toolroll 0.9.68 → 0.9.70

package/dist/agentconfig.d.ts

@@ -65,7 +65,7 @@ export type ProfileResolution = {
 export declare function resolveScopeProfile(store: Store, repo: string | null, ref: Pick<TaskRef, "agentProvider" | "agentModel"> | undefined, flags: PhaseFlags & {
     repairModel?: string | undefined;
     permissionMode?: UnattendedPermissionMode | undefined;
-}): ProfileResolution;
+}, platform?: NodeJS.Platform): ProfileResolution;
 /**
  * The two candidate tiers the routing policy chooses between, per phase,
  * read from configuration ONLY — never inferred from a model's name:

package/dist/agentconfig.js

@@ -21,6 +21,8 @@
  */
 import { PROJECT_NETWORK_DEFAULT, repositoryEcosystems, resolveNetwork } from "./egress.js";
 import { WRITES_DEFAULT } from "./writes-mode.js";
+import { checkAccessHere } from "./check-access.js";
+import { PROJECT_SANDBOX_DEFAULT } from "./project-sandbox.js";
 import { isProviderId, validateSpec } from "./provider.js";
 import { ACP_LIMITS, CLAUDE_LIMITS, CODEX_SHAPED_LIMITS, GEMINI_LIMITS } from "./scope.js";
 import { ACP_AGENTS, isAcpProvider } from "./acp-agents.js";
@@ -102,7 +104,7 @@ ref) {
     const valid = validateSpec(spec);
     return valid.ok ? { ok: true, spec, source: flags.model !== undefined ? "flag" : source } : { ok: false, problem: valid.problem };
 }
-export function resolveScopeProfile(store, repo, ref, flags) {
+export function resolveScopeProfile(store, repo, ref, flags, platform = process.platform) {
     const build = resolvePhaseAgent(store, "build", repo, flags, ref);
     if (!build.ok)
         return { ok: false, reason: "unknown-provider", problem: build.problem };
@@ -199,7 +201,14 @@ export function resolveScopeProfile(store, repo, ref, flags) {
     const network = resolveNetwork(provider, repo === null ? PROJECT_NETWORK_DEFAULT : store.projectNetwork(repo), repo === null ? [] : repositoryEcosystems(repo));
     // Where the build may write (writes-mode.ts): the project's setting, sealed likewise.
     const writes = repo === null ? WRITES_DEFAULT : store.projectWrites(repo);
-    return { ok: true, profile: { ...profile, network, writes }, provenance: { resolvedFrom: build.source, repairFrom } };
+    // How far its checks reach (check-access.ts): the project's setting as checks can get it (sign-ins, off for now,
+    // seal as sandboxed: an approval never claims what its checks won't get), sealed only when wider than sandboxed.
+    const checkAccess = repo === null ? "sandboxed" : checkAccessHere(store.projectCheckAccess(repo), platform);
+    // The fence policy (sandbox parity, docs/plans/sandbox-parity.md §1.5): every new scope is v2; and the project's
+    // sandbox settings (project-sandbox.ts), sealed when it lists any.
+    const sandbox = repo === null ? PROJECT_SANDBOX_DEFAULT : store.projectSandbox(repo);
+    return { ok: true, profile: { ...profile, network, writes, ...(checkAccess === "sandboxed" ? {} : { checkAccess }), fencePolicy: 2,
+            ...(sandbox.readDeny.length === 0 ? {} : { readDeny: [...sandbox.readDeny] }), ...(sandbox.machLookup.length === 0 ? {} : { machLookup: [...sandbox.machLookup] }) }, provenance: { resolvedFrom: build.source, repairFrom } };
 }
 const PHASE_NOUN = { plan: "planner", build: "builder", repair: "repair", review: "reviewer" };
 export function resolveRouteCandidates(store, repo, pins = {}) {

package/dist/batch-checks.js

@@ -1,24 +1,4 @@
-/** Batch checks: like a merge queue, for projects that run the full check after every build.
- *
- * With batching on (a per-project setting, off by default), a Full build doesn't run its check
- * inline. It asks for a batch check on its exact commit, and waits up to the window (10 minutes)
- * for another result of the same project and the same approved command. The batch pass then
- * merges the waiting results onto the recorded project base in a temporary, detached checkout
- * and runs the approved check once:
- *
- * - it passes: every result gets its own sealed receipt, "checked together with" the others,
- *   naming the exact batch commit it tested;
- * - it fails: the batch is split in halves and each half checked, down to single results, so the
- *   one that breaks it is found and the others still pass on their own;
- * - the results conflict when merged: each is checked on its own.
- *
- * Nothing is merged into a real branch. The batch commit exists only in the temporary checkout,
- * which is always removed; each result still lands on its own.
- *
- * The queue is the follow-up check ledger (result-follow-ups.ts), with `batch` requests: the same
- * claim, receipts, abandoned-check reading, status projection and Merge gate. The policy is an
- * append-only ledger entry, like the check level. */
-import { fencedCheckoutCommands } from "./invoke.js";
+import { checkoutRunner, ranAtLine, widestRan } from "./invoke.js";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -67,7 +47,8 @@ export async function runBatchChecks(store, root, deps = {}) {
             finish("The approved check changed while it waited. Run checks to check it now.");
             continue;
         }
-        const key = `${ref.repo}\u0000${one.digest}`;
+        // A cohort shares one check level: results whose own checks ran at different levels are checked apart (check-access.ts).
+        const key = `${ref.repo}\u0000${one.digest}\u0000${store.runCheckAccess(one.runId)}`;
         cohorts.set(key, [...(cohorts.get(key) ?? []), { request: one.request, runId: one.runId, task: ref.externalId, head: one.head, base: one.base ?? null, at: one.at }]);
     }
     for (const [key, members] of cohorts) {
@@ -121,6 +102,8 @@ async function checkCohort(store, root, repo, cohort, deps) {
     const attempts = new Map(members.map(one => [one.request, []]));
     const bound = (text) => { const hits = scanForSecrets(text); return boundStreamHeadTail(hits.length > 0 ? redactSecretLines(text, hits) : text, 12 * 1024); };
     const section = (label, shown, result) => `=== ${label} ===\n$ ${shown}\n(exit ${result.code}${result.notFound ? ", could not start" : ""}${result.timedOut ? ", timed out" : ""})\n\n--- stdout ---\n${bound(result.stdout)}\n\n--- stderr ---\n${bound(result.stderr)}`;
+    // How each command actually ran (check-access.ts), per result: only the commands it was part of count for its receipt.
+    const ranAtOf = new Map();
     const note = (set, text) => { for (const one of set)
         logs.get(one.request).push(text); };
     const attempt = (set, tested, outcome) => { for (const one of set)
@@ -158,11 +141,15 @@ async function checkCohort(store, root, repo, cohort, deps) {
                 return { conflict: false, tested, outcome: { ran: false, failure: "Stopped before the check started." }, setupFailed: false };
             // The approvals are re-read before every spawn: a revoked or changed command never runs.
             const liveSetup = store.liveWorktreeSetup(repo);
+            // Worked out again right before each command (check-access.ts): a narrowing meanwhile applies to the next one. Each
+            // member is credited with exactly the commands of this set.
+            const setRan = (level) => { for (const one of set)
+                ranAtOf.set(one.request, [...(ranAtOf.get(one.request) ?? []), level]); };
             if ((liveSetup?.digest ?? null) !== (setup?.digest ?? null))
                 return { conflict: false, tested, outcome: { ran: false, failure: "The project's approved setup changed before the check started." }, setupFailed: false };
             if (liveSetup !== null) {
                 const shell = approvedCommandShell(liveSetup.command);
-                const prepared = await runWithIsolatedDatabase(fencedCheckoutCommands(store, repo, checkout, runner), shell.file, shell.args, { cwd: checkout, timeoutMs: liveSetup.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
+                const prepared = await runWithIsolatedDatabase(checkoutRunner(store, repo, checkout, runner, set.map(one => one.runId), setRan), shell.file, shell.args, { cwd: checkout, timeoutMs: liveSetup.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
                 note(set, section(`${label} · approved project setup on ${tested.slice(0, 7)}`, liveSetup.command, prepared));
                 if (prepared.code !== 0 || prepared.timedOut || prepared.notFound)
                     return { conflict: false, tested, outcome: { ran: false, failure: "The project's setup failed, so the check didn't run." }, setupFailed: true };
@@ -171,7 +158,7 @@ async function checkCohort(store, root, repo, cohort, deps) {
             if (live === null || live.digest !== command.digest)
                 return { conflict: false, tested, outcome: { ran: false, failure: "The approved check changed before it started." }, setupFailed: false };
             const shell = approvedCommandShell(live.command);
-            const ran = await runWithIsolatedDatabase(fencedCheckoutCommands(store, repo, checkout, runner), shell.file, shell.args, { cwd: checkout, timeoutMs: live.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
+            const ran = await runWithIsolatedDatabase(checkoutRunner(store, repo, checkout, runner, set.map(one => one.runId), setRan), shell.file, shell.args, { cwd: checkout, timeoutMs: live.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
             note(set, section(`${label} · full check on ${tested.slice(0, 7)}`, live.command, ran));
             return { conflict: false, tested, setupFailed: false,
                 outcome: ran.timedOut ? { ran: false, failure: "The check ran out of time." } : ran.notFound ? { ran: false, failure: "The check couldn't start." } : { ran: true, exitCode: ran.code } };
@@ -183,11 +170,12 @@ async function checkCohort(store, root, repo, cohort, deps) {
     };
     const seal = (one, mode, together, tested, outcome) => {
         const at = now();
-        const text = logs.get(one.request).length === 0 ? "No command started." : logs.get(one.request).join("\n\n");
+        const ranLine = ranAtLine(widestRan(ranAtOf.get(one.request) ?? []));
+        const text = logs.get(one.request).length === 0 ? "No command started." : [...logs.get(one.request), ...(ranLine === null ? [] : [ranLine])].join("\n\n");
         const logId = storeEvidence(store, root, one.runId, "structured-output", `batch-check-${one.request}.log`, Buffer.from(text, "utf8"), FOLLOW_UP_LOG, at, { captureStatus: "ok" });
         const logArtifact = store.getArtifact(logId);
         const batch = { mode, tested: tested ?? one.head, base, members: together.map(m => ({ task: m.task, run: m.runId, head: m.head })), attempts: attempts.get(one.request) };
-        const receipt = JSON.stringify({ version: 1, request: one.request, run: one.runId, head: one.head, tested, level: "full",
+        const receipt = JSON.stringify({ version: 1, request: one.request, run: one.runId, head: one.head, tested, level: "full", checkAccess: widestRan(ranAtOf.get(one.request) ?? []),
             command: { repo: command.repo, command: command.command, digest: command.digest, approvedBy: command.approvedBy },
             result: outcome, batch, log: { artifactId: logArtifact.id, sha256: logArtifact.sha256, bytesStored: logArtifact.bytesStored, truncated: logArtifact.truncated } }, null, 1);
         storeEvidence(store, root, one.runId, "structured-output", `batch-check-${one.request}.json`, Buffer.from(receipt, "utf8"), FOLLOW_UP_RECEIPT, at, { captureStatus: "ok" });

package/dist/browser/THIRD_PARTY_NOTICES.txt

@@ -489,6 +489,27 @@ DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
 OTHER DEALINGS IN THE FONT SOFTWARE.
 
+## Anthropic sandbox-runtime — Apache-2.0
+
+Copyright Anthropic PBC. https://github.com/anthropics/sandbox-runtime
+
+`@anthropic-ai/sandbox-runtime` 0.0.79 is a dependency, installed whole from npm with its own `LICENSE` (and its
+prebuilt Linux seccomp helpers, `vendor/seccomp/<arch>/apply-seccomp`). Toolroll calls it for every sandbox it runs
+(`src/sandbox-runtime.ts`, `src/sandbox-launch.ts`) and copies or modifies none of its code.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+
 ## Bundled dependency: @floating-ui/core 1.8.0
 
 MIT License

package/dist/builder.d.ts

@@ -1,3 +1,5 @@
+import { type NetworkProfile } from "./egress.js";
+import { type CheckAccess } from "./check-access.js";
 import type { WritesMode } from "./writes-mode.js";
 import type { LaunchNetwork } from "./invoke.js";
 import type { ProviderId } from "./contracts/provider.js";
@@ -187,6 +189,13 @@ export declare function redactSecretAssignments(text: string): string;
 /** A build's network (egress.ts): the one its approval sealed, or — sealed before network policies existed — the
  * narrowed legacy one (provider hosts and the repository's registries, nothing added since). */
 export declare function launchNetworkOf(store: Store, taskRef: number, profile: ExecutionProfile): LaunchNetwork;
+/** A build's checks' level and network: its approval's level as this platform can give it (sign-ins sealed before
+ * run sandboxed while sign-ins are off, and the run is stamped with that, what actually ran), and under sign-ins the network its
+ * approval sealed less its agent's own provider hosts (never its checks'). */
+export declare function checkLaunchOf(store: Store, runId: number, profile: ExecutionProfile, platform?: NodeJS.Platform): {
+    access: CheckAccess;
+    network: NetworkProfile | null;
+};
 /** Where a build may write (writes-mode.ts): what its approval sealed, or — sealed before write allowlists — anywhere
  * its fence allows, as it was approved. */
 export declare function launchWritesOf(profile: ExecutionProfile): WritesMode;

package/dist/builder.js

@@ -1,4 +1,5 @@
 import { legacyNetwork, repositoryEcosystems } from "./egress.js";
+import { CHECK_ACCESS_DEFAULT, checkAccessHere, checkNetworkOf } from "./check-access.js";
 import { checkoutGit } from "./teardown-git.js";
 import { isAcpProvider } from "./acp-agents.js";
 import { OBSERVATION_MAILBOX, observationBrief, parseObservationCases, collectObservations } from "./observations.js";
@@ -50,6 +51,7 @@ import { stopRequestedFor, stopWords, underStopWatch } from "./task-control.js";
 import { witnessedRunner } from "./process-custody.js";
 import { runWithIsolatedDatabase } from "./child-database.js";
 import { recordWorktreeProcess, saveWorkPatch } from "./worktree.js";
+import { launchSandboxOf, protectedChanges, protectedLinks } from "./agent-fence.js";
 import { approvalOf, digestOf, idleClock, isAcpProfile, profileDigestOf, routeParityProblem, watchdogsOf } from "./scope.js";
 import { legOf, routeDigestOf, routeFromJson } from "./phase-routing.js";
 import { execFileSync } from "node:child_process";
@@ -268,7 +270,26 @@ function buildCheckoutGit(given, worktree, mainCheckout = null) {
 /** A run's setup and check commands, in its build's fence, writing where the approval this build runs under sealed
  * (never the scope as it may since have been rewritten; invoke.ts fencedCommands). */
 function commandRunner(store, runId, profile, inner) {
-    return fencedCommands(store, runId, launchWritesOf(profile), inner);
+    // How far its checks reach (check-access.ts): what its approval sealed, stamped on the run (again: the dispatch stamped
+    // it first) so a later check of its result never runs wider; under sign-ins, behind its checks' own network.
+    const { access, network } = checkLaunchOf(store, runId, profile);
+    store.stampRunCheckAccess(runId, access, network);
+    return fencedCommands(store, runId, launchWritesOf(profile), inner, undefined, access, network ?? undefined, launchSandboxOf(profile));
+}
+/** A build's checks' level and network: its approval's level as this platform can give it (sign-ins sealed before
+ * run sandboxed while sign-ins are off, and the run is stamped with that, what actually ran), and under sign-ins the network its
+ * approval sealed less its agent's own provider hosts (never its checks'). */
+export function checkLaunchOf(store, runId, profile, platform = process.platform) {
+    const access = checkAccessHere(profile.checkAccess ?? CHECK_ACCESS_DEFAULT, platform);
+    if (access !== "sign-ins")
+        return { access, network: null };
+    const taskRef = store.getRun(runId)?.taskRef;
+    const sealed = taskRef === undefined ? undefined : launchNetworkOf(store, taskRef, profile);
+    // No sealed network to narrow from: its checks run sandboxed.
+    if (sealed === undefined || !("policy" in sealed))
+        return { access: CHECK_ACCESS_DEFAULT, network: null };
+    const repo = store.refForId(taskRef)?.repo ?? null;
+    return { access, network: checkNetworkOf(sealed.policy, profile.provider, repo === null ? { mode: "allowlist", hosts: [], loopback: "proxy-only" } : store.projectNetwork(repo)) };
 }
 /** Where a build may write (writes-mode.ts): what its approval sealed, or — sealed before write allowlists — anywhere
  * its fence allows, as it was approved. */
@@ -422,6 +443,12 @@ export async function build(store, request) {
     // resume below can match on them honestly.
     const provenScopeDigest = scope?.approvedDigest ?? "";
     const provenProfileDigest = profileDigestOf(effective.profile);
+    // Its checks' level and network, stamped now with the proof: a batched result that runs no command here still
+    // carries what its approval allows its checks (check-access.ts).
+    {
+        const launch = checkLaunchOf(store, request.runId, effective.profile);
+        store.stampRunCheckAccess(request.runId, launch.access, launch.network);
+    }
     store.stampRun(request.runId, {
         scopeDigest: provenScopeDigest,
         profileDigest: provenProfileDigest,
@@ -1350,7 +1377,7 @@ export async function build(store, request) {
             ...watchdogsOf(effective.profile, effective.timeoutMs),
             omitEnv: AGENT_ENV_DENYLIST,
             network: launchNetworkOf(store, request.taskRef, effective.profile),
-            writes: launchWritesOf(effective.profile),
+            writes: launchWritesOf(effective.profile), sandbox: launchSandboxOf(effective.profile),
             ...(agent === undefined ? {} : { runner: agent }),
             onSpawn: (pid) => { spawned = true; request.onProviderSpawn?.(pid); },
             onStreamEvent: (event) => liveLog.observe(event),
@@ -2694,7 +2721,7 @@ async function resumeUnhandedWork(captured, sessionId) {
             ...watchdogsOf(effective.profile, effective.timeoutMs),
             omitEnv: AGENT_ENV_DENYLIST,
             network: launchNetworkOf(store, request.taskRef, effective.profile),
-            writes: launchWritesOf(effective.profile),
+            writes: launchWritesOf(effective.profile), sandbox: launchSandboxOf(effective.profile),
             ...(agent === undefined ? {} : { runner: agent }),
             ...(request.onProviderSpawn === undefined ? {} : { onSpawn: request.onProviderSpawn }),
             clock,
@@ -2909,7 +2936,7 @@ async function ingestPark(args) {
                 ? watchdogsOf(args.profile, args.profile.repairTimeoutSeconds * 1000, true)
                 : { timeoutMs: args.profile !== undefined ? args.profile.repairTimeoutSeconds * 1000 : REPAIR_TIMEOUT_MS }),
             omitEnv: AGENT_ENV_DENYLIST,
-            ...(args.profile === undefined ? {} : { network: launchNetworkOf(store, request.taskRef, args.profile), writes: launchWritesOf(args.profile) }),
+            ...(args.profile === undefined ? {} : { network: launchNetworkOf(store, request.taskRef, args.profile), writes: launchWritesOf(args.profile), sandbox: launchSandboxOf(args.profile) }),
             ...(agent === undefined ? {} : { runner: agent }),
             ...(request.onProviderSpawn === undefined ? {} : { onSpawn: request.onProviderSpawn }),
             clock,
@@ -3480,6 +3507,25 @@ async function commit(git, worktree, branch, taskId, scope, summary, preparedCan
                 return { ok: true, committed: false, branch, summary };
         }
     }
+    // The protected names' backstop: a result that wrote a hook, Git config, editor or tool settings, a shell profile or
+    // an `.envrc` is refused, however it got written (the sandbox runtime holds the names there when a launch starts; one
+    // made after that, or by Codex, gets through it). The checkout is kept; nothing is committed.
+    const staged = await git(GIT, ["--no-optional-locks", "diff", "--cached", "--name-only", "--no-renames", "-z"], { cwd: worktree });
+    if (staged.code !== 0)
+        return { ok: false, reason: "commit-failure", message: firstLine(staged.stderr) };
+    // And any staged link at a protected name or a folder on the way to one (mode 120000, from the raw listing).
+    const raw = await git(GIT, ["--no-optional-locks", "diff", "--cached", "--raw", "--no-renames", "-z"], { cwd: worktree });
+    if (raw.code !== 0)
+        return { ok: false, reason: "commit-failure", message: firstLine(raw.stderr) };
+    const rawParts = raw.stdout.split("\0");
+    const links = [];
+    for (let at = 0; at + 1 < rawParts.length; at += 2)
+        if (rawParts[at].split(" ")[1] === "120000")
+            links.push(rawParts[at + 1]);
+    const forbidden = [...new Set([...protectedChanges(staged.stdout.split("\0").filter(one => one !== "")), ...protectedLinks(links)])];
+    if (forbidden.length > 0) {
+        return { ok: false, reason: "commit-failure", message: `The result changes ${forbidden.slice(0, 3).join(", ")}${forbidden.length > 3 ? ` and ${forbidden.length - 3} more` : ""}, which builds may not write (they run code or change tools for whoever opens the project next). Nothing was committed; the work is kept in ${worktree}.` };
+    }
     // Setup can create untracked files as well as edit tracked manifests.
     // Re-prove the whole staged tree after the normal path exclusions, before
     // committing, so neither can widen an exact prepared candidate.

package/dist/check-access.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Check access (v132, docs/plans/check-access.md): how far a project's setup and check commands reach beyond the
+ * plane's check fence. `sandboxed` (the default) is the fence as it is; `sign-ins` also reads the exact sign-in files
+ * of Claude, Codex and gh, under the project's network fence; `unsandboxed` runs them with no OS fence, trusted by the
+ * whole instance, for a project whose checks must create sandboxes themselves (Toolroll's own). Widening is an instance
+ * operator's act with a password typed now; any approver for the project may narrow it back.
+ */
+import { type NetworkProfile, type ProjectNetwork } from "./egress.js";
+export declare const CHECK_ACCESS_LEVELS: readonly ["sandboxed", "sign-ins", "unsandboxed"];
+export type CheckAccess = typeof CHECK_ACCESS_LEVELS[number];
+export declare const CHECK_ACCESS_DEFAULT: CheckAccess;
+export declare const isCheckAccess: (value: unknown) => value is CheckAccess;
+/** A stored or sealed value as a level: anything missing or unreadable is the narrowest, never a wider one. */
+export declare const checkAccessOf: (value: unknown) => CheckAccess;
+export declare const widerThan: (a: CheckAccess, b: CheckAccess) => boolean;
+/** The narrowest of several levels (none given: the default). */
+export declare const narrowestAccess: (levels: readonly CheckAccess[]) => CheckAccess;
+/** The level as a person reads it, in a sentence's middle ("Checks: …"). */
+export declare function checkAccessWords(level: CheckAccess): string;
+/** What each wider level means, said before anyone chooses it. */
+export declare const CHECK_ACCESS_WARNINGS: Readonly<Record<Exclude<CheckAccess, "sandboxed">, string>>;
+/** The services whose sign-ins a `sign-ins` check reads: Claude's and Codex's own hosts (egress.ts), and GitHub's. */
+export declare const SIGN_IN_HOSTS: readonly string[];
+/** Which of those a project's network doesn't allow (an open network allows all). The check's network is never widened
+ * for them: the operator adds them, as a network change of its own. */
+export declare function signInHostsMissing(network: ProjectNetwork): string[];
+/** The narrower of two networks: every host both allow (a wildcard allows what it covers), local services only if both
+ * do, open only if both are. A check never reaches what either its sealed network or the project's current one refuses. */
+export declare function narrowestNetwork(a: NetworkProfile, b: NetworkProfile): NetworkProfile;
+/** A build's checks' own network: what its approval sealed, less its agent's provider hosts (those are the agent's, never
+ * its checks'); narrower if a project host happens to be one of them. */
+export declare function checkNetworkOf(sealed: NetworkProfile, provider: string, project: ProjectNetwork): NetworkProfile;
+/** On (0.9.70, sandbox parity C10): a `sign-ins` check reads its sign-in files itself, through its sandbox, by name
+ * (agent-fence.ts signInGrants). Nothing privileged reads or copies one, so the race that kept sign-ins off (a folder
+ * swapped between a privileged check and its read) has nothing to race; a link planted at a sign-in name leads, inside
+ * the sandbox's own view, to a denied path. Every platform with an OS fence. */
+export declare const SIGN_INS_READY = true;
+export declare const signInsAvailable: (_platform?: NodeJS.Platform) => boolean;
+/** Why sign-ins can't be chosen here, said plainly (null: they can). */
+export declare const signInsUnavailableWords: (platform?: NodeJS.Platform) => string | null;
+/** The level checks actually get on this platform: `sign-ins` where it isn't available is `sandboxed` (narrower, never
+ * wider). Everything that seals, launches or stamps a check's level goes through this. */
+export declare const checkAccessHere: (level: CheckAccess, platform?: NodeJS.Platform) => CheckAccess;
+/** How a project's checks actually run here, as the settings page and `project check-access` say it: with no OS fence
+ * on this machine and unconfined running allowed by an operator, without a sandbox whatever is saved (never said to be
+ * sandboxed); otherwise the saved level as this platform can give it. */
+export declare function checkAccessRunsAs(level: CheckAccess, here: {
+    platform: NodeJS.Platform;
+    fenced: boolean;
+    unconfinedAllowed: boolean;
+}): CheckAccess;

package/dist/check-access.js

@@ -0,0 +1,77 @@
+/**
+ * Check access (v132, docs/plans/check-access.md): how far a project's setup and check commands reach beyond the
+ * plane's check fence. `sandboxed` (the default) is the fence as it is; `sign-ins` also reads the exact sign-in files
+ * of Claude, Codex and gh, under the project's network fence; `unsandboxed` runs them with no OS fence, trusted by the
+ * whole instance, for a project whose checks must create sandboxes themselves (Toolroll's own). Widening is an instance
+ * operator's act with a password typed now; any approver for the project may narrow it back.
+ */
+import { PROVIDER_HOSTS } from "./egress.js";
+export const CHECK_ACCESS_LEVELS = ["sandboxed", "sign-ins", "unsandboxed"];
+export const CHECK_ACCESS_DEFAULT = "sandboxed";
+export const isCheckAccess = (value) => typeof value === "string" && CHECK_ACCESS_LEVELS.includes(value);
+/** A stored or sealed value as a level: anything missing or unreadable is the narrowest, never a wider one. */
+export const checkAccessOf = (value) => isCheckAccess(value) ? value : CHECK_ACCESS_DEFAULT;
+const RANK = { sandboxed: 0, "sign-ins": 1, unsandboxed: 2 };
+export const widerThan = (a, b) => RANK[a] > RANK[b];
+/** The narrowest of several levels (none given: the default). */
+export const narrowestAccess = (levels) => levels.reduce((low, one) => RANK[one] < RANK[low] ? one : low, levels.length === 0 ? CHECK_ACCESS_DEFAULT : "unsandboxed");
+/** The level as a person reads it, in a sentence's middle ("Checks: …"). */
+export function checkAccessWords(level) {
+    return level === "sandboxed" ? "sandboxed" : level === "sign-ins" ? "sandboxed, with model and GitHub sign-ins" : "not sandboxed";
+}
+/** What each wider level means, said before anyone chooses it. */
+export const CHECK_ACCESS_WARNINGS = {
+    "sign-ins": "This project's checks can read your Claude, Codex and GitHub sign-ins, even where the project hides your home folder's files from builds. Its tests could use or send those credentials anywhere its network setting allows. Only choose this for projects you trust.",
+    unsandboxed: "This project's checks get your full access to this machine and to Toolroll itself, including its database and every sign-in. Only for a project whose checks must create sandboxes themselves, such as Toolroll's own.",
+};
+/** The services whose sign-ins a `sign-ins` check reads: Claude's and Codex's own hosts (egress.ts), and GitHub's. */
+export const SIGN_IN_HOSTS = [...PROVIDER_HOSTS["claude"], ...PROVIDER_HOSTS["codex"], "github.com", "api.github.com"];
+/** Which of those a project's network doesn't allow (an open network allows all). The check's network is never widened
+ * for them: the operator adds them, as a network change of its own. */
+export function signInHostsMissing(network) {
+    if (network.mode === "open")
+        return [];
+    const covered = (host) => network.hosts.some(one => one === host || (one.startsWith("*.") && host.endsWith(one.slice(1))));
+    return SIGN_IN_HOSTS.filter(host => !covered(host));
+}
+/** The narrower of two networks: every host both allow (a wildcard allows what it covers), local services only if both
+ * do, open only if both are. A check never reaches what either its sealed network or the project's current one refuses. */
+export function narrowestNetwork(a, b) {
+    const loopback = a.loopback === "any" && b.loopback === "any" ? "any" : "proxy-only";
+    if (a.mode === "open" && b.mode === "open")
+        return { version: 1, mode: "open", hosts: [], loopback };
+    if (a.mode === "open")
+        return { ...b, loopback };
+    if (b.mode === "open")
+        return { ...a, loopback };
+    const covers = (list, host) => list.some(one => one === host || (one.startsWith("*.") && (host.endsWith(one.slice(1)) || host === one)));
+    const hosts = [...new Set([...a.hosts.filter(host => covers(b.hosts, host)), ...b.hosts.filter(host => covers(a.hosts, host))])].sort();
+    return { version: 1, mode: "allowlist", hosts, loopback };
+}
+/** A build's checks' own network: what its approval sealed, less its agent's provider hosts (those are the agent's, never
+ * its checks'); narrower if a project host happens to be one of them. */
+export function checkNetworkOf(sealed, provider, project) {
+    if (sealed.mode === "open")
+        return sealed;
+    // A provider host the project itself lists (an operator added it, for its sign-ins, say) is the checks' too.
+    const agent = new Set((PROVIDER_HOSTS[provider] ?? []).filter(host => !project.hosts.includes(host)));
+    return { ...sealed, hosts: sealed.hosts.filter(host => !agent.has(host)) };
+}
+/** On (0.9.70, sandbox parity C10): a `sign-ins` check reads its sign-in files itself, through its sandbox, by name
+ * (agent-fence.ts signInGrants). Nothing privileged reads or copies one, so the race that kept sign-ins off (a folder
+ * swapped between a privileged check and its read) has nothing to race; a link planted at a sign-in name leads, inside
+ * the sandbox's own view, to a denied path. Every platform with an OS fence. */
+export const SIGN_INS_READY = true;
+export const signInsAvailable = (_platform = process.platform) => SIGN_INS_READY;
+/** Why sign-ins can't be chosen here, said plainly (null: they can). */
+export const signInsUnavailableWords = (platform = process.platform) => signInsAvailable(platform) ? null
+    : "Not available yet: sign-ins can't be shared with checks safely. Choose Sandboxed or Not sandboxed.";
+/** The level checks actually get on this platform: `sign-ins` where it isn't available is `sandboxed` (narrower, never
+ * wider). Everything that seals, launches or stamps a check's level goes through this. */
+export const checkAccessHere = (level, platform = process.platform) => level === "sign-ins" && !signInsAvailable(platform) ? CHECK_ACCESS_DEFAULT : level;
+/** How a project's checks actually run here, as the settings page and `project check-access` say it: with no OS fence
+ * on this machine and unconfined running allowed by an operator, without a sandbox whatever is saved (never said to be
+ * sandboxed); otherwise the saved level as this platform can give it. */
+export function checkAccessRunsAs(level, here) {
+    return !here.fenced && here.unconfinedAllowed ? "unsandboxed" : checkAccessHere(level, here.platform);
+}

package/dist/coding-provider.d.ts

@@ -1,3 +1,5 @@
+import type { CodingPermissions } from "./coding-workspace.js";
+import type { Store } from "./store.js";
 import { type ProcessObservationFailure } from "./process-tree.js";
 /** Read-only recovery witnesses, never authority to signal historical PIDs.
  * macOS ancestry is observational; a missed/failed observation stays fenced.
@@ -70,3 +72,15 @@ export declare function createCodexCodingProvider(options?: {
     command?: string;
     args?: string[];
 }): CodingProvider;
+/**
+ * An interactive Codex session's confinement (docs/plans/sandbox-parity.md C3): the permission profile a Codex build
+ * gets (agent-fence.ts codexFenceConfig), as the thread's config overrides: Toolroll's state, every other launch's
+ * folder and every other checkout in the plane's pools and the coding sessions' own pool denied, the session's own
+ * worktree given back; Codex's workspace writes; no network (Codex's command sandbox can't route through a proxy, and
+ * sessions have never had one). The worktree is bound to its project by the plane's own records first; anything that
+ * doesn't prove refuses the session.
+ */
+export declare function codingSessionPermissions(store: Pick<Store, "databaseFile" | "listWorktrees" | "projectSandbox">, worktreeRoot: string): (input: {
+    repo: string;
+    worktree: string;
+}) => CodingPermissions;

package/dist/coding-provider.js

@@ -1,6 +1,10 @@
 import { spawn } from "node:child_process";
 import { TextDecoder } from "node:util";
-import { hostname } from "node:os";
+import { homedir, hostname } from "node:os";
+import { readDenyPath } from "./project-sandbox.js";
+import { dirname, join } from "node:path";
+import { codexFenceConfig, fenceFor, FENCE_POLICY_CURRENT, runFolders, taskBoundary, trustedWorktreeBinding } from "./agent-fence.js";
+import { poolRootOf } from "./worktree.js";
 import { currentBootId } from "./boot-identity.js";
 import { createContainer, currentContainment } from "./containment.js";
 import { processMayBeAlive } from "./process-liveness.js";
@@ -423,3 +427,31 @@ export function createCodexCodingProvider(options = {}) {
         close,
     };
 }
+/**
+ * An interactive Codex session's confinement (docs/plans/sandbox-parity.md C3): the permission profile a Codex build
+ * gets (agent-fence.ts codexFenceConfig), as the thread's config overrides: Toolroll's state, every other launch's
+ * folder and every other checkout in the plane's pools and the coding sessions' own pool denied, the session's own
+ * worktree given back; Codex's workspace writes; no network (Codex's command sandbox can't route through a proxy, and
+ * sessions have never had one). The worktree is bound to its project by the plane's own records first; anything that
+ * doesn't prove refuses the session.
+ */
+export function codingSessionPermissions(store, worktreeRoot) {
+    return input => sessionPermissions(store, { ...input, worktreeRoot });
+}
+function sessionPermissions(store, input) {
+    const databaseFile = store.databaseFile();
+    if (databaseFile === null || databaseFile === "" || databaseFile === ":memory:")
+        return { problem: "The coding session has no state folder to fence, so it was not started." };
+    try {
+        const poolRoots = [join(dirname(databaseFile), "worktrees"), input.worktreeRoot, ...store.listWorktrees().map(record => poolRootOf(record.path, record.repo))];
+        const binding = trustedWorktreeBinding(input.repo, input.worktree, poolRoots);
+        const boundary = taskBoundary({ worktree: input.worktree, provider: "codex", binding, policy: FENCE_POLICY_CURRENT });
+        // The project's read denies, read live (a session seals none; they only narrow).
+        const readDeny = store.projectSandbox(input.repo).readDeny.map(one => readDenyPath(one, homedir()));
+        const launch = fenceFor("build", { databaseFile, worktree: input.worktree, boundary, binding, runFolders: runFolders(null), poolRoots, readDeny, policy: FENCE_POLICY_CURRENT });
+        return { config: codexFenceConfig(launch.fence, false, launch.fenceGrants) };
+    }
+    catch {
+        return { problem: "The session's worktree couldn't be bound to its project, so the session was not started." };
+    }
+}

package/dist/coding-workspace.d.ts

@@ -24,9 +24,22 @@ export declare class CodingActionError extends Error {
 export declare class CodingStateConflictError extends CodingActionError {
     constructor(id: string);
 }
+/** How a session's commands are confined (coding-provider.ts codingSessionPermissions): Toolroll's permission profile as
+ * the thread's config overrides, or a refusal. Required: no session starts without its caller saying which. */
+export type CodingPermissions = {
+    config: Record<string, unknown>;
+} | {
+    sandbox: 'workspace-write';
+} | {
+    problem: string;
+};
 type Options = {
     database: string;
     worktreeRoot: string;
+    permissions: (input: {
+        repo: string;
+        worktree: string;
+    }) => CodingPermissions;
     provider?: () => CodingProvider;
     admissionPaused?: () => boolean;
     authorize?: (actor: CodingActor, repo: string) => boolean;
@@ -92,6 +105,8 @@ export declare class CodingWorkspace {
     private putItem;
     private flush;
     private item;
+    /** The thread's confinement, made right before each start or resume from the plane's own records. */
+    private permissionsFor;
     private native;
     private request;
     private event;

package/dist/coding-workspace.js

@@ -278,6 +278,13 @@ export class CodingWorkspace {
         const clientId = string(item['clientId']) || string(item['clientUserMessageId']);
         return { id, type, text, status: string(item['status']) || null, ...(type === 'userMessage' && clientId ? { clientId } : {}) };
     }
+    /** The thread's confinement, made right before each start or resume from the plane's own records. */
+    permissionsFor(repo, worktree) {
+        const made = this.options.permissions({ repo, worktree });
+        if ('problem' in made)
+            throw Error(made.problem);
+        return made;
+    }
     native() {
         if (this.closed || this.closing || this.persistenceFailed)
             throw Error('The coding server cannot save activity. Reopen the workspace after the server recovers.');
@@ -445,7 +452,7 @@ export class CodingWorkspace {
             this.authorize(actor, repo);
             this.admit();
             nativeStartupAttempted = true;
-            const result = object(await this.request('thread/start', { cwd: worktree, approvalPolicy: 'on-request', approvalsReviewer: 'user', sandbox: 'workspace-write', ...(input.model ? { model: input.model } : {}), developerInstructions: CODING_INSTRUCTIONS + (context?.text ?? ''), persistExtendedHistory: true }));
+            const result = object(await this.request('thread/start', { cwd: worktree, approvalPolicy: 'on-request', approvalsReviewer: 'user', ...this.permissionsFor(repo, worktree), ...(input.model ? { model: input.model } : {}), developerInstructions: CODING_INSTRUCTIONS + (context?.text ?? ''), persistExtendedHistory: true }));
             const thread = object(result['thread']), nativeThreadId = string(thread['id']);
             if (!nativeThreadId)
                 throw Error('The agent did not return a session identity.');
@@ -494,7 +501,7 @@ export class CodingWorkspace {
         this.authorize({ name: session.owner, generation: session.generation }, session.repo);
         if (session.context)
             verifyCodingContext(session.context, session.repo, session.base);
-        const result = object(await this.request('thread/resume', { threadId: session.nativeThreadId, cwd: session.worktree, approvalPolicy: 'on-request', approvalsReviewer: 'user', sandbox: 'workspace-write', ...(session.model ? { model: session.model } : {}), developerInstructions: CODING_INSTRUCTIONS + (session.context?.text ?? ''), persistExtendedHistory: true }));
+        const result = object(await this.request('thread/resume', { threadId: session.nativeThreadId, cwd: session.worktree, approvalPolicy: 'on-request', approvalsReviewer: 'user', ...this.permissionsFor(session.repo, session.worktree), ...(session.model ? { model: session.model } : {}), developerInstructions: CODING_INSTRUCTIONS + (session.context?.text ?? ''), persistExtendedHistory: true }));
         const thread = object(result['thread']);
         if (thread['id'] !== session.nativeThreadId)
             throw Error('The agent returned a different conversation. Continuity could not be verified.');

package/dist/contracts/console-api.d.ts

@@ -84,6 +84,8 @@ export declare const CONSOLE_FORMS: {
     readonly projectLiveView: FormContract<"act" | "nonce" | "password" | "repo">;
     readonly projectNetwork: FormContract<"hosts" | "local" | "mode" | "password" | "repo">;
     readonly projectWrites: FormContract<"password" | "repo" | "writes">;
+    readonly projectCheckAccess: FormContract<"confirm-open" | "level" | "password" | "repo">;
+    readonly projectSandbox: FormContract<"mach" | "password" | "read-deny" | "repo">;
     readonly projectDelete: FormContract<"name" | "password" | "repo" | "step">;
     readonly policy: FormContract<"ceiling" | "models" | "password" | "provider" | "tools">;
     readonly approval: FormContract<"not_requester" | "password" | "paths" | "protect" | "repo">;

package/dist/contracts/console-api.js

@@ -93,6 +93,8 @@ export const CONSOLE_FORMS = {
     projectLiveView: formContract("POST /settings/project/live-view", ["repo", "act", "password", "nonce"]),
     projectNetwork: formContract("POST /settings/project/network", ["repo", "mode", "local", "hosts", "password"]),
     projectWrites: formContract("POST /settings/project/writes", ["repo", "writes", "password"]),
+    projectCheckAccess: formContract("POST /settings/project/check-access", ["repo", "level", "confirm-open", "password"]),
+    projectSandbox: formContract("POST /settings/project/sandbox", ["repo", "read-deny", "mach", "password"]),
     projectDelete: formContract("POST /settings/project/delete", ["repo", "name", "step", "password"]),
     policy: formContract("POST /settings/policy", ["password", "provider", "models", "tools", "ceiling"]),
     approval: formContract("POST /settings/approval", ["repo", "password", "protect", "paths", "not_requester"]),

package/dist/doctor.d.ts

@@ -17,6 +17,13 @@ export type DoctorReport = {
     findings: DoctorFinding[];
     unreadable: DoctorUnreadable[];
     notes: string[];
+    /** The sandbox every build runs in (sandbox-runtime.ts): Anthropic's sandbox-runtime, its version, and why it can't
+     * sandbox here (null when it can). */
+    sandbox?: {
+        engine: string;
+        version: string;
+        problem: string | null;
+    };
 };
 export type DoctorDeps = {
     platform?: NodeJS.Platform;

package/dist/doctor.js

@@ -24,6 +24,7 @@ import { envelopeJson } from "./envelope.js";
 import { run as runCommand } from "./exec.js";
 import { OWN_KEY_ENV } from "./keys.js";
 import { ALL_CREDENTIAL_ENV } from "./provider.js";
+import { SANDBOX_RUNTIME, sandboxRuntimeProblem, sandboxRuntimeWords } from "./sandbox-runtime.js";
 /** Names that say they hold a credential. */
 const CREDENTIAL_NAME = /(?:^|_)(?:API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|SECRET|SECRET_?KEY|TOKEN|AUTH_?TOKEN|PASSWORD|PASSWD|CREDENTIALS?|PAT)(?:_|$)/i;
 /** Names that only point at one: a path, a socket, an address. */
@@ -401,6 +402,8 @@ export function doctorLines(report) {
     }
     for (const note of report.notes)
         lines.push("", `Note: ${note}`);
+    if (report.sandbox !== undefined)
+        lines.push("", `Sandbox: ${sandboxRuntimeWords()}${report.sandbox.problem === null ? ", working here." : `, not available here: ${report.sandbox.problem}. Builds don't start unless an instance operator allows unconfined agents.`}`);
     if (report.checked.length > 0)
         lines.push("", "Checked:", ...report.checked.map(one => `  ${one}`));
     return lines;
@@ -418,6 +421,7 @@ export async function runDoctorCommand(argv, write, deps = {}) {
         return 2;
     }
     const report = await auditServiceEnvironment(deps);
+    report.sandbox = { engine: SANDBOX_RUNTIME.name, version: SANDBOX_RUNTIME.version, problem: sandboxRuntimeProblem() };
     if (json)
         write(envelopeJson({ command: "doctor", ...report }));
     else