toolroll 0.9.68 → 0.9.70

package/dist/invoke.js

@@ -29,14 +29,18 @@ import { witnessedRunner } from "./process-custody.js";
 import { underStopWatch } from "./task-control.js";
 import { childDatabaseEnv, isolatedChildDatabase, removeChildDatabase as removeAgentDatabase } from "./child-database.js";
 import { RunSignInError, noToolsArgs, prepareRunTools } from "./project-tools.js";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { poolRootOf } from "./worktree.js";
-import { BRIDGE_DIR } from "./agent-fence.js";
-import { agentFence, buildCacheEnv, buildCacheFolder, grantFolder, writeAllowlist, WRITES_DEFAULT, CheckoutBindingError, trustedWorktreeBinding, checkoutGitEnv, HARDENED_GIT_ARGS, codexFenceArgv, fenceGrants, fencedGitEnv, linuxFenceAvailable, linuxFenced, macosFenceAvailable, macosFenced, NO_GRANTS, runFolders, taskBoundary } from "./agent-fence.js";
-import { proxyEnv, providerOnlyNetwork, startEgressProxy } from "./egress.js";
-import { bridgeFits, startEgressBridge } from "./egress-bridge.js";
+import { checkLaunchRoot, signInGrants, signInIsItself } from "./agent-fence.js";
+import { CHECK_ACCESS_DEFAULT, checkAccessHere, narrowestAccess, narrowestNetwork, signInsAvailable } from "./check-access.js";
+import { readDenyPath } from "./project-sandbox.js";
+import { sandboxRuntimeWords } from "./sandbox-runtime.js";
+import { canonicalJson } from "./canonical-json.js";
+import { buildCacheEnv, buildCacheFolder, grantFolder, writeAllowlist, WRITES_DEFAULT, CheckoutBindingError, trustedWorktreeBinding, checkoutGitEnv, HARDENED_GIT_ARGS, codexFenceArgv, fenceFor, fencedGitEnv, LEGACY_SANDBOX, launchSandboxOf, linuxFenceAvailable, macosFenceAvailable, NO_GRANTS, sandboxedSpawn, serverGrantsOf, runFolders, taskBoundary } from "./agent-fence.js";
+import { proxyEnv, providerOnlyNetwork, repositoryEcosystems, resolveNetwork, startEgressProxy } from "./egress.js";
 import { claudeConfigDir, claudeDefaults, codexDefaults, codexHomeDir, isolatedCodexHome } from "./provider-home.js";
 import { billingOf, claudeBillingFrom, seenBilling } from "./spend.js";
 /** "Within seconds": how soon a silent failed run must end for its stderr to
@@ -241,7 +245,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // re-supply survives resolveChildEnv's chat-key strip); in
     // "subscription" mode the key is STRIPPED from the child so the CLI's
     // own login is used — its key is retained, just not handed over.
-    const { runner, clock: _clock, versionProbe: _probe, keyHome, timeoutMs: _hardTimeout, idleTimeoutMs: _idleTimeout, stdin: _callerStdin, accumulateUsage: _accumulateUsage, liveInput: _liveInput, acpCheck: _acpCheck, network: launchNetwork, writes: launchWrites, ...runOptions } = options;
+    const { runner, clock: _clock, versionProbe: _probe, keyHome, timeoutMs: _hardTimeout, idleTimeoutMs: _idleTimeout, stdin: _callerStdin, accumulateUsage: _accumulateUsage, liveInput: _liveInput, acpCheck: _acpCheck, network: launchNetwork, writes: launchWrites, sandbox: launchSandbox, ...runOptions } = options;
     // The live setting is read STRICTLY (atomic authority closure): a
     // present mode file that says neither word is a value-shaped refusal
     // before any stamp or process — never the subscription default a
@@ -304,6 +308,9 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // (tool-broker.ts), which alone holds their secrets. A review keeps its isolation.
     // Set once the fence is known: a fenced build's servers never start outside a fence.
     let serverMustBeFenced = false;
+    // Pinned for the attempt (sandbox parity C11): whether an instance operator allowed unconfined agents, read once now.
+    // A tool server the agent starts late gets the decision this attempt launched with, never one changed meanwhile.
+    const unconfinedAtLaunch = store.unfencedAgentsAllowed();
     // What the build writes (its checkout, its project's caches): a tool server never runs from there, nor reads it at all.
     const serverUntrusted = workspace === null ? [] : toolUntrusted(store, workspace, keyHome);
     const launchTools = invocation.phase === "review" ? null : await runTools(store, runId, spec, options.keyHome, clock, invocation.readOnlyTools, invocation.researchWithheld, containment, {
@@ -315,7 +322,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         untrusted: serverUntrusted,
         wrap: () => serverFence,
         // A fenced build's tool servers start only in a fence too, unless an instance operator allowed unconfined agents.
-        unwrapped: () => serverMustBeFenced && !store.unfencedAgentsAllowed()
+        unwrapped: () => serverMustBeFenced && !unconfinedAtLaunch
             ? "This machine can't confine the tool's server (no macOS sandbox, no working bubblewrap), so it was not started." : null,
     });
     if (launchTools !== null && "refused" in launchTools) {
@@ -344,7 +351,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // tool servers outside its command sandbox, so its own launch folder is
     // fenced too; Claude reads its config from there, inside the sandbox.
     const ownTools = tools?.privateDir === undefined ? null : realpathSync(tools.privateDir);
-    const fenceOf = invocation.phase === "review" ? { fence: [], fileTools: [], grants: NO_GRANTS, gitPaths: [], cache: undefined, problem: undefined } : runFence(store, runId, spec.provider, options.keyHome, codexHarness ? null : ownTools, launchWrites ?? WRITES_DEFAULT);
+    const fenceOf = invocation.phase === "review" ? { fence: [], fileTools: [], grants: NO_GRANTS, gitPaths: [], cache: undefined, problem: undefined } : runFence(store, runId, spec.provider, options.keyHome, codexHarness ? null : ownTools, launchWrites ?? WRITES_DEFAULT, launchSandbox ?? LEGACY_SANDBOX);
     if (fenceOf.problem !== undefined) {
         tools?.cleanup();
         codexHome?.cleanup();
@@ -385,13 +392,13 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     if (fence.length > 0) {
         // A tool server keeps its own reach (it holds its tool's secrets, not the agent's code): never the agent's network,
         // nor its write allowlist (a server keeps its own state where it always has).
-        const serverGrants = () => { const { network: _agentOnly, writes: _agentWrites, ...rest } = grants; return rest; };
+        const serverGrants = () => serverGrantsOf(grants);
         // Nor read what the build wrote: however its arguments are spelled, no byte of the checkout or caches can load.
         const serverDenies = [...fence, ...serverUntrusted.filter(path => existsSync(path)).map(path => realpathSync(path))];
-        if (macosFenceAvailable())
-            serverFence = (file, args) => macosFenced(file, args, serverDenies, serverGrants());
-        else if (linuxFenceAvailable())
-            serverFence = (file, args) => linuxFenced(file, args, serverDenies, serverGrants());
+        // Pinned: the server fence this attempt launched with, a copy, whatever changes later (C11).
+        const pinned = structuredClone(serverGrants());
+        if (macosFenceAvailable() || linuxFenceAvailable())
+            serverFence = (file, args, cwd) => sandboxedSpawn(file, args, serverDenies, pinned, cwd);
         serverMustBeFenced = true;
     }
     // No silent fallback (arc 1): a build this machine can't confine at the OS — Claude reduced to its own file-tool
@@ -403,10 +410,9 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         codexHome?.cleanup();
         removeAgentDatabase(isolatedDb.dir);
         return { kind: "refused", reason: "containment", providerVersion: attested?.version ?? null,
-            diagnostic: "This machine can't confine an agent (no macOS sandbox, no working bubblewrap), so nothing was started. Install bubblewrap, or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`." };
+            diagnostic: "This machine can't confine an agent (no macOS sandbox, no working bubblewrap), so nothing was started. Install bubblewrap, socat and ripgrep (Linux), or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`." };
     }
     let egress = null;
-    let bridge = null;
     let runTemp = null;
     const confinedOs = fenced.method === "macos-sandbox" || fenced.method === "linux-bubblewrap";
     if (fence.length > 0 && !codexHarness && confinedOs) {
@@ -428,22 +434,19 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
             }
             else {
                 egress = await startEgressProxy({ hosts: network.policy.hosts });
-                grants.network = { mode: "allowlist", proxyPort: egress.port, brokerPorts, loopback: network.policy.loopback, socketRoots };
+                grants.network = { mode: "allowlist", proxyPort: egress.port, brokerPorts, loopback: network.policy.loopback, socketRoots, token: egress.secret };
             }
-            if (fenced.method === "linux-bubblewrap" && grants.network.mode === "allowlist") {
-                const database = store.databaseFile();
-                // The plane's own fenced folder, unless a socket there would be too long a path (a unix socket's path is capped
-                // near 100 bytes): then the system temp folder, which a confined Linux build doesn't see (its /tmp is its own).
-                const fenced = database === null || database === "" || database === ":memory:" ? undefined : join(dirname(realpathSync(database)), BRIDGE_DIR);
-                bridge = await startEgressBridge([grants.network.proxyPort, ...grants.network.brokerPorts], fenced !== undefined && bridgeFits(fenced) ? fenced : undefined);
-                grants.network.bridge = { folder: realpathSync(bridge.folder), forwarder: realpathSync(bridge.forwarder), node: process.execPath };
-                // Its private /tmp gives back only its own folders: its checkout and its launch folder (its temp is inside).
-                grants.network.keep = [...(workspace === null ? [] : [realpathSync(workspace)]), ...(ownTools === null ? [] : [ownTools]), ...(fenceOf.gitPaths ?? [])];
+            // On Linux the build has a network of its own, and the sandbox runtime relays only two ports into it: the
+            // proxy's (3128) and a second (1080), which carries this run's tool broker. Claude's tool list names it there.
+            // (An injected runner, in tests, runs outside every sandbox and keeps the broker's own address.)
+            if (fenced.method === "linux-bubblewrap" && grants.network.mode === "allowlist" && runner === undefined && tools?.brokerPort !== undefined && tools.privateDir !== undefined) {
+                const list = join(tools.privateDir, "mcp.json");
+                if (existsSync(list))
+                    writeFileSync(list, readFileSync(list, "utf8").replaceAll(`http://127.0.0.1:${tools.brokerPort}/`, "http://127.0.0.1:1080/"), { mode: 0o600 });
             }
         }
         catch (error) {
             await egress?.close();
-            await bridge?.close();
             tools?.cleanup();
             codexHome?.cleanup();
             removeAgentDatabase(isolatedDb.dir);
@@ -451,8 +454,11 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
                 diagnostic: `The build's network could not be set up, so nothing was started: ${error instanceof Error ? error.message : String(error)}` };
         }
     }
+    // The attempt's pinned fence, stamped on the run (C11): its method, policy version, the digest of exactly what it was
+    // given, and the sandbox engine and version it runs in.
     if (invocation.phase !== "review")
-        store.recordRunFence(runId, { method: fenced.method, paths: fence.length }, clock());
+        store.recordRunFence(runId, { method: fenced.method, paths: fence.length, policy: (launchSandbox ?? LEGACY_SANDBOX).policy,
+            digest: fenceDigest(fence, grants), engine: sandboxRuntimeWords() }, clock());
     const billingSeen = { keySource: null, model: null, planWindows: false, answered: false };
     // v105: a Codex run on its sign-in bills as Codex says it's signed in (a ChatGPT plan, or a saved key, or Bedrock),
     // read right before it runs. Never with an injected runner: tests don't start a real Codex.
@@ -495,7 +501,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
             : ownKeyEnv.filter(name => name !== keyEnvName)),
     ];
     const launchOptions = {
-        ...(fenced.wrap.length === 0 ? {} : { fence: fenced.wrap, fenceGrants: grants }),
+        ...(fenced.wrap.length === 0 ? {} : { fence: fenced.wrap, fenceGrants: grants, confinement: "required" }),
         ...runOptions,
         ...(workspace === null ? {} : { cwd: workspace }),
         // v105: how the CLI really billed this turn (its key source, its plan's windows), read off its own stream.
@@ -565,7 +571,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
                 const insideFence = (file, args) => codexHarness
                     ? runCommand(executable, ["sandbox", ...codexFenceArgv(fence, invocation.skipPermissions, grants),
                         "-P", "standing-orders", "--", file, ...args], probeOptions)
-                    : runCommand(file, args, { ...probeOptions, fence: launchOptions.fence,
+                    : runCommand(file, args, { ...probeOptions, fence: launchOptions.fence, confinement: "required",
                         ...(launchOptions.fenceGrants === undefined ? {} : { fenceGrants: launchOptions.fenceGrants }) });
                 const check = await insideFence("git", gitArgs);
                 if (check.code !== 0) {
@@ -581,7 +587,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         // key in the launching environment must be absent. No agent takes part, so no agent can fake it.
         if (acpCheckAsk?.isolation !== undefined && launchOptions.fence !== undefined && workspace !== null) {
             // processGroup: run() applies the fence only on the process-group road (a plain execFile carries none).
-            const probe = { cwd: workspace, env: childEnv, omitEnv: childOmitEnv, fence: launchOptions.fence, ...(launchOptions.fenceGrants === undefined ? {} : { fenceGrants: launchOptions.fenceGrants }), timeoutMs: 15_000, processGroup: true };
+            const probe = { cwd: workspace, env: childEnv, omitEnv: childOmitEnv, fence: launchOptions.fence, confinement: "required", ...(launchOptions.fenceGrants === undefined ? {} : { fenceGrants: launchOptions.fenceGrants }), timeoutMs: 15_000, processGroup: true };
             const read = await runCommand("/bin/cat", [acpCheckAsk.isolation.file], probe);
             const env = await runCommand("/usr/bin/env", [], probe);
             acpIsolation = {
@@ -704,7 +710,6 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
             }, clock());
         }
         await egress?.close();
-        await bridge?.close();
     }
     // v105: the run's billing, fixed from evidence before its usage is priced: a key it was given is a key; otherwise
     // what the CLI said (Claude's stream) or was last seen doing (Codex's account), and the setting only when neither.
@@ -925,7 +930,7 @@ function linkedFor(store, worktree) {
 /** The paths this run's agent may not reach: the state folder around the live database (but not its own worktree),
  * ~/.toolroll (or its older name), its task boundary and other launches' private folders; what the fence gives back
  * (FenceGrants); and what only Claude's file tools refuse. */
-function runFence(store, runId, provider, keyHome, ownTools, writes = WRITES_DEFAULT) {
+function runFence(store, runId, provider, keyHome, ownTools, writes = WRITES_DEFAULT, sandbox = LEGACY_SANDBOX) {
     try {
         // A plane always has a database file; an in-memory store (a test) has nothing to fence.
         const databaseFile = store.databaseFile();
@@ -938,22 +943,24 @@ function runFence(store, runId, provider, keyHome, ownTools, writes = WRITES_DEF
             throw new CheckoutBindingError("The checkout's Git pointer was changed or its trusted binding could not be verified.");
         const poolRoots = [join(dirname(databaseFile), "worktrees"), ...store.listWorktrees().map(record => poolRootOf(record.path, record.repo))];
         const binding = worktree === null || row === null ? null : trustedWorktreeBinding(row.repo, worktree, poolRoots);
-        const boundary = worktree === null ? null : taskBoundary({ worktree, provider, ...home, binding });
+        const boundary = worktree === null ? null : taskBoundary({ worktree, provider, ...home, binding, policy: sandbox.policy });
         const folders = runFolders(ownTools);
         // A build with a checkout writes only its workspace unless its approval said anywhere (arc 2): its checkout and
         // Git data, its launch folder, its project's caches and the provider state its CLI must write.
         const allowed = worktree === null || row === null || writes !== "workspace" ? null
             : writeAllowlist({ provider, home: keyHome ?? homedir(), worktree, binding, launchFolder: ownTools, cache: buildCacheFolder(row.repo, keyHome ?? homedir()) });
-        const fence = agentFence({ databaseFile, worktree, ...home, boundary, binding, runFolders: folders, extra: allowed?.deny ?? [] });
-        const grants = fenceGrants({ databaseFile, worktree, boundary, runFolders: folders, linked: linkedFor(store, worktree), binding, ...home, poolRoots });
+        // The shared install is granted only as the plane linked it: this checkout's project and stamped setup.
+        // Every plane checkout pool is denied around this one: the plane's own beside the database, and the one this
+        // checkout was recorded in (a --pool elsewhere), so another project's worktree, present at launch, is out of reach. Native wrappers also cover later creations.
+        const launch = fenceFor(provider === "command" ? "command" : "build", { databaseFile, worktree, ...home, boundary, binding, runFolders: folders, poolRoots,
+            extra: allowed?.deny ?? [], linked: linkedFor(store, worktree), writes: allowed === null ? null : { writes: allowed.writes, readOnly: allowed.readOnly }, policy: sandbox.policy, provider,
+            // The sealed read denies, and whatever the project lists now too (adding a deny only narrows).
+            readDeny: [...new Set([...sandbox.readDeny, ...(row === null ? [] : store.projectSandbox(row.repo).readDeny)])].map(one => readDenyPath(one, keyHome ?? homedir())), machLookup: sandbox.machLookup });
         return {
-            fence,
+            fence: launch.fence,
             fileTools: boundary?.fileTools ?? [],
-            // The shared install is granted only as the plane linked it: this checkout's project and stamped setup.
-            // Every plane checkout pool is denied around this one: the plane's own beside the database, and the one this
-            // checkout was recorded in (a --pool elsewhere), so another project's worktree, present at launch, is out of reach. Native wrappers also cover later creations.
-            grants: allowed === null ? grants : { ...grants, writes: allowed.writes, readOnly: [...new Set([...grants.readOnly, ...allowed.readOnly])].sort() },
-            // The checkout's own Git data, which a private /tmp gives back beside the checkout (agent-fence.ts linuxFenced).
+            grants: launch.fenceGrants,
+            // The checkout's own Git data (a sign-ins check's network keeps it reachable).
             gitPaths: binding === null ? [] : [binding.gitdir, join(binding.main, ".git")],
             ...(allowed === null || row === null ? {} : { cache: buildCacheFolder(row.repo, keyHome ?? homedir()) }),
         };
@@ -969,22 +976,28 @@ function runFence(store, runId, provider, keyHome, ownTools, writes = WRITES_DEF
  * Their network stays as it was. A machine without an OS fence runs them as before; a fence that can't be prepared
  * (a checkout whose binding no longer proves) runs nothing.
  */
-export function fencedCommands(store, runId, writes, inner, available = () => macosFenceAvailable() || linuxFenceAvailable()) {
+export function fencedCommands(store, runId, writes, inner, available = () => macosFenceAvailable() || linuxFenceAvailable(), access = CHECK_ACCESS_DEFAULT, network, sandbox = LEGACY_SANDBOX) {
     // An injected runner (tests) starts no real command, as an injected agent starts no real agent (invokeAgent).
     if (inner !== runCommand)
         return inner;
     return async (file, args, options) => {
-        // As a build itself: where nothing can confine them, they run only when an instance operator allowed unconfined agents.
+        // As a build itself: where nothing can confine them, they run only when an instance operator allowed unconfined agents
+        // (and the run says so: its checks ran without a sandbox, whatever was sealed).
         if (!available()) {
-            if (store.unfencedAgentsAllowed())
+            if (store.unfencedAgentsAllowed()) {
+                store.stampRunCheckAccess(runId, "unsandboxed");
                 return inner(file, args, options);
-            return { code: 1, stdout: "", stderr: "This machine can't confine the build's commands (no macOS sandbox, no working bubblewrap), so they didn't run. Install bubblewrap, or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`.\n", timedOut: false, notFound: false };
+            }
+            return { code: 1, stdout: "", stderr: "This machine can't confine the build's commands (no macOS sandbox, no working bubblewrap), so they didn't run. Install bubblewrap, socat and ripgrep (Linux), or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`.\n", timedOut: false, notFound: false };
         }
-        const own = realpathSync(mkdtempSync(join(tmpdir(), "so-cmd-")));
+        const own = realpathSync(mkdtempSync(join(checkLaunchRoot(), "so-cmd-")));
         try {
             const temp = join(own, "tmp");
             mkdirSync(temp, { mode: 0o700 });
-            const fenced = runFence(store, runId, "command", undefined, own, writes);
+            // Not sandboxed (check-access.ts): the project's checks are trusted by the whole instance, as before 0.9.66.
+            if (access === "unsandboxed")
+                return await inner(file, args, { ...options, env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp } });
+            const fenced = runFence(store, runId, "command", undefined, own, writes, sandbox);
             if (fenced.problem !== undefined)
                 return { code: 1, stdout: "", stderr: `${fenced.problem}\n`, timedOut: false, notFound: false };
             if (fenced.fence.length === 0)
@@ -993,12 +1006,26 @@ export function fencedCommands(store, runId, writes, inner, available = () => ma
             const database = options?.env?.["TOOLROLL_DB"];
             const checkData = database === undefined || fenced.grants.writes === undefined ? null : grantFolder(dirname(database), false);
             const grants = checkData === null ? fenced.grants : { ...fenced.grants, writes: { ...fenced.grants.writes, subpaths: [...fenced.grants.writes.subpaths, checkData] } };
-            return await inner(file, args, {
-                ...options,
-                fence: fenced.fence,
-                fenceGrants: grants,
-                env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(fenced.cache === undefined || fenced.grants.writes === undefined ? {} : buildCacheEnv(fenced.cache)) },
-            });
+            const checkout = store.getRun(runId)?.worktree ?? null;
+            const signIns = access !== "sign-ins" ? null : checkout === null ? { problem: "The check's checkout is unknown, so its sign-ins can't be granted." }
+                : network === undefined ? { problem: "A check with sign-ins has no network sealed for it, so nothing ran." }
+                    : await signInsLaunch(store, own, temp, checkout, network, fenced.gitPaths ?? []);
+            if (signIns !== null && "problem" in signIns)
+                return { code: 1, stdout: "", stderr: `${signIns.problem}\n`, timedOut: false, notFound: false };
+            try {
+                return await inner(file, args, {
+                    ...options,
+                    fence: fenced.fence,
+                    // Each sign-in file looked at again right before the launch: one no longer itself isn't granted.
+                    fenceGrants: signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network },
+                    confinement: "required",
+                    env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(fenced.cache === undefined || fenced.grants.writes === undefined ? {} : buildCacheEnv(fenced.cache)), ...(signIns?.env ?? {}) },
+                    ...(signIns === null ? {} : { omitEnv: [...(options?.omitEnv ?? []), ...SIGN_INS_OMITTED_ENV] }),
+                });
+            }
+            finally {
+                await signIns?.close();
+            }
         }
         finally {
             rmSync(own, { recursive: true, force: true });
@@ -1011,22 +1038,25 @@ export function fencedCommands(store, runId, writes, inner, available = () => ma
  * project's writes setting, only that checkout, its Git data, its own temp folder, the project's caches and its check
  * database writable. Where nothing can confine them, they run only when an instance operator allowed unconfined agents.
  */
-export function fencedCheckoutCommands(store, repo, checkout, inner, available = () => macosFenceAvailable() || linuxFenceAvailable()) {
+export function fencedCheckoutCommands(store, repo, checkout, inner, available = () => macosFenceAvailable() || linuxFenceAvailable(), access = CHECK_ACCESS_DEFAULT, network, sandbox = LEGACY_SANDBOX) {
     if (inner !== runCommand)
         return inner;
     return async (file, args, options) => {
         if (!available()) {
             if (store.unfencedAgentsAllowed())
                 return inner(file, args, options);
-            return { code: 1, stdout: "", stderr: "This machine can't confine the project's checks (no macOS sandbox, no working bubblewrap), so they didn't run. Install bubblewrap, or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`.\n", timedOut: false, notFound: false };
+            return { code: 1, stdout: "", stderr: "This machine can't confine the project's checks (no macOS sandbox, no working bubblewrap), so they didn't run. Install bubblewrap, socat and ripgrep (Linux), or an instance operator allows unconfined agents with `toolroll config unconfined-agents allow`.\n", timedOut: false, notFound: false };
         }
         const databaseFile = store.databaseFile();
         if (databaseFile === null)
             return inner(file, args, options);
-        const own = realpathSync(mkdtempSync(join(tmpdir(), "so-cmd-")));
+        const own = realpathSync(mkdtempSync(join(checkLaunchRoot(), "so-cmd-")));
         try {
             const temp = join(own, "tmp");
             mkdirSync(temp, { mode: 0o700 });
+            // Not sandboxed (check-access.ts): the project's checks are trusted by the whole instance, as before 0.9.66.
+            if (access === "unsandboxed")
+                return await inner(file, args, { ...options, env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp } });
             let binding;
             try {
                 binding = trustedWorktreeBinding(repo, checkout);
@@ -1035,21 +1065,36 @@ export function fencedCheckoutCommands(store, repo, checkout, inner, available =
                 return { code: 1, stdout: "", stderr: "The check's checkout couldn't be bound to its project, so nothing ran.\n", timedOut: false, notFound: false };
             }
             const poolRoots = [join(dirname(databaseFile), "worktrees"), ...store.listWorktrees().map(record => poolRootOf(record.path, record.repo))];
-            const boundary = taskBoundary({ worktree: checkout, provider: "command", binding });
+            const boundary = taskBoundary({ worktree: checkout, provider: "command", binding, policy: sandbox.policy });
             const folders = runFolders(own);
             const cache = buildCacheFolder(repo);
             const allowed = store.projectWrites(repo) !== "workspace" ? null : writeAllowlist({ provider: "command", home: homedir(), worktree: checkout, binding, launchFolder: own, cache });
             const database = options?.env?.["TOOLROLL_DB"];
             const checkData = allowed === null || database === undefined ? null : grantFolder(dirname(database), false);
-            const base = fenceGrants({ databaseFile, worktree: checkout, boundary, runFolders: folders, linked: linkedFor(store, checkout), binding, poolRoots });
-            const grants = allowed === null ? base
-                : { ...base, readOnly: [...new Set([...base.readOnly, ...allowed.readOnly])].sort(), writes: { ...allowed.writes, subpaths: [...allowed.writes.subpaths, ...(checkData === null ? [] : [checkData])] } };
-            return await inner(file, args, {
-                ...options,
-                fence: agentFence({ databaseFile, worktree: checkout, boundary, binding, runFolders: folders, extra: allowed?.deny ?? [] }),
-                fenceGrants: grants,
-                env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(allowed === null ? {} : buildCacheEnv(cache)) },
-            });
+            const launch = fenceFor("check", { databaseFile, worktree: checkout, boundary, binding, runFolders: folders, poolRoots, extra: allowed?.deny ?? [], linked: linkedFor(store, checkout),
+                readDeny: sandbox.readDeny.map(one => readDenyPath(one, homedir())), machLookup: sandbox.machLookup, policy: sandbox.policy,
+                writes: allowed === null ? null : { writes: { ...allowed.writes, subpaths: [...allowed.writes.subpaths, ...(checkData === null ? [] : [checkData])] }, readOnly: allowed.readOnly } });
+            const grants = launch.fenceGrants;
+            // With sign-ins, under the network its caller proved for it (the narrowest of its results' sealed check networks and
+            // the project's current one): none given, nothing runs.
+            const signIns = access !== "sign-ins" ? null : network === undefined ? { problem: "A check with sign-ins has no network sealed for it, so nothing ran." }
+                : await signInsLaunch(store, own, temp, checkout, network, [binding.gitdir, join(binding.main, ".git")]);
+            if (signIns !== null && "problem" in signIns)
+                return { code: 1, stdout: "", stderr: `${signIns.problem}\n`, timedOut: false, notFound: false };
+            try {
+                return await inner(file, args, {
+                    ...options,
+                    fence: launch.fence,
+                    // Each sign-in file looked at again right before the launch: one no longer itself isn't granted.
+                    fenceGrants: signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network },
+                    confinement: launch.confinement,
+                    env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(allowed === null ? {} : buildCacheEnv(cache)), ...(signIns?.env ?? {}) },
+                    ...(signIns === null ? {} : { omitEnv: [...(options?.omitEnv ?? []), ...SIGN_INS_OMITTED_ENV] }),
+                });
+            }
+            finally {
+                await signIns?.close();
+            }
         }
         finally {
             rmSync(own, { recursive: true, force: true });
@@ -1118,3 +1163,96 @@ async function codexLoginBilling(binary, omitEnv) {
 function plainLines(stdout) {
     return stdout.split("\n").filter(line => !line.trimStart().startsWith("{")).join("\n");
 }
+/** What a `sign-ins` check never inherits: a caller's choice of Claude's config folder (Claude's keychain sign-in is
+ * keyed to its default one; check-access.ts). gh's and Codex's are set to the granted ones instead. */
+const SIGN_INS_OMITTED_ENV = ["CLAUDE_CONFIG_DIR"];
+/**
+ * A `sign-ins` check's launch (check-access.ts, sandbox parity C10): its exact sign-in files, read by the check itself
+ * through its sandbox (agent-fence.ts signInGrants: nothing privileged reads or copies one), its own transcript folder
+ * and Codex's session and log folders; Codex, gh and XDG pointed at the real folders; and the network the check runs
+ * under: open, or its allowlist through a proxy of its own (on Linux, relayed in by the sandbox runtime). Nothing about it is
+ * started unless all of it is.
+ */
+export async function signInsLaunch(store, own, temp, checkout, policy, gitPaths, platform = process.platform) {
+    if (!signInsAvailable(platform))
+        return { problem: "Sign-ins can't be shared with checks here, so nothing ran." };
+    const home = homedir();
+    const grants = signInGrants(home, checkout, platform);
+    let egress = null;
+    const close = async () => { await egress?.close(); };
+    try {
+        const env = { CODEX_HOME: join(home, ".codex"), GH_CONFIG_DIR: join(home, ".config", "gh"), XDG_CONFIG_HOME: join(home, ".config") };
+        if (policy.mode === "open")
+            return { grants, network: { mode: "open" }, env, close };
+        // Exactly the project's network: the services the sign-ins are for are reached only if the operator allowed their
+        // hosts (check-access.ts signInHostsMissing says which are missing; never added here).
+        egress = await startEgressProxy({ hosts: policy.hosts });
+        const network = { mode: "allowlist", proxyPort: egress.port, brokerPorts: [], loopback: policy.loopback, socketRoots: [temp, realpathSync(checkout)], token: egress.secret };
+        return { grants, network, env: { ...env, ...proxyEnv(egress, policy.loopback) }, close };
+    }
+    catch (error) {
+        await close();
+        return { problem: `The check's network could not be set up, so nothing ran: ${error instanceof Error ? error.message : String(error)}` };
+    }
+}
+/** How a check at `access` actually runs here: unsandboxed where no OS fence exists (and an operator allowed that), else
+ * as asked. Recorded on every check's receipt, so a check that ran without a sandbox is never shown as sandboxed. */
+export function actualCheckAccess(store, access) {
+    return macosFenceAvailable() || linuxFenceAvailable() || !store.unfencedAgentsAllowed() ? access : "unsandboxed";
+}
+/**
+ * A check of saved results, in their own checkout (batch-checks.ts, result-follow-ups.ts), worked out right before each
+ * command: never wider than any of those results' own checks ran, nor than the project allows now; under sign-ins, the
+ * narrowest of their sealed check networks and the project's current one. A result with no sealed network runs it
+ * sandboxed.
+ */
+export function checkoutLaunchOf(store, repo, runIds, platform = process.platform) {
+    // As checks can get it: sign-ins (off for now; a stamp or setting from before, or another database) run sandboxed.
+    const access = checkAccessHere(narrowestAccess([store.projectCheckAccess(repo), ...runIds.map(id => store.runCheckAccess(id))]), platform);
+    if (access !== "sign-ins")
+        return { access, network: undefined };
+    const sealed = runIds.map(id => store.runCheckNetwork(id));
+    if (sealed.length === 0 || sealed.some(one => one === null))
+        return { access: CHECK_ACCESS_DEFAULT, network: undefined };
+    const live = resolveNetwork("command", store.projectNetwork(repo), repositoryEcosystems(repo));
+    return { access, network: sealed.reduce((low, one) => narrowestNetwork(low, one), live) };
+}
+/** The widest level a check's commands actually ran at (what its receipt says). */
+export const widestRan = (levels) => levels.includes("unsandboxed") ? "unsandboxed" : levels.includes("sign-ins") ? "sign-ins" : CHECK_ACCESS_DEFAULT;
+/** A check log's line for how its commands ran, when wider than sandboxed (shown with the log). */
+export const ranAtLine = (level) => level === "sandboxed" ? null
+    : `=== Check access ===\n${level === "unsandboxed" ? "These commands ran without a sandbox." : "These commands ran sandboxed, with model and GitHub sign-ins."}`;
+/** A saved result's check command runner (batch-checks.ts, result-follow-ups.ts): its level and network worked out right
+ * now (checkoutLaunchOf), and how it actually runs told to `ran`. */
+export function checkoutRunner(store, repo, checkout, inner, runIds, ran, platform = process.platform) {
+    return (file, args, options) => {
+        const launch = checkoutLaunchOf(store, repo, runIds, platform);
+        ran(actualCheckAccess(store, launch.access));
+        return fencedCheckoutCommands(store, repo, checkout, inner, undefined, launch.access, launch.network, checkoutSandboxOf(store, repo, runIds))(file, args, options);
+    };
+}
+/**
+ * A saved result's checks' sandbox terms (sandbox parity C9), never wider than any of those results' own approvals nor
+ * the project now: v2 only when every result's approval sealed v2; every read deny any of them sealed or the project
+ * lists now; mach services only those all of them sealed and the project still lists. A result with
+ * no readable approval counts as v1 with nothing listed.
+ */
+export function checkoutSandboxOf(store, repo, runIds) {
+    const sealed = runIds.map(id => {
+        const taskRef = store.getRun(id)?.taskRef;
+        const ref = taskRef === undefined ? null : store.refForId(taskRef);
+        const profile = ref === null ? null : store.getScope(ref.externalId)?.approvedProfile ?? null;
+        return profile === null ? LEGACY_SANDBOX : launchSandboxOf(profile);
+    });
+    const live = store.projectSandbox(repo);
+    const common = (pick, now) => now.filter(one => sealed.length > 0 && sealed.every(terms => pick(terms).includes(one)));
+    return {
+        policy: sealed.length > 0 && sealed.every(one => one.policy === 2) ? 2 : 1,
+        readDeny: [...new Set([...live.readDeny, ...sealed.flatMap(one => one.readDeny)])].sort(),
+        machLookup: common(one => one.machLookup, live.machLookup),
+    };
+}
+/** The digest of a launch's whole fence (its denied paths and grants, canonical), as stamped on its run (C11). */
+export function fenceDigest(fence, grants) {
+    return createHash("sha256").update(`toolroll:fence:${canonicalJson({ fence: [...fence], grants: grants })}`).digest("hex").slice(0, 32);
+}

package/dist/operate.d.ts

@@ -67,6 +67,10 @@ export type OperateOptions = {
     flowStepIo?: Partial<StepIo>;
     /** Injected by tests: how often a worker's flow passes run beside its builds (default FLOW_EVERY_MS). */
     flowEveryMs?: number;
+    /** Injected by tests: the operating system this runs on (check access: no sign-ins on Linux yet). */
+    platform?: NodeJS.Platform;
+    /** Injected by tests: whether this machine has an OS fence for checks (macOS sandbox or bubblewrap). */
+    fenceAvailable?: () => boolean;
     /** Injected by tests: how `flows import` fetches a flow file's address. */
     flowFetch?: FetchLike;
     /** Injected by tests: how `integrations` checks reach services (fetch, gh, sign-in checks, mail servers). */