toolroll 0.9.68 → 0.9.70

package/dist/agent-fence.js

@@ -1,57 +1,38 @@
 /**
- * The agent fence: what no build, plan, scout or repair agent may read or
- * write, whatever its permission mode. Agents run as the operator's own OS
- * user, so without it an agent could read the approver's remembered login
- * (`up-login.txt`), runner and coordinator tokens, provider keys, project
- * tool secrets, other runs' evidence, or the live database — and use them
- * to approve its own work. The fence closes that at the operating system,
- * not in the model's instructions:
+ * The agent fence: what no build, plan, scout or repair agent may read or write, whatever its permission mode. Agents
+ * run as the operator's own OS user, so without it an agent could read the approver's remembered login
+ * (`up-login.txt`), runner and coordinator tokens, provider keys, project tool secrets, other runs' evidence, or the
+ * live database — and use them to approve its own work. The fence closes that at the operating system, not in the
+ * model's instructions.
  *
- * - Codex (every platform): a permission profile that extends its own
- *   `:workspace` sandbox (Auto keeps it exactly: workspace writes, no
- *   network) or widens it to write anywhere with network on (Full access,
- *   which used to mean no sandbox at all), and denies every fenced path.
- * - Claude and Gemini on macOS: the whole agent process runs inside a
- *   Seatbelt profile that allows everything except the fenced paths.
- * - Claude and Gemini on Linux (v88): the agent runs under bubblewrap, in its
- *   own mount namespace where every fenced folder is an empty one and every
- *   fenced file is /dev/null. Used when `bwrap` is installed and works here.
- * - Claude everywhere also gets Read/Edit deny rules for its own file tools.
+ * The sandbox itself is Anthropic's sandbox-runtime (sandbox-runtime.ts): every macOS Seatbelt profile and every Linux
+ * bubblewrap + seccomp invocation is generated by its code, with its baseline, its mandatory write denies (shell
+ * profiles, .git/hooks, .vscode, .mcp.json and the rest) and its limits. This module decides only the few static rules
+ * Toolroll passes it (srtTermsOf): Toolroll's own state and database denied to read and write; the build's own
+ * checkout writable; other tasks' checkouts read, never written; the project's read-deny list; under policy v1 (an
+ * approval sealed before 0.9.70) the home configuration denied by name; a sign-ins check's exact files read again; the
+ * run's proxy as its only way out when its network is confined.
  *
- * Checked against codex-cli 0.156 and Claude Code 2.1.281 with a canary
- * file read by an obfuscated script: "Operation not permitted".
+ * Codex (every platform) fences its own agent's commands with its own sandbox: a permission profile with the same
+ * denies (codexFenceArgv). Claude also gets Read/Edit deny rules for its own file tools.
  *
- * A build's fence also holds its task boundary (`taskBoundary`): home
- * configuration and the repositories beside its own, so a build works in
- * its task's folders and nowhere else it could do harm.
- *
- * Beside what it denies, a fence grants a little back (`FenceGrants`): other
- * tasks' git metadata is read but never written and their checkouts can be
- * looked up, so `git gc` and `git worktree prune` see live siblings and keep
- * them; the shared dependencies this checkout links are read and run, never
- * written. Every plane checkout pool is denied whole, this build's own checkout given back
- * (`CheckoutPool`), so another project's worktree is out of reach (Codex covers projects present at launch).
- * On macOS the agent also can't read another process's arguments
- * and environment (`kern.procargs`) or inspect a process outside its own
- * sandbox, so a tool server's or Toolroll's own secrets don't leak through
- * a process listing, and every other run's launch folder in the system temp
- * folder is denied, even one made after this launch began. Nor can it get
- * another process's task port (a debugger's way into its memory), or
- * rename or remove a folder of the user's above a fenced path or the temp
- * folder, which would reach the fenced path under a new name.
+ * A build's fence also holds its task boundary (`taskBoundary`): under v1 the home configuration and the repositories
+ * beside its own; under v2 only the primary checkout write-denied.
  */
 import { INSTANCE_DIR } from "./console-instance.js";
 import { ACP_AGENTS, ACP_PROVIDER_IDS } from "./acp-agents.js";
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
 import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { readMonitoring } from "./monitoring-settings.js";
 import { existingFolders } from "./names.js";
 import { DEPS_FOLDER, linkedKey, readyCopy, sharedCopies } from "./shared-deps.js";
-/** Beside the database: where Linux builds' network bridges are made (its name reads as secret wherever it is). */
-export const BRIDGE_DIR = "bridge-secrets";
+import { SEATBELT_PROBE, sandboxRuntimeProblem, srtSpawn } from "./sandbox-runtime.js";
+import { getDefaultWritePaths } from "@anthropic-ai/sandbox-runtime";
 /** Names that are secrets wherever the database lives (used when its folder is shared with other things). */
 const SENSITIVE_NAME = /(^up-login\.txt$|token|secret|login|password|credential|vapid|keys?\b|\.pem$|\.key$|^backups$|^evidence$|^remote$|^sign-in\.json$|^monitoring\.json$)/i;
 function real(path) {
@@ -134,40 +115,21 @@ export function agentFence(options) {
     const fence = new Set();
     /** The console's run folder: kept by its own pathname through canonicalization (and its target's too). */
     let runFolder = null;
-    /** The bridges' folder, likewise. */
-    let bridgeFolder = null;
     const home = real(options.home ?? homedir());
     const worktree = options.worktree === null ? null : real(options.worktree);
     if (options.databaseFile !== null && options.databaseFile !== "" && options.databaseFile !== ":memory:") {
         const database = real(options.databaseFile);
         const state = dirname(database);
+        // By name, there or not (a journal made later is denied too wherever a fence denies by name: Seatbelt and Codex).
         for (const suffix of ["", "-wal", "-shm", "-journal"])
-            if (existsSync(database + suffix))
-                fence.add(database + suffix);
+            fence.add(database + suffix);
         // The console's run folder (its discovery sockets, console-instance.ts) beside the database, wherever that is: no
         // build may add, rename or remove anything in it while a console listens there. It is made (owner-only) before any
         // build starts if it isn't there yet, so a build can never be the one to create it — and the fence always has a
-        // real folder to cover (a Linux bind needs one).
         // Whatever is at that path is fenced, always — a folder, a file, a link (the path itself, never only where a link
         // points), a folder holding anything at all — so no build can replace it; when nothing is there it is made first.
         // If it can't be made, the path is fenced anyway: a sandbox that can't cover a missing path refuses to launch
         // rather than run unfenced. The name is Toolroll's own; nothing else belongs there.
-        // The folder Linux builds' network bridges are made in (egress-bridge.ts): made before any build starts and fenced
-        // from every build, so no build — however long it runs — can reach a bridge made for a later one.
-        const bridges = join(state, BRIDGE_DIR);
-        try {
-            lstatSync(bridges);
-        }
-        catch {
-            try {
-                mkdirSync(bridges, { mode: 0o700 });
-            }
-            catch { /* fenced below either way */ }
-        }
-        // Fenced by its own name as well as where it leads: a link planted there is itself out of reach (and the bridge
-        // refuses a root that isn't a private folder: egress-bridge.ts).
-        bridgeFolder = bridges;
-        fence.add(bridges);
         runFolder = join(state, INSTANCE_DIR);
         const present = () => { try {
             lstatSync(runFolder);
@@ -215,24 +177,20 @@ export function agentFence(options) {
     // v104: the folder the audit stream writes to holds the whole instance's history.
     if (options.databaseFile !== null && options.databaseFile !== "" && options.databaseFile !== ":memory:") {
         const stream = readMonitoring(dirname(real(options.databaseFile))).folder?.path;
-        if (stream !== undefined && existsSync(stream))
+        if (stream !== undefined)
             fence.add(real(stream));
     }
     for (const path of options.extra ?? [])
-        if (existsSync(path))
-            fence.add(real(path));
+        fence.add(real(path));
     // Secret, state, database, explicit-extra and home-config denies are never exemptible.
-    if (options.runFolders !== undefined)
-        for (const path of otherRunFolders(options.runFolders))
-            fence.add(path);
     for (const path of options.boundary?.protectedShell ?? [])
         fence.add(real(path));
-    const protectedPaths = new Set([...fence].flatMap(path => path === runFolder || path === bridgeFolder ? [path, real(path)] : [real(path)]));
+    const protectedPaths = new Set([...fence].flatMap(path => path === runFolder ? [path, real(path)] : [real(path)]));
     for (const path of options.boundary?.shell ?? [])
         fence.add(path);
     const binding = options.binding;
     const needed = binding === undefined || binding === null ? [] : [binding.gitdir, real(join(binding.main, ".git"))];
-    return [...new Set([...fence].flatMap(path => path === runFolder || path === bridgeFolder ? [path, real(path)] : [real(path)]))].filter(path => {
+    return [...new Set([...fence].flatMap(path => path === runFolder ? [path, real(path)] : [real(path)]))].filter(path => {
         if (protectedPaths.has(path) || !needed.some(target => target === path || inside(target, path)))
             return true;
         console.warn(`Dropped build fence entry covering this checkout's own Git data: ${path}`);
@@ -275,6 +233,10 @@ export function taskBoundary(options) {
     const needed = [worktree, main, gitdir].filter((path) => path !== null);
     const own = new Set(PROVIDER_HOME[options.provider] ?? []);
     const present = (names) => names.map(name => join(home, name)).filter(path => existsSync(path)).map(real);
+    // Policy v2 (docs/plans/sandbox-parity.md §1.2): the home folder, the repositories beside this one and the project's
+    // primary checkout are read as Anthropic's sandbox runtime reads them; only writes to the primary checkout stay denied.
+    if ((options.policy ?? 1) === 2)
+        return v2Boundary(worktree, main, gitdir);
     const shell = new Set(present(HOME_CONFIGURATION.filter(name => !own.has(name))));
     const protectedShell = [...shell];
     const repository = (path) => existsSync(join(path, ".git"));
@@ -316,11 +278,43 @@ export function taskBoundary(options) {
                 shell.add(path);
         }
     }
-    // Git needs this worktree's metadata and the shared objects/refs, but
-    // must not prune or rewrite the metadata of another task's checkout. It
-    // still reads that metadata (gc keeps what a sibling's HEAD and index
-    // reach) and looks up the checkout it names: a checkout it can't see is
-    // one `git worktree prune` deletes the entry of.
+    const { readOnly, lookup } = siblingGitData(main, gitdir);
+    const fileTools = options.provider === "claude" ? present(CLAUDE_FILE_TOOL_HOME).filter(path => !shell.has(path)) : [];
+    // By name too, present or not: a build started while ~/.codex is absent must never make it (and later swap it for a
+    // link while a sign-ins check reads through it). The sandbox runtime takes them as read and write denies by name.
+    const homeNames = HOME_CONFIGURATION.filter(name => !own.has(name)).map(name => join(home, name)).sort();
+    return { protectedShell, shell: [...shell].sort(), fileTools: fileTools.sort(), readOnly: [...readOnly].sort(), lookup: [...lookup].sort(), homeNames };
+}
+/** A v2 boundary: nothing of the home folder, the repositories beside this one or the primary checkout is denied to
+ * read; the primary checkout (all but its `.git`, which this worktree's Git needs) is never written; other tasks' Git
+ * metadata is read, never written, as under v1. */
+function v2Boundary(worktree, main, gitdir) {
+    const noWrite = new Set();
+    if (main !== null && main !== worktree) {
+        let entries = [];
+        try {
+            entries = readdirSync(main);
+        }
+        catch {
+            entries = [];
+        }
+        for (const entry of entries) {
+            const path = join(main, entry);
+            if (entry !== ".git" && path !== worktree && !inside(worktree, path))
+                noWrite.add(path);
+        }
+    }
+    const { readOnly, lookup } = siblingGitData(main, gitdir);
+    for (const path of noWrite)
+        readOnly.add(path);
+    return { protectedShell: [], shell: [], fileTools: [], readOnly: [...readOnly].sort(), lookup: [...lookup].sort(), homeNames: [] };
+}
+/**
+ * Git needs this worktree's metadata and the shared objects/refs, but must not prune or rewrite the metadata of another
+ * task's checkout. It still reads that metadata (gc keeps what a sibling's HEAD and index reach) and looks up the
+ * checkout it names: a checkout it can't see is one `git worktree prune` deletes the entry of.
+ */
+function siblingGitData(main, gitdir) {
     const readOnly = new Set();
     const lookup = new Set();
     if (gitdir !== null && main !== null) {
@@ -364,16 +358,23 @@ export function taskBoundary(options) {
             lookup.add(join(checkout, ".git"));
         }
     }
-    const fileTools = options.provider === "claude" ? present(CLAUDE_FILE_TOOL_HOME).filter(path => !shell.has(path)) : [];
-    return { protectedShell, shell: [...shell].sort(), fileTools: fileTools.sort(), readOnly: [...readOnly].sort(), lookup: [...lookup].sort() };
+    return { readOnly, lookup };
 }
-/** The prefixes of every launch's private folders: its tools' config, a Codex build's own home, and a Linux build's
- * network bridge (egress-bridge.ts). */
+/** The prefixes of every launch's private folders: its tools' config and a Codex build's own home (and a check's). */
 export const RUN_FOLDER_PREFIXES = ["so-tools-", "so-codex-", "so-net-", "so-cmd-"];
-export function runFolders(own, root = tmpdir()) {
-    return { root: real(root), own: own === null ? null : real(own) };
+export function runFolders(own, root) {
+    // The system's own roots (not one a caller names): on a Mac, checks' launch folders are under the short one too.
+    const also = root === undefined && process.platform === "darwin" && existsSync(CHECK_LAUNCH_ROOT_MACOS) ? [CHECK_LAUNCH_ROOT_MACOS] : [];
+    return { root: real(root ?? tmpdir()), own: own === null ? null : real(own), ...(also.length === 0 ? {} : { also }) };
 }
-/** Every other launch's private folder there now. */
+/** Where a check's launch folder is made on a Mac: a short shared folder, so its TMPDIR leaves room for a unix socket
+ * path (about 104 bytes). */
+export const CHECK_LAUNCH_ROOT_MACOS = "/private/tmp";
+/** The folder a check's launch folder is made in: on a Mac the short one, elsewhere the system temp folder. */
+export const checkLaunchRoot = () => process.platform === "darwin" && existsSync(CHECK_LAUNCH_ROOT_MACOS) ? CHECK_LAUNCH_ROOT_MACOS : tmpdir();
+/** Every other launch's private folder in the system temp folder now, each only as the real folder it is (a link planted
+ * there is never followed, nor fenced in its target's place) and this user's own. A shared root (`also`, /private/tmp on
+ * a Mac) is never listed: anyone may plant entries there, so it is fenced by name pattern alone. */
 function otherRunFolders(folders) {
     let entries = [];
     try {
@@ -382,8 +383,21 @@ function otherRunFolders(folders) {
     catch {
         entries = [];
     }
-    return entries.filter(entry => RUN_FOLDER_PREFIXES.some(prefix => entry.startsWith(prefix))).map(entry => join(folders.root, entry)).filter(path => path !== folders.own);
+    const uid = process.getuid?.();
+    return entries.filter(entry => RUN_FOLDER_PREFIXES.some(prefix => entry.startsWith(prefix))).map(entry => join(folders.root, entry)).filter(path => {
+        if (path === folders.own)
+            return false;
+        try {
+            const held = lstatSync(path);
+            return held.isDirectory() && !held.isSymbolicLink() && (uid === undefined || held.uid === uid);
+        }
+        catch {
+            return false;
+        }
+    });
 }
+/** Every root launch folders are made under (the system temp folder, and on a Mac the short shared one). */
+export const runRoots = (folders) => [folders.root, ...(folders.also ?? [])];
 export { isWritesMode, WRITES_DEFAULT } from "./writes-mode.js";
 /** Claude's transcript folder for a working folder: its path with every character but a letter or digit made `-`
  * (Claude Code's own naming; a name over 200 characters gets a suffix, so it is granted by prefix). */
@@ -539,17 +553,6 @@ export function buildCacheEnv(folder) {
         DENO_DIR: at("deno"), XDG_CACHE_HOME: at("xdg"),
     };
 }
-/**
- * Services a sandboxed process could ask to act outside the sandbox for it (macOS): open a URL in a browser (Launch
- * Services), script another application (Apple Events), fetch in the background (nsurlsessiond), look a name up
- * (the DNS service: a lookup is itself a message out), or read and write the clipboard. Denied when the network is
- * confined; the run's proxy resolves names for it.
- */
-export const DELEGATION_SERVICES = [
-    "com.apple.coreservices.launchservicesd", "com.apple.coreservices.quarantine-resolver", "com.apple.lsd.mapdb", "com.apple.lsd.modifydb", "com.apple.lsd.open",
-    "com.apple.coreservices.appleevents", "com.apple.nsurlsessiond", "com.apple.nsurlsessiond.NSURLSessionProxyService",
-    "com.apple.dnssd.service", "com.apple.mDNSResponder", "com.apple.pasteboard.1",
-];
 export const NO_GRANTS = { readOnly: [], readable: [], lookup: [] };
 /**
  * The pool deny for one launch. `roots` come from the plane's own records (the pool beside the database, and the one
@@ -618,6 +621,7 @@ export function fenceGrants(options) {
     }
     const pool = options.poolRoots === undefined ? undefined : checkoutPool({ roots: options.poolRoots, worktree: options.worktree, binding: options.binding ?? null, ...(options.home === undefined ? {} : { home: options.home }) });
     return { readOnly: [...options.boundary?.readOnly ?? []], readable, lookup: [...new Set(lookup)].sort(), ...(options.runFolders === undefined ? {} : { runFolders: options.runFolders }),
+        ...(options.boundary?.homeNames === undefined || options.boundary.homeNames.length === 0 ? {} : { homeNames: [...options.boundary.homeNames] }),
         ...(pool === undefined || pool.deny.length === 0 ? {} : { pool }) };
 }
 /** The setup a shared copy was installed by (its ready note), or null. */
@@ -664,12 +668,42 @@ const toml = (value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`
  * `codexPool`, which denies them around the build's own checkout, written back.
  */
 export function codexFenceArgv(fence, fullAccess, grants = NO_GRANTS) {
+    const access = codexFilesystem(fence, fullAccess, grants);
+    const filesystem = [...access].map(([path, mode]) => `${toml(path)}=${toml(mode)}`);
+    return [
+        "-c", 'default_permissions="standing-orders"',
+        "-c", `permissions.standing-orders.extends=${grants.writes === undefined ? '":workspace"' : '":read-only"'}`,
+        "-c", `permissions.standing-orders.filesystem={${filesystem.join(",")}}`,
+        // Codex's command sandbox can't route through a proxy: its commands reach the network only when the run's sealed
+        // network is open (and Full access asked for it), and are offline otherwise.
+        ...(codexNetworkOn(fullAccess, grants) ? ["-c", "permissions.standing-orders.network.enabled=true"] : []),
+        ...(fullAccess ? ["-c", 'approval_policy="never"'] : []),
+    ];
+}
+const codexNetworkOn = (fullAccess, grants) => fullAccess && (grants.network === undefined || grants.network.mode === "open");
+/**
+ * The same permission profile as codexFenceArgv, as the config overrides a Codex app-server thread takes
+ * (`thread/start` and `thread/resume` `config`; checked against codex-cli 0.156: the thread reports
+ * `activePermissionProfile` standing-orders, and its commands are refused the denied paths). Approval policy is the
+ * caller's own (an interactive session asks).
+ */
+export function codexFenceConfig(fence, fullAccess, grants = NO_GRANTS) {
+    return {
+        default_permissions: "standing-orders",
+        "permissions.standing-orders.extends": grants.writes === undefined ? ":workspace" : ":read-only",
+        "permissions.standing-orders.filesystem": Object.fromEntries(codexFilesystem(fence, fullAccess, grants)),
+        ...(codexNetworkOn(fullAccess, grants) ? { "permissions.standing-orders.network.enabled": true } : {}),
+    };
+}
+/** Each path of a Codex permission profile and its access, the strongest last (a deny outranks a grant). */
+function codexFilesystem(fence, fullAccess, grants) {
     const { deny, readOnly } = flattened(fence, grants);
     // Codex's harness reads its own launch files outside the command sandbox.
     // Deny the namespace, including folders created after this policy was built.
     if (grants.runFolders !== undefined) {
-        for (const prefix of RUN_FOLDER_PREFIXES) {
-            deny.push(join(grants.runFolders.root, `${prefix}*`), join(grants.runFolders.root, `${prefix}*`, "**"));
+        for (const root of runRoots(grants.runFolders)) {
+            for (const prefix of RUN_FOLDER_PREFIXES)
+                deny.push(join(root, `${prefix}*`), join(root, `${prefix}*`, "**"));
         }
     }
     // Launch folders can already be in the base fence when invoke appends them.
@@ -697,27 +731,39 @@ export function codexFenceArgv(fence, fullAccess, grants = NO_GRANTS) {
         for (const path of held.read)
             access.set(path, "read");
         for (const path of held.deny)
-            access.set(path, "deny");
+            access.set(path, pool.readable === true && !(pool.sealed ?? []).some(one => path === one || inside(path, one)) ? "read" : "deny");
+        // A sealed folder (flows' scratch) is denied whole, but on the way to this launch's own folder (Codex can't deny an
+        // ancestor and still reach inside it: its other entries are denied one by one, by codexPool, from the same split).
+        for (const sealed of pool.sealed ?? [])
+            if (!(pool.own !== null && (pool.own === sealed || inside(pool.own, sealed))))
+                access.set(sealed, "deny");
         for (const path of held.write)
             access.set(path, "write");
     }
-    // Denies are keyed where they resolve; the console's run folder is also denied by its own pathname, so a link there
-    // stays unreplaceable, not only its target.
+    // What no launch writes (homeWriteDenies): read-only, where Codex writes at all (Full access, or an allowlist).
+    // Never inside a denied path: Codex lets the more specific path win, so a read there would bring it back.
+    const deniedPaths = deny.filter(one => !one.includes("*")).map(real);
+    for (const path of grants.writeDenies ?? []) {
+        const leads = resolvedPath(path);
+        const denied = (one) => access.get(one) === "deny" || deniedPaths.some(den => one === den || inside(one, den));
+        // A name that leads into a denied path (a linked ~/.ssh into a read-denied folder) is denied by its own name too,
+        // never read back.
+        if (denied(leads)) {
+            access.set(path, "deny");
+            continue;
+        }
+        if (denied(path))
+            continue;
+        access.set(path, "read");
+    }
+    // Denies are keyed where they resolve; the console's run folder is also denied by its
+    // own pathname, so a link there stays unreplaceable, not only its target.
     for (const path of deny) {
         access.set(real(path), "deny");
         if (basename(path) === INSTANCE_DIR)
             access.set(path, "deny");
     }
-    const filesystem = [...access].map(([path, mode]) => `${toml(path)}=${toml(mode)}`);
-    return [
-        "-c", 'default_permissions="standing-orders"',
-        "-c", `permissions.standing-orders.extends=${grants.writes === undefined ? '":workspace"' : '":read-only"'}`,
-        "-c", `permissions.standing-orders.filesystem={${filesystem.join(",")}}`,
-        // Codex's command sandbox can't route through a proxy: its commands reach the network only when the run's sealed
-        // network is open (and Full access asked for it), and are offline otherwise.
-        ...(fullAccess && (grants.network === undefined || grants.network.mode === "open") ? ["-c", "permissions.standing-orders.network.enabled=true"] : []),
-        ...(fullAccess ? ["-c", 'approval_policy="never"'] : []),
-    ];
+    return access;
 }
 /**
  * Codex cannot deny an ancestor and still traverse it to the own checkout. Deny existing
@@ -814,117 +860,7 @@ export function claudeFenceSettings(fence, readOnly = []) {
     const rules = [...fence.flatMap(path => [`Read(/${path})`, `Read(/${path}/**)`, `Edit(/${path})`, `Edit(/${path}/**)`]), ...readOnly.flatMap(path => [`Edit(/${path})`, `Edit(/${path}/**)`])];
     return JSON.stringify({ permissions: { deny: rules } });
 }
-const seatbelt = (path) => `"${path.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
-const seatbeltRegex = (path) => path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-/**
- * The folders the user owns above each path (never `/`, nor the path itself), and each `roots` folder itself when the
- * user owns it. A Seatbelt path rule follows the name, not the folder: renaming one of these would bring a fenced path
- * back under a name no rule mentions. A folder the user doesn't own can't be renamed by a build anyway.
- */
-export function ownedAncestors(paths, roots = [], uid = process.getuid?.()) {
-    const out = new Set();
-    const owned = (path) => { try {
-        return uid !== undefined && statSync(path).uid === uid;
-    }
-    catch {
-        return false;
-    } };
-    const climb = (from) => {
-        for (let folder = from; folder !== dirname(folder); folder = dirname(folder))
-            if (owned(folder))
-                out.add(folder);
-    };
-    for (const path of paths)
-        climb(dirname(path));
-    for (const root of roots)
-        climb(root);
-    return [...out].sort();
-}
-/**
- * A Seatbelt profile that allows everything except reading or writing the
- * fenced paths, less what `grants` gives back (a later Seatbelt rule
- * outranks an earlier one). Whatever the paths, the process can't read
- * another's arguments and environment (`kern.procargs`, which `ps -E` and
- * KERN_PROCARGS2 use) or inspect a process outside its own sandbox:
- * `process-info*` limited by target alone doesn't stop the sysctl. It can't
- * take another process's task port either (`task_for_pid`, what lldb attaches
- * with; a task name port too), so a tool server's or Toolroll's own memory
- * and environment stay out of reach. Last, every folder of the user's above
- * a fenced or read-only path and above the temp folder (and the temp folder
- * itself) can't be renamed or removed, though what is inside them stays
- * writable as before. The checkout pools are denied first, and the build's own
- * checkout given back right after, so every later deny still holds inside it.
- */
-export function macosFenceProfile(fence, grants = NO_GRANTS) {
-    const paths = (filter, list) => list.map(path => `(${filter} ${seatbelt(path)})`).join(" ");
-    const folders = grants.runFolders;
-    const pool = grants.pool;
-    const above = ownedAncestors([...fence, ...grants.readOnly, ...pool?.deny ?? []], [folders?.root ?? real(tmpdir())]);
-    return [
-        "(version 1)",
-        "(allow default)",
-        // A workspace build writes only its allowlist (and the terminal devices); every deny and read-only rule after this
-        // still holds inside it.
-        ...(grants.writes === undefined ? [] : [
-            "(deny file-write*)",
-            `(allow file-write* (subpath "/dev")${grants.writes.subpaths.length === 0 ? "" : ` ${paths("subpath", grants.writes.subpaths)}`}${grants.writes.prefixes.map(one => ` (regex #"^${seatbeltRegex(one.path)}${one.suffix}")`).join("")})`,
-            // A granted folder itself can't be renamed, removed or replaced (by a link to anywhere, say): only what is in it.
-            ...(grants.writes.subpaths.length === 0 ? [] : [`(deny file-write* ${paths("literal", grants.writes.subpaths)})`]),
-        ]),
-        ...(pool === undefined || pool.deny.length === 0 ? [] : [`(deny file-read* file-write* ${paths("subpath", pool.deny)})`]),
-        ...(pool?.own == null ? [] : [
-            `(allow file-read* file-write* ${paths("subpath", [pool.own])})`,
-            `(deny file-write* ${paths("literal", [pool.own])})`,
-        ]),
-        ...(pool === undefined || pool.lookup.length === 0 ? [] : [`(allow file-read-metadata ${paths("literal", pool.lookup)})`]),
-        ...(fence.length === 0 ? [] : [`(deny file-read* file-write* ${paths("subpath", fence)})`]),
-        ...(grants.readOnly.length === 0 ? [] : [`(deny file-write* ${paths("subpath", grants.readOnly)})`]),
-        ...(folders === undefined ? [] : [`(deny file-read* file-write* (regex #"^${seatbeltRegex(folders.root)}/(${RUN_FOLDER_PREFIXES.map(seatbeltRegex).join("|")})"))`]),
-        ...(grants.lookup.length === 0 ? [] : [`(allow file-read-metadata ${paths("literal", grants.lookup)})`]),
-        // Denied whole above, granted back narrowly here (a later rule wins): an entry made after launch beside it stays denied.
-        ...(grants.readable.length === 0 ? [] : [`(allow file-read* file-test-existence ${paths("subpath", grants.readable)})`]),
-        // Each readable copy's own folder can be listed, never read: bundlers such as esbuild find node_modules by listing
-        // its parent, which a lookup alone refuses (the Linux and Codex fences list it as read-only already).
-        ...(grants.readable.length === 0 ? [] : [`(allow file-read-data ${paths("literal", [...new Set(grants.readable.map(one => dirname(one)))])})`]),
-        ...(folders?.own == null ? [] : [`(allow file-read* file-write* ${paths("subpath", [folders.own])})`]),
-        '(deny sysctl-read (sysctl-name-prefix "kern.procargs"))',
-        "(deny process-info-pidinfo)",
-        "(allow process-info-pidinfo (target same-sandbox))",
-        "(deny mach-priv-task-port)",
-        "(deny mach-task-name)",
-        ...(above.length === 0 ? [] : [`(deny file-write* ${paths("literal", above)})`]),
-        ...macosNetworkRules(grants.network),
-        // A workspace build reaches no unix socket but its own (a container engine's, an agent's, a database's would act
-        // outside its limits for it), whatever its network: a confined network has its own rule for this already. Its open
-        // network still names hosts: the system's DNS service answers on a unix socket, and without it nothing resolves.
-        ...(grants.writes === undefined || grants.network?.mode === "allowlist" ? [] : [
-            "(deny network-outbound (remote unix-socket))",
-            `(allow network-outbound (remote unix-socket (path-literal ${seatbelt(MACOS_DNS_SOCKET)})))`,
-            ...(grants.writes.subpaths.length === 0 ? [] : [`(allow network-outbound ${grants.writes.subpaths.map(root => `(remote unix-socket (subpath ${seatbelt(root)}))`).join(" ")})`]),
-        ]),
-    ].join("\n");
-}
-/**
- * The network half of the macOS fence. Every outbound connection is denied, then loopback is given back as the launch
- * allows: every local port under `loopback: "any"`, else the run's proxy and broker alone. (Seatbelt admits a port an
- * allow names whatever a deny after it says, so a local port can't be refused once all are admitted: the choice is all
- * or none, plus the run's own.) Filters name the remote end only: a `local ip` filter would admit any outbound
- * connection.
- */
-export function macosNetworkRules(network) {
-    if (network === undefined || network.mode === "open")
-        return [];
-    const local = (port) => `(remote ip "localhost:${port}")`;
-    return [
-        "(deny network-outbound)",
-        `(allow network-outbound ${network.loopback === "any" ? local("*") : [network.proxyPort, ...network.brokerPorts].map(local).join(" ")})`,
-        ...(network.socketRoots.length === 0 ? [] : [`(allow network-outbound ${network.socketRoots.map(root => `(remote unix-socket (subpath ${seatbelt(root)}))`).join(" ")})`]),
-        `(deny mach-lookup ${DELEGATION_SERVICES.map(name => `(global-name ${seatbelt(name)})`).join(" ")})`,
-    ];
-}
-export const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
-/** Where macOS's resolver (mDNSResponder) answers: every name lookup on a Mac is a message to this socket. */
-export const MACOS_DNS_SOCKET = "/private/var/run/mDNSResponder";
+const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
 /** A process already inside a Seatbelt sandbox (an agent's, or a flow check zone's) can't apply another: sandbox-exec says so. */
 const NESTED_SANDBOX = /sandbox_apply: Operation not permitted/;
 let seatbeltWorks = null;
@@ -950,217 +886,351 @@ export function macosFenceAvailable(platform = process.platform, probe) {
     if (probe !== undefined)
         return works(probe);
     seatbeltWorks ??= works(() => {
-        const ran = spawnSync(SANDBOX_EXEC, ["-p", "(version 1)(allow default)", "/usr/bin/true"], { timeout: 5_000, encoding: "utf8" });
+        const ran = spawnSync(SANDBOX_EXEC, ["-p", SEATBELT_PROBE, "/usr/bin/true"], { timeout: 5_000, encoding: "utf8" });
         return { status: ran.status, stderr: ran.stderr ?? "" };
     });
     return seatbeltWorks;
 }
-/** The spawn that runs `file args` inside the macOS fence (same process: sandbox-exec replaces itself with the agent). */
-export function macosFenced(file, args, fence, grants = NO_GRANTS) {
-    return { file: SANDBOX_EXEC, args: ["-p", macosFenceProfile(fence, grants), file, ...args] };
-}
-/** Whether bubblewrap runs here (checked once): installed, and allowed to make its namespace. */
-let bubblewrapWorks = null;
-export function linuxFenceAvailable(platform = process.platform, probe = () => spawnSync("bwrap", ["--dev-bind", "/", "/", "--", "true"], { timeout: 5_000, stdio: "ignore" }).status === 0) {
+/** Whether the sandbox runtime can sandbox here on Linux (checked once): bubblewrap, socat, its seccomp helper and
+ * ripgrep installed, and unprivileged user namespaces allowed. A machine that can't is no Linux fence at all. */
+let linuxWorks = null;
+export function linuxFenceAvailable(platform = process.platform, probe = () => sandboxRuntimeProblem("linux") === null) {
     if (platform !== "linux")
         return false;
-    if (bubblewrapWorks === null) {
+    if (linuxWorks === null) {
         try {
-            bubblewrapWorks = probe();
+            linuxWorks = probe();
         }
         catch {
-            bubblewrapWorks = false;
+            linuxWorks = false;
         }
     }
-    return bubblewrapWorks;
+    return linuxWorks;
+}
+/** Thrown when no sandbox can be made for a launch: the spawn road refuses it. */
+export class LinuxFenceUnavailable extends Error {
 }
-/** A secret-name pattern (SPLIT_SECRET_PATTERNS) as a test of one path segment. */
-const patternTest = (pattern) => new RegExp(`^${pattern.split("*").map(seatbeltRegex).join(".*")}$`);
-const SECRET_SEGMENT = SPLIT_SECRET_PATTERNS.map(patternTest);
 /**
- * The grants bubblewrap may bind back over its masks: each existing read-only or readable path, never one that is a
- * fenced path itself, a read-only one inside a fenced path (only the shared install this run links is read inside
- * one), another launch's private folder, or one with a secret-looking name below its fenced folder. Bubblewrap can't
- * mask by pattern, so a grant a pattern would deny is dropped instead (fail closed).
+ * The runtime's config for a launch (sandbox-runtime.ts SrtTerms), from its fence: every fenced path denied to read and
+ * write (with the exact paths read again inside them), the pools' other checkouts write-denied (and, under v1, read-
+ * denied) around the build's own, the flows' scratch folders sealed, the launch's writes (its allowlist, or anywhere
+ * outside the denies), its mach services and its network.
  */
-function linuxGrants(fence, grants) {
-    const folders = grants.runFolders;
-    const launchFolder = (path) => folders !== undefined && inside(path, folders.root) && path !== folders.own && !(folders.own != null && inside(path, folders.own))
-        && RUN_FOLDER_PREFIXES.some(prefix => relative(folders.root, path).split(sep)[0].startsWith(prefix));
-    const secretBelow = (path) => fence.some(one => inside(path, one) && relative(one, path).split(sep).some(segment => SECRET_SEGMENT.some(test => test.test(segment))));
-    const ok = (path, readOnlyGrant) => existsSync(path) && !fence.includes(path) && !launchFolder(path) && !secretBelow(path)
-        && !(readOnlyGrant && fence.some(one => inside(path, one)));
-    return [...new Set([...grants.readOnly.filter(path => ok(path, true)), ...grants.readable.filter(path => ok(path, false))])];
-}
-/** The spawn that runs `file args` inside the Linux fence: the whole filesystem as it is, the checkout pools masked
- * and the build's own checkout bound back read-write over them, then every fenced path masked whole (an empty
- * folder, or /dev/null for a file), so what is made there after launch is masked too; then only the explicit grants
- * bound back read-only (bubblewrap binds from the original root, so a grant inside a mask still reaches its files). */
-export function linuxFenced(file, args, fence, grants = NO_GRANTS) {
-    const network = grants.network?.mode === "allowlist" ? grants.network : null;
-    if (network !== null && network.bridge === undefined)
-        throw new Error("A confined network on Linux needs its bridge");
-    const mask = (path) => {
-        let folder = true;
-        try {
-            folder = statSync(path).isDirectory();
-        }
-        catch {
-            folder = true;
-        }
-        return folder ? ["--tmpfs", path] : ["--ro-bind", "/dev/null", path];
-    };
-    const pool = grants.pool?.deny ?? [];
-    const own = grants.pool?.own != null && existsSync(grants.pool.own) ? ["--bind", grants.pool.own, grants.pool.own] : [];
-    const kept = linuxGrants([...fence, ...pool], grants).flatMap(path => ["--ro-bind", path, path]);
-    // A confined network: a network and a process view of its own, the host's sockets out of reach (a socket in a
-    // mounted folder is not network, so they are masked), and the run's proxy and broker carried in by the forwarder.
-    const isolated = network === null ? [] : [
-        "--unshare-net", "--unshare-pid", "--proc", "/proc",
-        ...linuxHostSockets(undefined, undefined, undefined, grants.writes !== undefined).flatMap(mask),
-        "--ro-bind", network.bridge.folder, network.bridge.folder,
-    ];
-    // A confined build gets a /tmp of its own (other programs' sockets, other runs' folders and anything planted there
-    // all out of sight at once), with only its own folders there given back; every mask and grant below still applies.
-    // A workspace build (arc 2) sees the whole filesystem read-only, a /dev of its own and a /tmp of its own, with only
-    // its allowlist bound back writable; its own checkout's Git data is in that list.
-    const writes = grants.writes;
-    const root = writes === undefined ? ["--dev-bind", "/", "/"] : ["--ro-bind", "/", "/", "--dev", "/dev"];
-    const writable = writes === undefined ? [] : [...writes.subpaths, ...writes.prefixes.map(one => one.path)].filter(path => existsSync(path)).flatMap(path => ["--bind", path, path]);
-    // What a private /tmp gives back is read-only for a workspace build (its writable part is bound again after): the
-    // checkout's whole shared Git data among it must not come back writable.
-    // A confined network brings a /tmp of its own (arc 1); a workspace build with an open network sees the shared /tmp
-    // read-only like the rest of the root, its own folders there bound back writable.
-    const privateTmp = network === null ? [] : ["--tmpfs", "/tmp", ...(network?.keep ?? []).filter(path => inside(path, "/tmp") && existsSync(path)).flatMap(path => [writes === undefined ? "--bind" : "--ro-bind", path, path])];
-    // A workspace build never reaches the host's own services either (a container engine would write anywhere for it),
-    // whatever its network: confined networks mask them below already.
-    const services = writes === undefined || network !== null ? [] : linuxHostSockets(undefined, undefined, undefined, true).flatMap(mask);
-    const command = network === null ? [file, ...args]
-        : [network.bridge.node, network.bridge.forwarder, network.bridge.folder, ...[network.proxyPort, ...network.brokerPorts].map(String), "--", file, ...args];
-    return { file: "bwrap", args: [...root, ...privateTmp, ...writable, ...pool.flatMap(mask), ...own, ...fence.flatMap(mask), ...kept, ...services, ...isolated, "--die-with-parent", "--", ...command] };
-}
-/** The host's own sockets a process in a mounted filesystem could still talk to (D-Bus, the display, container
- * engines), wherever they exist here. */
-export function linuxHostSockets(uid = process.getuid?.(), home = homedir(), tmp = "/tmp", followLinks = false, env = process.env) {
-    // The system's own, root-owned: resolved (/var/run is a link to /run) so bubblewrap mounts over the real path, once.
-    const system = [
-        ...(uid === undefined ? [] : [`/run/user/${uid}`]), "/run/dbus", "/var/run/dbus", "/var/run/docker.sock", "/run/docker.sock", "/run/containerd", "/run/podman",
-        "/var/run/podman", "/run/systemd/private", "/run/snapd.socket", "/run/screen",
-    ];
-    const masks = new Set();
-    for (const path of system) {
-        try {
-            masks.add(realpathSync(path));
-        }
-        catch { /* not here */ }
+export function srtTermsOf(fence, grants = NO_GRANTS) {
+    const denyRead = new Set(fence.map(real));
+    // A readable grant's own folder is read too: bundlers (esbuild) find node_modules by listing it. The runtime can't
+    // grant a listing without the folder's files, so the shared copy's folder is read whole (its ready note among them).
+    const allowRead = new Set(grants.readable.flatMap(path => [real(path), real(dirname(path))]));
+    const denyWrite = new Set([...fence, ...grants.readOnly].map(real));
+    for (const path of grants.writeDenies ?? [])
+        denyWrite.add(path);
+    for (const name of grants.homeNames ?? []) {
+        denyRead.add(name);
+        denyWrite.add(name);
     }
-    // The user's own, in places a build could plant names: taken only as the real folders or sockets they are, never
-    // through a link (a planted link would turn a mask onto any folder at all). Container engines
-    // run per user (Docker Desktop and the docker CLI's folder whole, so a socket made there later is covered too;
-    // Colima, OrbStack, Lima, Rancher Desktop, rootless containers); a terminal multiplexer takes commands from its
-    // socket; an SSH agent signs as you; editors keep IPC sockets in /tmp (hidden by the build's private /tmp).
-    // Masked whoever owns it (a folder `sudo docker` made is root's): only a link is never followed, since a link turns
-    // a mask onto its target. A link there is a residual until builds can't write the home folder (arc 2).
-    const owned = (path) => {
-        try {
-            const held = lstatSync(path);
-            return !held.isSymbolicLink() && (held.isDirectory() || held.isSocket());
-        }
-        catch {
-            return false;
-        }
-    };
-    for (const path of [".docker", ".colima", ".orbstack", ".lima", ".rd", ".local/share/containers"].map(name => join(home, name))) {
-        if (owned(path))
-            masks.add(path);
-        // A workspace build can't plant a link in the home folder, so a link there is the operator's own: its target is
-        // masked too (an engine moved elsewhere).
-        else if (followLinks) {
-            try {
-                if (lstatSync(path).isSymbolicLink())
-                    masks.add(realpathSync(path));
-            }
-            catch { /* dangling */ }
-        }
-    }
-    // An engine Toolroll's own environment points at, wherever it is (never the build's to choose): always masked. So is
-    // the SSH agent it names (it signs as you), which a shared /tmp would otherwise leave in reach.
-    for (const name of ["DOCKER_HOST", "CONTAINER_HOST"]) {
-        const socket = /^unix:\/\/(\/.+)$/.exec(env[name] ?? "")?.[1];
-        if (socket !== undefined) {
-            try {
-                masks.add(realpathSync(socket));
+    for (const file of grants.signIns?.read ?? [])
+        allowRead.add(file);
+    // Every other launch's private folder unread by pattern (one made after this launch too), this launch's own read
+    // again. Writes are denied to those there at launch, under every root: the runtime can't write back inside a write
+    // deny, so a pattern would take this launch's own folder too (one made after launch is writable under `anywhere`).
+    const folders = grants.runFolders;
+    if (folders !== undefined) {
+        for (const root of runRoots(folders)) {
+            for (const prefix of RUN_FOLDER_PREFIXES)
+                denyRead.add(join(root, `${prefix}*`));
+            // And by name, each there right before the launch (this runs at the spawn): on Linux the runtime gives a pattern
+            // no mask where a path it allows lies beside its matches. Written: only where the launch writes anywhere (under a
+            // write allowlist they are out of its writes already).
+            for (const path of otherRunFolders({ root, own: folders.own })) {
+                denyRead.add(path);
+                if (grants.writes === undefined)
+                    denyWrite.add(path);
             }
-            catch { /* not there */ }
         }
+        if (folders.own !== null)
+            allowRead.add(folders.own);
     }
-    const agent = env["SSH_AUTH_SOCK"];
-    if (agent !== undefined && isAbsolute(agent)) {
-        try {
-            const socket = realpathSync(agent);
-            masks.add(socket);
-            // The folder an agent makes for its socket (ssh-XXXX in /tmp) too, so a socket it makes next is out of reach.
-            if (inside(socket, real(tmp)) && dirname(socket) !== real(tmp) && !lstatSync(dirname(socket)).isSymbolicLink())
-                masks.add(dirname(socket));
+    const pool = grants.pool;
+    if (pool !== undefined) {
+        // Under v1 the pools are unread too, the build's own checkout read again; under v2 they are read (owner Q-C).
+        if (pool.readable !== true)
+            for (const root of pool.deny)
+                denyRead.add(root);
+        // The build's own checkout is read again inside whatever is denied around it (the pools, a flow's sealed scratch).
+        if (pool.own !== null)
+            allowRead.add(pool.own);
+        // Never written but the build's own checkout: the runtime can't write back inside a write deny, so each other
+        // entry on the way is denied instead (codexPool's split, as Codex takes it).
+        for (const path of codexPool(pool).deny)
+            denyWrite.add(path);
+        for (const sealed of pool.sealed ?? []) {
+            denyRead.add(sealed);
+            if (!(pool.own !== null && (pool.own === sealed || inside(pool.own, sealed))))
+                denyWrite.add(sealed);
         }
-        catch { /* not there */ }
     }
-    // A build that shares /tmp (a workspace build with an open network) reaches none of the sockets there either: every
-    // socket two levels down (a multiplexer's, an agent's, a display's, an editor's), and the folder that holds it, taken
-    // as it is (never through a link). Toolroll's own launch folders are fenced by name already.
-    if (followLinks) {
-        const socketIn = (folder, depth) => {
-            let found = false;
-            let entries = [];
-            try {
-                entries = readdirSync(folder);
-            }
-            catch {
-                return false;
-            }
-            for (const entry of entries) {
-                const path = join(folder, entry);
-                if (RUN_FOLDER_PREFIXES.some(prefix => entry.startsWith(prefix)))
-                    continue;
-                let held;
-                try {
-                    held = lstatSync(path);
-                }
-                catch {
-                    continue;
-                }
-                if (held.isSocket()) {
-                    masks.add(path);
-                    found = true;
-                }
-                else if (held.isDirectory() && !held.isSymbolicLink() && depth > 0 && socketIn(path, depth - 1)) {
-                    masks.add(path);
-                    found = true;
-                }
-            }
-            return found;
-        };
-        socketIn(tmp, 1);
-    }
-    return [...masks].sort();
+    const readConfig = { denyOnly: [...denyRead].sort(), allowWithinDeny: [...allowRead].sort() };
+    const writes = grants.writes;
+    // A sign-ins check also writes Codex's session and log folders and its own Claude transcripts (never inside a
+    // write deny: under policy v1 the home configuration stays unwritten whole).
+    const signInWrites = [...grants.signIns?.writes ?? [], ...(grants.signIns?.transcripts ?? []).map(folder => join(folder, "*.jsonl"))];
+    // Writing anywhere: everything but the denies. The launch's own checkout and folder are named too, so a backend that
+    // binds a read deny's re-allowed paths back (bubblewrap) binds those back writable.
+    const allowOnly = writes === undefined ? ["/", ...(pool?.own == null ? [] : [real(pool.own)]), ...(folders?.own == null ? [] : [folders.own])]
+        : [...writes.subpaths, ...writes.prefixes.map(one => `${one.path}*`), ...signInWrites, ...getDefaultWritePaths({ denyRead: readConfig.denyOnly, allowRead: readConfig.allowWithinDeny })];
+    const network = grants.network;
+    return {
+        readConfig,
+        writeConfig: { allowOnly: [...new Set(allowOnly)].sort(), denyWithinAllow: [...denyWrite].sort() },
+        allowMachLookup: [...grants.machLookup ?? [], ...grants.signIns?.mach ?? []],
+        network: network === undefined || network.mode === "open" ? { kind: "open" } : {
+            kind: "proxy", httpPort: network.proxyPort, ...(network.brokerPorts[0] === undefined ? {} : { socksPort: network.brokerPorts[0] }),
+            ...(network.token === undefined ? {} : { token: network.token }), localServices: network.loopback === "any", unixSockets: [...network.socketRoots],
+        },
+    };
+}
+/** The spawn that runs `file args` from `cwd` inside the sandbox runtime's sandbox (sandbox-runtime.ts srtSpawn), and the
+ * environment it needs beside the caller's. */
+export function sandboxedSpawn(file, args, fence, grants = NO_GRANTS, cwd, temp) {
+    return srtSpawn(file, args, srtTermsOf(fence, grants), cwd ?? process.cwd(), temp);
 }
 /**
  * What each agent's fence gives it, by permission mode: the one table README's "What an agent can reach" shows
  * (fenceSummaryMarkdown; a test holds them equal).
  */
 export const FENCE_SUMMARY = [
-    {
-        agent: "**Codex / OpenRouter** (any OS)",
-        auto: "Codex's sandbox with the fence: writes only the checkout, its Git data and the project's caches (anywhere outside the fence, under a project set to write anywhere); no network",
-        full: "the same writes, with the fence; its commands reach the network only when the project's network is open",
-    },
     {
         agent: "**Claude, Gemini, ACP agents**",
-        auto: "macOS: inside a Seatbelt sandbox that denies the fence and writes only the checkout, its Git data, the project's caches, the run's temp folder and the agent's own session files. Linux: the same in bubblewrap, with a /tmp of its own. Neither (Windows, or Linux without bubblewrap): the build doesn't start, unless an instance operator allows unconfined agents",
+        auto: "Anthropic's sandbox-runtime (Seatbelt on macOS; bubblewrap and its seccomp filter on Linux, which also needs socat and ripgrep): reads your home folder except the folders the project lists, never Toolroll's folders; other tasks' work read, never written; writes only the checkout, its Git data, the project's caches, the run's temp folder and the agent's own session files (anywhere outside the fence, under a project set to write anywhere), never the runtime's protected names in the checkout (Git hooks and config, shell profiles, `.mcp.json`, editor settings); no Apple Events. Neither (Windows, or a Linux missing one of those): the build doesn't start, unless an instance operator allows unconfined agents",
         full: "same",
     },
+    {
+        agent: "**Codex / OpenRouter** (any OS)",
+        auto: "Codex's own sandbox, given the same fence: reads your home folder except the folders the project lists, never Toolroll's folders; other tasks' work read, never written; writes only the checkout, its Git data and the project's caches (anywhere outside the fence, under a project set to write anywhere); no network",
+        full: "the same reads and writes, with the fence; its commands reach the network only when the project's network is open",
+    },
 ];
 /** FENCE_SUMMARY as README's markdown table. */
 export function fenceSummaryMarkdown() {
     return ["| | Auto | Full access |", "|---|---|---|", ...FENCE_SUMMARY.map(row => `| ${row.agent} | ${row.auto} | ${row.full} |`)].join("\n");
 }
+/** The sign-in files a `sign-ins` check reads, by fixed name under the person's home (never from the environment, so no
+ * caller's CLAUDE_CONFIG_DIR or GH_CONFIG_DIR points a grant at .ssh): Claude's account and settings (and, on Linux,
+ * its credentials file; on a Mac they are in the keychain), gh's hosts and config, and Codex's config and sign-in. */
+const SIGN_IN_FILES = (platform) => [
+    ".claude.json", join(".claude", "settings.json"), ...(platform === "linux" ? [join(".claude", ".credentials.json")] : []),
+    join(".config", "gh", "hosts.yml"), join(".config", "gh", "config.yml"), join(".codex", "config.toml"), join(".codex", "auth.json"),
+];
+/**
+ * A `sign-ins` check's grants (sandbox parity C10, srt-style): each sign-in file by its name, read by the check itself
+ * through its sandbox. Nothing privileged reads or copies one: the sandbox resolves the name in its own view, so a link
+ * planted there into Toolroll's state leads to a denied path (Seatbelt checks the resolved file; bubblewrap resolves
+ * inside its mount namespace, where the state is masked). On a Mac, the checkout's own Claude transcript folder (made
+ * when absent, only as the real folder it is), whose session files alone are written; and Codex's session and log
+ * folders (when ~/.codex is there), never its config.
+ */
+export function signInGrants(home, checkout, platform = process.platform) {
+    const base = real(home);
+    // Read by name, but only a name that is itself now: every folder from the home folder down a real one, the file a
+    // regular file with one name (never a link, never a hard link to something else). The sandbox resolves it again.
+    const read = SIGN_IN_FILES(platform).map(name => join(base, name)).filter(path => signInIsItself(base, path));
+    const transcript = claudeProjectFolder(base, real(checkout));
+    // A transcript folder Claude would name by prefix (a very long checkout path) isn't granted: never a prefix of others.
+    const folder = transcript.byPrefix || !existsSync(join(base, ".claude")) ? null : grantFolder(transcript.path);
+    const codex = join(base, ".codex");
+    const writes = grantFolder(codex, false) === null ? [] : ["sessions", "log"].map(name => grantFolder(join(codex, name))).filter((path) => path !== null);
+    return { read, transcripts: folder === null || platform !== "darwin" ? [] : [folder], writes, mach: platform === "darwin" ? ["com.apple.trustd.agent"] : [] };
+}
+/** Whether a sign-in file is itself, now: every folder from the (real) home folder down a real folder, the file a
+ * regular file with one name (never a link, never a hard link to something else). Checked when granted and again right
+ * before the launch (invoke.ts); the sandbox resolves the name a third time. */
+export function signInIsItself(base, path) {
+    let at = base;
+    const parts = relative(base, path).split(sep);
+    if (parts.length === 0 || parts[0] === ".." || isAbsolute(relative(base, path)))
+        return false;
+    for (const [index, part] of parts.entries()) {
+        at = join(at, part);
+        try {
+            const held = lstatSync(at);
+            if (held.isSymbolicLink() || (index < parts.length - 1 ? !held.isDirectory() : !(held.isFile() && held.nlink === 1)))
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
+export const FENCE_POLICY_CURRENT = 2;
+export const LEGACY_SANDBOX = { policy: 1, readDeny: [], machLookup: [] };
+/** A build's sandbox terms, exactly as its approval sealed them: an approval from before 0.9.70 is policy v1 (the home
+ * configuration denied) with nothing listed. */
+export function launchSandboxOf(profile) {
+    return { policy: profile.fencePolicy ?? 1, readDeny: profile.readDeny ?? [], machLookup: profile.machLookup ?? [] };
+}
+/** The one place a launch's fence is made (docs/plans/sandbox-parity.md C1): its denies, its grants, and
+ * `confinement: "required"`, so the spawn road refuses it where no OS fence applies rather than running it bare. */
+export function fenceFor(kind, ctx) {
+    const home = ctx.home === undefined ? {} : { home: ctx.home };
+    // The project's read denies join the fence by name, there or not (the runtime denies a path that isn't there yet).
+    const fence = agentFence({ databaseFile: ctx.databaseFile, worktree: ctx.worktree, ...home, boundary: ctx.boundary, binding: ctx.binding, runFolders: ctx.runFolders, extra: [...ctx.extra ?? [], ...ctx.readDeny ?? []] });
+    const found = fenceGrants({ databaseFile: ctx.databaseFile, worktree: ctx.worktree, boundary: ctx.boundary, runFolders: ctx.runFolders, linked: ctx.linked ?? null, binding: ctx.binding, ...home, poolRoots: ctx.poolRoots });
+    // Toolroll's own install, the sandbox runtime's package and the Node running them, never written by anything it
+    // launches: rewriting the code that fences a build would switch the fence off.
+    const made = { ...found, readOnly: [...new Set([...found.readOnly, ...toolrollInstall(ctx.worktree, ctx.home ?? homedir(), ctx.binding?.main ?? null)])].sort() };
+    const written = ctx.writes ?? null;
+    const grants = {
+        ...made,
+        ...(written === null ? {} : { writes: written.writes, readOnly: [...new Set([...made.readOnly, ...written.readOnly])].sort() }),
+        ...(ctx.network === undefined ? {} : { network: ctx.network }),
+        ...(ctx.machLookup === undefined || ctx.machLookup.length === 0 ? {} : { machLookup: [...ctx.machLookup] }),
+        // Under a write allowlist these are out of reach already; where the launch writes anywhere, they are denied by name.
+        writeDenies: homeWriteDenies(ctx.home ?? homedir(), ctx.binding, ctx.provider ?? null),
+        ...(made.pool === undefined ? {} : { pool: { ...made.pool, ...(ctx.policy === 2 ? { readable: true } : {}),
+                // Flows' scratch folders in the pool (and any the caller names) stay denied whole, at every policy version.
+                sealed: sealedScratch(ctx.poolRoots, ctx.scratchRoots ?? []) } }),
+    };
+    return { kind, fence, fenceGrants: grants, confinement: "required" };
+}
+/** The flows' scratch folders inside the checkout pools (`flow-checks` beside the checkouts) and any a caller names,
+ * each denied by name whether or not it is there yet, and where it is a link, where it leads too. */
+export function sealedScratch(poolRoots, named) {
+    const out = new Set();
+    for (const path of [...poolRoots.filter((root) => root !== null).map(root => join(real(root), "flow-checks")), ...named.map(one => join(real(dirname(one)), basename(one)))]) {
+        out.add(path);
+        try {
+            if (lstatSync(path).isSymbolicLink())
+                out.add(realpathSync(path));
+        }
+        catch { /* not there, or dangling: denied by name */ }
+    }
+    return [...out].sort();
+}
+/**
+ * Toolroll's own install as no launch may write it: this package's folder (its compiled code, the sandbox launch
+ * helper among it), the sandbox runtime's package wherever it was installed, and the Node running them with the
+ * folder it lives in (its npm and global packages beside it), as the real folders they are. Never a folder that holds
+ * the launch's own checkout or its repository (a build of Toolroll's own source, run from it: that repository's other
+ * files are the primary checkout's, write-denied already), the home folder or one above it, and nothing the user
+ * doesn't own (root's folders are out of a build's reach already).
+ */
+export function toolrollInstall(worktree, home, repository = null) {
+    const own = worktree === null ? null : real(worktree);
+    const repo = repository === null ? null : real(repository);
+    const uid = process.getuid?.();
+    const ours = (path) => { try {
+        return uid === undefined || statSync(path).uid === uid;
+    }
+    catch {
+        return false;
+    } };
+    let runtime = [];
+    try {
+        runtime = [dirname(dirname(createRequire(import.meta.url).resolve("@anthropic-ai/sandbox-runtime")))];
+    }
+    catch {
+        runtime = [];
+    }
+    const candidates = [resolve(dirname(fileURLToPath(import.meta.url)), ".."), ...runtime, dirname(dirname(real(process.execPath))), real(process.execPath)].map(real);
+    const homeReal = real(home);
+    return [...new Set(candidates)].filter(path => path !== dirname(path) && path !== homeReal && !inside(homeReal, path)
+        && !(own !== null && (own === path || inside(own, path))) && !(repo !== null && (repo === path || inside(repo, path))) && ours(path)).sort();
+}
+/** Names that run code or reconfigure tools for whoever opens the project next: the sandbox runtime's DANGEROUS_FILES
+ * (@anthropic-ai/sandbox-runtime sandbox-utils), and the names its mandatory denies can't hold when they are made
+ * after a launch starts (`.envrc`, package-manager and Claude settings). */
+export const PROTECTED_FILES = [".gitconfig", ".gitmodules", ".bashrc", ".bash_profile", ".zshrc", ".zprofile", ".profile", ".ripgreprc", ".mcp.json",
+    ".envrc", ".npmrc", ".yarnrc", ".yarnrc.yml", ".claude/settings.json", ".claude/settings.local.json", ".git/config"];
+/** Folders protected whole, wherever they are (the runtime's dangerous directories, with Git's hooks). */
+export const PROTECTED_DIRS = [".vscode", ".idea", ".claude/commands", ".claude/agents", ".git/hooks"];
+/**
+ * The handoff's backstop (builder.ts commit): the changed paths (relative, from Git) that are protected names at any
+ * depth, in any case. The sandbox runtime denies these when a launch starts; one made after it started (a new nested
+ * folder's `.envrc`, say) gets through the sandbox, and a result that holds it is refused.
+ */
+export function protectedChanges(changed) {
+    const files = PROTECTED_FILES.map(one => one.toLowerCase());
+    return changed.filter(path => {
+        const lower = `/${path.toLowerCase()}`;
+        // A protected folder's own name too (a link committed as `pkg/.vscode`), not only what is in it.
+        return files.some(name => lower.endsWith(`/${name}`)) || PROTECTED_DIRS.some(dir => lower.includes(`/${dir.toLowerCase()}/`) || lower.endsWith(`/${dir.toLowerCase()}`));
+    });
+}
+/**
+ * The handoff's backstop for links (builder.ts commit): a staged symbolic link (Git mode 120000) whose path is a
+ * protected name or a folder on the way to one (`pkg/.claude`, `.vscode`, `lib/.git`), at any depth, in any case. A
+ * link there would lead whoever opens the project to settings, hooks or commands kept anywhere.
+ */
+export function protectedLinks(links) {
+    const entries = [...PROTECTED_FILES, ...PROTECTED_DIRS].map(one => one.toLowerCase().split("/"));
+    return links.filter(path => {
+        const parts = path.toLowerCase().split("/").filter(one => one !== "");
+        return entries.some(entry => {
+            // The link's last parts are the entry's first ones (the whole entry, or a folder on the way to it).
+            for (let take = 1; take <= Math.min(entry.length, parts.length); take++) {
+                if (parts.slice(parts.length - take).join("/") === entry.slice(0, take).join("/"))
+                    return true;
+            }
+            return false;
+        });
+    });
+}
+/** The home folder's own persistence points beyond the protected names (login items, systemd user units and autostart,
+ * Git's, gh's, pip's and fish's configuration, the shells' other startup files, SSH and GnuPG, and the folders on a
+ * login PATH). Under `.config/` each also stands under $XDG_CONFIG_HOME. */
+export const HOME_PERSISTENCE = ["Library/LaunchAgents", ".config/systemd/user", ".config/autostart", ".config/git", ".config/gh", ".config/pip",
+    ".config/fish", ".pip", ".zshenv", ".zlogin", ".bash_login", ".ssh", ".gnupg", ".local/bin", "bin"];
+/** The sign-in folders and files at home no launch writes, but an agent its own exact sign-in files (OWN_SIGN_INS). */
+const HOME_SIGN_INS = [".codex", ".claude.json", ".claude/.credentials.json"];
+/** The exact sign-in files an agent's own launch still writes (Claude's account and credentials). Codex's harness
+ * refreshes its sign-in outside the sandbox, so its commands write none. Configuration and persistence names stay
+ * denied for every agent. */
+const OWN_SIGN_INS = { claude: [".claude.json", ".claude/.credentials.json"] };
+/** `path` as it resolves now: through every link above it (and at it), however much of it exists. */
+function resolvedPath(path) {
+    let head = path;
+    const rest = [];
+    while (head !== dirname(head)) {
+        try {
+            return join(realpathSync(head), ...rest.reverse());
+        }
+        catch {
+            rest.push(basename(head));
+            head = dirname(head);
+        }
+    }
+    return path;
+}
+/**
+ * What no launch writes, whatever its writes, as static write denies for the sandbox runtime (whose own protected names
+ * are anchored at the launch's folder only) and Codex's profile: the home folder's protected names (shell profiles, Git
+ * and tool configuration), its persistence points and sign-ins (but the launch's own agent's exact sign-in files), and
+ * the bound repository's own Git config, hooks and submodules (a linked worktree reaches them through its `.git`
+ * file). Each by its name and by where it leads now (a linked ~/.config or LaunchAgents is denied at both ends). On
+ * Linux only those there at launch: the runtime holds an absent name with a stand-in nothing can read for the launch's
+ * length, and the person's own git and shells then fail on their ~/.gitconfig and ~/.bashrc (measured). Under a write
+ * allowlist an absent one is out of reach anyway; under `anywhere` it can be made (an accepted limit).
+ */
+export function homeWriteDenies(home, binding, provider, platform = process.platform, env = process.env) {
+    const base = real(home);
+    const own = new Set(OWN_SIGN_INS[provider ?? ""] ?? []);
+    const names = [...new Set([...PROTECTED_FILES.filter(name => !name.startsWith(".git/")), ...PROTECTED_DIRS.filter(name => !name.startsWith(".git/")), ...HOME_PERSISTENCE, ...HOME_SIGN_INS])]
+        .filter(name => !own.has(name));
+    const xdg = env["XDG_CONFIG_HOME"];
+    const roots = (name) => [join(base, name), ...(name.startsWith(".config/") && xdg !== undefined && isAbsolute(xdg) ? [join(xdg, name.slice(".config/".length))] : [])];
+    const paths = names.flatMap(name => roots(name).filter(path => platform !== "linux" || existsSync(path)));
+    const git = binding === null ? [] : ["config", "hooks", "modules"].map(name => join(real(join(binding.main, ".git")), name));
+    return [...new Set([...paths, ...git].flatMap(path => [path, resolvedPath(path)]))].sort();
+}
+/** A tool server's grants from its build's: never the agent's network or write allowlist (a server keeps its own state
+ * where it always has), and never the build's own checkout or launch folder read back (nothing a build wrote loads in a
+ * process that holds a tool's secrets). */
+export function serverGrantsOf(grants) {
+    const { network: _agentOnly, writes: _agentWrites, ...rest } = grants;
+    return {
+        ...rest,
+        ...(rest.pool === undefined ? {} : { pool: { ...rest.pool, own: null } }),
+        ...(rest.runFolders === undefined ? {} : { runFolders: { ...rest.runFolders, own: null } }),
+    };
+}