toolroll 0.9.68 → 0.9.69

package/dist/store.js

@@ -1,5 +1,6 @@
 import { WRITES_DEFAULT } from "./writes-mode.js";
-import { PROJECT_NETWORK_DEFAULT, projectNetworkFromValue, runNetworkFromValue } from "./egress.js";
+import { checkAccessOf, widerThan } from "./check-access.js";
+import { networkFromValue, PROJECT_NETWORK_DEFAULT, projectNetworkFromValue, runNetworkFromValue } from "./egress.js";
 import { isAcpProfile, isAcpProvider } from "./acp-agents.js";
 import { ACP_CONFORMANCE_VERSION, launchFromJson } from "./acp-attest.js";
 import { reclaimDatabase } from "./database-reclaim.js";
@@ -718,7 +719,9 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // (confinement_setting, one row; off unless an instance operator turns it on).
 // v131 adds, and changes no saved row: where a project's builds may write (project_writes; agent-fence.ts, docs/plans/
 // agent-baseline-hardening.md arc 2) — only their workspace unless an approver chose anywhere.
-export const SCHEMA_VERSION = 131;
+// v132 adds, and changes no saved row: how far a project's checks reach beyond the check fence (project_check_access;
+// check-access.ts, docs/plans/check-access.md) — sandboxed unless an instance operator widened it.
+export const SCHEMA_VERSION = 132;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -851,7 +854,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -988,6 +991,15 @@ CREATE TABLE IF NOT EXISTS project_writes (
   updated_by  TEXT NOT NULL
 );
 `;
+/** v132: how far a project's checks reach beyond the check fence (check-access.ts CheckAccess). */
+export const PROJECT_CHECK_ACCESS_SCHEMA = `
+CREATE TABLE IF NOT EXISTS project_check_access (
+  repo        TEXT PRIMARY KEY,
+  level       TEXT NOT NULL CHECK (level IN ('sandboxed', 'sign-ins', 'unsandboxed')),
+  updated_at  TEXT NOT NULL,
+  updated_by  TEXT NOT NULL
+);
+`;
 /** v129: a finished run's How it ran, derived from its own records on first view (display only: never a verdict). Its
  * parser version says when to derive again; `steps` says how complete the step detail was, and why not. */
 export const RUN_EFFICIENCY_SCHEMA = `
@@ -3923,6 +3935,11 @@ function initializeStore(db, file) {
     db.exec(CONFINEMENT_SCHEMA);
     // v131: where a project's builds may write (a new table only).
     db.exec(PROJECT_WRITES_SCHEMA);
+    // v132: how far a project's checks reach beyond the check fence (a new table), and the level each build's checks ran
+    // at (run.sandbox_access; saved rows read NULL: sandboxed).
+    db.exec(PROJECT_CHECK_ACCESS_SCHEMA);
+    addColumn(db, "run", "sandbox_access", "TEXT");
+    addColumn(db, "run", "sandbox_network", "TEXT");
     // v123: a flow that runs on its own (flow-unattended.ts): its grants and daily runs (new tables), and which authority
     // armed a plan's unchanged-plan approval (plan_authorization.basis, V123_ADDED_COLUMNS: saved rows read the mode).
     db.exec(FLOW_UNATTENDED_SCHEMA);
@@ -6729,6 +6746,19 @@ export class Store {
                     .get(taskId);
                 if (writtenByLead !== undefined)
                     return false;
+                // CHECK ACCESS (v132, check-access.ts): a scope whose checks reach beyond the fence (sign-ins, or no sandbox at
+                // all) seals only on a person's password ceremony — never a mode, a grant, a chat confirmation or a carry.
+                const profileText = this.db.prepare("SELECT profile_json FROM task_scope WHERE task_id = ?").get(taskId)?.["profile_json"];
+                let sealedAccess;
+                try {
+                    const stored = typeof profileText === "string" ? JSON.parse(profileText) : null;
+                    sealedAccess = stored?.profile?.["checkAccess"];
+                }
+                catch {
+                    sealedAccess = "unreadable";
+                }
+                if (sealedAccess !== undefined)
+                    return false;
             }
             // SEPARATION OF DUTIES (v102), enforced in the primitive so no road
             // around it exists: a project's rules can refuse the requester, and
@@ -18987,6 +19017,59 @@ export class Store {
         this.db.prepare("UPDATE lead_queue SET context_json = NULL WHERE message = ?").run(message);
         this.db.prepare("DELETE FROM memory_search WHERE kind = 'conversation' AND ref = ?").run(`message:${message}`);
     }
+    // ---- check access (v132, check-access.ts). Kept last in the class: the freshness tripwire pins method positions.
+    /** How far a project's checks reach beyond the check fence: its saved level, or sandboxed. */
+    projectCheckAccess(repo) {
+        // A damaged row reads as the narrowest level, never a wider one.
+        return checkAccessOf(this.db.prepare("SELECT level FROM project_check_access WHERE repo = ?").get(repo)?.["level"]);
+    }
+    /** Who last changed a project's check access, and when (null: never changed). */
+    projectCheckAccessChange(repo) {
+        const row = this.db.prepare("SELECT updated_by, updated_at FROM project_check_access WHERE repo = ?").get(repo);
+        return row === undefined ? null : { by: String(row["updated_by"]), at: String(row["updated_at"]) };
+    }
+    /** The level a run's setup and checks ran at (its sealed approval's, or unsandboxed where no OS fence exists). Its
+     * follow-up and batch checks never run wider than this. */
+    stampRunCheckAccess(runId, level, network = null) {
+        this.db.prepare("UPDATE run SET sandbox_access = ?, sandbox_network = ? WHERE id = ?").run(level, network === null ? null : JSON.stringify(network), runId);
+    }
+    /** The network a run's sign-ins checks ran under (null: none sealed; such a run's later checks run sandboxed). */
+    runCheckNetwork(runId) {
+        const text = this.db.prepare("SELECT sandbox_network FROM run WHERE id = ?").get(runId)?.["sandbox_network"];
+        if (typeof text !== "string")
+            return null;
+        try {
+            return networkFromValue(JSON.parse(text));
+        }
+        catch {
+            return null;
+        }
+    }
+    /** The level a run's checks ran at: missing or unreadable reads as sandboxed. */
+    runCheckAccess(runId) {
+        return checkAccessOf(this.db.prepare("SELECT sandbox_access FROM run WHERE id = ?").get(runId)?.["sandbox_access"]);
+    }
+    /** A project's check access changed: saved, and in the ledger as before → after. `may` is what the caller proved:
+     * "widen" only after an instance operator's password typed now; anything else may only narrow. The level is read again
+     * and compared in the same transaction as the write, so a change made while the caller was proving itself can't turn
+     * a narrowing into a widening. Refused: null, nothing written. */
+    setProjectCheckAccess(repo, level, by, now, authority) {
+        return this.transact(() => {
+            const before = this.projectCheckAccess(repo);
+            // Who is acting is proved again here too: an account revoked, demoted or moved off the project while its password
+            // was being checked changes nothing.
+            const account = this.accountOf(by);
+            if (account === null || account.revokedAt !== null || account.role !== "approver" || !this.accountCanAccess(by, repo))
+                return null;
+            if (widerThan(level, before) && (authority.may !== "widen" || !this.isInstanceOperator(by)))
+                return null;
+            this.db.prepare(`INSERT INTO project_check_access (repo, level, updated_at, updated_by) VALUES (?, ?, ?, ?)
+        ON CONFLICT (repo) DO UPDATE SET level = excluded.level, updated_at = excluded.updated_at, updated_by = excluded.updated_by`).run(repo, level, now.toISOString(), by);
+            const after = this.projectCheckAccess(repo);
+            this.recordPolicy(by, repo, "check access", before, after, now);
+            return { before, after };
+        });
+    }
 }
 /** A stored count or id that must be a whole, non-negative number — a
  * NULL, an empty string, a fraction, or text reads as null (v48 authority repair). */

package/dist/surface.js

@@ -353,6 +353,7 @@ const GUIDE_ROWS = [
     operator("runner bind", "replace which repositories a worker may build in"),
     operator("runner capacity", "set how many tasks a worker runs at once; running work carries on, the new number applies at the next claim"),
     operator("project checks", "show or set a project's batch checks (--batch on|off, off by default): results that finish within 10 minutes share one full check on a temporary batch commit; nothing is merged into a real branch"),
+    operator("project check-access", "show or set how far a project's checks reach: sandboxed (the default), with model and GitHub sign-ins, or not sandboxed; an instance operator widens it with a password typed now"),
     operator("project concurrency", "set how many of a project's tasks build at once (default 2, never past the worker's capacity); running work carries on"),
     operator("coordinator mint", "mint the MCP filing credential — repo-bound, rate-limited, token shown once"),
     operator("coordinator revoke", "revoke an MCP filing credential"),
@@ -450,7 +451,7 @@ const REMOTE_STEP_UP = [
     // A person's own API tokens: a password step-up on the server's machine, or the console. Never with a token.
     "tokens create", "tokens list", "tokens revoke", "tokens rotate",
     "mode show", "mode set", "mode revoke", "chat-approval on", "review on", "review off", "config set", "config clear",
-    "verify set", "verify clear", "verify level", "project checks", "project concurrency", "intake grant", "intake clear", "webhook primary",
+    "verify set", "verify clear", "verify level", "project checks", "project check-access", "project concurrency", "intake grant", "intake clear", "webhook primary",
 ];
 const REMOTE_YES = [
     "status", "integrations", "ready", "gaps", "grants", "sync", "audit",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.68",
+  "version": "0.9.69",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"