narrowest of their sealed check networks and the project's current one. A result with no sealed network runs it
+ * sandboxed.
+ */
+export function checkoutLaunchOf(store, repo, runIds, platform = process.platform) {
+    // As checks can get it: sign-ins (off for now; a stamp or setting from before, or another database) run sandboxed.
+    const access = checkAccessHere(narrowestAccess([store.projectCheckAccess(repo), ...runIds.map(id => store.runCheckAccess(id))]), platform);
+    if (access !== "sign-ins")
+        return { access, network: undefined };
+    const sealed = runIds.map(id => store.runCheckNetwork(id));
+    if (sealed.length === 0 || sealed.some(one => one === null))
+        return { access: CHECK_ACCESS_DEFAULT, network: undefined };
+    const live = resolveNetwork("command", store.projectNetwork(repo), repositoryEcosystems(repo));
+    return { access, network: sealed.reduce((low, one) => narrowestNetwork(low, one), live) };
+}
+/** The widest level a check's commands actually ran at (what its receipt says). */
+export const widestRan = (levels) => levels.includes("unsandboxed") ? "unsandboxed" : levels.includes("sign-ins") ? "sign-ins" : CHECK_ACCESS_DEFAULT;
+/** A check log's line for how its commands ran, when wider than sandboxed (shown with the log). */
+export const ranAtLine = (level) => level === "sandboxed" ? null
+    : `=== Check access ===\n${level === "unsandboxed" ? "These commands ran without a sandbox." : "These commands ran sandboxed, with model and GitHub sign-ins."}`;
+/** A saved result's check command runner (batch-checks.ts, result-follow-ups.ts): its level and network worked out right
+ * now (checkoutLaunchOf), and how it actually runs told to `ran`. */
+export function checkoutRunner(store, repo, checkout, inner, runIds, ran, platform = process.platform) {
+    return (file, args, options) => {
+        const launch = checkoutLaunchOf(store, repo, runIds, platform);
+        ran(actualCheckAccess(store, launch.access));
+        return fencedCheckoutCommands(store, repo, checkout, inner, undefined, launch.access, launch.network)(file, args, options);
+    };
+}

package/dist/operate.d.ts

@@ -67,6 +67,10 @@ export type OperateOptions = {
     flowStepIo?: Partial<StepIo>;
     /** Injected by tests: how often a worker's flow passes run beside its builds (default FLOW_EVERY_MS). */
     flowEveryMs?: number;
+    /** Injected by tests: the operating system this runs on (check access: no sign-ins on Linux yet). */
+    platform?: NodeJS.Platform;
+    /** Injected by tests: whether this machine has an OS fence for checks (macOS sandbox or bubblewrap). */
+    fenceAvailable?: () => boolean;
     /** Injected by tests: how `flows import` fetches a flow file's address. */
     flowFetch?: FetchLike;
     /** Injected by tests: how `integrations` checks reach services (fetch, gh, sign-in checks, mail servers). */